Problem solved.
Thanks everyone.
Problem solved.
Thanks everyone.
what are the name and locations of the files?
if u can tell us that we can help in deciding what will be the best for u….Please do not delete any file
we also have essexboy our malware removal expert here…so if its something serious i will give him call via PM and he will help u out…
Happy to help!
true indian.
What if I post a screen shot of the said list of infected files?yes attach a screen shot
crop the pic so you dont show your hole desktop…and save as gif…you only have 200kb
lower left corner > additional options > attach
Problem solved. Thanks everyone!
WARNING!do not take any actions for conserv.dll and desktop.ini files deleting or doing anything else will cause Boot failure other files can be moved to the chest u are infected with a backdoor infection.
http://forum.avast.com/index.php?topic=53253.0
follow the guide above and attach all logs…
essexboy notified…he will be here by night 8 to 11pm according to UK time.
Happy to help!
true indian.
Problem solved. Thanks everyone!
apart from conserv.dll and desktop.ini other files can be moved to the chest…
this is actually backdoor maxplus 90 infection…
u can also try this:
Download Dr Web from here Fill in the small form and download
http://www.freedrweb.com/download+cureit+free/?lng=en
It will download as an 8 digit file save it to your desktop
Restart in safe mode and run
Accept the enhanced version
Then run the full scan allow it to cure all infections found.
this should find and cure conserv.dll and its associates…
Happy to help!
true indian.
Problem solved. Thanks everyone!
Hi there would you be prepared to try out an update to aswMBR that should remove this… ? If so run all elements in step 1.
If not then skip to step 2
Step 1
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\ProgramData\m5kwoayxgy520shc [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\ProgramData\v1ji23o1bs3pin [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776 [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\ProgramData\6m55df0j81e776 [2011/12/09 23:16:22 | 000,000,112 | ---- | M] () -- C:\ProgramData\8y3hx0ocM.dat [2011/12/09 23:16:22 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\6Figb5.com.b [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\ProgramData\m5kwoayxgy520shc [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\ProgramData\v1ji23o1bs3pin [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/09 23:16:22 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\6Figb5.com.b [2011/12/09 23:14:44 | 000,000,112 | ---- | C] () -- C:\ProgramData\8y3hx0ocM.dat [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776 [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\ProgramData\6m55df0j81e776:Files
ipconfig /flushdns /c
C:\Windows\tasks\At*.job:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
THEN
Please delete your current copy and download this latest version
Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the “Scan” button to start scan
http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRScan.gif
On completion of the scan click save log, save it to your desktop and post in your next reply
http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRsavelog.gif
Step 2
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\ProgramData\m5kwoayxgy520shc [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\ProgramData\v1ji23o1bs3pin [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776 [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\ProgramData\6m55df0j81e776 [2011/12/09 23:16:22 | 000,000,112 | ---- | M] () -- C:\ProgramData\8y3hx0ocM.dat [2011/12/09 23:16:22 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\6Figb5.com.b [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\ProgramData\m5kwoayxgy520shc [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8 [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\ProgramData\v1ji23o1bs3pin [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l [2011/12/09 23:16:22 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\6Figb5.com.b [2011/12/09 23:14:44 | 000,000,112 | ---- | C] () -- C:\ProgramData\8y3hx0ocM.dat [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776 [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\ProgramData\6m55df0j81e776:Files
ipconfig /flushdns /c
C:\Windows\tasks\At*.job:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
THEN
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now