12

Hi Justin_xp,

The combofix turned up the following malware executable to be cleansed:
The executable is hidden in renv

----a-w           524,288 2007-06-19 13:24:53  C:\Program Files\Thoosje Sidebar V2.0\Thoosje Sidebar .exe

Note the space between the file name and the .exe

You need to run cfscript

  1. Please open Notepad

    • Click Start , then Run
    • Type notepad .exe in the Run Box.

  2. Now copy/paste the entire content of the codebox below into the Notepad window:



Renv::
<pre>
----a-w           524,288 2007-06-19 13:24:53  C:\Program Files\Thoosje Sidebar V2.0\Thoosje Sidebar .exe
</pre>

  1. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

  2. Save the above as CFScript.txt

  3. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again. See picture below how to perform this.

  4. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

    • Combofix.txt
    • A new HijackThis log.

polonus