[list]Hi,
Mistakes that are made by running ComboFix:
CF has not been run from Desktop:
Running from: J:\ComboFix.exe
You have been just create shortcut by mistake or or intentional.
C:\Documents and Settings\Leonna\Desktop\Shortcut to ComboFix.exe.lnk
Drive c: () (Fixed) (Total:228.11 GB) (Free:58.13 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive j: (KINGSTON) (Removable) (Total:0.48 GB) (Free:0.47 GB) FAT
===============================
Your system is in a disastrous state. You need to stay with me to the end untill we fix your computer.
Multiple Antivirus Programs
You are running more than 1 Antivirus program!
Running - more than one - antivirus program is not recommended because:
[*]They can conflict with each other.
[*]Report the other antivirus software as malicious.
[*]Antivirus programs use an enormous amount of computer’s resources… actively scanning your computer.
[*]Can cause your computer to become unstable…run slowly and even, in rare cases, BSOD crash…etc
I strongly suggest you uninstall one of them. Which one, is your decision.
=> Wisit this website for downloading AppRemover tool:
http://www.appremover.com/
Follow video from the site, run this tool, and remove any found remainder of previsu installed AntiVirus. Do not uninstall avast.
------ Next -------
- Delete old Combofix (drag&drop into Recycle bin) + delete copy from your flashdrive.
- Download new, flesh ComboFix copy and save it to your Desktop:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Runing ComboFix’s via CFScript:
Open notepad and copy/paste the text present inside the code box below:
FileLook::
c:\windows\system32\dllcache\hidparse.sys
DirLook::
C:\45fb849343a6770bb2587b863f62
KillAll::
File::
C:\Windows\assembly\GAC\Desktop.ini
C:\Documents and Settings\Leonna\hpothb07.dat
C:\Documents and Settings\LocalService\hpothb07.dat
Folder::
c:\docume~1\Leonna\LOCALS~1\APPLIC~1\Google\Desktop\Install
c:\program files\Google\Desktop\Install
c:\program files\AskPartnerNetwork
C:\Program Files\Web Assistant
ClearJavaCache::
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ApnTBMon”=-
Driver::
APNMCP
DDS::
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
RegNull::
[HKEY_USERS\S-1-5-21-3356611892-1797742675-451484230-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@=“FlashBroker”
“LocalizedString”=“@c:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_9_900_117_ActiveX.exe,-101”
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
“Enabled”=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@=“c:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_9_900_117_ActiveX.exe”
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@=“{FAB3E735-69C7-453B-A446-B6823C6DF1C9}”
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@=“IFlashBroker5”
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@=“{00020424-0000-0000-C000-000000000046}”
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@=“{FAB3E735-69C7-453B-A446-B6823C6DF1C9}”
“Version”=“1.0”
Save this as CFScript.txt
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:[b]ComboFix.txt[/b] )
------ Next -------
Download TDSSKiller and save it to your desktop
Execute TDSSKiller.exe by doubleclicking on it.
Confirm “End user Licence Agreement” and “KSN Statement” dialog box by clicking on Accept button.
[*] Press Start Scan
[*] If Suspicious object is detected, the default action will be Skip, click on Continue.
[*] If Malicious objects are found, select Cure.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt
Please post the contents of that log in your next reply.
------ Next -------
Re-run FRST, just press [ Scan ] button and attach here fresh FRST.txt logreport.
