Open Spybot and make sure teatimer is disabled, we will re-enable afterwards. To do so do the following
Open Spybot
Click mode
click Advanced mode
if you get a warning answer “yes”
click tools
click resident
uncheck resident “teatimer” and SDHelper if installed
click allow change
reboot
Open HJT, run a system scan only, check mark these lines if present
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O23 - Service: Security Service (NANU) - Unknown owner - C:\WINDOWS\system32\svcd\svchost.exe
Close all other browsers/windows, click fix, close HJT.
Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.
Copy and paste all the text in the quote box below into Notepad.
Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.
File::
C:\WINDOWS\system32\svcd\svchost.exe
C:\winefni.exe
C:\winvvys.exe
C:\WINDOWS\system32\url3
C:\WINDOWS\system32\url2
C:\WINDOWS\system32\url1
C:\WINDOWS\system32\CID
C:\WINDOWS\system32\SvcNm
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\intelidee.sys
C:\Documents and Settings\Compaq_Owner\Application Data\internaldb41.dat
C:\Program Files\d.bat
RENV::
----a-w 79,224 2008-01-12 14:41:51 C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w 245,760 2008-01-13 17:09:10 C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe
----a-w 286,720 2008-01-12 14:42:10 C:\Program Files\QuickTime\qttask .exe
----a-w 1,415,824 2008-01-13 01:23:38 C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w 15,360 2008-01-12 14:42:22 C:\WINDOWS\system32\ctfmon .exe
Folder::
C:\WINDOWS\system32\svcd
C:\WINDOWS\system32\url3
C:\WINDOWS\system32\url2
C:\WINDOWS\system32\url1
C:\WINDOWS\system32\CID
C:\WINDOWS\system32\SvcNm
C:\temp\tn3
C:\WINDOWS\system32\vt8
C:\WINDOWS\system32\ob3
C:\WINDOWS\system32\mp2
C:\WINDOWS\system32\ez4
C:\WINDOWS\system32\edcA01
C:\WINDOWS\system32\che9
C:\temp\Ryuan1
This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HJT log.
