Hi again
Looking better – how are things running now?
Don’t worry about noting any services while combofix is running – it’s unlikely to happen. Just let it do what it has to do.
Combofix
- Close any open browsers.
- Open notepad and copy/paste the text in the box below into it:
Code:
File::
C:\WINDOWS\system32\pavas.ico
C:\WINDOWS\system32\Help.ico
C:\WINDOWS\system32\ttvwa.ini2
C:\WINDOWS\system32\ttvwa.bak2
C:\WINDOWS\system32\ttvwa.bak1
Folder::
C:\DEDUCT
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
Looking at the image below as an example
Save this as
CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it will produce a log for you at
"C:\ComboFix.txt"
Do not mouseclick combofix's window whilst it's running. This may cause it to stall.
CAUTION! Anyone else thinking of using the above script does so at their own risk - you may end up re-installing Windows!
Please post the log
C:\ComboFix.txt along with a fresh
HijackThis Log for further review.
Online Scan
Establish an internet connection & perform an online scan with
Internet Explorer at
Kaspersky WebScanner
Next Click on
Kaspersky Online Scanner
A Welcome screen will appear - click 'Accept' at the bottom. You will be prompted to install an ActiveX component from Kaspersky, Click
Yes.- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:Scan Options:- Scan Archives
- Scan Mail Bases
Click
OK
Now under select a target to scan: Select
My Computer- This will program will start and scan your system.
- The scan will take a while so be patient and let it run.
- Once the scan is complete it will display if your system has been infected.
Now click on the
Save as Text button:
- Save the file to your desktop.
- Copy and paste that information in your next post.
Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.
* Turn off the real time scanner of any existing antivirus program while performing the online scan
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.
Logs required
C:\Combofix.txt
Kaspersky Log
HijackThis Log