Hi,
I understand that you're trying to fix this on your own but please allow me to assist you fully.
Quote:
|
lets make sure we are talking about the same thing the recovery console is a choice in the boot options when i press f8 while booting the system i can boot into it and have already so if you are talking about something else i dont have it but if thats it i have already use it atleast once
|
Yes, that's the recovery console that I asked aobut. Reason I asked is because I found it odd that combofix reported that it isn't installed. I never saw something like that before. Let's see if the next run will still show it.
Open HijackThis > choose Scan Only > Place a
checkmark in the boxes beside these entries in
bold.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O8 - Extra context menu item: &Search - ?p=ZKxdm021YYUS
Close your browsers and all open windows except for HijackThis, then click "Fix checked". Exit HijackThis.
________
Combofix Deletions- Open notepad.
- Copy and paste the text inside the code box below to notepad
Code:
File::
C:\WINDOWS\system32\nqpqhjqe.dll
C:\WINDOWS\system32\JlnVDJjl.ini
Folder::
C:\WINDOWS\system32\.2cc3bae2
Driver::
Kry17
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Kry17.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\2cc3bae2]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nqpqhjqe]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccywuSJ]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{089FD14D-132B-48FC-8861-0048AE113215}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5AA2BA46-9913-4dc7-9620-69AB0FA17AE7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AAD1C6AD-10AB-4cae-97FB-0AADDEC8A14B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB1E5328-9006-453B-B900-51C3745F923A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{51C64053-2BAF-43BF-9A66-E4254C5FA7A8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
Filelook::
C:\WINDOWS\system32\6C.tmp
C:\WINDOWS\system32\ikhcore.cfg
Dirlook::
C:\WINDOWS\system32\312191
- Save and Name it as "CFScript"
- Drag and drop CFScript.txt to your copy of combofix.
- You can take a look at the image below if you're unsure on how to do it.
- Combofix wil restart your machine then it will produce a log afterwards.
- Please post the contents of that log along with a fresh HijackThis log.
________
Please do an online scan with
Kaspersky WebScanner
Warning: If you had kaspersky online scanner installed before 10-5-2007, please uninstall it as kaspersky released a new version. Previous version had a serious flaw which could result in a buffer overflow.
You will be promted to install an ActiveX component from Kaspersky, Click
Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT
- Now click on Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Extended (if available otherwise Standard)
- Scan Archives
Scan Mail Bases
- Click OK
- Now under select a target to scan:
- This will program will start and scan your system.
- The scan will take a while so be patient and let it run.
- Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
- Save the file to your desktop.
- Copy and paste that information in your next post.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
________
Your Java is out of date....
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.
- Click Start > Control Panel
- Click Add/Remove Programs
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove button.
- Repeat as many times as necessary to remove all versions of Java.
- Reboot your computer once all Java components are removed.
Then download
Java Runtime Environment 6u6, and install it to your computer.
On your next reply, please include a
- Fresh HijackThis log.
- kaspersky scan log
- combofix log