Hi,
- Open notepad (Start>All programs>accessories>notepad ) (It must be notepad, not wordpad, or it won't work)
- Copy the entire contents of the Quote Box below to Notepad.
- Name the file as CFScript.txt
- Change the Save as Type to All Files
- and Save it on the desktop
- Click Format and ensure Wordwrap is unchecked.
Code:
Collect::
C:\Documents and Settings\Lalit\~.exe
RenV::
C:\All Songs\songs\Songs from Vaibhav\Vaibhav_fun-time\FUN\VotCount .exe
Save this as
CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript.txt into ComboFix.exe
When finished, it shall produce a log for you. Post that log in your next reply.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.
Ensure you are connected to the internet and click OK on the message box. A browser will open. Simply follow the instructions to copy/paste/send the requested file.
==============================
Please do a scan with
Kaspersky Online Scanner
Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
Click on the
Accept button and install any components it needs.
- The program will install and then begin downloading the latest definition files.
- After the files have been downloaded on the left side of the page in the Scan section select My Computer.
- This will start the program and scan your system.
- The scan will take a while, so be patient and let it run.
- Once the scan is complete, click on View scan report
- Now, click on the Save Report as button.
- In the drop down box labeled Files of type change the type to Text file.
- Save the file to your desktop.
- Copy and paste that information in your next post.
================================
Please post back the Combofix.txt, Kaspersky report and another fresh HijackThis log please.