View Single Post
Old 11-06-2008, 06:08 PM   #12 (permalink)
sUBs
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 24,340
OS: N/A


Re: internet pages are being hijacked

Quote:
Is there anything else I should do?
Yes there is. We'll need to clean up the rubbish ThreatFire left on the machine.


Open notepad and copy/paste the text in the quotebox below into it:

Code:
File::
c:\windows\61510.exe
C:\Documents and Settings\ken\My Documents\completed torrents\ConvertXtoDVD 3 v3.2.1.55b\vsoConvertXtoDVD3_setup.exe
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\61510]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
Driver::
TfFsMon
TfSysMon
ThreatFire
TfNetMon
Save this as "CFScript"





Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.
sUBs is offline