System Volume Information\ is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be resetting/clearing the cache in a little while by uninstalling ComboFix.
Several finds are in Norton Quarantine
C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine
They are safe there, as Norton has rendered them inert, but you may want to remove them from the machine. See if these instructions help you finally remove them from the machine.
Please use
Symantec's guide to remove the Norton Quarantine files.
==========================================
These files are infected, and where they came from is part of the problem
Delete them all.
"C:\Documents and Settings\Enrico Fantini\Documenti\File ricevuti\Configurazione_Caratteri_V2.0 WinXP.rar"
"C:\Documents and Settings\Enrico Fantini\Documenti\File ricevuti\guarda ke serio....rar"
"C:\Documents and Settings\Enrico Fantini\Documenti\File ricevuti\magia.rar"
"C:\Documents and Settings\Enrico Fantini\Documenti\File ricevuti\иииии.rar" <<<<<<<<<< Not sure if this translated properly
M:\eMule\Incoming\MIRC 6.21 + KeyGen Controller Programmi ITA.rar<<<<<<<<<<<<<<<<<<KEYGEN
"M:\eMule\Incoming\SpyRemover 2.63.zip"
As I mentioned in my previous post, P2P applications in and of themselves are not always bad, but the downloads many people seek and obtain with them are.
Cracked (
Illegal) Software
This is quite likely the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is
always a risk.
Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore. Don't think: "I have a good Antivirus and Firewall installed, they will protect me" - because that's not true... and even before you know it, your Antivirus and Firewall may become disabled by the malware which has now found its way on your system.
If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer.
Additionally,
cracked programs are illegal.
Referring to the
Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. Before posting for help, we ask that you uninstall any such applications, as indicated in this
sticky topic.
As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (
illegal) software is still present on the machine. Any future requests for help may be ignored.
Uninstall these illegal softwares now.
Other than that..............
Your logs appear clean.You should be good to go. We still have a few items to address.
Go to
-> Run ->
copy/paste in the following single line command & click OK
combofix /u
This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.
Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
- Microsoft Windows Update - http://www.windowsupdate.com
Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
- SpywareBlaster to help prevent spyware from installing in the first place.
- Install & update SpywareBlaster with the latest definitions.
After you have updated, click the button - enable protection for all unprotected items
- Winpatrol
Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.
You can get a free copy of Winpatrol or use the Plus version for more features.
You can read Winpatrol's FAQ if you run into problems.
- MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.- Download Host.zip to your desktop.
- From your Desktop right-click (hosts.zip) and select:
Extract All from the menu.
- Click Next, click Next, select the option:
"Show Extracted files", click Finish
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
- Once updated you should see another prompt that the task was completed.
- ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
Do not install more than one AntiVirus program because they will conflict with each other.
- FIREWALL
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here
Do not install more than one firewall program because they will conflict with each other.
Scan here
http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer
Here are some additional utilities that will further enhance your safety.
- http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
- http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
- http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
- http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.
ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles
If you want to fight back the Malware Writers that have made your life a misery, please take a look
here and read what you can do against it.
Please respond to this thread one more time so we can mark this thread as resolved.