Hello and Welcome to TSF.
If you haven't already, please
Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click
Thread Tools, then click
Subscribe to this Thread. Make sure it is set to
Instant notification by email, then click
Add Subscription.
Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.
------------------------------------------------------
Do you use conduit engine?
Was kingsoft antivirus a previous install?
------------------------------------------------------
Please download
aswMBR.exe to your desktop.
- Double-click aswMBR.exe to run it.
- When prompted to download the latest Avast! virus definitions, please choose Yes
- Click the Scan button to start scan.
- Wait until it says, 'Scan finished successfully'. ( Note - do not select any Fix at this time)
- Click Save log, and save it to your desktop.
- Click Exit.
- Please post the contents of that log, aswMBR.txt, in your next reply.
There shall also be a file on your desktop named
MBR.dat. Right-click that file and select Send To > Compressed (zipped) folder. Please attach that zipped file in your next reply.
------------------------------------------------------
When you run this tool, remember to choose 'Skip' not 'Cure' if it finds something. We just want a scan, not a fix.
Download
tdsskiller.exe and Save it to your Desktop.
Double-click
tdsskiller.exe and click 'Run'
Click 'Start scan'.
If no infection is found, click 'Close' and let me know.
If an infection is found, select 'Skip' from the dropdown menu under 'Cure' then click 'Continue' > 'Close' > 'Close'.
It will produce a log here > C:\TDSSKiller.2.8.8.0_date_time_log.txt
Please navigate to the file, double-click to open it, and copy/paste the contents in your next reply.
------------------------------------------------------
Open
Notepad and copy/paste the entire contents of the codebox below into Notepad:
Code:
@echo off
if exist log.txt del /s/q log.txt
dir /a /s "c:\users\rev\appdata\roaming\Wandoujia2" > log.txt
notepad log.txt
del %0
Save this as
peek.bat and choose to
Save as type: - All Files to your desktop then close the Notepad file.
It should look like this:
Right-click on
peek.bat and choose 'Run as administrator' to allow it to run. A Notepad file will open. Post the contents of that file in your next reply.
------------------------------------------------------
