definite virus

[tetonbob]

Ok, great.

Before we close this out, I wouldn't mind taking a look at the crash dump created when you tried to use Kaspersky

See if there are minidump files located here, from the 17th Nov

C:\Windows\minidump

If so, zip them up, and attach them.

It might help pinpoint the cause of the crash, so I can steer you to the right section if further assistance is required.

[Sugar.Tears]

sure :D

[tetonbob]

The crash dumps are suggesting a memory corruption after a conflict with the Kaspersky driver. Heh, you knew this already. What I can't tell with my limited dump reading skills is if it's an issue with physical memory, or just a conflict we can write off as an event just due to the online scanner.

If you have no other such events, I'd say it's "one of those things". If you have other memory related crash events, I'd look into the memory on the machine itself...have it tested. The folks in the Windows XP or Hardware sections would be better suited to help if needed.

I think we can close this out.

Some final housekeeping instructions, and protection information

Other than that, your logs appear clean.You should be good to go. We still have a few items to address.

Go to -> Run -> copy/paste in the following single line command & click OK

combofix /u

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:

• Microsoft Windows Update - http://www.windowsupdate.com
  Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• Winpatrol
  
  Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.
  
  You can get a free copy of Winpatrol or use the Plus version for more features.
  
  You can read Winpatrol's FAQ if you run into problems.
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
    
  • Click Next, click Next, select the option:
    "Show Extracted files", click Finish
    
  • This will open the newly created hosts folder on your Desktop.
    
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
    
  • Once updated you should see another prompt that the task was completed.
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
  
  Do not install more than one AntiVirus program because they will conflict with each other.
  
  
• FIREWALL
  Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here
  
  Do not install more than one firewall program because they will conflict with each other.

Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Here are some additional utilities that will further enhance your safety.

• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• HOW DID I GET INFECTED IN THE FIRST PLACE?
• MAKING INTERNET EXPLORER SAFER

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[Sugar.Tears]

that specific boot screen is still coming up after uninstalling combofix (in case you wanted to know) and the taskbar glitches that I pointed out first thing are still happening... other than that things are great!

Thanks Mr. Bob... you are awesome!!

as far as it being memory related... I wouldnt know... but would be willing to seek help if you feel I need it...

[tetonbob]

that specific boot screen is still coming up after uninstalling combofix

That's as expected. Microsoft Windows Recovery Console is now a permanent addition to your machine's boot menu.

constantly slows the pc down (but as soon as I disconnect the usb for the internet the system speeds up again)... its causing the motherboard to beep (a phaser like noise.. not a beep but a tone that goes down in pitch and lasts for just a second) which coincides with some glitching with the taskbar/buttons/title bars (turn black)

You might have hardware issues concurrent with the malware we just removed.

Does this "glitch" with the taskbar occur in Safe mode?

[Sugar.Tears]

no... not that I'm aware of anyway... every time it happens it makes that phaser like noise and I always notice when that happens,

I'm ultimately saying that I highly doubt it has occurred in safe mode (which I've been in a few times in the past couple days

[tetonbob]

Ok, I'd like to be certain that this doesn't occur in safe mode, so restart the machine in safe mode, and let it run for a while. Then restart in normal mode, and see if you can pinpoint what's running on the machine when this sound and taskbar effect take place.

I think we'll be sending you to the Hardware section of the forum for a checkup on that issue.

[Sugar.Tears]

it doesn't seem to be anything out of the ordinary running when it happens...

and it didn't happen in safe mode

a few more crashes this morning... but I think *think* it may have something to do with my wireless receiver

[tetonbob]

Ok, so no issues in safe mode and issues in normal mode usually means driver conflict of some sort.

(but as soon as I disconnect the usb for the internet the system speeds up again).

I think *think* it may have something to do with my wireless receiver

I think it may also. For that, you'll be better off asking for help in the Hardware section of the forum, or networking

http://www.techsupportforum.com/netw...dsl-satellite/

Let them know you've been here and cleared of malware.

[Sugar.Tears]

ok... will do! thanks bob!

just pointing out though... this part

(but as soon as I disconnect the usb for the internet the system speeds up again).

has stopped completely... hasnt happened since the malware was removed