Please help! Had Defender virus warning - Now desktop icons have vanished!

paddywak

Sorry just saw your last post. What do I need to scan?

SaqibQ

The files on page 7!

SaqibQ

Please follow my instructions on post #147. If you need help, let me know.

paddywak

Just sent Combofix and Hijack to uploading as per your instructions from no 147. Hope it works.

SaqibQ

No, no, no!

I want you to do this:

1. Scan the files I asked for on page 7 using VirusTotal. Do not scan ComboFix or HijackThis as their logs are appearing fine on the forum.
2. Save the results from VirusTotal (for each file scanned) in Notepad.
3. Save the Notepad file on your Desktop.
4. Go to this website and upload the Notepad file.
5. The website will provide you a download link.
6. Post that link here so I can download the Notepad file

I need to see the results clearly so I can determine if the files need deleting. We wouldn't want to delete a wrong file by mistake.

paddywak

Yhamks for your fantastic patience. You have been very kind so will get this virus done now.

paddywak

Forum Link
http://uploading.com/files/ESRNWO0N/Virus1.txt.html


HTML Link
<a href=http://uploading.com/files/ESRNWO0N/Virus1.txt.html>Download from Uploading.com</a>

paddywak

Hi SaqibQ

I just thought I'd turn my computer off and on again to see if it was still doing the actions of the past while. This seems to have stopped so am I to believe that whatever you did for me this evening cleared the virus? I am in total awe of you experts Idon't know what happened but you are all computer life savers.
If this has stopped should I put on the AVAST again and the superantispyware or follow the instructions from an earlier post to add other stuff on? Should I be deleting anything of my desktop now if the problem has been solved?
These probably sound simple things to you but as someone who doesn't understand I value your help.
Thanks

aliEnRIK

Make sure PCTOOLS firewall and AVAST anti virus are running

SaqibQ

Hi,

That's great to hear! We're almost done. You can enable Avast after running ComboFix.

Please do the following...

1. Open HijackThis
- Click the Do a system scan only button
- Check the following entries (below)

O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://ebanking.northernbank.co.uk/.../e-Safekey.cab

- Close ALL open windows (especially Internet Explorer!)
- Click Fix Checked
Close HiajckThis

2. Open Notepad and copy/paste the text in the Quote Box below into it:

File::
c:\windows\system32\redivipo.dll
C:\windows\system32\hugeloko.dll
c:\windows\system32\nodivivo.dll
c:\windows\system32\DFT0VQRC.exe
c:\windows\system32\j5wEG5nB.exe
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At25.job
C:\WINDOWS\tasks\At26.job
C:\WINDOWS\tasks\At27.job
C:\WINDOWS\tasks\At28.job
C:\WINDOWS\tasks\At29.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At30.job
C:\WINDOWS\tasks\At31.job
C:\WINDOWS\tasks\At32.job
C:\WINDOWS\tasks\At33.job
C:\WINDOWS\tasks\At34.job
C:\WINDOWS\tasks\At35.job
C:\WINDOWS\tasks\At36.job
C:\WINDOWS\tasks\At37.job
C:\WINDOWS\tasks\At38.job
C:\WINDOWS\tasks\At39.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At40.job
C:\WINDOWS\tasks\At41.job
C:\WINDOWS\tasks\At42.job
C:\WINDOWS\tasks\At43.job
C:\WINDOWS\tasks\At44.job
C:\WINDOWS\tasks\At45.job
C:\WINDOWS\tasks\At46.job
C:\WINDOWS\tasks\At47.job
C:\WINDOWS\tasks\At48.job
C:\WINDOWS\tasks\At49.job
C:\WINDOWS\tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job

Save this as CFScript.txt to your Desktop



Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.