Please help! Had Defender virus warning - Now desktop icons have vanished!

SaqibQ

Hows it going with this?

paddywak

Sorry SaqibQ have just got to opening this up again. Am going to do what your suggested. The Northern bank thing is my bank but will scan it anyway. Will post when done.

paddywak

I was wondering if SaqibQ is about tonight. Just wondering if the last post is o.k. and whether to put the antivirus and firewall back on now?

SaqibQ

Did you run ComboFix as instructed above? If you did, I need to see the new log please. You can then turn your Anti-Virus and Firewall back on!

Also, let me know how the computer is running.

paddywak

I did a combofix but a pop up came up and siad tat it need to shut down. Will do another one this evening and post it. It will probably be after 7pm. Will I do a hijack as well?

paddywak

Sorry about the spelling above. I didn't check it before I sent it. Hope you can read it anyway.

SaqibQ

While I look through the log, please enable your Anti-Virus and Firewall. I see more bad files showing the logs...

paddywak

Hi SaqibQ
Should i be doing anything else if more bad files are showing as per your last post?
Do I still enable the PCtools firewall and AVAST anti virus?

SaqibQ

Hi,

I'm writing some instructions for you now. Yes, please enable PCtools firewall and AVAST Anti-Virus.

SaqibQ

Hi,

I got a bit more work for you to do. Please ensure your Anti-Virus and Firewall are enabled.

1. Run HijackThis and click on Open the Misc Tools section.
Click on delete a file on reboot...
Copy and paste the following into the "File name:" text box and then click Open:

c:\windows\system32\bidiyije.dll

When you are asked "Do you want to restart your computer now?", click NO.
Repeat these steps for the following file(s) and this time, when you reach the end, click OK:

c:\windows\system32\kejepuha.dll
c:\windows\system32\kegezadu.dll

Your PC MUST reboot to delete the files!

2. Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
This program is for XP and Windows 2000 only!

• Double-click ATF Cleaner.exe to open it.
• Under Main select the following:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

Click Exit on the Main menu to close the program.

3. Start Malwarebytes

• Select the Update tab, and click on Check for Updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt

You may post the Malwarebytes log now or at the end once the instructions below are complete...

4. Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)

• Scan Options:

Scan Archives
Scan Mail Bases
[*]Click OK
[*]Now under select a target to scan:

Select

My Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.

• Now click on the Save Report As button:
• Change Save as type: to Text file
• Save this as Kaspersky scan to your Desktop

[*]Post the Kaspersky report in your next reply.
5. I need to see another log from HijackThis.

• Run Hijackthis.
• Click on Open the Misc Tools section.
• Next click on Open uninstall manager.
• Press the Save list button.
• Save the file to your desktop, with the default name of uninstall_list
• Copy & Paste the entire contents of that file in your in your next post.

6. Please post the following...

Malwarebytes log (if not already posted)
Kaspersky report
Uninstall list
New HijackThis log

You may need several replies if you cannot fit everything into one post.