TR/agent.72967 please help

linni

Hi again. I've tried several times to do it all again, from the beginning, I've deleted Combofix (qwerty), I've renamed everything, but it doesn't matter what I do, the 'one' still appears at the end of the scan. I've looked and the 'hidden' files and the box is already ticked. The only thing I can think of is, I dont get a 'save as' option when I install combofix, just either 'run' or 'save', so I 'save' as 'qwerty' in 'my documents'. Should I be saving it somewhere else?

or

when I save the Java (in red) from notepad to my documents, I name it CFScript with nothing at all after it. I drag it into Combofix (qwerty) and the 'one' only ever appears at the end of the scan. The CFScript file disappears from 'my documents' after the scan.

The computer has crashed a few times and I get a Microsoft warning 'it has crashed due to a serious error'...

Shall I just chuck it in the bin!

CPJames19

linni wrote: »

Hi again. I've tried several times to do it all again, from the beginning, I've deleted Combofix (qwerty), I've renamed everything, but it doesn't matter what I do, the 'one' still appears at the end of the scan. I've looked and the 'hidden' files the box is already ticked. The only thing I can think of is, I dont get a 'save as' option when I install combofix, just either 'run' or 'save', so I 'save' as 'qwerty' in 'my documents'. Should I be saving it somewhere else?

or

when I save the Java (in red) from notepad to my documents, I name it CFScript with nothing at all after it. I drag it into Combofix (qwerty) and the 'one' only ever appears at the end of the scan. The CFScript file disappears from 'my documents' after the scan.

The computer has crashed a few times and I get a Microsoft warning 'it has crashed due to a serious error'...

Shall I just chuck it in the bin!

Just follow this tutorial:

http://www.howtogeek.com/howto/8693/how-to-remove-antivirus-live-and-other-roguefake-antivirus-malware/

aliEnRIK

Open malwarebytes

goto MORE TOOLS

then RUN TOOL

manually remove all these (If any) that are still there ~
c:\documents and settings\mum\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a2098 76-259997f1-n\msvcp71.dll
c:\documents and settings\mum\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a2098 76-259997f1-n\jmc.dll
c:\documents and settings\mum\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a2098 76-259997f1-n\msvcr71.dll
c:\documents and settings\mum\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad3 91-5932947c-n\decora-sse.dll
c:\documents and settings\mum\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad3 91-5932947c-n\decora-d3d.dll

Then ~

Download CCLEANER
http://www.ccleaner.com/download/builds/downloading-slim
Run the CLEANER scan (UNTICK 'cookies')
Then run the REGISTRY scan (Backup the registry when it asks)


reboot

Download GLARY UTILITIES
http://www.glaryutilities.com/download/gusetup_slim.exe
Run the ONE CLICK scan
Goto MODULES / SYSTEM TOOLS / WINDOWS STANDARD TOOLS / then run SYSTEM FILE CHECKER

linni

I''ve done everything up to Glary Utilities run system file checker and a box appears on the screen saying 'Windows file protection. files that are required for Windows to run properly must be copied to the DLL Cache. Insert your Windows XP Home Edition now' but all I have is a recovery disk or Office Enterprise.

linni

James - that looks like a great site, I will have a good read through it..

aliEnRIK

linni wrote: »

I''ve done everything up to Glary Utilities run system file checker and a box appears on the screen saying 'Windows file protection. files that are required for Windows to run properly must be copied to the DLL Cache. Insert your Windows XP Home Edition now' but all I have is a recovery disk or Office Enterprise.

Thats ok, leave that bit

aliEnRIK

Reinstall JAVA

Hows it running now?

linni

Should I cancel it then because if I say skip it, it says it might ask me for it again later?

aliEnRIK

Cancel it yes

linni

Every time I click Cancel, it just keeps coming back up again so should I close it down completely?