Problems with computer - Help needed please

aliEnRIK

For some reason the command didnt work (perhaps you didnt copy and paste exactly?)

Try direct
Open malwarebytes
Goto MORE TOOLS
then RUN TOOL
Then search for and kill (Youll need to be able to see 'hidden files and folders')~
c:\windows\system32\XDva295.sys

EverDecreasingCircles

Sorry, I can get as far as RUN TOOL but don't understand how to do the rest.

When I click on RUN TOOL it wants to know what file to open and I can't find that one. How do I make sure I can see 'hidden files and folders'?

EDC

aliEnRIK

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/win_fcab_show_file_extensions.mspx?mfr=true

EverDecreasingCircles

Thanks. I've done as it says on that link. I still can't find that file though when I click on RUN TOOL. I get the box titled OPEN. Where do I want to look? If I type in the file name it says it doesn't exist. Sorry to be dim.

ETA: I've found system32 but can't see anything like XDva295.sys in there. Not sure I'm in the right place though!

EDC

aliEnRIK

Open c drive
Open the windows folder
Open the system 32 folder
It 'should' be in there

If it isnt then retry combofix again using the notepad file (copy EXACTLY as is without spaces at the beginning) ~
File::

EverDecreasingCircles

I can't find it in the system 32 folder so I've tried combofix again and it's still there! I copied and pasted this
c:\windows\system32\XDva295.sys
and also tried just
File::
c:\windows\system32\XDva295.sys
and
File::c:\windows\system32\XDva295.sys
but it's on all 3 logs. This is part of the latest one:

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/17/2010 5:13 PM 108289]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [12/13/2009 4:27 PM 27632]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [12/13/2009 4:26 PM 90112]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [12/13/2009 4:09 PM 13224]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [12/13/2009 4:26 PM 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [12/13/2009 4:26 PM 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [12/13/2009 4:26 PM 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [12/13/2009 4:26 PM 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [12/13/2009 4:26 PM 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [12/13/2009 4:26 PM 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [12/13/2009 4:26 PM 109864]
S3 XDva295;XDva295;\??\c:\windows\system32\XDva295.sys --> c:\windows\system32\XDva295.sys [?]

Maybe I'm not copy and pasting right? (where's the confused smiley when you want it)

EDC

aliEnRIK

ok, leave that be for now

Hows it running?

EverDecreasingCircles

It seems to be running OK at the moment.

Thanks for your help, I really appreciate it

EDC

aliEnRIK

Update and run a FULL scan with malwarebytes

Assuming that comes back clean then id say your good to go

If you dont use it already, may as well give your system a clean ~

Download CCLEANER
http://www.ccleaner.com/download/builds/downloading-slim
Run the CLEANER scan (UNTICK 'cookies')
Then run the REGISTRY scan (Backup the registry when it asks)

Reluctant_spender

S3 XDva295;XDva295;\??\c:\windows\system32\XDva295.sy s --> c:\windows\system32\XDva295.sys [?]

The ? indicates that the file may or may not exist. means CF couldn't enumerate the file correctly