FAO aliEnRIK. Combofix Log after rootkit cleaned, thankyou for looking.

aliEnRIK

rockin_plumber wrote: »

Maybe I missunderstood that..
Did you want to know what loose files where in the folders along the way??

Only if they were in either of the 'pMjHnAb08514' folders

rockin_plumber

aliEnRIK wrote: »

Only if they were in either of the 'pMjHnAb08514' folders

:rotfl:oh well did all that for nothing then

See what happens tomoro when I do the scan :T

rockin_plumber

aliEnRIK wrote: »

Only if they were in either of the 'pMjHnAb08514' folders

Just let me clarify this was ok...

When I opened folder 'pMjHnAb08514'
inside there was a file called 'pMjHnAb08514'

Sorry to be a pain

Anyway Ran quick scan of DR WEB all clear and running full scan..

50 minutes in and 82000 objects scanned, this is gonna be a long scan

So far its found 1 object

Object
856c4-184-0.dat

Path
C:\Documents and Settings\All Users\Application Data\Alwil\Avast5\arpot

Status
BackDoor.Tdss.4005

Action
Incurable.Moved.

aliEnRIK

rockin_plumber wrote: »

Just let me clarify this was ok...

When I opened folder 'pMjHnAb08514'
inside there was a file called 'pMjHnAb08514'

Sorry to be a pain

No worries

Open malwarebytes
Goto MORE TOOLS
then RUN TOOL
Use the tool to destroy that pMjHnAb08514 file

rockin_plumber

Dr Web is running the scan so that may take all night at this rate :rotfl:

Shall I let it finish before i delete that file

aliEnRIK

You should be ok to do it as its running

rockin_plumber

Ooops

When I plugged in my netbook charger I knocked the bleepin switch and turned off the infected pc :mad::mad::mad:

So starting the scan again

But should I do anything with the object It found that I mentioned above??

Object
856c4-184-0.dat

Path
C:\Documents and Settings\All Users\Application Data\Alwil\Avast5\arpot

Status
BackDoor.Tdss.4005

Action
Incurable.Moved.

its moved it to the DR WEB quarantine folder

and I have deleted that file you mentioned previously with Malwarebytes

aliEnRIK

Just let dr web run

rockin_plumber

Blimey.. that took about 15 hours to complete :eek:

The only problem is it asks you what to do every time it finds something...

So it may have been sat idle all night for all I know

Should I let Dr Web delete what it has found??

What it has found looks to be mostly in system restore files or in Combofix quarentine folder??

I still have my AV turned off on the machine and its not connected to internet at the moment so cant get the log to this computer very easy at the moment.

aliEnRIK

You said 'mostly'
What else has it found?