System Tool Virus-Please review Hijack This LOG

sumeet

Update;

I have ran Rkill first of all in safemode with Networking and have the results below;
Rkill was run on 01/03/2011 at 19:52:56.
Operating System: Windows Vista (TM) Home Premium

Processes terminated by Rkill or while it was running:

Rkill completed on 01/03/2011 at 19:52:59.

Then updated MalwareBytes and performed full scan again which has come back with one infected file-Hijack.StartmenuInternet, Registry Data, HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\iexplore.exe\shell\open\command\(default)

Should I remove this selected file and can anyone outline next steps, thanks...

aliEnRIK

Remove it, then goto LOGS and post the WHOLE of the log that was produced

sumeet

Log below and it saying to restart the computer, shall I press ok and then leave in normal mode?

Log;
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4052
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.19019
01/03/2011 21:40:30
mbam-log-2011-03-01 (21-40-30).txt
Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|G:\|)
Objects scanned: 307996
Time elapsed: 45 minute(s), 18 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Sonia\AppData\Local\av.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

aliEnRIK

yes - Go for it

sumeet

Thanks, just doing this now but is anything else needed after that? On the other thread you are suggesting Spybot and other fixes or is that a worse infection?

aliEnRIK

I never suggested to use spybot, I asked to switch it off so it wont affect combofix

fiddiwebb

sumeet

You need to update the database in Malwarebytes, just press on the update tab when you open Malwarebytes and then click on check for updates.

Start up in normal mode and see if you can update Malwarebytes and then run a full scan.

If Malwarebytes finds anything remove it and then post the log file in your next message

sumeet

Tried rebooting after deleting previous item above but in normal mode System Tool virus is still there, re running Rkill and MWB quickscan gives results below, anything further I can do?


This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Rkill was run on 01/03/2011 at 22:19:29.
Operating System: Windows Vista (TM) Home Premium

Processes terminated by Rkill or while it was running:
C:\Windows\system32\userinit.exe

Rkill completed on 01/03/2011 at 22:19:31.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4052
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.19019
01/03/2011 22:25:51
mbam-log-2011-03-01 (22-25-51).txt
Scan type: Quick scan
Objects scanned: 125546
Time elapsed: 5 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

aliEnRIK

You still havnt updated mlawarebytes to the latest database (its months behind)

sumeet

fiddiwebb wrote: »

sumeet

You need to update the database in Malwarebytes, just press on the update tab when you open Malwarebytes and then click on check for updates.

Start up in normal mode and see if you can update Malwarebytes and then run a full scan.

If Malwarebytes finds anything remove it and then post the log file in your next message

I did update in safe mode and ran full scan earlier tonight also in safe mode and then deleted Hijack this infection, see halfway up thread but on rebooting to normal mode System Tool is still there and pevents me from getting to MWB in normal mode.