HELP! PLEASE! Win 7 anti spyware con has infected & taken over my laptop!

dalek

This is the second scans log............


05/04/2011 20:24:41
mbam-log-2011-04-05 (20-24-40).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|)
Objects scanned: 263202
Time elapsed: 17 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

karatepet

Looks like malwarebytes got rid of it.Is the laptop running ok.?

Browntoa

dalek , now run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and post the log file

dalek

I am using it now, yes.

It seems to be ok.

Is there anything else i should scan with?

dalek

Browntoa wrote: »

dalek , now run this

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

and post the log file

Thankyou.

I will do it now.

dalek

Hmm windows defender doesn't seem to work - its telling me to re start my computer, so i will try again.

Browntoa

wait for AlienRik to take a read of the combofix log (he's the expert on these) , its removed a couple of extra bits

dalek

Okey dokes.

dalek

YIKES - A NEW infected file found by malaware!

It didnt find it on the 2nd scan.

Just restarting pc

dalek

The new log file

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6281

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

05/04/2011 21:21:18
mbam-log-2011-04-05 (21-21-18).txt

Scan type: Full scan (C:\|D:\|E:\|G:\|)
Objects scanned: 266399
Time elapsed: 21 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\******\AppData\Local\fnv.exe" -a "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)