Could someone please look at this hijackthislog?

buyitall

I have now managed to format the drive and all the files have disappeared, it is now empty. I will start again with it when I have the new hard drive installed. I will probably lose a few things purchased since the image, but they should all be on my ipod anyway. Many thanks for all your advice. Let's just hope the hard drive is near the surface when I open up the laptop tonight! xx

aliEnRIK

Laptop hardrive should be easy

Usually a few screws hold a plastic cover on. The hard drive itself will probably be held by a few screws, then simply pulls out of its interface

aliEnRIK

Id recommend that when youve put the new hard drive in and got it up and running, give a full scan with malwarebytes and run combofix so we can say for certain that its clean (Your call, its just I obviously dont know that your image is free of nasties)

buyitall

Thank you, I will do that. Was there a particular line in the combofix log which set the alarm bells ringing?

aliEnRIK

The trojans should be easy to deal with (top part of the log, probably about 6 or 7 entries)

The main issue ive had before was -
c:\users\Mason\AppData\Local\Temp\catchme.dll 53248 bytes executable

Its a rootkit that when I first tried I didnt manage to remove (But the OP also did a runner so maybe I would have in the end)

buyitall

Thanks, I will have to hope for the best with the image because I have now realised that you can get viruses etc from websites which stream video. I know that my children have watched football matches in the past which aren't on Sky, ESPN or terrestrial - so the malware could have been there for a while. I was (naively) under the impression that if you didn't download any files you were safe. I will be MUCH more careful from now on. My son's laptop is also infected, I will do a system restore on that, as there is nothing on there that he will miss when it is formatted. The netbook seems to be clean.

aliEnRIK

You can get a virus just by visiting an infected website
and ANY website can be hacked and a virus inserted (ive been on at least two legit sites myself where its happened - that said, due to one of them I managed to save myself approx 150 quid. Sometimes good things come from viruses )

You could click a link that has one hidden, or takes you to an infected website

You can download them (thats the major one by far)

The ones most fall for are actually installing them themselves as they believe theyre getting something out of it (installing software to watch streaming football for example, they can easily put viruses in the software you 'need' to install to use it)

Email attachments can be infected

Facebook (and the like) apps can be dodgy

Phishing is getting huge

The list goes on

buyitall

I am wondering about just doing a factory restore to be on the safe side and forgetting about the true image backup. If I do this, is there any way of accessing the photos and itunes folders and just 'saving' them? I think I could live with losing everything else, if it's safer.

aliEnRIK

So you want to save the itunes and pics you have on the infected computer?

However you back them up - you run the risk of infecting the backup

But sure, you should be able to save the folders to any media you like (not sure about itunes mind if youve downloaded them, they may have protecion on. I dont deal with itunes so really not sure)

Again though, surely it would be best to fit the new hardrive? Youve already bought it, so surely you should put it to use?
(Safest way I can think of is do a factory restore, then make an image of it, then fit the new drive and put the image on that - assuming it allows the image on the new drive!?)

buyitall

Thanks, I think I am just getting paranoid about the new disc being infected. I was wondering about installing the new drive to factory settings then just extracting the music and photos from the image - is it possible to pick and choose what you want from the image or is the whole point of it that you replicate the exact state of your computer at a given point?