Help needed to remove Trojan horse patched_c.LYU

waddler_8

What happens exactly when you double click combofix.exe?

kellyp

A combo fix box opens and a black dos screen in it and a green bar showing progress (within the dos screen its deleting and extracting files) I have just tried rerunning it and now I have a message saying there is a new version available and I didnt get that before (should I say yes or no?)

waddler_8

Go ahead & Say Yes

kellyp

I've clicked yes, and then the green bar gets to the end and then nothing happens. The combofix box closes and no blue box appears as stated in intructions

waddler_8

Delete the copy of combofix you have & download it again

kellyp

3rd time lucky - blue box now appeared! I'll post log once completed

waddler_8

Good. It may not perform exactly as the tutorial, as every infection is different, but it will be very similar.

kellyp

SO it ran as stated in the instructions, but then the computer automatically rebooted itself before it showed the log file. I have found the log file after reboot and is as follows:


ComboFix 12-07-01.01 - SAMSUNG 01/07/2012 10:37:53.1.2 - x86
Microsoft Windows 7 Starter 6.1.7601.1.1252.44.1033.18.2037.1118 [GMT 1:00]
Running from: C:\Users\SAMSUNG\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


The log seems quite different to those on the examples so I hope I've done it cirrectly. Definitely turned off AVG prior to running combofix, but presumably has turned itself on after reboot.

waddler_8

The log will have popped up itself after the reboot. It looks like you've accessed it early before all the information was wrote to it.

Look again at the root of your C:\ drive for combofix.txt and see if it differs now.

Also look in the folder C:\Qoobox for ComboFix-quarantined-files.txt and post the contents of that.

kellyp

The combfix file still reads the same. In qoobox i can only find a catchme.txt file which appears to have an error:

---

2012-07-01 - 10:33:57

---

error: 31