Potential Virus - Help please

waddler_8

Got it.

Can you also send me the files ComboFix2.txt & ComboFix-quarantined-files.txt

You'll find them in the C:\qoobox folder.

DCodd

waddler_8 wrote: »

Got it.

Can you also send me the files ComboFix2.txt & ComboFix-quarantined-files.txt

You'll find them in the C:\qoobox folder.

Will do.

I'm at work at the moment. Won't be home till about 9.00pm but will send them then if that's ok?

Thanks

waddler_8

No problem.

DCodd

Hi waddler_8.

sent the files.

Thank you and sorry for being a pain.

waddler_8

DCodd wrote: »

MSE is blocking me posting the log, even just a fraction of it.

Same here. It's a right pain.

closed wrote: »

might not work, but to post the log try changing all references of system 32 to system42

Know something I don't closed? :huh: For some reason it's just not letting me post anything with "system32" in it?

(Look at the post's source to see how I did that)

Any idea why?

waddler_8

@DCodd

Run this combofix script.

If combofix tells you there is a newer version available, let it update.

• Open Notepad
• Copy and paste the text present inside the code box below (Don't include Code:)

KILLALL::

File::
c:\windows\system[B][/B]32\2107949594.dat 
c:\windows\system[B][/B]32\Packet.dll 
c:\windows\system[B][/B]32\pthreadVC.dll 
c:\windows\system[B][/B]32\SETB.tmp
c:\windows\system[B][/B]32\WanPacket.dll 
c:\windows\system[B][/B]32\wpcap.dll

Driver::
BITS ACS
BITSAppMgmt
BITSwscsvc
LmHostsClipSrvMessenger
MSDTCHTTPFilter
MFE_RR
rm


FileLook::
c:\windows\system[B][/B]32\activedsl.exe

ClearJavaCache::

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
• Temporarily disable your anti-virus Avast, before following the steps below.
• To disable your Antivirus, see here
  
• Drag CFScript.txt into ComboFix.exe as the screenshot above shows.
• ComboFix will scan & may reboot when it finishes. Combofix.txt will open.
• Copy and paste the contents of the log here.

closed

It's the forum bug, that started a month or so ago, still not fixed.

I posted in the bug thread, but the powers that be said it's all fixed now and locked it.

http://forums.moneysavingexpert.com/showpost.php?p=62812253&postcount=78

waddler_8

Cheers closed - first time I can recall coming across it although I was away for a few weeks recently.

DCodd

Hi waddler_8

I don't have combofix.exe just a downloaded installer in my downloads folder?

Thanks

waddler_8

That's it. Drag cfscript into that icon.