Tip:
Printing this topic may be beneficial.
Click on the 'Print' button (top right hand side):
to change the format into a printable format
-----------------------------
This site recognizes that malware is evolving at a very fast rate, sadly HijackThis isn't evolving so quickly.
So, to this end we ask that you submit an 'OTL' report instead of a HijackThis log.
Before submitting this report, we ask that you follow this procedure first.
Step 1 Clean out your temporary internet files and temp files. Download
TFC by OldTimer to your desktop
Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator ). It will close all programs saved all your work Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion . Once it's finished it should reboot your machine . If it does not, please manually reboot the machine yourself to ensure a complete clean. Step 2 Before you start to remove malware, we recommend that you follow the instructions in this next step.
This will be your safeguard if you have any problems with your system.
Backup Your Registry The easiest way to do this is to use a program called
ERUNT Please download ERUNT from
Here and save it to your 'Desktop'.
Click Erunt.exe and follow the prompts to backup your registry to a folder of your choice.
Note: To restore your registry, go to the folder and start ERDNT.exe Step 3 Scan your computer with Malwarebytes Anti Malware Please download
Malwarebytes Anti-Malware and save it to your desktop.
Make sure you are connected to the Internet. Double-click on Download_mbam-setup.exe to install the application. When the installation begins, follow the prompts and do not make any changes to default settings. When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-Malware Launch Malwarebytes' Anti-Malware Then click Finish . MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. On the Scanner tab:Make sure the "Perform Quick Scan " option is selected. Then click on the Scan button. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. The scan will begin and "Scan in progress When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found Click OK to close the message box and continue with the removal process. Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found. Make sure that everything is checked Remove Selected . When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below) The log is automatically saved and can be viewed by clicking the Logs tab in MBAM. Copy and paste the contents of that report in your post and exit MBAM. Note : If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.Step 4 Download OTL if you have problems, try this download link :OTL Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output Minimal Output . Check the boxes beside LOP Check and Purity Check .
Now copy the lines in the codebox below. netsvcs right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste . Click the Run Scan Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt . These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply. Note:Running the above script with OTL will turn on your system restore and set a new restore point (XP only) Step 5 Please download
GMER from one of the following locations and save it to your desktop:
Main Mirror This version will download a randomly named file (Recommended) Zipped Mirror This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop. Disconnect from the Internet and close all running programs. Temporarily disable any real-time active protection Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked. Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe. GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress) If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO . Now click the Scan button. If you see a rootkit warning window, click OK. When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log . Click the Copy button and paste the results into your next reply. Exit GMER and re-enable all active protection when done. If you encounter any problems, try running GMER in Safe Mode .
Then please wait for your thread to be answered.
Please
do not 'bump' your thread... if we see more than 0 replies we may think that someone has already answered you.
Please do not post a ComboFix report unless asked to by a member of the Malware Hunters group .
To summarize :
In your post, please supply:
MBAM scan report and
Extras.Txt .
If you have any problems running any of the above requests, please inform the helper that replies to you.
Thanks
Note:We don't accept HijackThis logs in your (1st) post, instead our Malware Hunters staff will demand an OTL log. 
AuthorTopic: How to post for malware removal help (Read 2821 times)
 
  
