Hi there Hickoryboyz, welcome to PCHF.


Your pc is very heavily infected, and it would probably be better and faster to format and reinstall windows then to spend alot of time cleaning it all up.

Is that an option for you, to reinstall windows? Or do you want to try and clean it anyway?

Thanks for the reply. I kinda figured that and I'm doing this for a friend, so yes, that is an option and definitely what I'm going to do. Thanks. I just didn't know anything about or how to read hijackthis logs. Good to have confirmation. I'm actually right now using a UBCD for Windows to clean some things, after these cleans I'm going to reboot to see what all is fixed. I'll give i another hour and then I'm reformatting if it isn't drastically better. Later.

HJT Log

Attached Files

hjtlog10_20.txt (4.5 KB, 2 views)

Its looking abit better, but it is still a big mess I'm afraid.

If you want to clean it up then let's start with these:


Step 1. Download AboutBuster 6.0 and unzip it to your desktop.
Step 2. Boot your machine into safe mode (Optional step), recommended.
Step 3. Run AboutBuster 6.0 and select "Begin Removal". Make sure you click "Yes" to every message box that appears.
Step 4. Restart your computer and run AboutBuster one final time.




Please download AVG Anti-Spyware 7.5 (30 day free trial)

• Install AVG Anti-Spyware.
• Double-click the icon on Desktop to launch AVG Anti-Spyware.
• Then on the top of the Status screen click on Shield.
• Click the word active to change it to inactive.
• You will need to update AVG Anti-Spyware to the latest definition files.
• On the top of the main screen click Update.
• Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
• Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Again right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update AVG Anti-Spyware:
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.


When you have finished updating, EXIT AVG Anti-Spyware.
Please reboot your computer into Safe Mode. To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads. Select Safe Mode on the screen that appears.

• In Safe Mode,run AVG Anti-Spyware.
• Click Scanner.
• Click on the Scan tab.
• Click Complete System Scan to begin scanning.
• When the scan is complete click on Custom (Next to "Set all elements to:") and change it to Quarantine.
• Then click Apply all actions.

Once finished, click the Save report button, then click Save Report As. This will create a text file.
Make sure you save it where you know to find it again (like on the Desktop).

The default location for the "report log" is the C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports folder.
(assuming of course your OS is in C:\)


Restart back into Normal Mode.



If AVG Anti-Spyware crashes or hangs:

If during your scan AVG Anti-Spyware "crashes" or "hangs", please try scanning again. Before running the scan, click on 'Scanner' (the 3rd bar from the top on the left) and Choose 'Settings'. Uncheck 'Scan in NTFS Alternate Data Streams' as this can cause problems in overly infected systems. And then run a new scan.



Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found:
• If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously, the AVGas log, and a new HJT log in your next reply.