setup files of games opens with dos application..it just pops up and closes..so please can someone help me..i cant play any games..

THANK YOU

Hi, Arun1989 Welcome to PCHF

You may have a malware issue, please contact crush for the prework..

Thanks Codex. I'll move this over to the New HJT forum now.

Arun,

If you could please do the following:

Read this before doing Prework:
http://www.pchelpforum.com/new-hijac...tructions.html

After that:



First: read the following article, and follow suggestions/instructions if required

Warnings Regarding P2P Sharing Sites

Next Please Do the Following:


1. Set System and Hidden files and folders to show:

For Vista:

• Click the (Vista Icon) and click on Computer.
• Click Organize and click on Folder and Search Options.
• Click on the View tab.
• Un-check the Hide Protected Operating System Files (Recommended) box.
• Under Hidden files and folders, click Show hidden files and folders.
• If you see a warning message, click Yes.
• Click Apply.
• Click OK.

For XP:

• Right-Click My Computer choose Explore, click on Tools, Folder Options.
• Click the View tab.
• Place a tick next to Display content of System folders, (answer OK to warnings)
• Under Hidden files and folders, click Show hidden files and folders.
• If you see a warning message, click Yes.
• Click Apply.
• Click OK.

For 98/2000/ME:

• Double-click the My Computer icon
• Click on the View menu, click Folder Options
• Advanced Settings box, under the "Hidden files" folder, click Show all files.
• If you see a warning message, click Yes.
• Click Apply.
• Click OK.

2. Disable System Restore to prevent re-infection.
(If you have/use it.)

Vista:

• Click the (Vista Icon) and right click on Computer and select Properties.
• Click on System Protection (click OK if you are prompted with a warning).
• Un-check all of the boxes in the list of Available Disks for Automatic Restore Points.
• Click Apply.
• Click OK.

WinXP.

• Click the Start button.
• Right-click My Computer, and then click Properties.
• On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives.

WinME.

• Click Start > Settings > Control Panel.
• Double-click the System icon.
• If the System icon is not visible, click View all Control Panel options to display it.
• On the Performance tab, click File System.
• On the Troubleshooting tab check Disable System Restore.
• Click OK. Click Yes, when you are prompted to restart Windows.

3. Please download and run Malwarebytes as follows.

• Please download Malwarebytes' Anti-Malware from one of these places:
  • Majorgeeks.com
  • besttechie.net
• Double Click mbam-setup.exe to install the application.
• Make sure a check-mark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.(The scan may take some time to finish,so please be patient.)
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply along with the HijackThis log.

Please Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

4. Download and Run HijackThis! (HJT) from Trend Micro

First download the newest version of HijackThis! from either
Bleeping Computers or
Trend Micro

Save the file to your desktop, when you run HJT make sure that you install it into it's own folder, otherwise it will install as a temp location and will not give you accurate information.

Click on Run Scanner and Save a Log File
When it has finished, a text file will have been saved, copy and paste the entire log back into your thread. Do not attempt to fix anything yourself with HijackThis! it can cause very serious damage to your computer and programs. Wait until you are given instructions by one of the Security Team.

Please do not follow any instructions from any user or staff member other than those listed in the Please Read Before Following Advice thread.


We have an excellent Security Team, and will take the time and effort to assist you according to your technical abilities. Please feel free to ask for any clarification, guidance or information that you may need. That's what we're here for.

After all that is done please follow up with the following:

Run both these programs.


Please download Malwarebytes' Anti-Malware from one of these places:

|MG| Malwarebytes Anti-Malware 1.31

http://www.besttechie.net/tools/mbam-setup.exe


Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, navigate to the Update tab and click Check For Updates. It will then download the latest updates for you
* Now navigate back to the Scan tab
* Select "Perform Full Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire report in your next reply along with a fresh HijackThis log.

Please Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.


================================================== ===================================

================================================== ===================================


Ok. Lets download ComboFix.exe. This will give me a better view to the files running and also hidden on your computer and also those in the registry..Please download from one of these webpages .

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe


* IMPORTANT !!! Save ComboFix.exe to your Desktop


Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools.

Double-click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Recovery Console can be installed from your disc if you have Vista if you wish.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes to continue scanning for malware.

When finished, it shall produce a log for you. Please include the HJT log prior to everything, MBAM log, C:\ComboFix.txt, and HJT log after running everything in your next reply.

Regards,
Crush
PCHF Security Team

Thanks alot guys

That's all clean. Just do this and I'll move you back out to another forum for evaluation:

This will clear away any of the files and folders that were created by ComboFix.

Go to :
Start > Run then copy and paste the following highlighted text below and click OK.



When ComboFix receives such an instruction, it will do the following:

a) Deletes the following files/folders:
* ComboFix.exe
* %system%\swxcacls.exe
* %system%\swsc.exe
* %system%\VFind.exe
* %system%\moveex.exe
* %system%\swreg.exe
* %systemroot%\catchme.exe
* \ComboFix
* \Qoobox
* \VundoFix Backups
* \Deckard
* \_OTMoveIt
* %systemroot%\erdnt\subs
b) Resets the clock settings.
c) Hides file extensions
d) Hides System/Hidden files
e) Clears System Restore cache and create new Restore point

As you can see, when using the uninstall switch there is no need to instruct the user to rehide system files/folders, nor flush the System Restore.

**Note**

As listed above, the %systemroot%\erdnt\subs will be deleted as well.

Be absolutely certain the thread is resolved before using /u. Should the system go 'south' for some reason, you'll no longer have the erunt backup to invoke.

Thanks Crush, i appologize

Ok..i uninstalled combofix as per your instructions....but the problem is not resolved..