Name: Kalynn Date: March 20, 2008 at 14:36:10 Pacific Subject: Win32/Zonebac.gen!F won't go away OS: MS WinXP Prof SP2 CPU/Ram: Pentium D 2.80Ghz, 512MB Model/Manufacturer: Dell Precision Workstatio
Comment:
Computer running slow. Have downloaded PC Tools, Webroot Spysweeper w/ AntiVirus. Today I went to Microsoft. Downloaded Windows Live OneCare. It notified me of Win32/Zonebac.gen!F and says it cleans it, but later, it pops back up for cleaning. HELP! (I've seen other postings, but am afraid to follow instr b/c of warning of HijackThis being all inclusive.
Please download and install the latest version of HijackThis v2.0.2:
Download the "HijackThis" Installer from this link: Hijack This
1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Double-click on the FindAWF.exe file to run it. It will open a command prompt and ask you to "Press any key to continue". You will be presented with a Menu. 1. Press 1 then Enter to scan for bak folders 2. Press 2 then Enter to restore files from bak folders 3. Press 3 then Enter to remove bak folders 4. Press 4 then Enter to reset domain zones 5. Press E then Enter to EXIT Press 1 then press Enter. Copy and paste the contents of the AWF.txt file in your next reply.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:48:05 PM, on 3/20/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal
Follow their directions to disable any realtime protection that you have as it will interfere with the fix by reinstalling the corrupt files.
Double-click the FindAWF icon once again If a Security Alert shows, allow the program to run. As instructed, press any key to continue. Use the following option:
Press 2 then Enter to restore files from bak folders A text file opens called: files.txt Copy/paste the following list of bolded files to be restored:
Next, close and click Yes to save the changes. Once files.txt is saved, FindAWF does the following: -It attempts to terminate the process represented by each filename on the list, if running -Deletes the rogue file from the parent folder, if present -Copies the original file to the parent folder When done with the above, it automatically runs a new scan and opens a new log. Please provide the new FindAWF log in your reply.
jabuck, before I do this: I uninstalled Lavasoft & Rising Antivirus about a week or so ago when I started this process. They didn't seem to be detecting anything. How do I get that off for good before I follow your instructions for the RealTime programs???
Double-click the FindAWF icon once again If a Security Alert shows, allow the program to run. As instructed, press any key to continue. Use the following option: Press 3 then Enter to remove bak folders A text file opens called: folders.txt Copy /paste the following list of bolded folders to be removed:
Next, close and click Yes to save the changes. Once folders.txt is saved, FindAWF does the following: -It deletes the contents of the bak folders -Removes the bak folders When done with the above, it automatically runs a new scan and opens a new log. Please provide the new FindAWF log in your reply.
If you uninstalled them in add/remove programs go to C:\Program Files and delete their folders.
You must have an antivirus.
I use the free version of AVG, you can download it at this link: AVG Free Antivirus
The current date is: Thu 03/20/2008 The current time is: 22:17:21.28
bak folders found ~~~~~~~~~~~
Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~
end of report
Jabuck- Thanks for all your help. Does this look good now??? I have antivirus with Webroot Spy Sweeper w/ Antivirus. Is it usually good to have more than one?
Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log it produces.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
After you download it to your desktop and begin installing it only allow the "install icon on desktop" to install . Then run it, use only as suggested, it's powerful use only the prechecked items.
Double-click the FindAWF icon once again If a Security Alert shows, allow the program to run. As instructed, press any key to continue. Use the following option: Press 4 then Enter to reset domain zones This removes all entries from the domain zones. When the program returns to the main menu, use the following option: Press E then Enter to EXIT Next, Launch Notepad, and copy/paste everything between the X's making "regedit4" the very top line. Save in: Desktop File Name: fixme.reg Save as Type: All files Click: Save XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Then, disconnect from the Internet! Next, Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information. Optional if the following programs are in your computer. Note that since the Domains are deleted SpywareBlaster protection must be re-enabled. Spybot's Immunize feature must be used again, also you have to re-install IE-SpyAd if installed. Delete the fixme.reg file just created.
Do I need to turn off my antivirus/antispyware properties to do the above actions? I downloaded Combofix from link 1 and attempted to perform, but my PC Tools said there was a malicious trojan trying to work and stopped it. Please advise. Thanks so much.
Disable any realtime protection that you have (spysweeper, etc) the link in response #3 covers most of them but any other ones need to be turned off or an allowance made for the tools to run.
ComboFix 08-03-21.1 - JMMarcum 2008-03-23 19:41:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.222 [GMT -5:00] Running from: C:\Documents and Settings\JMMarcum\Desktop\ComboFix.exe * Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] .
((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) .
Jabuck, just completed all your instructions. Immediately noticed when logging back onto internet that the forever-there zedo intercept tag thing didn't flash across the bottom. It seems to run quite smoothly. Here's my next question for you. I have a teenager who, despite my repeated instructions, will log onto facebook & myspace. I think that is the source of my problems. How do you feel about those sites? She downloads Itunes as well. Don't want to go thru this again. Any guidance from you concerning surfing habits and what I've just experienced with my computer problems? Thanks so much for your help. It was invaluable to me.
Turn off SpySweeper, Windows Defender, and Spyware Doctor and Ad-Awares "ad-watch"
Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\150.tmp C:\14E.tmp C:\14C.tmp C:\Program Files\page.html C:\Program Files\c.zip C:\Program Files\b.zip C:\Program Files\a.zip C:\Program Files\B.ico C:\Program Files\A.ico
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
After you download it to your desktop and begin installing it only allow the "install icon on desktop" to install . Then run it, use only as suggested, it's powerful use only the prechecked items.
Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component
Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".
--------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, March 23, 2008 11:20:31 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 24/03/2008 Kaspersky Anti-Virus database records: 656785 ---------------------
Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true
Scan Target - My Computer: C:\ D:\
Scan Statistics: Total number of scanned objects: 81743 Number of viruses found: 11 Number of infected objects: 50 Number of suspicious objects: 0 Duration of the scan process: 01:04:59
Infected Object Name / Virus Name / Last Action C:\Backup 1012-2007\old docs and settings\joe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-25ae8293.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped C:\Backup 1012-2007\old docs and settings\joe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-25ae8293.zip ZIP: infected - 1 skipped C:\Backup 1012-2007\Program Files\page.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\1EC.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\1ED.tmp Infected: Trojan-Downloader.Win32.Small.buy skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\1EE.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\1EF.tmp Infected: Trojan-Downloader.Win32.Small.buy skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\1F0.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\1F1.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\20.tmp Infected: Trojan.Win32.Agent.bqn skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\21.tmp Infected: not-a-virus:FraudTool.Win32.BestSeller.c skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\22.tmp Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\23.tmp Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\24.tmp Infected: Trojan.Win32.Agent.bck skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\25.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\26.tmp Infected: Trojan-Downloader.Win32.Adload.lv skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\27.tmp Infected: Trojan.Win32.BHO.hj skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\28.tmp Infected: Trojan.Win32.Agent.bck skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\29.tmp Infected: Trojan.Win32.Agent.bqn skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\2A.tmp Infected: Trojan-Downloader.Win32.Agent.dpn skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\2B.tmp Infected: Trojan-Downloader.Win32.Agent.dpn skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\cwmtafeb.exe Infected: Trojan.Win32.Agent.bck skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\diocujdl.exe Infected: Trojan.Win32.Agent.bck skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\ipodhytc.dll Infected: Trojan.Win32.BHO.hj skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\tsqsofsi.exe Infected: Trojan.Win32.Agent.bck skipped C:\Backup 1012-2007\Program Files\Trend Micro\Internet Security\Quarantine\winable.exe Infected: Trojan-Downloader.Win32.Adload.lv skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-03122008-052256.log Object is locked skipped C:\Documents and Settings\JMMarcum\Cookies\index.dat Object is locked skipped C:\Documents and Settings\JMMarcum\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\JMMarcum\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\JMMarcum\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{DCFC89DF-7C3A-4015-8ED4-A6E7F142AB44} Object is locked skipped C:\Documents and Settings\JMMarcum\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\JMMarcum\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\JMMarcum\NTUSER.DAT Object is locked skipped C:\Documents and Settings\JMMarcum\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\page.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped C:\Program Files\Spyware Doctor\NetworkLayer\InterfaceDLL.txt Object is locked skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\1EC.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\1ED.tmp Infected: Trojan-Downloader.Win32.Small.buy skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\1EE.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\1EF.tmp Infected: Trojan-Downloader.Win32.Small.buy skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\1F0.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\1F1.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\20.tmp Infected: Trojan.Win32.Agent.bqn skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\21.tmp Infected: not-a-virus:FraudTool.Win32.BestSeller.c skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\22.tmp Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\23.tmp Infected: not-a-virus:FraudTool.Win32.BestSeller.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\24.tmp Infected: Trojan.Win32.Agent.bck skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\25.tmp Infected: not-a-virus:Monitor.Win32.PCTattletale.a skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\26.tmp Infected: Trojan-Downloader.Win32.Adload.lv skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\27.tmp Infected: Trojan.Win32.BHO.hj skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\28.tmp Infected: Trojan.Win32.Agent.bck skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\29.tmp Infected: Trojan.Win32.Agent.bqn skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\2A.tmp Infected: Trojan-Downloader.Win32.Agent.dpn skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\2B.tmp Infected: Trojan-Downloader.Win32.Agent.dpn skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\cwmtafeb.exe Infected: Trojan.Win32.Agent.bck skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\diocujdl.exe Infected: Trojan.Win32.Agent.bck skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\ipodhytc.dll Infected: Trojan.Win32.BHO.hj skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\tsqsofsi.exe Infected: Trojan.Win32.Agent.bck skipped C:\Program Files\Trend Micro\Internet Security\Quarantine\winable.exe Infected: Trojan-Downloader.Win32.Adload.lv skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{13E47E20-9E7A-420A-BD5F-05A82D1952DD}\RP241\change.log Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped
ComboFix 08-03-21.1 - JMMarcum 2008-03-23 23:23:30.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.189 [GMT -5:00] Running from: C:\Documents and Settings\JMMarcum\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\JMMarcum\Desktop\CFScript.txt * Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
Jabuck, had a bad virus back in Oct. of last year. So bad computer kept locking up and had to take to local computer guys. They never told me what exactly the virus was. Said they "wiped computer clean" and reloaded old desktop with files back on. Could some of my problems be with that? Just thought I'd give you heads up. Thanks for all your help.
Hello, Jabuck. I posted the requested Scan Report from KASPERSKY ONLINE SCANNER REPORT in Reply #16. I also posted the ComboFix log in Reply #17 as requested. Do I need to do anything further? How does it look? I know just enough to be dangerous with my computer and really appreciate all your help. Hope to hear from you soon as I am holding my computer hostage at home until I complete whatever you suggest I do for it. Thanks so much.
The information on Computing.Net is the opinions of its users. Such
opinions may not be accurate and they are to be used at your own risk.
Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net, LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE
