Nasty virus- need help

Hello, please download and post a log with HiJackThis.

Click here to download HJTsetup.exe
  • Save HJTsetup.exe to your desktop.
  • Double click on the HJTsetup.exe icon on your desktop.
  • By default it will install to C:\Program Files\Hijack This.
  • Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
  • Put a check by Create a desktop icon then click Next again.
  • Continue to follow the rest of the prompts from there.
  • At the final dialogue box click Finish and it will launch Hijack This.
  • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
  • Click Save to save the log file and then the log will open in notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
 
Can you pls run it in normal mode, that way we can see running processes (could be the virus).

thanks.
 
Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • You can also access the log in the Logs tab of Malwarebytes' Anti-Malware.

Please post both the Malwarebytes' Anti-Malware log and a new HijackThis log.
 
well the only solution is to do it normal mode, wait till everything has started up and then do it, also the processors could be the virus running a lot, so it is important that these things are done in normal mode.
 
What happens when you try to copy files to the flash drive? I certainly haven't given up on cleaning your system, though.

Please run HijackThis and choose Do a system scan only.

Place a check next to the following entries:

  • [*]R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/uk/ý
    [*]F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit .exe,C:\WINDOWS\system32\oembios.exe,
    [*]O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - (no file)
    [*]O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    [*]O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
    [*]O4 - HKLM\..\Run: [lphc553j0enft] C:\WINDOWS\system32\lphc553j0enft.exe
    [*]O8 - Extra context menu item: &Search - ?p=ZNfox000
    [*]O20 - Winlogon Notify: nethesen - C:\WINDOWS\
    [*]O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLaun cher.exe (file missing)
Please close all open windows except for HijackThis and choose Fix checked

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
 
You must log in or register to reply here.
Back
Top