[KbkAK]

While scan is in progress, i'll ask, do you know whats the reason of such behaviour of PC?

[evilfantasy]

From the logs it looks like you had ran into Vundo, Trojans and a few other bad guys.

[KbkAK]

God damn it! I cant even complete this online scan, because it freezed again, and it was like 60% complete. But from what i saw, the C drive had 2 threats, any other way to speed this scan up? What should i do?

[evilfantasy]

You can run this one in Safe Mode to give it a better chance at completing.

Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start
• An information notice will appear, click OK.
• This starts a short scan that will scan the files currently running in memory.
• If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
• If or when something is found, click the Yes button when it asks you if you want to cure it.

• Once the short scan has finished, Click Settings > Change Settings
• Under the Scanning tab UNcheck Heuristic analysis and click OK
• Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
• Click Yes to all if it asks if you want to cure/move any file(s).
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
• Save the DrWeb.csv report to your Desktop.
• Exit Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

* After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
* Copy and paste that log in the next reply

[KbkAK]

Hello, freshly "baked" log:
A0235535.exe;C:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP226;Trojan.Recycle;Usunięty.;
A0235536.exe\data018;C:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP226\A0235536.exe;Adware.SearchAid. 40;;
A0235536.exe/data025\data005;C:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP226\A0235536.exe/data025;Adware.Msearch;;
data025;C:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP226;Kontener zawiera zainfekowane obiekty;;
A0235536.exe;C:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP226;Archiwum zawierające zainfekowane obiekty;Przeniesiony.;
A0235537.reg;C:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP226;Trojan.StartPage.1505;Usunięty .;
kps.godfather.exe\data002;D:\GF\kps.godfather.exe; Tool.DiskHide;;
kps.godfather.exe;D:\GF;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
morpheustoolbar.exe/data001\data006;D:\Morpheus\morpheustoolbar.exe/data001;Adware.Msearch;;
data001;D:\Morpheus;Kontener zawiera zainfekowane obiekty;;
morpheustoolbar.exe;D:\Morpheus;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
ctfmon.exe;D:\Recycled;Trojan.Recycle;Usunięty.;
A0235794.exe\data002;D:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227\A0235794.exe;Tool.DiskHide;;
A0235794.exe;D:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
A0235795.exe/data001\data006;D:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227\A0235795.exe/data001;Adware.Msearch;;
data001;D:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227;Kontener zawiera zainfekowane obiekty;;
A0235795.exe;D:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
A0235796.exe;D:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227;Trojan.Recycle;Usunięty.;
sd4hide.exe;D:\THE GODFATHER;Tool.DiskHide;;
ctfmon.exe;E:\Recycled;Trojan.Recycle;Usunięty.;
A0236476.exe;E:\System Volume Information\_restore{3EF520F9-2866-4353-9EB3-182722F47AEC}\RP227;Trojan.Recycle;Usunięty.;
Usunięty means deleted, Przeniesiony means Moved

[evilfantasy]

That found a few things and removed or fixed them. Is the computer running any better now?

[KbkAK]

Slightly, now i can open drives (earlier i had to right click>explore). But its still freezing, forcing me to reboot.

[evilfantasy]

Download ATF Cleaner by Atribune to your Desktop.

Alternate download link

Note: Vista users must use Run As Administrator

• Under Main: Select Files to Delete choose: Select All.
• Click the Empty Selected button.
• If you use Firefox browser click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
• If you use Opera browser click Opera at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords click No at the prompt.
• Click Exit on the Main menu to close the program.

Note that your system will run slower for a reboot or two after having used this tool so don't panic.

Important: Restart the computer before continuing.

----------

Any changes now?

.

[KbkAK]

No, still cant log onto MSN, and i think it will freeze again soon. You must admit, thats some weird stuff.

[evilfantasy]

Reset settings for Internet Explorer 6

Reset Explorer Settings IE 6

Default Security Settings

For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press Enter. When Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

*Internet
*Local Intranet
*Trusted Sites
*Restricted Sites.

Click OK to exit.

Any changes?