[Elmer Fudd]

Originally Posted by evilfantasy

I am concerned over this entry C:\WINDOWS\system32\antiwpa.dll <<Do you know what it is?

No I don't, it's an old computer given to me recently by someone I used to work with. Memory is only 20GB total, shows how old it is ! Used by his son, I've cleared a load of crap out over the last few weeks but can't get round this.

[evilfantasy]

You have a virus that is very new. It takes legit .exe files and modifies them. We will do this process but sometimes it takes multiple passes to get them all.



Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.

• Click Start , then Run
• Type notepad.exe in the Run Box.

2. Copy the quoted text below by highlighting all the text and pressing Ctrl+C

RenV::
C:\Program Files\McAfee\MBK\McAfeeDataBackup .exe
C:\Program Files\McAfee.com\Agent\mcagent .exe
C:\Program Files\SiteAdvisor\6253\SiteAdv .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbxyaaw]

3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick combofix's window while it is running. That may cause your system to freeze

----------

Run a new Hijackthis scan and post the log.

----------

Next post
Combofix log
New Hijackthis log

[evilfantasy]

Originally Posted by Elmer Fudd

No I don't, it's an old computer given to me recently by someone I used to work with. Memory is only 20GB total, shows how old it is ! Used by his son, I've cleared a load of crap out over the last few weeks but can't get round this.

It is a tool used for illegitimate purposes. We will take care of that next.