Support Forums

Quote:@echo off
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
del %0

• Click Start and navigate to Control Panel.
  If you are in Classic View:
  
  1. Click on Folder Options
     
  2. On the View tab, uncheck the following:
     • Hide file extensions for known file types
       
     • Hide protected operating system files (Recommended)
  3. Click Yes on the warning message.
     
  4. Under Hidden files and folders, check Show hidden files and folders.
     
  5. Click Apply to All Folders.
     
  6. Click OK.
  • If you are in Control Panel Home View:
    
    1. Click on Appearance and Personalization > Show Hidden Files or Folders.
       
    2. On the View tab, uncheck the following:
       • Hide file extensions for known file types
         
       • Hide protected operating system files (Recommended)
    3. Click Yes on the warning message.
       
    4. Under Hidden files and folders, check Show hidden files and folders.
       
    5. Click Apply to All Folders.
       
    6. Click OK.

• Go to 'VirusTotal'.
  
• Click Browse.
  
• Copy and paste the exact file name(s) in bold (if there are more than one file listed, please open multiple tabs) to the address bar located on top of the new window that appeared:
  • c:\windows\system32\deployJava1.dll
    c:\windows\system32\usbaaplrc.dll
    c:\windows\system32\flash_player.exe
    c:\windows\system32\drivers\gkfgefdi.sys
    c:\windows\system32\drivers\TsUsbFlt.sys
• Click Open > Send File.
  
• Copy and paste back the link(s) to the result(s) once VirusTotal has finished scanning the file.

• Save ComboFix to your desktop.
  
• Disable your anti-virus and anti-spyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. If you have difficulty properly disabling your protective programs, refer to 'this' link.
  
• Double-click ComboFix.exe and follow the prompts.
  
• As part of its process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery or repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
• If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
  
  
  

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  
  
  
  
• Click on Yes, to continue scanning for malware.
  
• When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

• A Fresh HijackThis (HJT) Log
  
• ComboFix Log
  
• Doesn't Do Squat (DDS) Logs
  • DDS.txt
    
  • Attach.txt
• VirusTotal Results

• On your desktop, right-click the HijackThis icon and select Properties.
  
• Navigate to the Compatibility tab and put a check on the Run this program as an administrator box.
  
• Click Apply > OK.
  
• HijackThis should prompt you to run it as an administrator every time you open it.

• Save it to your desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the lines inside the Code box below to the Clipboard by highlighting all of the content and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  Code:

  :Processes
explorer.exe

:Files
c:\windows\system32\gvjhu.exe
c:\windows\temp\Lbe.exe
c:\users\tyler\appdata\roaming\8BD3CBF1A238C722473BB8C7B3E545D4
c:\users\tyler\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
c:\windows\system32\drivers\gkfgefdi.sys

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTM, right-click in the Paste Instructions for Items to be Moved window and choose Paste.
  
• Click the red MoveIt! button.
  
• Copy everything in the Results window to the Clipboard by highlighting all of the content and by pressing CTRL + C (or, after highlighting, right-click and choose Copy).
  
• Paste it in your next reply.
  
• Close OTM.

• Save it to your desktop.
  
• Please double-click OTL.exe to run it.
  
• Make sure all other windows are closed to let it run uninterrupted.
  
• Under the Custom Scan box paste this in:
  
  
  Code:

  %systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.sys
%systemroot%\system32\drivers\*.dll
%systemroot%\system32\drivers\*.ini
%systemroot%\system32\drivers\*.exe
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.
%appdata%\*.*
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
disk.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
usbstor.sys
/md5stop
CREATERESTOREPOINT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  
• When the scan completes, it will open two Notepad windows.
  • OTL.txt
    
  • Extras.txt
• These are saved in the same location as OTL.
  
• Please copy (Right-click > Select All > Copy) the contents of these files, one at a time, and post it with your next reply.

• A Fresh HijackThis (HJT) Log
  
• ComboFix Log
  
• Doesn't Do Squat (DDS) Logs
  • DDS.txt
    
  • Attach.txt
• OTL Log
  
• OTM Log

• Try running ComboFix by running this in the Run prompt: "%userprofile%\desktop\combofix.exe"
  
• If you get another BSOD, please do so in Safe Mode.