(10-27-2010, 02:22 PM)Reality Wrote:

Code:

O4 - HKCU\..\Run: [neaoxrscwm.exe] "C:\Users\Peter\AppData\Local\Temp\neaoxrscwm.exe"

There is one part of the infection.

Refer to the thread below in order to clean your computer.

http://www.geekstogo.com/forum/topic/286282-removal-instructions-for-fake-microsoft-security-essentials-alert/

(10-27-2010, 02:27 PM)Reality Wrote: Metallica wouldn't lie about that.

All you can do is wait for Quintus, nobody is allowed to give instructions anymore.

Spoiler (Click to View)

• Step 1
  
  Please run HijackThis. Click 'Do a system scan only' and place a check next to the following line(s) if present:
  
  O4 - HKCU\..\Run: [neaoxrscwm.exe] "C:\Users\Peter\AppData\Local\Temp\neaoxrscwm.exe"
  O4 - HKCU\..\Run: [lFtEnd.exe] C:\Users\Peter\AppData\Local\Temp\lFtEnd.exe
  
  Then, close all other open windows and click 'Fix Checked'. You are to reboot your system afterwards.

• Step 2
  
  Download DDS.scr by sUBs from one of the following links and save it to your Desktop.
  
  'Link 1'
  'Link 2'
  

• • Double-click on DDS.scr and a command window will appear. This is normal.
    
  • Shortly after two logs will appear, DDS.txt and Attach.txt.
    
  • A window will open instructing you save and post the logs. Save the logs to a convenient place such as your Desktop.
    
  • Copy the contents of both logs and post in your next reply.

• In your next post, please provide the following:
  • A Fresh HijackThis (HJT) Log
    
  • Deckard's System Scanner (DDS) Logs
    • DDS.txt
      
    • Attach.txt

• Format of Response
  
  
  Code:

  [color=#00BFFF][b]Step #[/b][/color]
[color=#FFD700][b]Problems Encountered:[/b][/color]

[color=#00BFFF][b]Step #[/b][/color]
[color=#FFD700][b]Problems Encountered:[/b][/color]

[color=#00BFFF][b]Step #[/b][/color]
[color=#FFD700][b]Problems Encountered:[/b][/color]

[color=#00BFFF][b]Link To Requested Logs:[/b][/color]

• Step 3
  
  Please download the OTM File Mover from 'here'. Please click the Go (Arrow Button) or press Enter in the URL address bar to start the download.
  • Save it to your Desktop.
    
  • Please double-click OTM.exe to run it.
    
  • Copy the lines inside the Code box below to the Clipboard by highlighting all of the content and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    
    
    Code:

    :Processes
explorer.exe

:Files
C:\Users\Peter\AppData\Local\Temp\neaoxrscwm.exe
C:\Users\Peter\AppData\Local\Temp\lFtEnd.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• • Return to OTM, right-click in the Paste Instructions for Items to be Moved window and choose Paste.
    
  • Click the red MoveIt! button.
    
  • Copy everything in the Results window to the Clipboard by highlighting all of the content and by pressing CTRL + C (or, after highlighting, right-click and choose Copy).
    
  • Paste it in your next reply.
    
  • Close OTM.
  
  
  Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the moving process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start > All Programs > Accessories > Notepad) and click File > Open. In the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present. Copy and paste the contents of that document back here in your next post.

• Step 4
  
  Please run a free online scan with ESET Online Scanner by downloading ESET Smart Installer 'here'. Save it to your Desktop.

• • Double-click esetsmartinstaller_enu.exe to execute the program.
    
  • Tick 'YES, I accept the Terms of Use'.
    
  • Click 'Start'.
    
  • If this is your first time installing the scanner, allow the 'ActiveX Control' to install.
    
  • Database download may take some time.
    
  • When done, make sure that the option 'Remove found threats' is ticked. Under the and 'Advanced Settings', please put a check on the following options:
    • Scan for potentially unwanted applications
      
    • Enable Anti-Stealth Technology
  • Click 'Start'.
    
  • Wait for the scan to finish.
    
  • Once it is finished, use Notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt.
    
  • Copy and paste that log as a reply to this topic.

• In your next post, please provide the following:
  • A Fresh HijackThis (HJT) Log
    
  • ESET Scan Log
    
  • OTM Log

• Format of Response
  
  
  Code:

  [color=#00BFFF][b]Step #[/b][/color]
[color=#FFD700][b]Problems Encountered:[/b][/color]

[color=#00BFFF][b]Step #[/b][/color]
[color=#FFD700][b]Problems Encountered:[/b][/color]

[color=#00BFFF][b]Step #[/b][/color]
[color=#FFD700][b]Problems Encountered:[/b][/color]

[color=#00BFFF][b]Link To Requested Logs:[/b][/color]

• Comments:
  • I'll check on you tomorrow again.