Need Help - AntiMalware Doctor

[Untouch]

AntiMalware Doctor
This f**ker got on my computer and is driving me crazy.
I've tried going through deleting it to remove it but he keeps coming back
Any help?

[Reality]

Boot into Safe Mode with Networking

• Download MalwareBytes' Anti-Malware. Save it to your desktop
  
• Run mbam-setup.exe
  
• Go through the installation and at the end make sure 'Launch' and 'Update' are checked off.
  
• When it is finished updating, run a full scan. Remove any infections and post the log it generates, after rebooting.
  

Safe Mode:

Windows XP:

Restart your computer and hold down F8. When given the option, Select Safe Mode with Networking

--

Windows Vista & 7:

Restart your computer and tap F8. When given the option, Select Safe Mode with Networking.

---

If it tells you that MalwareBytes' is infected, rename it to 'scanner.exe' and run it.

[Untouch]

Yeah I did some research and found a program to stop the virus and the program you stated I found too.
I have been running a full scan, been going for just over 40mins and it detected 12 infections so far.
Only got this laptop 2 weeks ago.
Dam McAfee never got ride of it, blocked it or detected it.

[Reality]

McAfee won't find it because it's recommended you use mbam to get rid of it.

You might have some proxy problems after it's over so I'll use my noob skills to help you

Got some tricks

---

Also, you should know that you can get a virus like this whenever, it's known as a Rogue Anti Virus and it usually exploits infected websites so when you go to them, it backdoors (? @backdoor), just my guess for backdoor, but it usually comes from if you click bad ads, etc.

[Untouch]

Ok here we go:

Spoiler (Click to View)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4595

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11/09/2010 23:57:26
mbam-log-2010-09-11 (23-57-26).txt

Scan type: Full scan (C:\|Q:\|)
Objects scanned: 293033
Time elapsed: 52 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 17

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\OTGV1DNWQQ (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\YXE7DXCQ37 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mediafix70700en02.exe (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{499de96b-3e13-7efb-e0c3-14c2227ccf07} (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yxe7dxcq37 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Peter\AppData\Roaming\2E6C5AEB0A74A68919A38810C4B77857\mediafix70700en02.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XRW71MNW\mediafix70700en02[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\1biq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\Dhb.exe (Spyware.Zbot.SI) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\Dhc.exe (Spyware.Zbot.SI) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\Dhd.exe (Spyware.Zbot.SI) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\Dhe.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\Dhf.exe (Trojan.Downloader) -> Delete on reboot.
C:\Users\Peter\AppData\Local\Temp\Dhg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\onxwrcmsea.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.
C:\Users\Public\Documents\Server\sphlp.dll (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\0.5303293974979855.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Roaming\Huga\ovse.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.
C:\Users\Peter\AppData\Local\Temp\Dhh.exe (Trojan.FakeAlert) -> Delete on reboot.

It seems to have worked. Hope it has.

[Reality]

Just want to see this log for my use only, possibly yours if something shows that I'm looking for:

Download HiJackThis.

• Save it to your desktop and run the installer
  
• When the installation is completed, run it as administrator (Vista/Win7), and do a System Scan and Save a Log File
  
• When the scan is completed (takes about 2 seconds), it will produce hijackthis.txt. Copy the contents of the file and paste them on PasteBin.
  
• Paste the URL Pastebin gives you in that thread and wait to be helped
  

[Untouch]

Would you like me paste it here or in a pm?
The link that is.

[Reality]

Just post it here. You don't need to fix any lines though.

[Untouch]

http://pastebin.com/GuU5axbq

[Reality]

Alright

Looks fine to me. I was looking for Proxy Settings in there, wasn't a bad line about it