Hey Scott - that looks better.

Do you know what this is?
C:\ELEVATOR
What's in the folder?


Let's go ahead and remove Combofix and the files/folders it created:

• Click Start > Run

Not Quite! Still some baddies remaining - please do the following:
-- Please delete your copy of ComboFix and download a fresh one to your Desktop
-- Download the attached file CFScript.txt to...

I'm not sure what you are referring to - You don't want to install a service pack. We need the appropriate Recovery Console download for your machine.

Most likely this one :...

Hi Scott,

-- So the Recovery Console installed with no trouble?

Open a command prompt and type:

"%userprofile%\desktop\combofix.exe" /KillAll

Note ---> ix.exe"<space> /Kil

Actually, that's good - no need to see it.

Are you able to move the renamed combofix to the desktop?
If so, please follow the steps in this linky to manually install the Recovery Console...

Let's try something different first:
Please Download Win32kDiag from a linky below and place it on the Desktop of the ill compy.
• http://ad13.geekstogo.com/Win32kDiag.exe...

That's great! Congrats :)



-- Are you still able to transfer programs to the ill computer?
-- Are you able to get a command prompt on the ill computer?

Can you do this:
Download all...

^^^What she said!!

Actually, though, in your case I think a reformat was the right way to go - I was just a bit leery of the homemade XP CD.

Glad it all worked out OK :)

PP

Do you have a utility on the compy to burn recovery media from this partition? It would probably be START > All Programs > Tools or Accessories, if not obvious....

That would be best, if you are...

Great - No rush.
I imagine you'll be pretty busy :)

I, or one of the other volunteers, will be happy to help once you are ready.

PP

Do you need a second partition?

Is d:\ your original recovery partition?

Congratulations :)

See if you are able to download the attached FindWPP.zip and Extract the FindWpp Folder from the ZIP to your Desktop.
In the FindWPP folder, you'll see RunThis.bat.
Run it, if...

You're not going to ruin anything. Worse comes to worse, you can buy a legit OS CD and use that.
All you are doing is wiping the hard drive - no worries. If you run into problems with your current...

I'd rather try a bootable recovery console, than the homemade XP CD, to be honest. Very leery of that.
With the recovery console, we could repair MBR and Boot.ini.
Unfortunately, my time is very...

Hang on for a bit and let me go over the thread and try to answer those questions :)

Will post them shortly.

HA! I know - same here!
Hey - at least I learned some things along the way about Vista and Laptop touchpad sensitivity....... I'm sure they will come in handy down the road for people with similar...

These are Rootkit Revealer remnants - not baddies, but you'd think it'd clean up after itself a bit....

I'm really limited on time at the moment - what issues are remaining?

PP:)

Well . . . . I didn't think of it either . . . .

Happy to have been of service :)

I feel a tinge of regret in saying this, but it appears the Ulysses of Daniweb threads has come to a close....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:31:46, on 29/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
...

-- What do you mean by that - what happens when you try?
(tap F8 on restart)

-- Don't panic just yet :)
While a reformat is generally best in these cases, I suspect you may run into problems...

You're welcome :)

-- I was talking to a friend and she mentioned she had a similar problem with her laptop cursor jumping around and it was due to her touchpad.
In your control panel / mouse...

Yes - That is normal. No worries. Just let it run and delete the baddies it is unable to neutralize.

-- Can you attach that Zip from AVPTool for me please.

Since combofix can't run and MBAM...

That is not the proper procedure. We like to operate under the assumption that "an infected restore point is better than none at all" in the event that the repair process goes awry and we need to...

Did you reboot and try combofix?



If that doesn't work, let's try another powerful tool:
Please Download Kaspersky's AVP Tool (http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/)

--...

What's the setup.exe from?

At this point, I am not sure what to tell you - there are so many different areas to investigate that it would not really be feasible to do that in a forum setting.
The...

OK - Let's have a whack at this AVG:

Please download the attached RemAVG.zip and extract RemAVG.reg from the Zip to your desktop.
-- DoubleClick on RemAVG.reg and allow the contents to merge...

Great!

Now, do the Avenger step from post #57 and see if combofix will run.

Let me know how you fare.

PP:)

I am going to be away from the computer for a while, so I'll assume you were able to copy atapi.sys to C:\atapi.sys as in post #56.


If it is not still on the ill machine, please download The...

It may not allow you to do so. No worries - we'll do it a different way.

-- Open task manager and see if you can stop svchust.exe from running. Note the spelling.
Let me know.

-- Also, try...

I've got to run, so I'll assume you can get a command prompt.

Let's do this:

Open a command prompt and type the following exactly as I have posted it. Copy and paste would be better so you...

Well . . .I need to update that a bit LOL!

Anyhoo, I think it shows enough to get started.


Are you able to get a command prompt on the ill computer?
START > RUN > Type cmd OK

PP:)

No worries! I'll be around.

PP:)

Great - I'll post some removal steps late tonight or Monday to remove the AVG stuff from registry.

PP:)

Please do.

It will make removing it easier ( yeah - I know I'll probably regret saying that.....)

PP:)

LOL!
I was trying to reply the other day, but I couldn't access the thread - got some sort of phpbb error (I think) . . .

PP:)

Is that the whole thing?

I figured there'd be more - no worries if not.

PP:)

Well . . . Unfortunately it is not very lucrative at the moment :)


Luckily for you, we are not nearly as overwhelmed as some other forums.
I have a friend who runs a popular forum and they are...

There are a number of different ways malware accomplishes this. Lately, modifications to legit files along with some rootkitted components seems to be the method of choice.

In your case, atapi.sys...

Are you able to download the attached FindWPP.zip and Extract the FindWPP Folder from the ZIP and place it on your ill computer?

If so, do that and then open the FindWPP Folder and run RunThis.bat...

It shows in your DDS Attach log:
iTunes
Java(TM) 6 Update 15
Junk Mail filter update

Any trouble installing the updated version?


No worries - we can deal with that. Did you try to delete...