So first let me show a screenshot.
http://i239.photobucket.com/albums/ff65/Monosuke/HELPFFS.jpg
As you see on the left side it is placing porn on my desktop somehow. Not quite sure how. Also I got get of police pro just now. I couldn't find it in my registry when i follow the instructions located here:
Now I am a relative novice as far as computers go so here I go.
When I used combo-fix this is the .txt file that was updated so I think this is the right thing:
32788R22FWJFW\PEV.exe UZIP 32788R22FWJFW\License\pv_5_2_2.zip 32788R22FWJFW\
32788R22FWJFW\PV.exe -kf *.pif
Killing '*.pif'
pv: No matching processes found
MOVE /Y 32788R22FWJFW\PV.exe 32788R22FWJFW\PV.cfexe
32788R22FWJFW\PV.cfexe -kf *.pif
Killing '*.pif'
"C:\32788R22FWJFW\n.pif" cmdwait 2500 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd (4936)
PUSHD "C:\32788R22FWJFW"
IF NOT EXIST pev.cfexe COPY /Y pev.exe pev.cfexe
1 file(s) copied.
IF NOT EXIST NircmdB.exe COPY /Y Nircmd.cfexe NircmdB.exe
1 file(s) copied.
SET "Comspec=C:\WINDOWS\system32\cmd.execf"
IF NOT EXIST C:\WINDOWS\system32\cmd.exe GOTO Not_NT
IF EXIST OsVer EXIT
VER 1>OsVer
GREP.cfexe -F "5.2." OsVer
IF 1 == 0 GOTO Not_NT
GREP.cfexe -F "5.1.2" OsVer 1>XP.mac
IF 0 == 0 GOTO NT
GREP.cfexe -isq "ProductType.*WinNT" WinNT00 || GOTO Not_NT
SED.CFEXE "/^PATH=/I!d; s///; s/\x22//g" Oripath 1>OriPath00
PEV.EXE -rtf -s+901 .\OriPath00 && (
SED.CFEXE -r "s/\x22//g; s/(.{900}).*/\1/; s/;[^;]*$//" OriPath00 1>OriPath01
FOR /F "TOKENS=*" %G IN (OriPath01) DO @SET "PATH=C:\32788R22FWJFW;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;%G"
)
IF NOT EXIST OriPath01 FOR /F "TOKENS=*" %G IN (OriPath00) DO SET "PATH=C:\32788R22FWJFW;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;%G"
SET "PATH=C:\32788R22FWJFW;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem"
Killing 'runonce.exe'
Killing 'grpconv.exe'
Killing 'procmon.exe'
pv: No matching processes found
PEV -rtf --c:##5# .\* and { License.exe or 32788R22FWJFW.exe or OsVer.exe or WinNT.exe or N_.exe } 1>temp00 && (
PV -o%f * 1>temp01
PEV -tf -t!o --files:temp01 --c:##5#b#f# 1>temp02
GREP -Fif temp00 temp02 1>temp03
SED "/.* /!d; s///" temp03 1>temp04
SED ":a; $!N; s/\n/\x22 \x22/; ta; s/.*/\x22&\x22/" temp04 1>temp05
FOR /F "TOKENS=*" %G IN (temp05) DO @NIRCMD KILLPROCESS %G
)
CALL :MDCheck
Could Not Find C:\32788R22FWJFW\md5sum00.pif
PEV -rtf -md53A36F2E3123203B4DD38D95B03356EEB .\md5sum.pif || CALL :MDFaiL ChkSum_Fail
.\md5sum.pif
PEV -tf --files:files.pif --c:##5#b#f# 1>mdCheck00.dat
GREP -vs "^!MD5:" mdCheck00.dat 1>mdCheck0a.dat
GREP -Fvf md5sum.pif mdCheck0a.dat 1>mdCheck01.dat && CALL :MDFaiL
GOTO :EOF
=============================================
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Robby\Application Data
CFLDR=32788R22FWJFW
Chksum=3A36F2E3123203B4DD38D95B03356EEB
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=ROB
ComSpec=C:\WINDOWS\system32\cmd.execf
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Robby
KMD=CF4194.exe
LOGONSERVER=\\ROB
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=C:\32788R22FWJFW;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem
PATHEXT=.CFEXE;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 11, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0b
ProgramFiles=C:\Program Files
PROMPT=$
Qrntn=C:\Qoobox\Quarantine
QTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip
RKEY_=hklm\software\microsoft\windows nt\currentversion\windows
SESSIONNAME=Console
sfxcmd="C:\Documents and Settings\Robby\Desktop\combo-fix.exe"
sfxname=C:\Documents and Settings\Robby\Desktop\combo-fix.exe
SYSTEM=C:\WINDOWS\system32
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Robby\LOCALS~1\Temp
TMP=C:\DOCUME~1\Robby\LOCALS~1\Temp
USERDOMAIN=ROB
USERNAME=Robby
USERPROFILE=C:\Documents and Settings\Robby
windir=C:\WINDOWS
=============================================
IF NOT DEFINED sfxname GOTO END
GREP -F \ temp01 && CALL :Aux
ATTRIB.EXE +R "C:\Documents and Settings\Robby\Desktop\combo-fix.exe"
GREP -Fi "C:\WINDOWS\system32\userinit.exe" Userinit00 || (SWREG ADD "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "C:\WINDOWS\system32\userinit.exe," )
Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
CALL LANG.bat
I am still attempting as I write this to get HiJackthis to work. I'm not sure why it isn't opening. I went to the intial HJACKTHIS file and it will not open and tells me I don't have the correct permissions, so I deleted it and redownloaded it.
Okay so I got it reinstalled started to run it then it closed on me after I clicked run+save log. Lasted all of 5-7 seconds. I attempted to reopen it and it gave me a permissions blurb again.
