Hijack this log-install log-gmer log

Hello and welcome to Malware Removal.

My name is peku006 and I will be helping you to remove any infection(s) that you may have.
I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

Please observe these rules while we work:

• If you don't know or understand something please don't hesitate to ask
• Please DO NOT run any other tools or scans whilst I am helping you.
• It is important that you reply to this thread. Do not start a new topic.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• Absence of symptoms does not mean that everything is clear.

1 - download and run RSIT

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)

2 - Status Check
Please reply with

1.the logs from RSIT (log.txt ,info.txt)

Thanks peku006

Hi ftmyersbuc

did you put this line into your hosts file ?

127.0.0.1 mpa.one.microsoft.com

Please download MGADiag.exe to your Desktop from here:
http://go.microsoft.com/fwlink/?linkid=56062

• Double-click on MGADiag.exe
• When the program has finished, click on the Validation tab and then click on Copy to Clipboard.
• Please post the results in your next reply.

Thanks peku006

Hi ftmyersbuc

Reset Host File w/ Batch file
Note: If you used any custom Hosts (eg. Spybot's Immunize, MVPS Hosts, etc...), you will have to reapply them!

1. Open Notepad.
2. Copy and paste the contents of the box below, into Notepad.
   

   @Echo off
   pushd\windows\system32\drivers\etc
   attrib -h -s -r hosts
   echo 127.0.0.1 localhost>HOSTS
   attrib +r +h +s hosts
   popd
   del %0

3. Using the Command line, select File... then select Save As.
4. Filename = RestHost.bat
5. Save as Type = All Files <<=== important, won't work otherwise.
6. Save the file to your Desktop.
   
   RestHost.bat <<------------- you should see this on your desktop.
7. Double click on the RestHost.bat to execute. The batch file will be deleted when finished.

After that, Reboot.

We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here.

When finished, it will produce a log for you
Please include the C:\ComboFix.txt in your next reply for further review.


Thanks peku006

Hi ftmyersbuc

Ok....

Hi

Did you read this :

ComboFix Recovery Console

Hi ftmyersbuc
Ok......

1. are you using IE? If so, what have you got for the privacy and security options?

2. Try going to Start --> Run then type in cmd and click on Ok. This will bring up the command prompt, here type in netsh winsock reset catalog then after a few seconds it will say that you must restart, type exit, then restart computer and try again.

You cannot log in to or connect to:

and yes ,you can use a CD or flash drive to transfer these files

Hi ftmyersbuc

I am getting a message that my Windows XP may not be valid, so I do not know if you can help me any further. This computer was built by my Husband's friend about 4 years ago, so I don't know if he might have used an invalid or pirated version of windows. Unfortunately, we are not unable to contact him regarding the matter. It doesn't surprise me, however, he always was a wanker. .

you're not the first who bought a computer with a pirated windows.......(who needs enemies, when friends are like that )

If I am still infected, I don't know if it is worth it to buy a legit operating system or just buy a new tower and be done with it.

If you would,I would appreciate you reviewing the log to determine if the malware is gone. If it is gone, then I can go to Microsoft and purchase a valid copy of windows, right?

it seems that combofix deleted the infection........
but I do not know which one is a "cheaper alternative" to genuine windows or a new computer.......your choice...........
(my personal opinion is that the four-year-old computer is really old )

let me know what you want to do........

Thanks peku006

As this issue appears to be resolved, this topic is now closed.

We are pleased to have been some help in getting you clean.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read :
Donations For Malware Removal