Will_Raleigh

Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.28.07 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 Raleigh :: KEEP [administrator] Protection: Enabled 7/28/2012 8:44:55 PM mbam-log-2012-07-28 (20-44-55).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 245990 Time elapsed: 6 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Thank you very much. It's back.

As per your instructions, here is the log from Combofix. Still no recycle bin, I'm beginning to think its being held hostage. log.txt

Ok done. Here is the new .txt file. No recycling bin though. TDSSKiller.2.7.48.0_26.07.2012_13.54.39_log.txt

Ok that worked. It found something in my MBR. It says it can not cure the MBR and asks to write a standard boot code. I clicked no because Im not sure if this should be done. It also said I'd need to reinstall any custom boot loaders. But I don't have anything like that as all I have instaled is windows XP. TDSSKiller.2.7.48.0_26.07.2012_13.37.29_log.txt

I've rebooted and tried again normally. I've also tried running it from safe mode and renaming it. In safe mode it will ask me if I want to run it or cancel, I choose run and then nothing happens.

After downloading tdskiller, I double clicked on it and nothing happens. No install wizard or pop-ups like are shown in your post.

Unhide has put the files back into there proper place. Thank you for that. I still seem to be missing my recycling bin, maybe it got recycled? heh RKreport1.txt

My computer was infected today by this malware. I ran malware bytes and it found the following items: Registry Values Detected: 1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|GpsloETRwVekmjv.exe (Trojan.FakeAlert.3CH) -> Data: C:\Documents and Settings\All Users\Application Data\GpsloETRwVekmjv.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 6 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Documents and Settings\All Users\Application Data\GpsloETRwVekmjv.exe (Trojan.FakeAlert.3CH) -> Delete on reboot. A further scan has come up clean but I am still missing icons in my start menu folders and I seem to have lost my recycle bin as well as the icons above the programs in the start menu, such as windows update. I was able to unhide most of the files and folders but the rest of them are still "missing". Any help you could render would be very much appreciated. Thank you P.S. Avast did not pick this up and it was fully up to date. dds.txt attach.txt