Alright, here we go...

It all started this morning when I started up my laptop and felt like getting back into some Neverwinter Nights 2. Having just woken up, and being extremely lazy, I DECIDED I didn't want to go searching for the disc (that I legally own). I headed over to Game Copy World to find a No-CD fixed EXE, when a veritable smorgasbord of pop-ups filled my screen. I thought 'Oh great, some ad-ware' and fired up AVG 8, which is when all my problems began.

The Windows Security Center icon flashed red in the system tray and told me that my firewall, automatic updates, and virus protection had all been turned off. I clicked the balloon, hoping to remedy the problem. As the Security Center popped up, it's window border kept flashing, as if it was losing focus and regaining it, on the order of once or twice per second. I put everything back the way it was and exited hastily.

Now back in AVG, it couldn't connect to the update server, then all the different components of AVG started shutting down and starting up on their own. After it finished it's little fit, I went ahead with the SCAN, which showed me a Trojan by the name of SHeur2.GAS mascarading as csrssc.exe in my Temp folder. After moving the file and it's associated registry key to the virus vault, it prompted me to reboot, which I did.

After the reboot, I proceeded on to Firefox to learn some more about SHeur2.GAS, which a) led me to this forum, and b) showed that I definitely did not cure the entire infection as after I clicked the link to this forum, I was instead redirected to some advertisement page which spawned a number of pop-ups. Cue exiting Firefox upon noticing that my network download speed was maintaining a steady 60k/sec with no Internet activity on my part. I also disabled all network connections to my laptop, and am now broadcasting from my roommate's PC.

I read the topic regarding what to do before posting and here are all the necessary logs.

I only hope the specialists see fit to smile upon me in my time of need.

[attachment deleted by admin]Welcome to CH.

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
- O20 - AppInit_DLLs: avgrsstx.dll cghckd.dll
- O20 - Winlogon Notify: khfEtSlM - khfEtSlM.dll (file missing)

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

NOTE: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Go to Start > Run and type notepad.exe then click OK

Copy and paste the below into Notepad and save as fixme.reg to Your Desktop

Code: [Select]REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"Alcmtr"=-
Locate fixme.reg on your Desktop and double-click it. Answer Yes when prompted to merge with the Registry.

Make sure that you tell me if you receive a success message about adding the above to the registry. If you do not get a success message, it did not work.

Delete the fixme.reg from the Desktop.

----------

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.

For Windows XP Systems install the Recovery Console:

- If you are using Windows XP and do not already have the Recovery Console installed, please ensure your Internet connection is active (if possible) and click Yes.
- If for some reason your Internet is not working click No.
- If you are not using Windows XP, you will not be prompted.
- When prompted to accept the EULA click OK.
- Accept Microsoft's EULA (Click Yes).
- When you are told that the RC is installed correctly click YES to continue scanning for malware.

When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is COMPLETE.So far, so good! The registry edit worked and ComboFix ran through to completion, so here is the log.

[attachment deleted by admin]Download the OTMoveIt3 by OldTimer

Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator.

* Save it to your Desktop.
* Double-click OTMoveIt3.exe to run it.
* Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

Code: [Select]:Processes
explorer.exe

:services

:reg

:files
d:\windows\Tasks\mqrhbrgx.job

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

* Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
* Click the red Moveit! button.
* Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. If not, reboot anyway.

----------

Run the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Looks good. Only one file REMOVED. Is the computer running OK now?


• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.
• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.
.
----------

1. Double click

• When finished exit out of OTMoveIt3

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.