I'm on my mom's laptop, because EVEN though the guide is practically idiot-proof, she needs help. I walked her through the scanning process and all the logs are attached. She says that after she updated her JRE that she got these wierd messages, I didn't GET to see the actual messages, but she googled the file in question, a .dll (very helpful), and she read it was a virus. I did the scans and MBAM and SAS both picked up viruses, so it's probably not completely clean right now even after scanning/fixing. I can get any other required information as needed.

We followed ALL the steps, including JRE 6 - 17.

[Saving space, attachment deleted by admin]If you already have ComboFix be sure to delete it and download a new copy.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your ANTIVIRUS and any antispyware REAL time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.
Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFixSomething really bad happened after finishing the combofix scan. She can't get on IE because when she runs it, she gets an Illegal operation error due to a registry key marked for deletion. The shortcut on the desktop does nothing and the one in the start menu says the same, but then after it says "The item you selecte is unavailable. It might have been moved, renamed, or removed. Do you want to remove it from the list?"

She has no other browsers, but I can probably get firefox portable on it.

FF portable gets the same error message as trying to run IE from the quick launch. Nevermind...she just did a factory restore. A restore won't get rid of malware.

Did CF create a log you can post? Look in C:\combofix.txtQuote from: evilfantasy on November 22, 2009, 06:47:23 PM

A restore won't get rid of malware.

Did CF create a log you can post? Look in C:\combofix.txt

Yes you should be good to go. I would run an online scan from BitDefender or ESET just to be sure.