Can't visit major security sites, use Norton, or MSN/Gmail..

[Caeliferum]

Can't find the file... Seems it doesn't exist. o_O

[Gecko]

Caeliferum,

I believe where there is a will there is a way, so I will keep trying until we get it.
Here is what I think is going on,
Something is hiding the Wininit.ini and some other things either the spyware or Norton.
In you startuplist log the Wininit.ini is set to rename a file but the entry is too long to read the full path. I think the file that is being renamed is the one that reinstalls the dill file that is the actual spyware.

So lets try replacing the Wininit.ini on reboot and see if we can stop it from renaming the file.

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

First you need to make an empty file, start notepad click file and then Save As.
In the Save In section select your desktop.
In the Save As section click the dropdown and select "All".
In the File Name section name the file Wininit.ini and click save.

Reboot into safe mode

If you get any error(s) just continue with these instructionsto the end

Click start > run and type regsvr32 -u lao.dll and press enter a window will open and tell you if was unregistered.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked.

Now delete the following file:
c:\windows\system32\lao.dll

Start Killbox, type or paste the below into the "File Path of File to Delete" text box:
c:\windows\wininit.ini

Now put a check next to "Replace on reboot" a new text box will now appear bellow the other one.
Click on the folder next to this new text box and browse to your desktop and select the Wininit.ini file that you made.

Next click the red circle with the X in it.
Killbox will tell you that all listed files will be replaced on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

You will loose you internet so use the WinsockFix to get it back.

Once you have the internet back post a new HiJackThis log when you reply.

[Caeliferum]

[Gecko]

[Caeliferum]

Hm, can't delete lao.dll.

[Gecko]

Caeliferum,

I think that we are missing something basic with that in mind I think you should run AVG again in safe mode.

Reboot your computer into SafeMode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning:
1. Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
2. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
3. AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
4. If you have any infections you will prompted, then select "Apply all actions"
5. Next select the "Reports" icon at the top.
6. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
7. Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan in your reply.

[Caeliferum]

[Gecko]

Caeliferum,

Just cookies nothing else

Lets try replacing the Wininit.ini and the lao.dll files on reboot using killbox

Warning these instructions are for this thread only!
You should never attempt to use them for anything else!

Please copy this to Notepad and save it to your desktop or print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any other open windows when you are following the procedures below.

Reboot into safe mode

If you get any error(s) just continue with these instructionsto the end

Start Killbox, put a check next to "Replace on reboot" a new text box will now appear bellow the other one.
Click on the folder next to this new text box and browse to your desktop and select the Wininit.ini file that you made.

Next copy the below red part:

c:\windows\wininit.ini
c:\windows\system32\lao.dll


Click 'File' in the killbox Menu on top and choose Paste from clipboard
Now click the red X icon to replace these files on reboot
Killbox will tell you that all listed files will be replaced on next reboot and asks if you would like to Reboot now, click YES

If you don't get that message, reboot manually.

You will loose your internet so use the WinsockFix to get it back.

Once your system has rebooted post a new HiJackThis log when you reply.

[Caeliferum]

[Gecko]

Caeliferum

Your log is actually clean for the moment

Can you try running the combofix again and see if it works now.

Also look in you root (C:\) and see if you have a file named RootkitReveal.txt if you do can you please post it's contents.

[Caeliferum]

Combofix still isn't working. Says OS is incompatible.

There is such a file there, but it is blank.

[Gecko]

Caeliferum,

How it running? (crossing fingers)

Can you now get to the security sites you could not before?

[Caeliferum]

[Gecko]

Caeliferum,

I was afraid that would happen


Make a new Folder for example C:\Dllconpare
Download to that folder then run it

Start Program and Click the Run Locate.com and wait a few seconds til the scan says complete.
(default settings usually are sufficient)

Click the Compare button to start the sorting process.

Files in the upper portion have been verified to "exist" as where Files in the bottom section have some form of problem being accessed.
There will be only minimal, if any files listed there... once that Compare scan is complete, and you find you have a few files listed in the lower box.

Click on any of the listed entries to select it.. Right click the mouse and use the Option Rescan.

This will run the file through the standard Windows Find and if it does exist, will be removed from the list (to further filter the found objects)

After that if you are left with files that are still not found, click the Make a Log of what was found button, you will need to post that log.

----------------------------
Make a new Folder for example C:\silentrunners
Please download to that folder.

To launch the script, double-click it.
You may get a warning from your anti-virus program you will need to “Authorize this script”

The output file will be in the same directory as the script. The name will always start with the words, Startup Programs

Please post the results from both DllCompare and silent runners