Infected!

[Multiply]

Help! Currently I'm writing this on my laptop which is clean. My main computer has had a RAT on it for a few days now I think. But I only found out last night. As soon as I found out I disconnected it from the internet and ran a Norton virus scan. Nothing came up in the results. After that I turned it off. What should my next step be?
Thanks.

 

[Chewbaka]

Post a HJT log for starters.

 

[Multiply]

OTL.txt
http://pastebin.com/VdjwfBxV


Extras.txt
http://pastebin.com/XxQ5sX1S


Malware Bytes
http://pastebin.com/nN9xHdZq


Scan after MSCONFIG. (Malware Bytes)
http://pastebin.com/pCqZzkea


House call virus scan:
Nothing found.

 

[Multiply]

Sup harry

Spoiler

LOLOLOLOLOLOL.
Not MR Team, gtfo.

---

MBAM seems to of caught it.

Post a HJT log.

I ran a scan, but it didn;t save a log :S

I'm hoping Bytes got it.

 

[Multiply]

Thank you so much for your helping Automatic Coding, maybe you should get accepted for MR Team

How do I delete:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java (Backdoor.Bot) -> Value: Java -> No action taken.

 

[Oxide]

!--Only Malware Removal Team are to post in here except the OP--!

 

[Multiply]

!--Only Malware Removal Team are to post in here except the OP--!

Am I allowed to make an exception for this post?
Automatic Coding helped me successfully remove it within 1 hour of posting, while a MR member hasn't even been online yet.

 

[Oxide]

The reason is bad advice may be given and have a negative impact on your computer or make it worse.

 

[Tha Sneak]

I'm in HJT.
I'm active.
I'm not stupid.
You're not active.

You're not a HJT helper.
I'm active.
I'm not stupid.
You're not trained.

 

[Techno]

"Time Spent Online: 3 Days, 4 Hours, 47 Minutes, 51 Seconds"

In 9 months.
Really?

People quit and come back. He came back to be MR Team. Get over it Jonathan.

 

[Multiply]

Fresh OTL Log:
http://pastebin.com/P1qwbEPy

 

[Tha Sneak]

Hi,

Please download aswMBR from here

• Save aswMBR.exe to your Desktop
• Double click aswMBR.exe to run it
• Click the Scan button to start the scan as illustrated below

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives

• Once the scan finishes click Save log to save the log to your Desktop
  
  
  
  
• Copy and paste the contents of aswMBR.txt back here for review

 

[Multiply]

Hi,

Please download aswMBR from here

• Save aswMBR.exe to your Desktop
• Double click aswMBR.exe to run it
• Click the Scan button to start the scan as illustrated below

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives

• Once the scan finishes click Save log to save the log to your Desktop
  
  
  
  
• Copy and paste the contents of aswMBR.txt back here for review

I just ran that, then when I clicked 'Scan' I got bluescreened.

Problem signature:
  Problem Event Name:	BlueScreen
  OS Version:	6.1.7601.2.1.0.768.3
  Locale ID:	2057

Additional information about the problem:
  BCCode:	1000007e
  BCP1:	FFFFFFFFC0000094
  BCP2:	FFFFF88001058C23
  BCP3:	FFFFF88003B62788
  BCP4:	FFFFF88003B61FE0
  OS Version:	6_1_7601
  Service Pack:	1_0
  Product:	768_1

Files that help describe the problem:
  C:\Windows\Minidump\082811-30186-01.dmp
  C:\Users\Harry\AppData\Local\Temp\WER-48578-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\windows\system32\en-US\erofflps.txt

Then I had to restart my computer.

 

[Tha Sneak]

Hi,

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
• Click the Start Scan button
• After the scan has finished, click the Close button
• Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory.

 

[Multiply]

Hi,

Please download TDSSKiller from here and save it to your Desktop.

• Doubleclick TDSSKiller.exe to run the tool
• Click the Start Scan button
• After the scan has finished, click the Close button
• Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory.

Scan Log:
http://pastebin.com/J1EKi3xh

 

[Tha Sneak]

Hi,

Please download ComboFix

from BleepingComputer.com

Alternate link: GeeksToGo.com

Alternate link: Forospyware.com


Rename ComboFix.exe to commy.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
• Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\commy.exe" /stepdel
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista. Just continue scanning, and skip the console install.
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

 

[Multiply]

Ok, just before I run Combo fix. Why does my AV not like it?

 

[Tha Sneak]

Just want to say one thing here. Why would you ask him to download TDSSKiller if you had already seen the log? You knew all along that combofix was the best tool for the job. You wasted his time running TDSSKiller.

TDSSKiller is for a specific infection that I was looking for. ComboFix doesn't remove it. I know what I'm doing and you have no room to tell me otherwise. Don't post here again.

 

[All Day Win]

If you're not part of the MR team don't post here this is your final warning.

 

[Tha Sneak]

It is a false positive. Disable your AV and run ComboFix.