something awful

[jholland1964]

I am guessing it is NOT all cleaned. Only because every cleaning program was not done on all drives which is the way it should have been done.
Bulk of cleaning was done on C drive. Combofix was only run on C drive for instance as was SDFix.

[philtro]

So would you rather I go to another forum for help at this point?

[jholland1964]

Ok, here is the reason this upset me so much, as you know you said nothing about multiple hard drives, so, I wasn't LOOKING for multiple hard drives, which means I made and error.
Now look at all these scans and what YOU told the programs to scan:
1st MBA-M...C & E
2nd MBA-M...C, E, F, G
3rd MBA-M...C,F,G,H.

Rootkit Reveal found items on C & E
Dr Web Cureit found items on C & F

ESET I have to assume was only run on C
Combofix of course ran on C
SDFix ran on C

You were never consistent on what drives you had scanned, especially with MBA-M which can pretty much scan all drives.
Yes, many infections showed on C drive...is this the one with the new install or was it one of the other ones?
Most infections were found on C but I have no way of knowing if C is the infected drive and it is infecting the others or if one of the other's is infected and is spreading the infections to C.

[philtro]

I have three hard disks, one of them I was initially going to wipe, however by the time this thread was answered I had decided to include it in the process and salvage some of the files. the fourth is a 4gb usb stick which has no files, but I had plugged in so included in the scans. I believe along the way the CD drive letter was switched with drive E.

Now I have 3 discs, however my system drive is split in two (did it late last night): C and E . this shouldn't have effected anything though, I just resized C and made the new space a new partition.
the other hard drives are now called F and H
the removable is G and as of today has some downloaded files on it (for the reinstall I had planned)

[jholland1964]

Honestly at this point I don't know what to tell you. We have no way of knowing which hard drive contained/contains the infection. I don't believe just wiping the drive we just cleaned out will assure you that it won't get infected again. Obviously this drive was clean and was reinfected by something from one of the other drives.
I am just truly dismayed that all this information wasn't included from the beginning because I now cannot in good conscience tell you that anything is clean.

[philtro]

I'm certainly not insisting it's clean at this point, i thought it was, but obviously not.

I am really at a loss for words at this point, I really want to thank you for you help, I will start over again somewhere else.

[jholland1964]

I'm certainly not insisting it's clean at this point, i thought it was, but obviously not.

I am really at a loss for words at this point, I really want to thank you for you help, I will start over again somewhere else.

Please give where ever you post ALL information and all drives. Run scans on ALL drives for every program you run, otherwise you will never be certain all infection is remove. Do that or else reformat all drives and reload. But if you do that don't install anything that was saved from an unscanned drive, that could be the one.

[philtro]

ok this program found some stuff:

Process.exe;C:\WINDOWS\system32;Tool.Prockill;;

MixedInKey_3.0.1.exe\data012;F:\My Documents\programs\Mixed In Key\MixedInKey_3.0.1\MixedInKey_3.0.1.exe;BackDoor .Bifrost.740;;

MixedInKey_3.0.1.exe;F:\My Documents\programs\Mixed In Key\MixedInKey_3.0.1;Archive contains infected objects;Moved.;

A0000270.exe\data012;F:\System Volume Information\_restore{735ADBFB-D616-4DC5-8780-444AE0870117}\RP2\A0000270.exe;BackDoor.Bifrost.74 0;;

A0000270.exe;F:\System Volume Information\_restore{735ADBFB-D616-4DC5-8780-444AE0870117}\RP2;Archive contains infected objects;Moved.;

I am still baffled as to how these results didn't make it clear that I had more than a C: drive/partition. I assumed all along that you were seeing other drive letters than C:.

Once again, I thank you for your time and help.

Phillip

[jholland1964]

I am still baffled as to how these results didn't make it clear that I had more than a C: drive/partition. I assumed all along that you were seeing other drive letters than C:.

Sorry you cannot understand. I made an error because I wasn't given full information on the system, I admitted I made an error. These logs are not easy to read as it is and sometimes things are missed. I guarantee things WILL not be missed if poster provides FULL INFORMATION.

[Gizmokid2005]

philtro - when you are requesting help of this nature in regards to any type of malicious software it is imperative that you provide the forum with full detailed information on what your system contains, especially drives. Malicious files are notorious for embedding and duplicating themselves making it more difficult to remove.

If you feel the need to go elsewhere, by all means do so.

I do encourage you though, to try and make amends, and provide full detailed information of the system if you would like help to further clean the system. That is if jholland is still willing to help.

You must understand that incomplete information makes fixing an issue such as this, impossible.