Hi, I know I should know better but I downloaded a game from Piratebay and guess what ! Win32 trojan. AVP tried to remove but it kept replicating and I ended up with about 10 hits. Finally removed. Malwarebytes could not find any trace. Now I find everyday I have a scheduled upload job that my firewall blocks. I guess I have a rootkit. I tried to get into safe mode to run malwarebytes but F8 doesn't work. Running windows xp 32 bit. Anyone have a boot to kick me.

any help to figure out how to get into safe mode appreciated. tks

 

-----signature-----

f8 should still work, just spam it during the post.

if you can burn a cd, boot from http://support.kaspersky.com/viruses/rescuedisk and run the scan. cant hurt!

 

-----signature-----

will burn disk from work, tks

 

-----signature-----

If you have a basic spare keyboard try booting up into safe mode with that connected, some of the more complex keyboards don't respond before Windows has loaded.

ok will try the other keyboard. I tried to make the boot disk but my writer at work won't recognize disk ! Anyway I came home early (dentist!) I checked task manager there is an upload to occur every 4 hours

C:\WINDOWS\system32\rundll32.exe "C:\Program Files\Microsoft Fix it Center\MatsApi.dll",RetryDataUpload

Also a config task also to run every 4 hrs

C:\WINDOWS\system32\rundll32.exe "C:\Program Files\Microsoft Fix it Center\MatsApi.dll",RunCollectConfigurationInfo

Likewise, while I was typing this I had a request from Mozilla to upload a plugin command-plugin.exe

This bad baby doesn't give up and has all the tricks.

thank you private firewall 7.0

I may have to reinstall.......Dumb me.

 

-----signature-----

Have you tried a system restore?

yes, tried system restore, it never works, always fails. says unable to restore?

 

-----signature-----

Gonna sound dumb, I know, but Uninstall the Microsoft Fix It Center, which is a real program.

I've had good luck with safe mode, then combofix, and then malwarebytes. (I haven't run into that particular one yet though.)

 

-----signature-----

ComboFix

RootKitRevealer

Kaspersky Rescue CD 10