Virus on my computer. Please help!

If any of the above tools won't run, then re-download them and rename the file before saving to your desktop. Or use another pc to download the file and rename it before transfering it to the infected pc.

Hi again,
I downloaded both items successfully.  However I have attempted to run a scan with Malwarebytes three times now and each time I get the blue screen of death after scanning approximately 28,000 items.  I was attempting to run a full scan on all drives each time it happened.  When my computer restarted the first two times I got the following error messages;

Problem signature:
  Problem Event Name:      BlueScreen
  OS Version:      6.0.6001.2.1.0.768.3
  Locale ID:      1033

Additional information about the problem:
  BCCode:      1000008e
  BCP1:      C0000005
  BCP2:      91046B8A
  BCP3:      C8518754
  BCP4:      00000000
  OS Version:      6_0_6001
  Service Pack:      1_0
  Product:      768_1

Files that help describe the problem:
  C:\Windows\Minidump\Mini012509-01.dmp
  C:\Users\abletobecain\AppData\Local\Temp\WER-97017-0.sysdata.xml
  C:\Users\abletobecain\AppData\Local\Temp\WER4A29.tmp.version.txt

Read our privacy statement:
  http://go.microsoft.com/fwlink/?linkid=50163&clcid=0x0409



Problem signature:
  Problem Event Name:      BlueScreen
  OS Version:      6.0.6001.2.1.0.768.3
  Locale ID:      1033

Additional information about the problem:
  BCCode:      1000008e
  BCP1:      C0000005
  BCP2:      9100DB8A
  BCP3:      C699A754
  BCP4:      00000000
  OS Version:      6_0_6001
  Service Pack:      1_0
  Product:      768_1

Files that help describe the problem:
  C:\Windows\Minidump\Mini012509-02.dmp
  C:\Users\abletobecain\AppData\Local\Temp\WER-78094-0.sysdata.xml
  C:\Users\abletobecain\AppData\Local\Temp\WER33CC.tmp.version.txt

Read our privacy statement:
  http://go.microsoft.com/fwlink/?linkid=50


After the third restart I did not get an error message.  Am I doing something wrong?
Thanks,
~Jhanek

This is a rootkit. combofix should take care of it but since this is Vista Combofix might also have problems running.

You can try running it in Safe Mode and show us the resulting log.
You could also try SUPERAntispyware and see if that helps.
http://www.superantispyware.com/

We can also try and use Gmer later(I'll post the instructions later)if nothing helps.

Sorry, but I don't quite understand.  Should I not run malware first and just run combofix instead?  And when I run combofix your saying that I should run it in safe mode first or run it normally first and try safe mode as a second option?
Thanks for your help,
~Jhanek

I thought MBAM would not finished its run? even if you redownload and rename it?

So I thought try SUPERAntispyware instead and see if that will run successfully.

Then if problem persists, you can run Combofix in Safe Mode, Combofix only supports 2000/XP but it will run on vista as well. Some Vista system are able to run combofix in normal mode but I always go for safe mode when it's Vista to minimize possible running problems.(use at your own risk)

Or if SUPERAntispyware doesn't help, instead of running Combofix we can use Gmer. These are just options for you to choose.

Ok so, I got SUPERAntispyware to run successfully but I'm not sure what to do now. Do I remove and quarantine all the items it detected? If I do, do I still need to run Combofix?
Thanks,
~Jhanek

Let it quarantine all the threats found and if the problem is resolved you don't have to run another tool.

If the rootkit is still present and the problem persists, then we can run Combofix.

I quarintined everything that superantispyware found and it was good for a while (no trojan message).  However, when I started my computer up tonight it popped up again everytime I opened a new web page.  I ran superantispyware again and it seems to have worked again but will it pop up again later?   Also the second error (library not registered) still pops when I turn on my computer.  Should I try combofix now?
Thanks,
~Jhanek

Yes, try running Combofix in Safe Mode, also disable security shields and don't mouse-click while combofix is running.

I ran Combofix in Safe Mode and I disabled Pc-cillin and Windows Defender but I did this before I went into safe mode.  Was that correct?

When I ran it I got a couple of errors.

First was a windows box that  said;

Windows cannot find '32788R22FWJFW\nircmd.com'  Make sure you typed the name correctly, and then try again.

The next error was from Combofix and it said;

Combofix has detected the presence of rootkit activity and needs to reboot the machine.  Kindly note down on paper, the name of each file. We may need it later.

C:\Windows\system32\drivers\msqpdxnbcbcrrx.sys
C:\Windows\system32\msqpdxwqsctmei.dll

Also when I clicked ok after the message it didn't reboot and I had to do it myself.

Lastly I just wanted to note what was in the blue screen of Combofix itself.  In the top left corner was -C.bat. Here's what it said;

The system cannot find message text for mesage number 0X8 in the message file for system.
Scanning for infected files...
This typically doesn't take more than 10 minutes. However scan times for badly infected times may easily double.
Access Denied. Administrator permissions are needed to use the selected options.
   Use an administrator command prompt to complete these tasks.
The system cannot find message text for mesage number 0X8 in the message file for system.

Also when I restarted my computer my clock had changed to military time.  What should I do?
Thanks,
~Jhanek

Thanks, I got out of military time no problem.  I guess I was unclear with my prior post.  I posted everything that combofix gave me.  It was just a couple of error boxes.  It seems that I can't dissable Pc-cillin in safe mode.  I think if you could coach me how to dissable it combofix would work.  Also, I looked for C:\combofix.txt but I can't find it anywhere.  AAAHHHHHH!!
Thanks for your patience.