Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
18-Nov-2009, 07:55 PM
#1 | |||||
| Help!! |
| |
19-Nov-2009, 03:13 AM
#3 | |||||
| Hello there  Welcome to the TSG Forums. My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me. Please note the following:
Step 1 Download OTS to your Desktop
Code: %SYSTEMDRIVE%\eventlog.dll /s /md5 %SYSTEMDRIVE%\scecli.dll /s /md5 %SYSTEMDRIVE%\netlogon.dll /s /md5 %SYSTEMDRIVE%\cngaudit.dll /s /md5 %SYSTEMDRIVE%\sceclt.dll /s /md5 %SYSTEMDRIVE%\ntelogon.dll /s /md5 %SYSTEMDRIVE%\logevent.dll /s /md5 %SYSTEMDRIVE%\iaStor.sys /s /md5 %SYSTEMDRIVE%\nvstor.sys /s /md5 %SYSTEMDRIVE%\atapi.sys /s /md5 %SYSTEMDRIVE%\si3112.sys /s /md5 %SYSTEMDRIVE%\viadsk.sys /s /md5 %SYSTEMDRIVE%\nvatabus.sys /s /md5 %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 %SYSTEMDRIVE%\viasraid.sys /s /md5 %SYSTEMDRIVE%\AGP440.sys /s /md5 %SYSTEMDRIVE%\vaxscsi.sys /s /md5
Please attach the log in your next post. To do so click on the blue "Reply" button or "Go Advanced" and click on the "Manage Attachments" button To ensure that I get all the information this log will need to be attached. If it is too large to attach then upload it to Dropio and post the sharing link/url (The Drop's URL will be similar to : http:://drop.io/daerk) Step 2 Download SysProt Antirootkit from the link below (you will find it at the bottom of the page under attachments, or you can get it from one of the mirrors). http://sites.google.com/site/sysprotantirootkit/ Unzip it into a folder on your desktop. Start the Sysprot.exe program.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
19-Nov-2009, 04:09 PM
#5 | |||||
| Good Job. I can see the cause of the problems now. Let's do the following: NOTE: ComboFix should NOT be used without supervision by someone trained in its use. It does a whole lot more to a system than just remove infected files. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you please let me know. A increasing number of infections are spreading using Autoplay and leaving it disabled is a good idea. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
19-Nov-2009, 05:16 PM
#6 | |||||
| ComboFix 09-11-19.03 - Dan Gentner 11/19/2009 15:56.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.629 [GMT -5:00] Running from: c:\documents and settings\Dan Gentner\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\89368 c:\documents and settings\All Users\Application Data\89368\BackUp\MediaChecker.lnk c:\documents and settings\All Users\Application Data\89368\mozcrt19.dll c:\documents and settings\All Users\Application Data\89368\sqlite3.dll c:\documents and settings\All Users\Application Data\89368\WS72c.exe c:\documents and settings\All Users\Application Data\89368\WSD_A.ico c:\documents and settings\All Users\Application Data\89368\WSDDSys\vd952342.bd c:\documents and settings\Dan Gentner\Application Data\inst.exe c:\program files\Mozilla Firefox\searchplugins\search.xml c:\windows\wiaserviv.log Infected copy of c:\windows\system32\drivers\iaStor.sys was found and disinfected Restored copy from - Kitty ate it  . ((((((((((((((((((((((((( Files Created from 2009-10-19 to 2009-11-19 ))))))))))))))))))))))))))))))) . 2009-11-19 00:15 . 2009-11-19 00:15 57 ----a-w- C:\PE.sys 2009-11-19 00:00 . 2009-11-19 00:00 55 ----a-w- C:\sld.dll 2009-11-18 23:58 . 2009-11-19 00:30 -------- d-sh--w- c:\documents and settings\Dan Gentner\Application Data\System Defender 2009-11-18 23:50 . 2009-11-18 23:50 44 ----a-w- C:\CLSV.drv 2009-11-18 23:29 . 2009-11-18 23:29 -------- d-----w- c:\documents and settings\Dan Gentner\Application Data\AVG8 2009-11-18 23:28 . 2009-11-18 23:28 13 ----a-w- C:\tjd.sys 2009-11-18 23:07 . 2009-11-18 23:07 73 ----a-w- C:\kernel32.drv 2009-11-18 22:37 . 2009-11-18 22:37 71 ----a-w- C:\cid.sys 2009-11-18 22:37 . 2009-11-18 22:38 -------- d-sh--w- c:\windows\system32\config\systemprofile\Application Data\System Defender 2009-11-18 22:37 . 2009-11-18 22:37 -------- d-sh--w- c:\documents and settings\All Users\Application Data\WSDDSys 2009-11-18 22:36 . 2009-11-18 22:37 -------- d-sh--w- c:\documents and settings\All Users\89ee9b1 2009-11-18 20:45 . 2009-11-19 18:20 79488 ----a-w- c:\documents and settings\Dan Gentner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2009-11-12 18:39 . 2009-11-10 14:33 4026136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe 2009-11-12 18:39 . 2009-11-10 14:33 2016536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe 2009-11-12 18:39 . 2009-11-10 14:33 1257240 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe 2009-11-12 18:39 . 2009-11-10 14:33 3963672 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll 2009-11-12 18:39 . 2009-11-02 04:01 600344 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgnsx.exe 2009-11-12 18:39 . 2009-11-02 04:01 496920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll 2009-11-10 14:33 . 2009-11-02 04:01 360584 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys 2009-11-10 14:31 . 2009-11-02 04:01 1657112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2009-11-10 14:31 . 2009-11-02 04:01 610072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe 2009-11-02 19:30 . 2009-10-16 17:12 1119488 ----a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll 2009-11-02 04:04 . 2009-11-02 04:04 -------- d-----w- c:\documents and settings\Dan Gentner\Local Settings\Application Data\AVG Security Toolbar 2009-11-02 04:02 . 2009-11-02 04:02 -------- d-----w- C:\$AVG 2009-11-02 04:01 . 2009-11-10 14:33 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-11-02 04:01 . 2009-11-02 04:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2009-11-02 04:01 . 2009-11-02 04:01 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-11-02 04:01 . 2009-11-02 04:01 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-11-02 04:01 . 2009-11-19 02:53 -------- d-----w- c:\windows\system32\drivers\Avg 2009-11-02 04:01 . 2009-11-02 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar 2009-11-02 04:01 . 2009-11-19 02:50 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9 2009-11-02 02:50 . 2009-11-02 02:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-11-02 02:05 . 2005-04-21 00:22 32768 ----a-w- c:\windows\system32\instlsp.exe 2009-11-02 02:05 . 2005-04-21 00:22 11264 ----a-w- c:\windows\system32\sporder.dll 2009-11-02 01:22 . 2009-11-02 01:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-10-22 07:01 . 2009-02-07 23:02 2066048 ----a-w- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-10-22 07:01 . 2009-02-06 11:08 2189056 ----a-w- c:\windows\system32\dllcache\ntoskrnl.exe 2009-10-22 07:01 . 2009-02-06 11:06 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-10-22 07:01 . 2009-02-06 11:06 2145280 ----a-w- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-10-22 07:01 . 2009-02-06 10:32 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-10-22 07:01 . 2009-02-06 10:32 2023936 ----a-w- c:\windows\system32\dllcache\ntkrpamp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-19 20:45 . 2008-06-10 16:24 -------- d-----w- c:\documents and settings\Dan Gentner\Application Data\U3 2009-11-02 04:01 . 2008-06-06 00:26 -------- d-----w- c:\program files\AVG 2009-11-02 01:38 . 2008-07-08 21:21 -------- d-----w- c:\program files\Symantec 2009-11-02 01:38 . 2008-07-08 21:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-11-02 01:09 . 2008-07-08 21:21 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-11-02 00:00 . 2008-12-07 20:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-11-02 00:00 . 2009-03-23 19:36 4045527 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-10-28 20:28 . 2008-09-04 17:24 -------- d-----w- c:\documents and settings\Dan Gentner\Application Data\uTorrent 2009-10-10 18:51 . 2009-10-10 18:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage 2009-10-10 18:51 . 2009-10-10 18:51 -------- d-----w- c:\documents and settings\Dan Gentner\Application Data\Office Genuine Advantage 2009-10-03 17:14 . 2008-06-05 23:54 -------- d-----w- c:\documents and settings\Dan Gentner\Application Data\Apple Computer 2009-10-03 16:01 . 2008-06-05 23:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-09-24 04:28 . 2009-09-24 04:27 -------- d-----w- c:\program files\iTunes 2009-09-24 04:27 . 2009-09-24 04:27 -------- d-----w- c:\program files\iPod 2009-09-24 04:27 . 2008-06-05 23:52 -------- d-----w- c:\program files\Common Files\Apple 2009-09-24 04:12 . 2009-09-24 04:12 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe 2009-09-11 14:18 . 2009-09-11 14:18 136192 ----a-w- c:\windows\system32\SET28D.tmp 2009-09-11 14:18 . 2009-09-11 14:18 136192 ------w- c:\windows\system32\SET4A3.tmp 2009-09-11 14:18 . 2004-08-04 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-10 19:54 . 2008-12-07 20:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 19:53 . 2008-12-07 20:46 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-04 21:03 . 2009-09-04 21:03 58880 ----a-w- c:\windows\system32\SET2E5.tmp 2009-09-04 21:03 . 2009-09-04 21:03 58880 ------w- c:\windows\system32\SET4B9.tmp 2009-09-04 21:03 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-28 23:42 . 2009-09-18 00:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys 2009-08-28 23:42 . 2009-09-18 00:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-08-26 08:00 . 2004-08-04 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll 2008-04-07 06:59 . 2009-11-19 02:56 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2008-04-07 06:59 . 2009-11-19 02:56 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2008-04-07 06:59 . 2009-11-19 02:56 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2008-04-07 06:59 . 2009-11-19 02:56 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2008-04-07 06:59 . 2009-11-19 02:56 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll 2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488] [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-10-16 17:12 1119488 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488] [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="c:\program files\Ares\Ares.exe" [2008-02-20 963072] "EPSON Stylus C80 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE" [2001-10-04 69632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-01 344064] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "MBBalloon"="c:\program files\HOTALBUMMyBOX\MBBalloon.exe" [2006-12-15 787096] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2009-11-12 2020120] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-22 339968] c:\documents and settings\All Users\Start Menu\Programs\Startup\ MediaChecker.lnk - c:\program files\HOTALBUMMyBOX\MediaChecker.exe [2006-12-15 913560] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-11-02 04:01 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"= "c:\\Documents and Settings\\All Users\\89ee9b1\\WS89ee.exe"= R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [6/5/2008 8:00 PM 15172] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/1/2009 11:01 PM 333192] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/1/2009 11:01 PM 360584] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/5/2008 8:13 PM 24652] S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/1/2009 11:01 PM 285392] . Contents of the 'Scheduled Tasks' folder 2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Dan Gentner\Application Data\Mozilla\Firefox\Profiles\cobodq9j.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.espn.com/ FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils 2.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils 3.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils 35.dll FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - plugin: c:\documents and settings\Dan Gentner\Application Data\Mozilla\Firefox\Profiles\cobodq9j.default\extensions\moveplayer@movene tworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - HKCU-Run-Aim6 - (no file) HKLM-Run-System Defender - c:\documents and settings\All Users\Application Data\89368\WS72c.exe AddRemove-dvdSanta 4.50 - Make your own DVD movies!_is1 - c:\program files\dvdSanta\unins000.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-19 16:06 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant] "ImagePath"="a" . Completion time: 2009-11-19 16:08 ComboFix-quarantined-files.txt 2009-11-19 21:08 Pre-Run: 49,086,001,152 bytes free Post-Run: 50,572,869,632 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 1B215E10588B80693E5ACF0903F4B211 |
19-Nov-2009, 10:17 PM
#7 | |||||
| Good Job. Please do the following: 1. Close any open open programs before running the fix. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the codebox below into it: Code: KillAll:: File:: C:\PE.sys C:\sld.dll C:\CLSV.drv C:\tjd.sys C:\kernel32.drv C:\cid.sys c:\windows\system32\SET28D.tmp c:\windows\system32\SET4A3.tmp c:\windows\system32\SET2E5.tmp c:\windows\system32\SET4B9.tmp Folder:: c:\documents and settings\Dan Gentner\Application Data\System Defender c:\windows\system32\config\systemprofile\Application Data\System Defender c:\documents and settings\All Users\Application Data\WSDDSys c:\documents and settings\All Users\89ee9b1 Registry:: [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "c:\\Documents and Settings\\All Users\\89ee9b1\\WS89ee.exe"=- Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Also, please run OTS.exe if you still have it and click on the Quick Scan button. Attach the results of this scan to your next reply for me.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
20-Nov-2009, 01:13 AM
#10 | |||||
| Good job  Let's do the following:STEP 1 Run OTS
Code: [Unregister Dlls] [Empty Temp Folders] [ClearAllRestorePoints] [Reboot]
Note: You may receive some errors while running the fix. Just press Ok and the fix should continue normally. If it seems to get stuck, give it some time. It's probably still working. STEP 2  Run MalwareBytes AntiMalware
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. STEP 3 I also want to run an online scanner. This will take a while but it's worth it as it can often find things all other scans will miss. The online scanner uses Java, so I will need you to download and install the latest version for that. Please go here to download the installer: http://java.com/en/download/index.jsp Reboot your machine when that's done. STEP 4 Using Internet Explorer or Firefox, visit Kaspersky Online Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take quite a long time to download.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 10:46 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile