Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
19-Nov-2009, 10:46 AM
#1 | ||||||
 Search Redirects |
| |
20-Nov-2009, 04:03 PM
#2 | |||||
| Hello there  Welcome to the TSG Forums. My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me. Please note the following:
Step 1 Download OTS to your Desktop
Code: %SYSTEMDRIVE%\eventlog.dll /s /md5 %SYSTEMDRIVE%\scecli.dll /s /md5 %SYSTEMDRIVE%\netlogon.dll /s /md5 %SYSTEMDRIVE%\cngaudit.dll /s /md5 %SYSTEMDRIVE%\sceclt.dll /s /md5 %SYSTEMDRIVE%\ntelogon.dll /s /md5 %SYSTEMDRIVE%\logevent.dll /s /md5 %SYSTEMDRIVE%\iaStor.sys /s /md5 %SYSTEMDRIVE%\nvstor.sys /s /md5 %SYSTEMDRIVE%\atapi.sys /s /md5 %SYSTEMDRIVE%\si3112.sys /s /md5 %SYSTEMDRIVE%\viadsk.sys /s /md5 %SYSTEMDRIVE%\nvatabus.sys /s /md5 %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 %SYSTEMDRIVE%\viasraid.sys /s /md5 %SYSTEMDRIVE%\AGP440.sys /s /md5 %SYSTEMDRIVE%\vaxscsi.sys /s /md5
Please attach the log in your next post. To do so click on the blue "Reply" button or "Go Advanced" and click on the "Manage Attachments" button To ensure that I get all the information this log will need to be attached. If it is too large to attach then upload it to Dropio and post the sharing link/url (The Drop's URL will be similar to : http:://drop.io/daerk) Step 2 Download SysProt Antirootkit from the link below (you will find it at the bottom of the page under attachments, or you can get it from one of the mirrors). http://sites.google.com/site/sysprotantirootkit/ Unzip it into a folder on your desktop. Start the Sysprot.exe program.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
20-Nov-2009, 06:33 PM
#4 | |||||
| Good Job. Please do the following now: NOTE: ComboFix should NOT be used without supervision by someone trained in its use. It does a whole lot more to a system than just remove infected files. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you please let me know. A increasing number of infections are spreading using Autoplay and leaving it disabled is a good idea. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
21-Nov-2009, 01:33 AM
#6 | |||||
| Please do the following: 1. Close any open open programs before running the fix. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the codebox below into it: Code: KillAll::
Driver::
DMSKSSRh
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\4525c62b-11cd-4c66-ba3c-83b69cdc7a6c]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82721259-9894-00E7-7255-99ca3230262a}]
File::
c:\windows\System32\lullmw.exe
c:\docume~1\BRIANW~1.CHA\LOCALS~1\Temp\DMSKSSRh.sys
c:\program files\Common Files\System\tab-mmcs.dll
DDS::
mSearch Bar = hxxp://websearch.drsnsrch.com/sidesearch.cgi?id=
Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
21-Nov-2009, 03:28 AM
#8 | |||||
| Good  Let's do the following:STEP 1 Run OTS
Code: [Unregister Dlls] [Empty Temp Folders] [Reboot]
Note: You may receive some errors while running the fix. Just press Ok and the fix should continue normally. If it seems to get stuck, give it some time. It's probably still working. STEP 2  Please download Malwarebytes' Anti-Malware from Here.Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
21-Nov-2009, 04:16 PM
#10 | |||||
| Good. I'm glad to see those results. Let run an online scan to be absolutely sure you're clean. This will take a while but it's worth it as it can often find things all other scans will miss. STEP 1 Before we do, I need you to update Internet Explorer to IE8. Even if you don't use it, we need to have it updated as its components are deeply connected with Windows itself. Please go here to download the installer: http://www.microsoft.com/windows/internet-explorer/ STEP 2 The online scanner uses Java, so I will need you to download and install the latest version for that. Please go here to download the installer: http://java.com/en/download/index.jsp Reboot your machine when that's done. STEP 3 Using Internet Explorer or Firefox, visit Kaspersky Online Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take quite a long time to download.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
21-Nov-2009, 08:45 PM
#12 | |||||
| ComboFix had a false positive so let's restore that first: Please do the following: 1. Close any open open programs before running the fix. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the codebox below into it: Code: DeQuarantine:: C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\pciide.sys.vir Quit:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 11:39 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile