. My name is godawgs
and I will be assisting you with your Virus / Malware issues.I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.
I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.If you have not, please adhere to the guidelines below and then carefully follow all future instructions:
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same.
Because of this, you must reply within four days
. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
- Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
- Please let me know if you are using a computer with multiple accounts, as this can affect the instructions given.
- Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
I would recommend printing them out, if you can, so you can check off each step as you complete it.
Also, part of the fix may require you to be in Safe Mode, which will not allow you to access the internet, or my instructions!
- If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!
- All tools must be run from an account with Administrator privileges.
- Do not do things I do not ask for, such as running a spyware scan on your computer, installing/uninstall programs, deleting files, modifying the registry or running any tools, unless instructed to do so. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date (if possible)!
- Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.
- Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.
In order to be notified when your topic has been replied to:
Click My Settings at the top of the page. An Option page will open. In the left hand column click Notification Options. On the new page that opens under the Notification Preferences section click Watch every topic I reply to and set the notification type to Immediate Notification.I wanted to get to you ASAP to advise you not to download and run anymore tools unless you know what they are and exactly what they can do or have been asked by a malware removal helper to download and run them.
I did the following steps and I have the logs:
1. Malwarebytes (didn't detect any infected files)
4. Bootkit Remover
6. TDSS Killer
8. ComboFIX ( this step seemed to have had some positive effect)
Did you have GMER, TDSSKiller of ComboFix make any fixes? I will need to see the logs, but depending on the infection you have (if any) these tools can harm the system if you don't know what they do.
The Bootkit Remover tool is an old program that hasn't been updated since sometime in 2011.
FixTDSS is a tool designed for the Backdoor.Tidserv
infection so I'm not sure why you ran it for the Trojan.sirefef.fy
infection. I would like to see that log also.
DDS and aswMBR are primarily diagnosis tools. I want to see the aswMBR log as well.
...I saw some recommendations here for running OTL, but i wanted to double check with experts first
Downloading and running OTL is the only
recommendation you will see here to start the diagnosis and removal process.
We will start with an OTL scan, but depending on what infection you have and what the GMER, Bootkit Remover, TDSSKiller, FixTDSS and ComboFix tools have already done we may not be able to do very much.Step-1. OTL Custom ScanDownload OTL
to the Desktop. It is important that it is download to the Desktop.
users should right click the download link and click "Save File As"
. On the window that comes up, make sure the download location is the Desktop
and click the Save
Please copy the text in the code box below and paste it in the
box in OTL
. To do that:
- Highlight everything inside the code box, right click the mouse and click Copy.
hklm\software\clients\startmenuinternet|command /64 /rs
C:\Program Files\Common Files\ComObjects\*.* /s
>C:\commands.txt echo list vol /raw /hide /c
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
type c:\diskreport.txt /c
del c:\commands.txt^|y /hide /c
del c:\diskreport.txt^|y /hide /c
on the desktop. To do that:
- Double click on the OTL icon to run it. Make sure all other windows are closed.
- You will see a console like the one below:
- Check the box beside Scan All Users at the top of the console
- Make sure the Output box at the top is set to Standard Output.
- Check the boxes beside LOP Check and Purity Check.
- Place the mouse pointer inside the box, right click and click Paste. This will put the above script inside OTL
- Click the button. Do not change any settings unless otherwise told to do so.
- Let the scan run uninterrupted.
- When the scan completes, it will open OTL.Txt on the desktop. The Extras.txt file will be minimized. These files is also saved in the same location as OTL (it should be on your desktop).
- Please copy the contents of these files and paste them into your reply. To do that:
- On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
- Right click inside the forum post window then click Paste.This will paste the contents of the OTL.txt file in the in the post window.
Repeat for the Extras.txt
fileStep-2.Things For Your Next Post:1.
The OTL.txt log2.
The Extras.txt log3.
The GMER log4.
The Bootkit Remover log5.
The TDSSKiller log6.
The FixTDSS log7.
The aswMBR log8.
The ComboFix log
Once I have reviewed the logs I will get back tp you.