Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

win7 64bit won't start [Solved]


  • This topic is locked This topic is locked

#16
stavkon13

stavkon13

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
hi, and sorry for the late reply , but I am out of town....
I will be back tomorrow and apply your fixes as I currently do not have the laptop with me..

thanx again for everything....
  • 0

Advertisements


#17
Crowbar

Crowbar

    Teacher

  • GeekU Moderator
  • 4,487 posts
Ok, I'll be here, over the next few days I will be on in the mornings.
  • 0

#18
stavkon13

stavkon13

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
hi again,

I just did everything, the logs I got were the following

========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== FILES ==========
< net start mpsdrv /c >
No captured output from command...
C:\Users\Κατρίν\Desktop\cmd.bat deleted successfully.
< net start MpsSvc /c >
No captured output from command...
C:\Users\Κατρίν\Desktop\cmd.bat deleted successfully.
< net start bfe /c >
No captured output from command...
C:\Users\Κατρίν\Desktop\cmd.bat deleted successfully.
< net start wscsvc /c >
No captured output from command...
C:\Users\Κατρίν\Desktop\cmd.bat deleted successfully.

OTL by OldTimer - Version 3.2.68.0 log created on 10042012_202957

===============================================================================================================

Farbar Service Scanner Version: 19-09-2012
Ran by Κατρίν (administrator) on 04-10-2012 at 20:34:39
Running from "C:\Users\Κατρίν\Desktop"
Microsoft Windows 7 Home Premium (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2009-07-14 02:25] - [2009-07-14 04:45] - 1898576 ____A (Microsoft Corporation) 912107716BAB424C7870E8E6AF5E07E1

C:\Windows\System32\dnsrslvr.dll
[2009-07-14 02:21] - [2009-07-14 04:40] - 0182272 ____A (Microsoft Corporation) 676108C4E3AA6F6B34633748BD0BEBD9

C:\Windows\System32\mpssvc.dll
[2009-07-14 03:09] - [2009-07-14 04:41] - 0824832 ____A (Microsoft Corporation) AECAB449567D1846DAD63ECE49E893E3

C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll
[2009-07-14 02:36] - [2009-07-14 04:41] - 0170496 ____A (Microsoft Corporation) 765A27C3279CE11D14CB9E4F5869FCA5

C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****



So far everything looks great and there isn't any problem with the laptop
  • 0

#19
Crowbar

Crowbar

    Teacher

  • GeekU Moderator
  • 4,487 posts
Looking good :cool:
Lets sweep your computer for any remnants and if that looks good I will clean up my tools and send you on your way!

Step 1
Posted Image Please run Malwarebytes' Anti-Malware

  • Go to the Update tab and check for updates, please install any updates found.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Step 2
Note: You can use either Internet Explorer or Mozilla FireFox for this Scan.

Vista / 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: Posted Image
You will however need to disable your current installed Anti-Virus, how to do so can be read here.

If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the following instructions work with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on: Posted Image
  • When prompted allow Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked.
  • Make sure that the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Posted Image
  • The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically. The scan may take several hours.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close, make sure you copy the logfile first!
  • Now click on: Posted Image
  • Use notepad to open the logfile located at C:\Program Files (x86)/ESET/ESET Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic.
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
  • 0

#20
stavkon13

stavkon13

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
hi again,


here is the log from the ESET scan

[email protected] as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b45a480753ee39489ba5f243ca494bb9
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-10-07 08:45:12
# local_time=2012-10-07 11:45:12 )
# country="Greece"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=768 16777215 100 0 87498901 87498901 0 0
# compatibility_mode=5893 16776574 100 94 608868 102036696 0 0
# compatibility_mode=8192 67108863 100 0 196 196 0 0
# scanned=989
# found=0
# cleaned=0
# scan_time=50
[email protected] as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b45a480753ee39489ba5f243ca494bb9
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-10-07 10:23:10
# local_time=2012-10-07 01:23:10 )
# country="Greece"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=768 16777215 100 0 87499034 87499034 0 0
# compatibility_mode=5893 16776574 100 94 609001 102036829 0 0
# compatibility_mode=8192 67108863 100 0 329 329 0 0
# scanned=155119
# found=2
# cleaned=0
# scan_time=5795
D:\stav\Dirt.3-SKIDROW\sr-dirt3.iso a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I
D:\stav\Need.for.Speed.Hot.Pursuit-RELOADED\rld-nshp.iso a variant of Win32/Packed.VMProtect.AAD trojan (unable to clean) 00000000000000000000000000000000 I




and this is the log from the mbam scan

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Database version: v2012.10.07.02

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Κατρίν :: BLANCO [administrator]

7/10/2012 11:30:56 πμ
mbam-log-2012-10-07 (11-30-56).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 221536
Time elapsed: 1 minute(s), 34 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

so it seems there are 2 trojans left from iso files I dl'ed from net....
  • 0

#21
Crowbar

Crowbar

    Teacher

  • GeekU Moderator
  • 4,487 posts
Hi Stavkon13,
I think your computer is looking pretty good now,
I would love to have you delete those 2 files:
D:\stav\Dirt.3-SKIDROW\sr-dirt3.iso
D:\stav\Need.for.Speed.Hot.Pursuit-RELOADED\rld-nshp.iso

In the future, it would be wise not to download files like those from P2P sites, as they are usually the main way that malware infections are spread today.

Once you delete those 2 files:

Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL by right clicking the icon and selecting Run as Administrator
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [resethosts]
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

  • Download OTC to your desktop and run it
  • Click Yes to beginning the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.


We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Go to control panel
  • Select folder options (Appearance > Folder options in category view)
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.


Posted Image
Please see this article about a serious exploit in Java. It would be wise to follow those instructions, until Java is updated, probably in the middle of the October.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
  • Go to this site and click Do I have Java
  • It will check your current version and then offer to update to the latest version


SPRING CLEAN

To manually create a new Restore Point

  • Go to Control Panel and select System
  • Select System
  • On the left select System Protection and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create

Now we can purge the infected ones

  • Go Start > All programs > Accessories > system tools
  • Right click Disc cleanup and select run as administrator
  • Select Your main drive and accept the warning if you get one
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Posted Image
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programs on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe :wave:
  • 0

#22
stavkon13

stavkon13

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
hi again, I will do everything tonight when I get back home....

I already have malwarebytes running, and will also use the rest of the software you are advising me too...the laptop is running fine and there isn't a single strange thing to report :) :) :)

Thanx again for everything....
  • 0

#23
Crowbar

Crowbar

    Teacher

  • GeekU Moderator
  • 4,487 posts
You are very welcome :cool:

Thanks for helping me get a little bit closer to graduation! :thumbsup:
  • 0

#24
Dakeyras

Dakeyras

    Anti-Malware Mammoth

  • Expert
  • 9,723 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP