That's a littile progress.
Here's one thing that concerns me. This is from the Extras.txt log you posted:
Error - 12/17/2012 9:44:10 AM | Computer Name = amanda-TOSH | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort0.
I have discussed this with a colleague. This is usually an indication that the mother board is going bad. But I've also seen system errors like this that went away when the malware was removed. So what we want to do is remove the malware (if it isn't the mother board) and then see where we are.
The system crashes when aswMBR is run is also an indication that malware is preventing it from running.
In this round we are gonna run AdwCleaner again and have it remove the rest of the bad toolbar and BHO items on the machine. Then I want to rename aswMBR and see if we can get it to run.Step-1. Re-run AdwCleaner Fix Close all open windows and browsers.
Step-2.Run aswMBRChange the name of the aswMBR.exe file.
- Double click the adwcleaner.exe file to run AdwCleaner. (Vista and 7 users)right click The adwcleaner.exe, click Run as administrator and accept the UAC prompt to run AdwCleaner.
- Click the Deletion button and wait for the scan.
- Everything that was found will be deleted.
- When the scan ends, a report appears.
- Once done it will ask to reboot, allow this
- On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner[S1].txt
To do that:
- Right click on the aswMBR.exe file and click Rename in the context menu.
- Rename the aswMBR.exe file to iexplore.exe.
- Double click the iexplore.exe file to run it. (Windows /7 users: Right click the file and click Run as Administrator. If you get a UAC window, allow the file to run.
- If it asks you if you want to download the latest virus definitions, click "No"
- Click the "Scan" button to start the scan
- On completion of the scan click save log. Save it to your desktop and post in your next reply.
When you run aswMBR
, if it is shutdown automatically, then it is most likely the infection detecting that aswMBR
is running and terminating it. In this situation you should rename executable to iexplore.exe
and try it again.Step-3.Things For Your Next Post:Please post the logs in the order requested. Do Not
attach the logs unless I request it.1.
The AdwCleaner[S1].txt log2.
The aswMBR (iexplore.exe) log