[Andrewchan]

Thanks! So far so good. I will run it for the next few days and report if any other problem pops up.

Did the report I send in the last post shows all clear?

Edited by Andrewchan, 20 March 2013 - 06:43 AM.

[Advertisements]

Hi Andrewchan,

I would like to see Malwarebytes log. In meantime I'll prepare some cleanup for you...

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[maliprog]

Hi Andrewchan,

I would like to see Malwarebytes log. In meantime I'll prepare some cleanup for you...

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[Andrewchan]

Help! Now I can't start up in normal mode. What do I need to do? It load to a blue screen with error message but can got to safe mode. In safe mode, I can't go on Internet. Attached is the error message.

Attached Thumbnails

• 

Edited by Andrewchan, 21 March 2013 - 05:39 AM.

[maliprog]

When did this happened? Before running malwarebytes or after?

If it was after Malwarebytes then please tell me did it remove any malware on your system?

[Andrewchan]

this is before I try to execute your instruction.

[maliprog]

This error is cause by nvidia driver. Did you do updated your driver before this?

Can you try do to System restore. Restore your system to just a day ago if you can fined that restore point.

After this we need to double check your system for malware. Let me know results.

[Andrewchan]

Did not do anything but now the PC restart properly. Followed your instruction and below is the log after cleaning 2 virus.

===============================

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.03.23.03

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
user :: USER-PC [administrator]

3/23/2013 11:09:53 AM
mbam-log-2013-03-23 (11-09-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 212212
Time elapsed: 4 minute(s), 6 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\user\Downloads\BestCodecsPack.exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.
C:\Users\user\Downloads\XvidSetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.

(end)

[maliprog]

Hi Andrewchan,

I'm glad that worked. Your logs and system are clean now. I'm glad we fix up your computer.

Step 1

Please close all running programs and Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  
  :Commands
  [purity]
  [emptytemp]
  [resethosts]
  [clearallrestorepoints]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Step 2

We need to clean up your PC from programs we used.

Please start OTL one more time and click CleanUp button. OTL will restart your system at the end.

In case that any of the software we used in this fix still remains on your system please delete it manually (Right click on it and select Delete).

General recommendations

Here are some recommendations you should follow to minimize infection risk in the future:

1. Something to read

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

2. Make Backups of Important Files

Please read this article Home Computer Data Backup.

3. Regularly update your software

To eliminate design flaws and security vulnerabilities, all software needs to be updated to the latest version or the vendor’s patch installed.

You should download Update Checker from here. The program will automaticly check for newer version of software installed on your system.

[maliprog]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.