[Essexboy]

That's OK they are not a problem, it looks like this will be a repair job. So lets see where the problem lies

Download and run farbar service scanner



Tick "All" options.
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

[Advertisements]

So glad these scans are working

Farbar Service Scanner Version: 03-03-2013
Ran by jmacbeth (administrator) on 05-04-2013 at 10:30:54
Running from "C:\Users\jmacbeth\Downloads"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Network
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Attempt to access Yahoo.com returned error: Yahoo.com is offline


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy:
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

BITS Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

[joy2mac]

So glad these scans are working

Farbar Service Scanner Version: 03-03-2013
Ran by jmacbeth (administrator) on 05-04-2013 at 10:30:54
Running from "C:\Users\jmacbeth\Downloads"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Network
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Attempt to access Yahoo.com returned error: Yahoo.com is offline


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy:
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

BITS Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

[Essexboy]

OK download these two reg files to your desktop

[attachment=64115:BITS.reg]
[attachment=64116:wuauserv.reg]

Double click each in turn and allow to merge with the registry
Reboot and run FSS again please

[joy2mac]

Here is the FSS log created after registry merge and reboot:


Farbar Service Scanner Version: 03-03-2013
Ran by jmacbeth (administrator) on 05-04-2013 at 10:42:30
Running from "C:\Users\jmacbeth\Downloads"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Network
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy:
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

BITS Service is not running. Checking service configuration:
The start type of BITS service is OK.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

[Essexboy]

Are you booting in normal mode ? As the logs report network mode

Download Windows Repair (all in one) from this site

Install the programme then run



Go to step 3 and allow it to run SFC



On the start repairs tab click start


Select the following items and tick restart system when finished

[joy2mac]

I have been operating in Safe Mode - is this ok?

I had trouble finding the place to download the Windows Repair; I clicked on the "Download Now" (green tab) on the website and it directed me to Reimageplus.com. Should I download the Reimage program here?

Thanks for being so quick!

[Essexboy]

http://www.tweaking....r_aio_setup.exe use this direct link

Normal mode would be better

[joy2mac]

The direct link brings me to www.tweaking.com (same web page as before). When I click on "Download Now" it brings me to Reimageplus.com.

I will reboot in normal mode from here on out.

[Essexboy]

These are the download buttons
[attachment=64117:Capture.JPG]

[joy2mac]

Hi, and thanks again.

The Tweaking Windows Repair All-in-One System was installed. I ran it twice (22 minutes and 10 minutes). Both times it stalled at:

Searching: C:\FRST\Quarantine\Content.IE5\J94JMTRT\wbkDF50.tmp

Details are below:

- Normal Mode
- Uninstalled all anti-virus programs (AVG, CCleaner, SpyBot, Malowarebytes)
- Ran Windows Repair SFC - "Verification 100% complete. Windows Resource Protection did not find any integrity violations."
- Restart
- Ran Windows Repair, created backup registry and restore point, checked the items as directed from Post #20
- After 3 minutes, Dialog box read: Unhide Non System Files: Files Unhidden: 5 - Last File Unhidden: C:\SYSTEM.SAV
- Searching: C:\FRST\Quarantine\Content.IE5\J94JMTRT\wbkDF50.tmp
- Status: Working...
- I stopped the repair after 22 and 10 minutes (no progress made)


The Logs are Below:

Log:
Starting Repairs...
Start (4/5/2013 2:10:14 PM)

Repair WMI
Start (4/5/2013 2:10:14 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:10:19 PM)

Repair Windows Firewall
Start (4/5/2013 2:10:19 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:10:25 PM)

Repair Internet Explorer
Start (4/5/2013 2:10:25 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:10:31 PM)

Repair MDAC/MS Jet
Start (4/5/2013 2:10:31 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:10:37 PM)

Remove Policies Set By Infections
Start (4/5/2013 2:10:38 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:10:44 PM)

Repair Missing Start Menu Icons Removed By Infections
Start (4/5/2013 2:10:44 PM)
Running Repair Under System Account
Done (4/5/2013 2:10:47 PM)

Repair Icons
Start (4/5/2013 2:10:47 PM)
Running Repair Under System Account
Done (4/5/2013 2:10:50 PM)

Repair Winsock & DNS Cache
Start (4/5/2013 2:10:50 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:10:56 PM)

Unhide Non System Files
Start (4/5/2013 2:10:56 PM)

Stopping, Waiting for current repair to finish...

C:\ - Total Files Unhidden: 5
Repairs Stopped By User.
Done (4/5/2013 2:32:24 PM)
Total Repair Time: 00:22:11

---------------------------------------------------------------------------------------------------------

Log:
Starting Repairs...
Start (4/5/2013 2:54:50 PM)

Repair WMI
Start (4/5/2013 2:54:50 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:56:49 PM)

Repair Windows Firewall
Start (4/5/2013 2:56:49 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:57:21 PM)

Repair Internet Explorer
Start (4/5/2013 2:57:21 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:57:51 PM)

Repair MDAC/MS Jet
Start (4/5/2013 2:57:51 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:58:02 PM)

Remove Policies Set By Infections
Start (4/5/2013 2:58:02 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:58:07 PM)

Repair Missing Start Menu Icons Removed By Infections
Start (4/5/2013 2:58:07 PM)
Running Repair Under System Account
Done (4/5/2013 2:58:09 PM)

Repair Icons
Start (4/5/2013 2:58:09 PM)
Running Repair Under System Account
Done (4/5/2013 2:58:12 PM)

Repair Winsock & DNS Cache
Start (4/5/2013 2:58:12 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/5/2013 2:58:27 PM)

Unhide Non System Files
Start (4/5/2013 2:58:27 PM)

Stopping, Waiting for current repair to finish...

C:\ - Total Files Unhidden: 0
Repairs Stopped By User.
Done (4/5/2013 3:07:32 PM)
Total Repair Time: 00:12:43

[Essexboy]

How is the computer behaving now in normal mode ?

[joy2mac]

Hi,

The computer seems to be behaving ok in normal mode. The pop-up window I was getting as a sign of the virus is no longer appearing. Can I try running AVG, Malowarebytes, CCleaner and see if these can now run all the way through without stall? I originally thought they were stalling b/c the virus wasn't completely removed.

[joy2mac]

Hi,

The computer seems to be behaving ok in normal mode. The pop-up window I was getting as a sign of the virus is no longer appearing. Can I try running AVG, Malowarebytes, CCleaner and see if these can now run all the way through without stall? I originally thought they were stalling b/c the virus wasn't completely removed.

[Essexboy]

Yes try the programmes now and let me know the result

[joy2mac]

Hi,

Malowarebytes and CCleaner: success! clean scans

AVG Anti-Virus: Stalled (continuous running) at C:\FRST\Quarantine\Content.IE…\adsCAE….js. Ran it for 1.5 hours.

Also, I have files on the USB used to boot the computer with FRST. Is it ok to use this USB normally or do files/USB need to be cleaned somehow?

thank you for working on the weekend