[Anilou]

Hello,can anyone please help me? every malwarebytes program or anti virus program I try to download is being immediately deleted saying the program contained a virus and was deleted. I cant even download pdf files.
I have tried to down load OTL but that was deleted also

Edited by Anilou, 01 July 2013 - 05:30 PM.

[Advertisements]

Which Operating System is installed?

[JSntgRvr]

Which Operating System is installed?

[Anilou]

Windows 7 Home Premium

[JSntgRvr]

Please download Farbar Recovery Scan Tool and save it to a flash drive.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Plug the flash drive into the infected PC.

• If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
  
  If you are using Vista or Windows 7 enter System Recovery Options.
  
  To enter System Recovery Options from the Advanced Boot Options:
• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.
• Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.
  To make a repair disk on Windows 7 consult: http://www.sevenforu...isc-create.html
  
  
  To enter System Recovery Options by using Windows installation disc:
• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.
• On the System Recovery Options menu you will get the following options:
• Startup Repair
• System Restore
• Windows Complete PC Restore
• Windows Memory Diagnostic Tool
• Command Prompt
• Select Command Prompt
  
  Once in the Command Prompt:
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[Anilou]

I am not able to download Farbar Recovery Scan Tool on this computer and I don't have another one to use.
as soon as I try to download it the msg appears that it contained a virus and was deleted.

[JSntgRvr]

Somehow we need to get a report to be able to identify the issue. Turn Off all your security and attempt a download.

[Anilou]

yes I have tried that as well.
now I am unable to activate them again.

[JSntgRvr]

Press the Windows Key+R on your keyboard. At the Run Command copy and paste the following and click OK.

CMD /C Dir /s /a:l c:\* >>"%Userprofile%\desktop\Report.txt"

A Report.txt should be produced on your desktop. Open that file with Notepad and post its contents in a reply.

[Anilou]

all that opens is a black blank box

[JSntgRvr]

Yes. Wait until the black box closes (it will take a while), then check your desktop for a Report.txt file.

[Anilou]

Volume in drive C is OS
Volume Serial Number is DC44-2ADF

Directory of c:\

14/07/2009 02:38 PM <JUNCTION> Documents and Settings [C:\Users]
0 File(s) 0 bytes

Directory of c:\Program Files\Windows Defender

14/07/2009 03:07 PM <SYMLINKD> en-US [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpClient.dll [c:\windows\system32\config]
14/07/2009 11:09 AM <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpCommu.dll [c:\windows\system32\config]
14/07/2009 10:59 AM <SYMLINK> MpEvMsg.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpOAV.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpRTP.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpSvc.dll [c:\windows\system32\config]
14/07/2009 11:09 AM <SYMLINK> MSASCui.exe [c:\windows\system32\config]
20/11/2010 10:57 PM <SYMLINK> MsMpCom.dll [c:\windows\system32\config]
14/07/2009 10:59 AM <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
12 File(s) 3,919,360 bytes

Directory of c:\ProgramData

14/07/2009 02:38 PM <JUNCTION> Application Data [C:\ProgramData]
14/07/2009 02:38 PM <JUNCTION> Desktop [C:\Users\Public\Desktop]
14/07/2009 02:38 PM <JUNCTION> Documents [C:\Users\Public\Documents]
14/07/2009 02:38 PM <JUNCTION> Favorites [C:\Users\Public\Favorites]
14/07/2009 02:38 PM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14/07/2009 02:38 PM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes

Directory of c:\Users

14/07/2009 02:38 PM <SYMLINKD> All Users [C:\ProgramData]
14/07/2009 02:38 PM <JUNCTION> Default User [C:\Users\Default]
0 File(s) 0 bytes

Directory of c:\Users\All Users

14/07/2009 02:38 PM <JUNCTION> Application Data [C:\ProgramData]
14/07/2009 02:38 PM <JUNCTION> Desktop [C:\Users\Public\Desktop]
14/07/2009 02:38 PM <JUNCTION> Documents [C:\Users\Public\Documents]
14/07/2009 02:38 PM <JUNCTION> Favorites [C:\Users\Public\Favorites]
14/07/2009 02:38 PM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
14/07/2009 02:38 PM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes

Directory of c:\Users\Anita

20/07/2011 12:30 PM <JUNCTION> Application Data [C:\Users\Anita\AppData\Roaming]
20/07/2011 12:30 PM <JUNCTION> Cookies [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies]
20/07/2011 12:30 PM <JUNCTION> Local Settings [C:\Users\Anita\AppData\Local]
20/07/2011 12:30 PM <JUNCTION> My Documents [C:\Users\Anita\Documents]
20/07/2011 12:30 PM <JUNCTION> NetHood [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
20/07/2011 12:30 PM <JUNCTION> PrintHood [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
20/07/2011 12:30 PM <JUNCTION> Recent [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Recent]
20/07/2011 12:30 PM <JUNCTION> SendTo [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\SendTo]
20/07/2011 12:30 PM <JUNCTION> Start Menu [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Start Menu]
20/07/2011 12:30 PM <JUNCTION> Templates [C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes

Directory of c:\Users\Anita\AppData\Local

20/07/2011 12:30 PM <JUNCTION> Application Data [C:\Users\Anita\AppData\Local]
20/07/2011 12:30 PM <JUNCTION> History [C:\Users\Anita\AppData\Local\Microsoft\Windows\History]
20/07/2011 12:30 PM <JUNCTION> Temporary Internet Files [C:\Users\Anita\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes

Directory of c:\Users\Anita\Documents

20/07/2011 12:30 PM <JUNCTION> My Music [C:\Users\Anita\Music]
20/07/2011 12:30 PM <JUNCTION> My Pictures [C:\Users\Anita\Pictures]
20/07/2011 12:30 PM <JUNCTION> My Videos [C:\Users\Anita\Videos]
0 File(s) 0 bytes

Directory of c:\Users\Default

14/07/2009 02:38 PM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
14/07/2009 02:38 PM <JUNCTION> Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
14/07/2009 02:38 PM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
14/07/2009 02:38 PM <JUNCTION> My Documents [C:\Users\Default\Documents]
14/07/2009 02:38 PM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
14/07/2009 02:38 PM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
14/07/2009 02:38 PM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
14/07/2009 02:38 PM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
14/07/2009 02:38 PM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
14/07/2009 02:38 PM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes

Directory of c:\Users\Default\AppData\Local

14/07/2009 02:38 PM <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
14/07/2009 02:38 PM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
14/07/2009 02:38 PM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes

Directory of c:\Users\Default\Documents

14/07/2009 02:38 PM <JUNCTION> My Music [C:\Users\Default\Music]
14/07/2009 02:38 PM <JUNCTION> My Pictures [C:\Users\Default\Pictures]
14/07/2009 02:38 PM <JUNCTION> My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes

Directory of c:\Users\Public\Documents

14/07/2009 02:38 PM <JUNCTION> My Music [C:\Users\Public\Music]
14/07/2009 02:38 PM <JUNCTION> My Pictures [C:\Users\Public\Pictures]
14/07/2009 02:38 PM <JUNCTION> My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes

Directory of c:\Windows\winsxs\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea

14/07/2009 10:59 AM <SYMLINK> MpEvMsg.dll [c:\windows\system32\config]
1 File(s) 52,224 bytes

Directory of c:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c

14/07/2009 11:11 AM <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpClient.dll [c:\windows\system32\config]
14/07/2009 11:09 AM <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpCommu.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpOAV.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpRTP.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpSvc.dll [c:\windows\system32\config]
14/07/2009 11:09 AM <SYMLINK> MSASCui.exe [c:\windows\system32\config]
14/07/2009 10:59 AM <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
10 File(s) 3,806,208 bytes

Directory of c:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306

14/07/2009 11:11 AM <SYMLINK> MpAsDesc.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpClient.dll [c:\windows\system32\config]
14/07/2009 11:09 AM <SYMLINK> MpCmdRun.exe [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpCommu.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpOAV.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpRTP.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MpSvc.dll [c:\windows\system32\config]
14/07/2009 11:09 AM <SYMLINK> MSASCui.exe [c:\windows\system32\config]
20/11/2010 10:57 PM <SYMLINK> MsMpCom.dll [c:\windows\system32\config]
14/07/2009 10:59 AM <SYMLINK> MsMpLics.dll [c:\windows\system32\config]
14/07/2009 11:11 AM <SYMLINK> MsMpRes.dll [c:\windows\system32\config]
11 File(s) 3,867,136 bytes

Total Files Listed:
34 File(s) 11,644,928 bytes
51 Dir(s) 610,780,909,568 bytes free

[JSntgRvr]

Build and run the following batch file:

• Copy the entire contents of the Quote Box below to Notepad.
• Name the file as Reparse.bat
• Change the Save as Type to All Files
• and Save it on the desktop
• Once saved, right click on the Reparse.bat and select run as an administrator.

@Echo off
cd /d %~dp0
Color 1f
Title Removing Reparse Points by JSntgRvr
ECHO Working....... Please wait
fsutil reparsepoint delete "c:\Program Files\Windows Defender"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\en-US"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpAsDesc.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpClient.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpCmdRun.exe"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpCommu.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpEvMsg.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpOAV.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpRTP.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpSvc.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MSASCui.exe"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MsMpCom.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MsMpLics.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MsMpRes.dll"
Echo Seaching for Reparsed Points, please wait.
Dir /s /a:l c:\* >"%Userprofile%\desktop\Report.txt"
Start "%Userprofile%\desktop\Report.txt"
Exit

Once the MSDOS window closes, open the Report.txt and post its contents.

[Anilou]

wont allow me to save it as all files

[JSntgRvr]

Open an administrator Command prompt.

Click on Start, type CMD on the search box and press CTRL+SHIFT+Enter. The command window will be opened and on the upper left corner should say Administrator.

Copy and Paste the following lines on the prompt, one by one and press Enter.

fsutil reparsepoint delete "c:\Program Files\Windows Defender"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\en-US"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpAsDesc.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpClient.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpCmdRun.exe"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpCommu.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpEvMsg.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpOAV.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpRTP.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MpSvc.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MSASCui.exe"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MsMpCom.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MsMpLics.dll"
fsutil reparsepoint delete "c:\Program Files\Windows Defender\MsMpRes.dll"
Dir /s /a:l c:\* >"%Userprofile%\desktop\Report.txt"
Start "%Userprofile%\desktop\Report.txt"
Exit

When the Report.txt opens, post its contents in a reply.

[Anilou]

doesn't say administrator just users anita