[Essexboy]

It could be a temporary glitch

[Advertisements]

Okay, Sorry about the delay it scanned all night.  Here is the detected threat reports.  I skipped treating each one.  I will go on to start the rest of your instructions now.

 

Status: Detected   (events: 10)

12/9/2014 5:07:22 PM Detected adware not-a-virus:AdWare.Win32.AnProt.a C:\FRST\Quarantine\C\Program Files (x86)\AnyProtectEx\AnyProtectTrayIcon.exe Medium

12/9/2014 5:07:22 PM Detected adware not-a-virus:AdWare.Win32.AnProt.a C:\AdwCleaner\Quarantine\C\Users\Kevon\AppData\Local\AnyProtectScannerSetup.exe.vir//AnyProtectTrayIcon.exe Medium

12/9/2014 8:28:10 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\AppData\Local\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/9/2014 8:37:20 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\AppData\Local\tmp13205\dag13205.exe//# Medium

12/9/2014 10:14:58 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\AppData\Local\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/9/2014 10:22:17 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\Local Settings\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/9/2014 11:00:36 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\Local Settings\tmp13205\dag13205.exe//# Medium

12/9/2014 11:00:50 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\AppData\Local\tmp13205\dag13205.exe//# Medium

12/10/2014 1:15:10 AM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\Local Settings\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/10/2014 9:22:54 AM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\Local Settings\tmp13205\dag13205.exe//# Medium

[Aaron Beleven]

Okay, Sorry about the delay it scanned all night.  Here is the detected threat reports.  I skipped treating each one.  I will go on to start the rest of your instructions now.

 

Status: Detected   (events: 10)

12/9/2014 5:07:22 PM Detected adware not-a-virus:AdWare.Win32.AnProt.a C:\FRST\Quarantine\C\Program Files (x86)\AnyProtectEx\AnyProtectTrayIcon.exe Medium

12/9/2014 5:07:22 PM Detected adware not-a-virus:AdWare.Win32.AnProt.a C:\AdwCleaner\Quarantine\C\Users\Kevon\AppData\Local\AnyProtectScannerSetup.exe.vir//AnyProtectTrayIcon.exe Medium

12/9/2014 8:28:10 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\AppData\Local\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/9/2014 8:37:20 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\AppData\Local\tmp13205\dag13205.exe//# Medium

12/9/2014 10:14:58 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\AppData\Local\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/9/2014 10:22:17 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\Local Settings\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/9/2014 11:00:36 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\Local Settings\tmp13205\dag13205.exe//# Medium

12/9/2014 11:00:50 PM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Documents and Settings\Guest 1\AppData\Local\tmp13205\dag13205.exe//# Medium

12/10/2014 1:15:10 AM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\Local Settings\tmp13205\dag13205.exe//data0000.res/wpennybeed.exe Medium

12/10/2014 9:22:54 AM Detected adware not-a-virus:AdWare.Win32.PennyBee.a C:\Users\Guest 1\Local Settings\tmp13205\dag13205.exe//# Medium

[Aaron Beleven]

My program doesn't have a Manual Scan option (oddlly, in reports it has Manual Disinfection option):

 

[Essexboy]

Darn they have changed the programme

 

OK I will run a quick check for a replacement

[Essexboy]

OK AVZ is still available as a standalone tool http://support.kaspe...?el=1698#block2

Could you follow the instructions on the page to create the log. I will work on a set of instructions for this now but rather than keep you waiting

You will need to attach KL_syscure.zip

[Aaron Beleven]

.

Attached Files

•  KL_syscure.zip   58.02KB   127 downloads

[Essexboy]

The timing was perfect as I have just finished making the instructions

Could you let me know how it is running on completion

Open AVZ as before
Click "File" > "Custom scripts"


A dialogue will open
Copy and paste the following script into the marked space


Script for insertion :
 

begin
DeleteFile('');C:\Users\Kevon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
QuarantineFile('C:\Users\Kevon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini','');
DeleteService('SymELAM');
StopService('SymELAM');
BC_DeleteSvc('SymELAM');
DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SymELAM.sys','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SymELAM.sys');
DeleteFile('C:\Program Files (x86)\Mobogenie3\Mobogenie.exe','32');
BC_DeleteFile('C:\Program Files (x86)\Mobogenie3\Mobogenie.exe');
DeleteFile('C:\Users\Kevon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini','32');
BC_DeleteFile('C:\Users\Kevon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini');
DeleteFile('C:\WINDOWS\system32\drivers\NIS\1405000.01C\SYMEFA64.SYS','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NIS\1405000.01C\SYMEFA64.SYS');
DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SRTSP64.SYS','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SRTSP64.SYS');
DeleteFile('C:\WINDOWS\system32\drivers\NdisImPlatform.sys','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NdisImPlatform.sys');
BC_ImportDeletedList;
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Ensure that you copy from begin to end

[Aaron Beleven]

Oddly, I've noticed it's running even better now.  I don't know what's happening while we're working so I can't explain it.

 

Okay, so I pasted the script & selected "Run".  Here is the error .  I didn't proceed.

 

Edited by Aaron Beleven, 10 December 2014 - 12:31 PM.

[Essexboy]

Hmm I may have made a minor error in the script


Open AVZ as before
Click "File" > "Custom scripts"


A dialogue will open
Copy and paste the following script into the marked space then press run


Script for insertion :
 

begin
StopService('SymELAM');
BC_DeleteSvc('SymELAM');
DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SymELAM.sys','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SymELAM.sys');
DeleteFile('C:\Program Files (x86)\Mobogenie3\Mobogenie.exe','32');
BC_DeleteFile('C:\Program Files (x86)\Mobogenie3\Mobogenie.exe');
DeleteFile('C:\Users\Kevon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini','32');
BC_DeleteFile('C:\Users\Kevon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini');
DeleteFile('C:\WINDOWS\system32\drivers\NIS\1405000.01C\SYMEFA64.SYS','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NIS\1405000.01C\SYMEFA64.SYS');
DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SRTSP64.SYS','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NISx64\1405000.01C\SRTSP64.SYS');
DeleteFile('C:\WINDOWS\system32\drivers\NdisImPlatform.sys','32');
BC_DeleteFile('C:\WINDOWS\system32\drivers\NdisImPlatform.sys');
BC_ImportDeletedList;
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Ensure that you copy from begin to end

[Aaron Beleven]

It's running better & doesn't feel laggy.  Just old    & slow in an old machine sort of way.   It's playing videos now.  I opened up both browsers and it surfed a few sites.  Loading animations are fluid.  I'm not sure how best to check performance but I think it's another miracle from here.  I'm happy at this point.

[Essexboy]

You still had some Norton drivers running along with one piece of adware... Take it for a test run now and when you are happy let me know and we will tidy up

[Aaron Beleven]

So I ran Norton results were no threats found.  Unfortunately I had to uninstall Avast as I don't know how to simply turn it off.  I know I can get it again, but just in case I wanted to let you know.

 

Also, Norton notified me it needed updates but repeatedly failed to get those updates installed.

Edited by Aaron Beleven, 10 December 2014 - 05:52 PM.

[Essexboy]

Is the licence for Norton still valid or has it expired ?

[Aaron Beleven]

Yes it was. It said I needed to Renew and I attempted to and it appears to me it's simply reinstalled. Or restart A trial version.

Just a heads up, I won't have access to that machine for one and one half days. Though it is possible it'll be sooner.

[Essexboy]

No problem on the time