[bendevos]

yes but will do it again this weekend

[Advertisements]

OK i have tried two times again...

 

the check disk freezes at the same point :

 

14% step5/5 844 clusters free on 31XXXXXX handled

[bendevos]

OK i have tried two times again...

 

the check disk freezes at the same point :

 

14% step5/5 844 clusters free on 31XXXXXX handled

[Biscuithd]

This is quite perplexing! I'm sure for you too    So, let's re-trace some of our steps and see what I missed.

 

Please re-run ComboFix and post the results.

 

Scan with ComboFix

This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

 

 

 

[bendevos]

here it is 

 

ComboFix 15-02-02.01 - Christian 05/02/2015  20:53:43.4.2 - x86

Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.32.1036.18.3062.1226 [GMT 1:00]

Lancé depuis: C:\Users\Christian\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Un nouveau point de restauration a été créé

 

 

(((((((((((((((((((((((((((((   Fichiers créés du 2015-01-05 au 2015-02-05  ))))))))))))))))))))))))))))))))))))

 

 

2015-02-05 20:05:16 . 2015-02-05 20:05:16 -------- d-----w- C:\Users\Default\AppData\Local\temp

2015-01-25 18:41:49 . 2015-02-05 20:05:23 -------- d-----w- C:\Users\Christian\AppData\Local\temp

2015-01-22 21:04:49 . 2015-01-25 19:28:14 35064 ----a-w- C:\Windows\system32\drivers\TrueSight.sys

2015-01-22 21:04:47 . 2015-01-22 21:04:49 -------- d-----w- C:\ProgramData\RogueKiller

2015-01-20 20:26:53 . 2015-01-24 12:54:06 -------- d-----w- C:\FRST

2015-01-20 19:54:57 . 2015-01-20 19:54:57 -------- d-----w- C:\_OTL

2015-01-20 18:23:56 . 2015-01-20 18:23:56 114904 ----a-w- C:\Windows\system32\drivers\6BCB7B62.sys

2015-01-18 20:57:11 . 2015-01-24 13:01:51 114904 ----a-w- C:\Windows\system32\drivers\MBAMSwissArmy.sys

2015-01-18 20:54:23 . 2014-11-21 05:14:16 51928 ----a-w- C:\Windows\system32\drivers\mwac.sys

2015-01-18 20:54:23 . 2014-11-21 05:14:10 75480 ----a-w- C:\Windows\system32\drivers\mbamchameleon.sys

2015-01-18 20:54:23 . 2014-11-21 05:14:06 23256 ----a-w- C:\Windows\system32\drivers\mbam.sys

2015-01-18 20:54:15 . 2015-01-18 20:54:26 -------- d-----w- C:\Program Files\Malwarebytes Anti-Malware

2015-01-18 20:54:15 . 2015-01-18 20:54:15 -------- d-----w- C:\ProgramData\Malwarebytes

2015-01-18 20:42:21 . 2015-01-18 20:42:21 -------- d-----w- C:\Program Files\Canon

2015-01-18 12:22:24 . 2015-01-26 18:56:49 -------- d-----w- C:\found.001

.

 

 

((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))

 

2014-12-10 16:46:55 . 2013-02-28 13:02:58 701104 ----a-w- C:\Windows\system32\FlashPlayerApp.exe

2014-12-10 16:46:55 . 2012-02-14 09:05:56 71344 ----a-w- C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-12-03 02:06:01 . 2014-12-11 11:36:49 278528 ----a-w- C:\Windows\system32\schannel.dll

2014-12-02 11:01:11 . 2014-12-26 07:07:42 9054624 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5C572487-156E-481B-B7CB-BF64043F9C57}\mpengine.dll

2014-11-24 20:44:32 . 2014-12-11 10:32:38 367104 ----a-w- C:\Windows\system32\html.iec

2014-11-24 20:40:49 . 2014-12-11 10:32:36 1810944 ----a-w- C:\Windows\system32\jscript9.dll

2014-11-24 20:35:25 . 2014-12-11 10:32:39 1129472 ----a-w- C:\Windows\system32\wininet.dll

2014-11-24 20:34:40 . 2014-12-11 10:32:41 1427968 ----a-w- C:\Windows\system32\inetcpl.cpl

2014-11-24 20:33:56 . 2014-12-11 10:32:38 142848 ----a-w- C:\Windows\system32\ieUnatt.exe

2014-11-24 20:33:47 . 2014-12-11 10:32:42 421376 ----a-w- C:\Windows\system32\vbscript.dll

2014-11-24 20:32:47 . 2014-12-11 10:32:42 11776 ----a-w- C:\Windows\system32\mshta.exe

2014-11-24 20:32:36 . 2014-12-11 10:32:38 2382848 ----a-w- C:\Windows\system32\mshtml.tlb

2014-11-24 13:04:58 . 2009-10-03 20:22:49 229000 ------w- C:\Windows\system32\MpSigStub.exe

2014-11-18 13:56:48 . 2014-11-18 13:56:48 1202848 ----a-w- C:\Windows\system32\FM20.DLL

 

 

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))

 

 

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2009-04-11 06:28:03 1233920]

"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 02:25:11 125952]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2014-02-02 16:03:29 39408]

"Adobe Reader Synchronizer"="C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe" [2014-12-03 18:06:16 1104288]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 13:44:58 178712]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-04-01 08:56:12 141848]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-04-01 08:55:54 166424]

"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-04-01 08:56:06 133656]

"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-08-31 10:04:26 102400]

"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2007-09-01 12:03:50 32768]

"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2007-09-06 09:23:36 188416]

"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [BU]

"LMgrOSD"="C:\Program Files\Launch Manager\OSD.exe" [2006-12-26 09:23:34 180224]

"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2007-09-07 07:26:54 86016]

"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-07 18:52:05 30192]

"toolbar_eula_launcher"="C:\Program Files\GoogleEULA\EULALauncher.exe" [2007-02-09 13:54:28 16896]

"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 19:50:00 112216]

"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 10:27:00 136768]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 17:36:46 30040]

"Corel Photo Downloader"="C:\Program Files\Corel\Corel MediaOne\Corel Photo Downloader.exe" [2007-08-17 09:50:00 483144]

"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 16:50:37 1022152]

"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 12:05:40 60712]

"FAHConsole"="C:\Program Files\File Association Helper\FAHConsole.exe" [2014-01-28 09:16:30 616632]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2014-01-17 14:24:00 421888]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2014-10-15 04:42:34 157480]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [BU]

 

C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 - Capture d'écran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]

OpenOffice.org 3.3.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\

Scanner Finder.lnk - C:\Program Files\ScanWizard 5\ScannerFinder.exe [2009-1-28 344064]

WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK32.EXE [2014-10-27 565616]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ   FontCache

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2015-01-25 19:27:43 1086280 ----a-w- C:\Program Files\Google\Chrome\Application\40.0.2214.91\Installer\chrmstp.exe

 

Contenu du dossier 'Tâches planifiées'

 

2015-02-05 C:\Windows\Tasks\Adobe Flash Player Updater.job

- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-28 13:02:59 . 2014-12-10 16:46:56]

 

2015-02-05 C:\Windows\Tasks\Final Media Player Update Checker.job

- C:\Program Files\FinalMediaPlayer\FMPCheckForUpdates.exe [2012-04-28 18:57:43 . 2011-03-11 12:24:32]

 

2015-02-05 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-17 21:23:38 . 2014-10-23 15:54:07]

 

2015-02-05 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-17 21:23:38 . 2014-10-23 15:54:07]

 

2012-01-17 C:\Windows\Tasks\User_Feed_Synchronization-{6C7CAD5D-0F3D-4860-9722-FB54520B436D}.job

- C:\Windows\system32\msfeedssync.exe [2014-12-11 10:32:42 . 2014-11-24 20:32:48]

 

 

------- Examen supplémentaire -------

 

uStart Page = about:blank

mStart Page = about:blank

uInternet Settings,ProxyOverride = <local>;*.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

DPF: Microsoft XML Parser for Java

[Biscuithd]

I spent quite a bit of time review your most recent logs and reviewing what we've done to date. And, it would see like what is remaining is a disk problem. Likely a disk that is going bad fairly quickly.
 
Since there is no remaining Malware on you computer, I think the best course for you is to confirm my thoughts on the Hardware area of our board, here.
 
Since the Malware has been resolved, let's remove the tools that we've used so far.

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.

• Make sure that these ones are checked:

• Remove disinfection tools

• Purge system restore

• Reset system settings

• Push Run.

• The program will run for a few seconds and display a notepad report.

Paste it for my review.

[Biscuithd]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.