[Essexboy]

As an addition to the above


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :process
  explorer.exe

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[Advertisements]

Yes, I don't know what's wrong I just know my computer is acting strange and alot of .exe files are ending up corrupt that yellow yield looking sign is telling me that like once a day now

Attached Files

•  ComboFix.txt   28.34KB   164 downloads

[dch1314]

Yes, I don't know what's wrong I just know my computer is acting strange and alot of .exe files are ending up corrupt that yellow yield looking sign is telling me that like once a day now

Attached Files

•  ComboFix.txt   28.34KB   164 downloads

[dch1314]

Here is the other log file. Sorry for the hassle I am just not sure what is up with my computer

Attached Files

•  SystemLook.txt   7.59KB   134 downloads

[Essexboy]

Did you update a programme/driver at this time 2009-04-23 21:53 or was that when you ran SFC ?

[dch1314]

Im not sure I did and I don't know what SFC is. However, that was yesterday so I don't believe I updated a programme/driver.

[Essexboy]

Hmm Combofix shows no problems and the processes running under explorer are legitimate

Download Dr.Web CureIt to the desktop:

• Doubleclick the drweb-cureit icon to start the program.
• press start
• Allow the program to run the initial express scan
• This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
  Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
  
• Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
• Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take several hours)
• During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
  • Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
• Once the scan is complete, on the menu bar, click file and choose report list.
• Save the report to your desktop. The report will be called DrWeb.csv
• Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
• Close Dr.Web Cureit.
• Please post the Dr.Web.txt report in your next reply

[dch1314]

The program states something about combofix contains infected file should I move all files like the program is asking and about those shortcuts ending us missing mysteriously what can I do about that? Are they officially gone? Or can I run a system restore after fixing this problem?

[Essexboy]

Let Dr Web fix all it finds and when we see the result it may give us an idea of the problem

[dch1314]

Okay, I press yes to all...also like I was asking since all my shortcuts are ending up missing and I am sure the actual files are missing because I don't see avg 8.5 in my program file list anymore so are those programs gone forever? I already had to reinstall photoshop and such when they came up missing.

[Essexboy]

So it looks like something is uninstalling your programmes and of all types not just security or is it just removing the links

As combofix reported this AV: AVG Internet Security 3-pack *On-access scanning enabled* (Updated)

[dch1314]

Yes, it told me that the 3 pack was enabled and I needed to disable it before it runs but I don't have it on my system to disable it so that's confusing me alot. Also, yes it removed alot of my programs that had shortcuts on my desktop. I am not sure if its just the links or what they are deleting but I cant find the programs on my computer as of now

[Essexboy]

Is Dr Webb still running ? If so and on completion I would also like a new OTListit log

[dch1314]

Yes, complete scan is still running. I don't have OTLIstIt on the computer anymore so if you can give me the link again that would be appreciated

[Essexboy]

Here you go

• Download OTListIt2 to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

[dch1314]

Here is the Dr. Web log I will post the OtListIt once it's finished

Attached Files

•  DrWeb.txt   60.69KB   260 downloads