[JSntgRvr]

No I was using another computer to post my reply's. I was saving the logs to a thumb drive and then posting them with a good working computer. Is this not right?

Super.

Boot in Normal mode. How does it feels now?

Edited by JSntgRvr, 25 February 2010 - 01:34 PM.

[Advertisements]

I am still getting the same problems.
Programs not responding or opening
whenever shutting down I get stuck on shutting down windows screen and have to hold the power button down to turn the computer off

[HOH_Virus]

I am still getting the same problems.
Programs not responding or opening
whenever shutting down I get stuck on shutting down windows screen and have to hold the power button down to turn the computer off

[JSntgRvr]

Lets try AVP once again. Remove the setup_9.0.0.722_21.02.2010_00-05.exe from your desktop. Open OTS and click on the Cleanup button and follow the prompts.

Save these instructions so you can have access to them while in Safe Mode.

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode.
  

  You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
  Use your up arrow key to highlight SafeMode then hit enter.

• Double click the setup file to run it.
• Click Next to continue.
• It will by default install it to your desktop folder. Click Next.
• Hit ok at the prompt for scanning in Safe Mode.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• System Memory
• Startup Objects
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)

After that click on Security level then choose Customize then click on the tab that says Heuristic Analyzer then choose Enable Deep rootkit search then choose ok.
Then choose OK again then you are back to the main screen.

• Then click on Scan at the to right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left un-neutralized then click the button that says Neutralize all
• If it says it cannot be Neutralized then choose The delete option when prompted.
• Let it run unhindered. It may appear to be hanging, but it may recover.
• After that is done click on the reports button at the bottom and save it to file name it Kas.
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  

  Note: This tool will self uninstall when you close it so please save the log before closing it.

Edited by JSntgRvr, 25 February 2010 - 03:50 PM.

[HOH_Virus]

The directions you gave me for the AVP tool seem to be a little different for which the program is setup
for instance there is a tab that says autoscan and in the box I have checked
Hidden startup objects
disc boot sectors
Computer
but i see nothing similar to check that says system memory.

at the bottom there is a box that says Security level it is set to recommended, when I click on it my choices are High, Recommended, Low, and settings. When I click on settings a window pops up with two tabs called scope and additional.
When I click on the additional tab there is Heuristic Analysis allready checked and it is set to light scan by default then below that there is rootkit scan checked and a button below it that says deep scan which is unchecked. Also Enable self defense is checked.

Am I in the right area of the program?

[JSntgRvr]

Go ahead and scan with those settings. I will have to check if there has been changes to the tool.

[HOH_Virus]

I am 10 minutes into the scan and it is at 1% is that normal?

[JSntgRvr]

I am 10 minutes into the scan and it is at 1% is that normal?

Let it run unhindered.

[HOH_Virus]

I dont think anything is happening but I dont want to mess with it. It is at 1:20:17 and a file has not even been scanned yet.

[JSntgRvr]

Something is wrong and perhaps is not due to this Trojan. Looks like a problem with the Operating System itself. In the logs I see no other malware related problem.

You started this topic on Feb 18, at 05:52 PM. Lets attempt to restore the computer to an earlier date, specifically prior to the date you started the topic and the onset of this behavior.

Stop the Scan. Start the computer and tap on F8 until you reach the advanced options. Instead of Safe Mode, select Repair your computer. If not available, you will need to insert your Windows 7 installation DVD and restart, then press any key when prompted to boot from the cd. At the Install Windows screen, select Repair your computer.

Once you get to the System Recovery Options screen, select System Restore.

Select a date prior to the onset of this behavior and restore the computer to that date.

Let me know the outcome.

[HOH_Virus]

I get a message that says system restore did not complete successfully. You computers system files and settings were not changed.
Details:
An unspecified error occurred during system restore. (0x800700b7)

I tried to do a system restore initially before writing a post on geekstogo.com and it said the same thing from every restore point I tried.

[HOH_Virus]

ok odd but when i restarted it said it was completed successfully and some programs tha I have deleted like daemon tools are back.. So I will test its integrity and get back to you when I find out anything.

[HOH_Virus]

ughh still same problems... I will try a restore date from earlier

[HOH_Virus]

no go... that was the earliest restore point I had Feb 4th...

[JSntgRvr]

In the Advanced Options select Repair your computer, then in the Recovery Options see the drive Windows is installed. Lets call that location X: for now



Select the Command prompt. Type the following and press Enter after each line:

X:
CHKDSK /r

Replace X: for the drive letter Windows is installed. Once done, restart the computer.

It should take a considerable amount of time.

[HOH_Virus]

X:\windows\system32>C:

C:\>CHKDSK /r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another process. Chkdsk may run if this volume is dismounted first. ALL OPENED HANDLES TO THIS VOLUME WOULD BE INVALID.
Would you like to force a dismount on this volume? (Y/N)