[Soup_94]

All .exe files open MS Word and then a bunch of pop-ups display. CTRL-ALT-DEL and killing the MS Word does not help. I ran several SUPER virus/malware programs via the MS-DOS prompt with no success. I need something that will dis-associate whatever has hijacked my programs. I would call this a "Word" virus since that is all that opens...

Can anyone help or give advice?

[Advertisements]

Hello, Soup_94! Welcome to GeekstoGo! I'm piano9playa5 and will be assisting you with your malware problems. If you have any questions, ask away! Just a few tips to make things go smoothly:

• Please be patient. We are all volunteers here, with lives that can keep us busy elsewhere.
  I must check everything with a moderator before posting.
• Don't run tools you see being used in another topic. Running tools unsupervised can be dangerous.
• Copy\Paste logs in your replies, rather than attaching them, unless I instruct you to do otherwise.
  This makes things easier for me, and the moderator looking over this topic.
• Ensure "WordWrap" is disabled in Notepad.
  • Click Start > All Programs > Accessories > Notepad.
  • Click Format > Word Wrap (if checked, if not, leave it)
• To everyone except Soup_94: The instructions following were created specifically for Soup_94, please do not perform these steps unless instructed by a Trusted Helper.

Okay, so just as a quick note - this is a Command file > .COM extension > so it should run.

Download OTL to your desktop.
Firefox users - Right-click and select Save Link As...

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scans/Fixes box at the bottom, paste in the following:

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  nvraid.sys
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav

• Then click the Quick Scan button at the top. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Edited by piano9playa5, 29 March 2010 - 03:08 PM.

[Onaipian]

Hello, Soup_94! Welcome to GeekstoGo! I'm piano9playa5 and will be assisting you with your malware problems. If you have any questions, ask away! Just a few tips to make things go smoothly:

• Please be patient. We are all volunteers here, with lives that can keep us busy elsewhere.
  I must check everything with a moderator before posting.
• Don't run tools you see being used in another topic. Running tools unsupervised can be dangerous.
• Copy\Paste logs in your replies, rather than attaching them, unless I instruct you to do otherwise.
  This makes things easier for me, and the moderator looking over this topic.
• Ensure "WordWrap" is disabled in Notepad.
  • Click Start > All Programs > Accessories > Notepad.
  • Click Format > Word Wrap (if checked, if not, leave it)
• To everyone except Soup_94: The instructions following were created specifically for Soup_94, please do not perform these steps unless instructed by a Trusted Helper.

Okay, so just as a quick note - this is a Command file > .COM extension > so it should run.

Download OTL to your desktop.
Firefox users - Right-click and select Save Link As...

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scans/Fixes box at the bottom, paste in the following:

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  nvraid.sys
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav

• Then click the Quick Scan button at the top. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Edited by piano9playa5, 29 March 2010 - 03:08 PM.

[Soup_94]

piano9playa5 - Thank you for the reply. I had to hand off the PC to a wiser tech friend this afternoon. I had to run out of town and he is going to give it a go. If he fixes, I will post what he did. Otherwise, I will try your recommended options.

- Soup

[Onaipian]

For sure

[Onaipian]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.