[jamz39]

I was referred to this site by JSntgRvr and ask to run the REATOGO program and attach the OTL.txt scan file. This is in reference to my PC continual reboot to safe mode selection screen after downloading software and running from bleeping computer to get rid of the MS removal tool virus.
File is attached.
Thanks

Attached Files

•  OTL.txt   159.41KB   227 downloads

[Advertisements]

Save these instructions in the USB drive.

• Boot to the OTLPE CD
• Please double-click OTLPE.exe to run it as you did before.
• Copy the lines in the quote below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :files
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\procs\explorer.exe
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\h\explorer.exe
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\winlogon.exe
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\userinit.exe
  C:\Documents and Settings\All Users\Application Data\18472756
  D:\My Documents\ComboFixit.exe
  
  :Commands
  [EMPTYTEMP]

• Return to OTLPE, right click in the "Custom Scans/Fixes" window and choose Paste.
• Click the red Run Fix button.
• A report will be produced and saved in the C:\_OTL\MovedFiles folder in the form of Date_Time.log. Open that report and post its contents in a reply.

Restart the computer back to the OTLPE CD.

• Double-click on the OTLPE icon.
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start. Change the following settings
  
  • Change Drivers to All
  • Change Standard Registry to All
  • Under the Custom Scan box paste this in
    

    
    
    /md5start
    volsnap.sys
    snvcrs.sys
    /md5stop
    
    

• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive.
• Please post the contents of the C:\OTL.txt file in your reply also.

[JSntgRvr]

Save these instructions in the USB drive.

• Boot to the OTLPE CD
• Please double-click OTLPE.exe to run it as you did before.
• Copy the lines in the quote below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :files
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\procs\explorer.exe
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\h\explorer.exe
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\winlogon.exe
  C:\Documents and Settings\JohnMuto\Local Settings\temp\RarSFX2\userinit.exe
  C:\Documents and Settings\All Users\Application Data\18472756
  D:\My Documents\ComboFixit.exe
  
  :Commands
  [EMPTYTEMP]

• Return to OTLPE, right click in the "Custom Scans/Fixes" window and choose Paste.
• Click the red Run Fix button.
• A report will be produced and saved in the C:\_OTL\MovedFiles folder in the form of Date_Time.log. Open that report and post its contents in a reply.

Restart the computer back to the OTLPE CD.

• Double-click on the OTLPE icon.
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start. Change the following settings
  
  • Change Drivers to All
  • Change Standard Registry to All
  • Under the Custom Scan box paste this in
    

    
    
    /md5start
    volsnap.sys
    snvcrs.sys
    /md5stop
    
    

• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive.
• Please post the contents of the C:\OTL.txt file in your reply also.

[jamz39]

Thanks again,
John

Attached Files

•  04262011_142120.log   3.96KB   244 downloads
•  OTL.txt   102.59KB   231 downloads

[JSntgRvr]

Save this in the USB drive as a text file.

• Boot to the OTLPE CD
• Please double-click OTLPE.exe to run it as you did before.
• Copy the lines in the quote below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :OTL
  DRV - [2011/04/19 21:24:05 | 000,054,016 | ---- | M] () [Kernel | Boot] -- C:\WINDOWS\system32\drivers\snvcrs.sys -- (beoqdan)
  
  :files
  C:\WINDOWS\system32\drivers\volsnap.sys|C:\WINDOWS\ServicePackFiles\i386\volsnap.sys /Replace

• Return to OTLPE, right click in the "Custom Scans/Fixes" window and choose Paste.
• Click the red Run Fix button.
• A report will be produced and saved in the C:\_OTL\MovedFiles folder in the form of Date_Time.log. Open that report and post its contents in a reply.

Attempt to boot in Normal Mode. Let me know the outcome.

[jamz39]

thanks.

Attached Files

•  04262011_182426.log   800bytes   210 downloads

[jamz39]

Wow,

I am impressed. It worked. Actually started up and went to windows. Seems to be back to normal. Is there anything else I need to do?
Thanks a million.
Where can I donate too?
John

[JSntgRvr]

Congratulations. Lets make sure all is clear.

I would suggest as an antivirus AVAST, but wait until the following scans are completed.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    
    If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If any of these applications will not uninstall, it is first recommended to uninstall it with AppRemover by Opswat. http://www.appremove...ed-applications. Do not use AppRemover on Norton
    
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
• Install the Recovery Console if prompted.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" .

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

===================================

Please download Malwarebytes' Anti-Malware from Here. Never download Malwarebytes' Anti-Malware from other sources.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

========================

Perform an online scan at eset and let me know the outcome.