[UndoubledZim]

Hey guys having some trouble, none of my programs will open.
They won't even run in safe mode, tried to use exehelper Vipererrescue mbam rkill and the others listed in the help forums nothing seems to work = ( most of them open a command prompt when used and nothing else, also tried running them off a USB drive also just opened command prompt then nothing happens

edit: think I messed it up even worse by trying system restore now I cant connect to the internet either = (

apparently I don't have a "system image" to restore it to default either

would it be difficult to get a windows 7 disc and just reinstall from scratch?
or am I better off trying to fix whatever is wrong currently

any help would be appreciated

Edited by UndoubledZim, 14 March 2012 - 11:04 PM.

[Advertisements]

Hi, UndoubledZim! My nick name is CompCav and I will be assisting you with your Malware/Security problems. Please make sure you read all of the instructions and fixes thoroughly before continuing with them. If you have any questions or you are unsure about anything, just ask and I will help you out.

If you have resolved the issues you were originally experiencing, or have received help elsewhere, please let me know so that this topic can be closed.

I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.

Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. One of the steps I will be asking you to do requires you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.

If you are ready to get started, please review and follow these guidelines so that we resolve your issues in a timely and effective manner:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instructions that I give you. Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. These instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. However, the one thing that you should always do, is to make sure your anti-virus definitions are up-to-date!
• Please do not use the Attachment feature for any log file. Just do a Copy/Paste of the entire contents of the log file inside your post and submit.
• You must reply within four days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic. PM me only if I have not responded to your last post in 2 days.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to ultimately reformat your hard drive and reinstall the operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Please have the software and storage media for backing up your data available.

would it be difficult to get a windows 7 disc and just reinstall from scratch?
or am I better off trying to fix whatever is wrong currently

We can help you with either one. If you do not have the windows 7 disk we can start with cleaning your existing install. It is your decision.



Do you have another computer we can use to download files? If so what is the operating system (i . e. XP, Vista, Windows 7)

Do you have a small USB flash drive to transfer files?

Do you have some blank CD's to make CD's on the good machine?

[CompCav]

Hi, UndoubledZim! My nick name is CompCav and I will be assisting you with your Malware/Security problems. Please make sure you read all of the instructions and fixes thoroughly before continuing with them. If you have any questions or you are unsure about anything, just ask and I will help you out.

If you have resolved the issues you were originally experiencing, or have received help elsewhere, please let me know so that this topic can be closed.

I am currently still in training and my posts have to be approved by an expert so please expect a delay between my posts.

Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. One of the steps I will be asking you to do requires you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.

If you are ready to get started, please review and follow these guidelines so that we resolve your issues in a timely and effective manner:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
• Please make sure to carefully read any instructions that I give you. Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. These instructions are not suitable for any other computer, even if the issues are fairly similar.
• Do not do things I do not ask for, such as running a spyware scan on your computer. However, the one thing that you should always do, is to make sure your anti-virus definitions are up-to-date!
• Please do not use the Attachment feature for any log file. Just do a Copy/Paste of the entire contents of the log file inside your post and submit.
• You must reply within four days failure to reply will result in the topic being closed!
• Please do not PM me directly for help. If you have any questions, post them in this topic. PM me only if I have not responded to your last post in 2 days.
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to ultimately reformat your hard drive and reinstall the operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Please have the software and storage media for backing up your data available.

would it be difficult to get a windows 7 disc and just reinstall from scratch?
or am I better off trying to fix whatever is wrong currently

We can help you with either one. If you do not have the windows 7 disk we can start with cleaning your existing install. It is your decision.



Do you have another computer we can use to download files? If so what is the operating system (i . e. XP, Vista, Windows 7)

Do you have a small USB flash drive to transfer files?

Do you have some blank CD's to make CD's on the good machine?

[UndoubledZim]

Alright! thanks for the reply!

Yes I have another computer (albiet not a great one)
Yes I have a 2 gig usb drive
I believe I also have cd's and if not I can get them

[CompCav]

What is the operating system on the other computer?

[UndoubledZim]

both systems are windows 7 home the infected one is a sony vaio and the other is a acer (both laptops)

[CompCav]

Step 1.

We need to first protect your clean computer.

• Please download Panda USB Vaccine (you must provide valid e-mail and they will send you download link to this e-mail address) to your desktop.
• Install and run the program.
  

• Double-click on the file USBVaccine.zip located on your desktop.
• A file viewer will open. Double-click on the file USBVaccineSetup.exe. Please select Yes if you are asked if you want to allow the program to make changes to the computer.
• Follow the steps on screen to install the program on your computer.

• Plug in your USB drive and click on Vaccinate USB and Vaccinate Computer.

Step 2.

Please download the following files to your vaccinated USB drive on your clean computer:

Rkill.scr

RogueKiller.exe, rename to winlogon.com

OTL.scr

aswMBR.exe

Scan.txt here:  scan.txt   571bytes   507 downloads


Step 3.

Plug the USB flash drive into the ailing computer.
Copy rkill.scr to your desktop.
Double click rkill.scr, if it does not work the first time, try it several times.
Once it runs successfully, copy winlogon.com from your USB drive to your desktop.

• Quit all programs
• Start winlogon.com.
• Wait until Prescan has finished ...
• Click on the Scan button Step 1 in the picture.
• Note: If RogueKiller will not run please try it several times, if it still does not run rename it winlogon.com and try it several times.

• Wait for the end of the scan.
• The first report will be created on the desktop.
  
• Click on the Delete button step 2 in the picture.
• The second report will be created on the desktop.
  
• Next click on ShortcutsFix step 3 in the picture.
• The third report will be created on the desktop.

Please post:

All RKreport.txt text files located on your desktop.


Step 4.

Copy aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply



If it does not run rename it iexplore.exe and try it again.


Step 5.

Copy OTL.scr and scan.txt to your desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select Scan All Users
• Select Lop Check and Purity Check
• Double click scan.txt to open it.
• Select edit >> select all, then edit >>copy
• In the Custom Scan box right click and paste the text in the box
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

Step 6.

Copy the following logs from the ailing computer desktop to the USB flash drive:

All the RKreport.txt files
aswMBR.txt
OTL.txt
Extras.txt

Then plug the USB drive in your good computer and post all of the logs


How is the computer performing now?

[UndoubledZim]

when starting the infected computer I get RunDLL there was a problem starting C:\users\justin\appdata\local\temp\dfrgexer.dll

Is this relevant?

I have Rkill on my desktop now I double click and it asks if I want to allow it I hit yes then nothing happens have tried it many times now

Edited by UndoubledZim, 17 March 2012 - 05:18 PM.

[CompCav]

Step 1.

Copy winlogon.com (renamed RogueKiller.exe) onto the desktop of the ailing computer and run.

• Quit all programs
• Start winlogon.com.
• Wait until Prescan has finished ...
• Click on the Scan button Step 1 in the picture.
• Note: If RogueKiller will not run please try it several times, if it still does not run rename it winlogon.com and try it several times.

• Wait for the end of the scan.
• The first report will be created on the desktop.
  
• Click on the Delete button step 2 in the picture.
• The second report will be created on the desktop.
  
• Next click on ShortcutsFix step 3 in the picture.
• The third report will be created on the desktop.

Please post:

All RKreport.txt text files located on your desktop.

If this does not work go on to the next step.


Step 2.

Copy OTL.scr and scan.txt to your desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select Scan All Users
• Select Lop Check and Purity Check
• Double click scan.txt to open it.
• Select edit >> select all, then edit >>copy
• In the Custom Scan box right click and paste the text in the box
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

If neither step works answer the question at the end of step 3.

Step 3.

Copy the following logs from the ailing computer desktop to the USB flash drive:

All the RKreport.txt files
OTL.txt
Extras.txt

Then plug the USB drive in your good computer and post all of the logs

If none of the programs above worked:
Can you get to advanced options with F8?

[CompCav]

when starting the infected computer I get RunDLL there was a problem starting C:\users\justin\appdata\local\temp\dfrgexer.dll

Is this relevant?

Yes this is malware.

[UndoubledZim]

Rkill, Roguekiller (renamed)and OTL all ask me if I want to make changes to computer, I click yes then nothing happens.

F8 doesn't seem to do anything unless you mean at startup for safemode etc.

Edited by UndoubledZim, 18 March 2012 - 10:00 AM.

[CompCav]

Since you can get to the advanced options menu we will collect the information we need to begin cleaning your computer.

We will do that by performing this scan. You will need your USB flash drive.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Click on Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the flash drive. Please copy and paste it to your reply.

[UndoubledZim]

Scan result of Farbar Recovery Scan Tool Version: 15-03-2012
Ran by SYSTEM at 18-03-2012 17:42:51
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10134560 2010-04-06] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] %ProgramFiles%\Apoint\Apoint.exe [221480 2010-05-16] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup [82944 2010-01-19] (Sony Electronics Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2010-01-21] (Sony Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2011-01-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-04-08] (Sun Microsystems, Inc.)
HKU\Justin\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-02-08] (Google Inc.)
HKU\Justin\...\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" [399736 2011-04-07] (BitTorrent, Inc.)
HKU\Justin\...\Run: [ciphSVCS] rundll32 "C:\Users\Justin\AppData\Local\Temp\dfrgexer.dll",CreateProcessNotify [x]
HKU\Justin\...\Run: [sbunkmgr] rundll32 "C:\Users\Justin\AppData\Local\Temp\dfrgexer64.dll",CreateProcessNotify [62976 2011-11-15] (Kaspersky Lab)
HKU\Justin\...\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)

==================== Services (Whitelisted) ======

3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-09-28] (ArcSoft Inc.)
4 Lavasoft Ad-Aware Service; "C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe" [2152152 2011-09-02] (Lavasoft Limited)
4 MSSQL$DDNI; "C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.DDNI\MSSQL\Binn\sqlservr.exe" -sDDNI [43010392 2009-03-30] (Microsoft Corporation)
4 MSSQLServerADHelper100; "C:\Program Files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE" [47128 2009-03-30] (Microsoft Corporation)
2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\17.5.0.127\diMaster.dll" /prefetch:1 [135032 2009-12-09] (Symantec Corporation)
4 Oasis2Service; "C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe" [49152 2011-08-13] ()
4 PMBDeviceInfoProvider; "C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe" [360224 2009-10-24] (Sony Corporation)
2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75064 2011-07-29] ()
4 SampleCollector; "C:\Program Files\Sony\VAIO Care\collsvc.exe" "/service" "/counter=\Processor(_Total)\% Processor Time:5" "/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5" "/counter=\Network Interface(*)\Bytes Total/sec:5" "/directory=inteldata" [168448 2009-12-22] (Sony of America Corporation)
4 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
4 SOHCImp; "C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe" [108400 2010-02-24] (Sony Corporation)
4 SOHDms; "C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe" [422768 2010-02-24] (Sony Corporation)
4 SOHDs; "C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe" [67952 2010-02-24] (Sony Corporation)
4 SpfService; "C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService.exe" [302448 2010-02-08] (Sony Corporation)
4 SQLAgent$DDNI; "C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.DDNI\MSSQL\Binn\SQLAGENT.EXE" -i DDNI [366936 2009-03-30] (Microsoft Corporation)
4 SQLBrowser; "C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe" [254808 2009-03-30] (Microsoft Corporation)
4 SQLWriter; "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [157720 2008-07-10] (Microsoft Corporation)
4 StumbleUponUpdateService; "C:\Program Files (x86)\StumbleUpon\StumbleUponUpdateService.exe" [103336 2011-04-14] (stumbleupon.com)
4 VAIO Entertainment TV Device Arbitration Service; "C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe" [69632 2010-04-08] (Sony Corporation)
4 VAIO Event Service; "C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe" [217456 2010-03-02] (Sony Corporation)
4 VAIO Power Management; "C:\Program Files\Sony\VAIO Power Management\SPMService.exe" [574320 2010-03-25] (Sony Corporation)
4 VCFw; "C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe" [852336 2010-03-18] (Sony Corporation)
4 VcmIAlzMgr; "C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe" [529776 2010-02-19] (Sony Corporation)
4 VcmINSMgr; "C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe" [386416 2010-02-19] (Sony Corporation)
4 VcmXmlIfHelper; "C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe" [115568 2010-02-19] (Sony Corporation)
4 VUAgent; "C:\Program Files\Sony\VAIO Update 5\VUAgent.exe" [1250160 2010-05-31] (Sony Corporation)

========================== Drivers (Whitelisted) =============

3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [6402560 2010-04-06] (ATI Technologies Inc.)
3 Lavasoft Kernexplorer; \??\C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [17152 2011-02-22] ()
0 Lbd; C:\Windows\System32\Drivers\Lbd.sys [69152 2010-08-12] (Lavasoft AB)
1 SRTSP; C:\Windows\System32\drivers\NISx64\1105000.07F\SRTSP64.SYS [504880 2009-12-02] (Symantec Corporation)
1 SRTSPX; C:\Windows\System32\drivers\NISx64\1105000.07F\SRTSPX64.SYS [32304 2009-12-02] (Symantec Corporation)
2 IAStorDataMgrSvc; [x]
3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20091209.020\ENG64.SYS [x]
3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20091209.020\EX64.SYS [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-03-18 17:42 - 2012-03-18 17:43 - 0000000 ____D C:\FRST
2012-03-18 09:56 - 2012-03-17 16:07 - 0000571 ____A C:\Users\Justin\Desktop\scan.txt
2012-03-18 09:56 - 2012-03-17 16:03 - 0594432 ____A (OldTimer Tools) C:\Users\Justin\Desktop\OTL.scr
2012-03-18 09:53 - 2012-03-17 16:03 - 1219072 ____A C:\Users\Justin\Desktop\winlogon.com.exe
2012-03-17 17:16 - 2012-03-17 16:02 - 1008141 ____A C:\Users\Justin\Desktop\rkill.scr
2012-03-13 18:19 - 2012-03-13 18:19 - 158892465 ____A C:\Windows\MEMORY.DMP
2012-03-13 18:19 - 2012-03-13 18:19 - 0270768 ____A C:\Windows\Minidump\031312-29967-01.dmp
2012-03-13 17:59 - 2012-03-13 17:59 - 0000129 ____A C:\Windows\System32\MRT.INI
2012-03-13 17:47 - 2009-07-13 17:14 - 0020480 ____A (Microsoft Corporation) C:\Windows\svchost.exe
2012-03-13 16:01 - 2012-03-13 16:44 - 0000000 ____D C:\eeepcfr
2012-03-13 15:56 - 2012-03-13 16:44 - 0000000 ____D C:\Users\Justin\Desktop\OTLPEStd
2012-03-13 15:48 - 2012-03-13 15:48 - 0515892 ____A C:\Users\Justin\Desktop\eeepcfr.zip
2012-03-13 15:47 - 2012-03-15 18:01 - 0000000 ____D C:\Users\Justin\Desktop\New folder
2012-03-13 09:04 - 2012-03-13 09:05 - 13898368 ____A C:\Users\Justin\Downloads\SAS_984A281.COM
2012-03-03 22:49 - 2012-03-13 18:19 - 0000000 ____D C:\Windows\Minidump
2012-03-01 18:55 - 2012-03-05 22:09 - 0000102 ____A C:\Users\Justin\Desktop\Great words.txt

============ 3 Months Modified Files and Folders =============

2012-03-18 13:33 - 2011-08-10 20:00 - 0782176 ____A C:\Windows\ntbtlog.txt
2012-03-18 13:33 - 2010-09-16 05:18 - 0021094 ____A C:\aaw7boot.log
2012-03-18 13:33 - 2010-08-19 11:16 - 3015884800 __ASH C:\hiberfil.sys
2012-03-18 09:59 - 2009-07-13 20:45 - 0014144 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-03-18 09:59 - 2009-07-13 20:45 - 0014144 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-03-17 16:07 - 2012-03-18 09:56 - 0000571 ____A C:\Users\Justin\Desktop\scan.txt
2012-03-17 16:03 - 2012-03-18 09:56 - 0594432 ____A (OldTimer Tools) C:\Users\Justin\Desktop\OTL.scr
2012-03-17 16:03 - 2012-03-18 09:53 - 1219072 ____A C:\Users\Justin\Desktop\winlogon.com.exe
2012-03-17 16:02 - 2012-03-17 17:16 - 1008141 ____A C:\Users\Justin\Desktop\rkill.scr
2012-03-15 18:01 - 2012-03-13 15:47 - 0000000 ____D C:\Users\Justin\Desktop\New folder
2012-03-15 17:56 - 2012-02-05 21:18 - 0000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-03-14 15:25 - 2010-07-15 05:17 - 1165844 ____A C:\Windows\WindowsUpdate.log
2012-03-13 18:19 - 2012-03-13 18:19 - 158892465 ____A C:\Windows\MEMORY.DMP
2012-03-13 18:19 - 2012-03-13 18:19 - 0270768 ____A C:\Windows\Minidump\031312-29967-01.dmp
2012-03-13 18:19 - 2012-03-03 22:49 - 0000000 ____D C:\Windows\Minidump
2012-03-13 17:59 - 2012-03-13 17:59 - 0000129 ____A C:\Windows\System32\MRT.INI
2012-03-13 17:57 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\config\TxR
2012-03-13 17:56 - 2009-07-13 21:13 - 0871488 ____A C:\Windows\System32\PerfStringBackup.INI
2012-03-13 17:55 - 2010-08-31 08:50 - 56297240 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-03-13 17:47 - 2010-08-19 11:33 - 0000000 ____D C:\users\Justin
2012-03-13 17:47 - 2010-02-08 09:50 - 0000908 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-03-13 17:47 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-03-13 17:46 - 2011-06-16 20:55 - 0014808 ____A C:\Windows\setupact.log
2012-03-13 16:45 - 2012-02-05 21:19 - 0000000 ____D C:\Users\All Users\Spybot - Search & Destroy
2012-03-13 16:45 - 2012-02-05 21:19 - 0000000 ____D C:\ProgramData\Spybot - Search & Destroy
2012-03-13 16:45 - 2011-11-11 13:50 - 0000000 ____D C:\Users\All Users\PMB Files
2012-03-13 16:45 - 2011-11-11 13:50 - 0000000 ____D C:\ProgramData\PMB Files
2012-03-13 16:45 - 2011-08-18 19:38 - 0000000 ____D C:\Users\Justin\Desktop\terrafirma-1.7.2
2012-03-13 16:45 - 2011-04-28 11:21 - 0000000 ____D C:\Users\Justin\Downloads\Fallback plan gamma
2012-03-13 16:45 - 2010-09-27 17:52 - 0000000 ____D C:\Users\Justin\Desktop\Junk
2012-03-13 16:45 - 2010-09-25 18:56 - 0000000 ____D C:\Users\Justin\AppData\Roaming\vlc
2012-03-13 16:45 - 2010-08-27 16:03 - 0000000 ____D C:\Users\Justin\AppData\Roaming\uTorrent
2012-03-13 16:45 - 2010-02-08 10:44 - 0000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2012-03-13 16:45 - 2010-02-08 09:58 - 0000000 ____D C:\Users\All Users\Norton
2012-03-13 16:45 - 2010-02-08 09:58 - 0000000 ____D C:\ProgramData\Norton
2012-03-13 16:45 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\sysprep
2012-03-13 16:45 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\AppCompat
2012-03-13 16:44 - 2012-03-13 16:01 - 0000000 ____D C:\eeepcfr
2012-03-13 16:44 - 2012-03-13 15:56 - 0000000 ____D C:\Users\Justin\Desktop\OTLPEStd
2012-03-13 16:44 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\registration
2012-03-13 16:43 - 2010-12-30 18:05 - 0000000 ____D C:\Users\Justin\AppData\Roaming\SoftGrid Client
2012-03-13 16:41 - 2010-02-08 09:26 - 0000000 ____D C:\Program Files (x86)\DDNi
2012-03-13 15:48 - 2012-03-13 15:48 - 0515892 ____A C:\Users\Justin\Desktop\eeepcfr.zip
2012-03-13 13:27 - 2011-08-10 20:04 - 0000000 ____D C:\Users\Justin\AppData\Local\ElevatedDiagnostics
2012-03-13 09:05 - 2012-03-13 09:04 - 13898368 ____A C:\Users\Justin\Downloads\SAS_984A281.COM
2012-03-06 16:44 - 2011-12-30 16:57 - 0000000 ____D C:\Users\Justin\AppData\Local\PMB Files
2012-03-05 22:09 - 2012-03-01 18:55 - 0000102 ____A C:\Users\Justin\Desktop\Great words.txt
2012-03-03 22:48 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\LiveKernelReports
2012-03-03 22:01 - 2010-09-27 17:53 - 0000000 ____D C:\Users\Justin\Desktop\Vids
2012-03-01 09:18 - 2010-08-19 13:08 - 0001883 ____A C:\test.xml
2012-02-28 07:21 - 2011-11-12 07:05 - 0000000 ____D C:\Users\Justin\riotsGamesLogs
2012-02-16 06:00 - 2010-02-08 09:50 - 0000912 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-02-15 07:54 - 2010-08-19 11:26 - 0000174 ___SH C:\Users\Justin\Start Menu\Programs\Startup\desktop.ini
2012-02-15 07:54 - 2010-08-19 11:26 - 0000174 ___SH C:\Users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-02-15 06:29 - 2009-07-13 20:45 - 0299408 ____A C:\Windows\System32\FNTCACHE.DAT
2012-02-15 06:05 - 2010-12-30 18:04 - 0000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2012-02-15 06:05 - 2010-02-08 09:22 - 0888184 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-02-13 17:25 - 2011-06-15 10:00 - 0000000 ____D C:\Program Files (x86)\Steam
2012-02-12 15:09 - 2011-04-24 14:09 - 0000064 ____A C:\Windows\SysWOW64\rp_stats.dat
2012-02-12 15:09 - 2011-04-24 14:09 - 0000044 ____A C:\Windows\SysWOW64\rp_rules.dat
2012-02-05 21:19 - 2012-02-05 21:19 - 0001262 ____A C:\Users\Justin\Desktop\Spybot - Search & Destroy.lnk
2012-02-05 21:19 - 2012-02-05 21:19 - 0000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2012-02-05 21:18 - 2012-02-05 21:18 - 0001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-02-05 21:18 - 2012-02-05 21:18 - 0000000 ____D C:\Users\Justin\AppData\Roaming\Malwarebytes
2012-02-05 21:18 - 2012-02-05 21:18 - 0000000 ____D C:\Users\All Users\Malwarebytes
2012-02-05 21:18 - 2012-02-05 21:18 - 0000000 ____D C:\ProgramData\Malwarebytes
2012-02-05 21:16 - 2012-02-05 21:15 - 16409960 ____A (Safer Networking Limited ) C:\Users\Justin\Downloads\spybotsd162.exe
2012-02-05 21:15 - 2012-02-05 21:14 - 9502424 ____A (Malwarebytes Corporation ) C:\Users\Justin\Downloads\mbam-setup-1.60.1.1000.exe
2012-01-31 06:59 - 2011-06-29 05:17 - 0001940 ____A C:\Windows\PFRO.log
2012-01-29 13:55 - 2011-08-20 09:35 - 0000000 ____D C:\Users\Justin\Desktop\Minecraft
2012-01-26 21:52 - 2010-08-19 12:03 - 0279656 ____A (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2012-01-24 01:33 - 2010-02-08 09:50 - 0002358 ____A C:\Users\Justin\Desktop\Google Chrome.lnk
2012-01-19 12:27 - 2012-01-19 12:27 - 0000218 ____A C:\Users\Justin\.recently-used.xbel
2012-01-15 14:05 - 2012-01-15 14:05 - 0000720 ____A C:\Users\Justin\AppData\Local\PMB Fik?s
2012-01-13 20:02 - 2012-02-14 18:06 - 3143168 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-01-04 01:59 - 2012-02-14 18:06 - 14164480 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-01-04 01:58 - 2012-02-14 18:06 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-01-04 01:03 - 2012-02-14 18:06 - 12868096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-01-04 01:03 - 2012-02-14 18:06 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2012-01-02 22:24 - 2012-02-14 18:06 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-01-02 21:44 - 2012-02-14 18:06 - 0478208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2011-12-30 21:02 - 2011-12-30 21:02 - 0306176 ____A (Symthic) C:\Users\Justin\Desktop\Plotic04.exe
2011-12-30 15:49 - 2011-11-11 13:50 - 0000000 ____D C:\Program Files (x86)\Pando Networks
2011-12-30 15:38 - 2011-12-30 15:35 - 0010056 __ASH C:\Users\Justin\AppData\Local\520hi15og85k11361861fucfnu5j045lhy3vl18100j
2011-12-30 15:38 - 2011-12-30 15:35 - 0010056 __ASH C:\Users\All Users\520hi15og85k11361861fucfnu5j045lhy3vl18100j
2011-12-30 15:38 - 2011-12-30 15:35 - 0010056 __ASH C:\ProgramData\520hi15og85k11361861fucfnu5j045lhy3vl18100j
2011-12-27 19:59 - 2012-02-14 18:06 - 0499200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys


========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ======================

Percentage of memory in use: 15%
Total physical RAM: 3834.9 MB
Available physical RAM: 3243.25 MB
Total Pagefile: 3833.05 MB
Available Pagefile: 3223.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:288.63 GB) (Free:127.81 GB) NTFS
2 Drive e: (Recovery) (Fixed) (Total:9.36 GB) (Free:0.82 GB) NTFS ==>[System with boot components (obtained from reading drive)]
4 Drive g: () (Removable) (Total:1.86 GB) (Free:1.85 GB) FAT
7 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
8 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 1024 KB
Disk 1 Online 1943 MB 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Recovery 9 GB 1024 KB
Partition 2 Primary 100 MB 9 GB
Partition 3 Primary 288 GB 9 GB

======================================================================================================

Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E Recovery NTFS Partition 9 GB Healthy Hidden

======================================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System Rese NTFS Partition 100 MB Healthy

======================================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 288 GB Healthy

======================================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1907 MB 64 KB

======================================================================================================

Disk: 1
Partition 1
Type : 06
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G FAT Removable 1907 MB Healthy

======================================================================================================
==========================================================
TDL4: custom:26000022


==========================================================

Last Boot: 2012-02-08 21:45

======================= End Of Log ==========================

[CompCav]

Step 1.

Download the enclosed file.  fixlist.txt   770bytes   583 downloads


Save it in the USB drive.

Insert the USB drive into the ailing computer. Run FRST as you did before, except that this time around click on the Fix button.

The tool will make a log on the flashdrive (Fixlog.txt) please post it it your reply.


Step 2.

On the good computer download a fresh copy of the following tools and put them on the USB drive.

RogueKiller

ComboFix.


Boot the ailing computer into normal mode.

Insert the USB drive in the ailing computer and copy RogueKiller to the desktop.

Try to run it. If it does not run post the log above, skip the remaining steps, and let me know.

If it runs do these steps:

• Quit all programs
• Start RogueKiller.exe.
• Wait until Prescan has finished ...
• Click on the Scan button Step 1 in the picture.
• Note: If RogueKiller will not run please try it several times, if it still does not run rename it winlogon.com and try it several times.

• Wait for the end of the scan.
• The first report will be created on the desktop.
  
• Click on the Delete button step 2 in the picture.
• The second report will be created on the desktop.
  
• Next click on ShortcutsFix step 3 in the picture.
• The third report will be created on the desktop.

Please post:

All RKreport.txt text files located on your desktop.


Step 3.

Copy Combofix from the USB drive to the ailing computer desktop.


* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the Combofix log in your next reply as well as describe how your computer is running now


Step 4.

Please post:

FixLog.txt

if they can run post:
All RKreport.txt files
ComboFix.txt


Give me an update on how the computer is running

Edited by CompCav, 18 March 2012 - 07:46 PM.

[UndoubledZim]

when trying to Fix with Farbar I get the error No fixlist.txt found The fixlist.txt should be made and saved in the same directory the tool is located

I am sure that I put the .txt file you enclosed on the USB drive

[CompCav]

Plug the USB flash drive back in your clean computer.

Click Start >> Computer >> Double click the USB drive in the window.

Are fixlist.txt and FRST64.exe both in the root directory of the USB flash drive together?

If not please put them there together.

Regards,

CompCav