Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

ran hitmanpro 3.6.0 now my computer keeps rebooting

Started by charlietweeder , Apr 17 2012 09:13 PM

  • Please log in to reply

#1
charlietweeder
Posted 17 April 2012 - 09:13 PM

charlietweeder

    New Member

  • Member
  • Pip
  • 5 posts
I ran Hitmanpro 3.6.0 a few days ago because I suspected malware was infecting my computer. I had used it in the past on other computers with success but this time around not so much. It seemed to run fine, found a bunch of rootkits, trojans etc and rebooted after removing them like it said it would. When it started to reboot the first time after running hitmanpro, the system properties window was open (it never was before) and after about 15 seconds it rebooted and continues rebooting over and over until I power it off manually. I cannot boot windows normally- only to safe mode or safe mode with networking. I've tried to do a system repair and system restore with the OS DVD to no avail. System Repair runs and says it didn't find anything wrong and System Restore gives me an error saying it's already running. When I use "rstrui.exe /offline:c:\windows" when booted up in safe mode with networking I get a message saying it can't find any restore points but i know for a fact there are restore points because I had to restore to a previous point a couple years ago.

Any help or direction that anyone could provide would be very much appreciated. I've attached the XML file of the quarantine showing what hitmanpro removed.

Also, I'm running Windows Vista Home Premium, 32-bit

Attached File  quarantine.xml   7.91KB   299 downloads
  • 0

Advertisements

#2
Amlak
Posted 18 April 2012 - 01:39 AM

Amlak

    Member 1K

  • Member
  • PipPipPipPip
  • 1,470 posts
Welcome to Geeks to Go. Let's help you out with your malware issues.

Boot into Safe Mode with Networking. Then under that mode, do the following instructions.

---

Start -> Run (if you're using Vista/7, press and hold the Windows key on your keyboard and then press R to access Run):
type diskmgmt.msc
Click "OK"

Disk Management will open.

Click and hold the right side of the Disk Management Window and drag it to the right until you can see all the columns.

Take a screen Shot of the Disk Management Window and attach the screen shot to your reply. You can take a screenshot by pressing the PrintScreen/PrtScrn button located somewhere at the top of your keyboard and using Paste in the Paint program to paste the copied screenshot.

---

Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan

Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply

Posted Image

---

Download OTL to your Desktop
  • Double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in

    msconfig
safebootminimal
safebootnetwork
activex
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%PROGRAMFILES%\*.*
%APPDATA%\*.*
%systemroot%\Tasks\*.job
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

  • 0

#3
charlietweeder
Posted 24 April 2012 - 04:55 PM

charlietweeder

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thanks for the reply and for your help. I've followed your instructions above. Attached are the logs and documents you told me to provide. Let me know what the next step is.
diskmgmt.jpg
Attached File  aswMBR.txt   1.96KB   199 downloads
Attached File  OTL.Txt   59.44KB   173 downloads
Attached File  Extras.Txt   47.63KB   203 downloads

OTL logfile created on: 4/24/2012 5:34:25 PM - Run 1
OTL by OldTimer - Version 3.2.41.0 Folder = C:\Users\Steven\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.54 Gb Available Physical Memory | 84.89% Memory free
3.13 Gb Paging File | 2.89 Gb Available in Paging File | 92.28% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 450.70 Gb Total Space | 249.05 Gb Free Space | 55.26% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 14.89 Gb Free Space | 99.27% Space Free | Partition Type: NTFS
Drive F: | 1.86 Gb Total Space | 1.71 Gb Free Space | 91.86% Space Free | Partition Type: FAT
Drive T: | 931.51 Gb Total Space | 347.58 Gb Free Space | 37.31% Space Free | Partition Type: NTFS

Computer Name: MEDIACENTER | User Name: Steven | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/24 17:31:18 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Steven\Desktop\OTL.exe
PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2009/01/18 11:15:14 | 000,344,064 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\Filters\mmmpcdmx.ax
MOD - [2009/01/10 17:17:14 | 000,536,576 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\Filters\Haali\splitter.ax
MOD - [2009/01/10 17:14:08 | 000,079,360 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\Filters\Haali\mkzlib.dll
MOD - [2009/01/10 17:14:06 | 000,023,552 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\Filters\Haali\mkunicode.dll


========== Win32 Services (SafeList) ==========

SRV - [2012/04/12 17:51:58 | 007,245,976 | ---- | M] (SurfRight B.V.) [Auto | Stopped] -- F:\HitmanPro36.exe -- (HitmanPro36CrusaderBoot) HitmanPro 3.6 Crusader (Boot)
SRV - [2011/10/06 20:53:34 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/09/16 17:21:30 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/10/31 17:32:17 | 005,897,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2010/10/31 17:32:16 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/08/23 20:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2009/04/28 21:07:32 | 000,176,128 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2007/04/19 23:29:44 | 000,411,168 | ---- | M] (Acronis) [Auto | Stopped] -- C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe -- (AcrSch2Svc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Steven\AppData\Local\Temp\aswMBR.sys -- (aswMBR)
DRV - [2011/09/16 17:21:31 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2011/09/16 17:21:31 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\Windows\System32\drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/10/31 17:32:18 | 000,122,448 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSDriver.sys -- (AVGIDSDrivervtx)
DRV - [2010/10/31 17:32:18 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSFilter.sys -- (AVGIDSFiltervtx)
DRV - [2010/10/31 17:32:18 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_Vista\AVGIDSShim.sys -- (AVGIDSShimvtx)
DRV - [2010/10/31 17:32:18 | 000,025,168 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AVGIDSvx.sys -- (AVGIDSErHrvtx)
DRV - [2010/10/31 17:32:16 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/04/30 20:39:51 | 000,052,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (AvgRkx86)
DRV - [2010/04/19 20:29:20 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2010/03/31 06:59:24 | 000,350,720 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2009/09/02 03:09:24 | 000,176,128 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2009/04/28 22:31:38 | 004,491,776 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/11/26 13:51:02 | 000,333,824 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr61.sys -- (rt61x86)
DRV - [2005/10/26 11:06:30 | 000,356,096 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rt61.sys -- (RT61) Linksys Wireless-G PCI Adapter Driver(RT61)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.911
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2011/09/29 17:56:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.27\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/17 21:04:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.27\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/17 21:04:01 | 000,000,000 | ---D | M]

[2009/05/28 21:59:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steven\AppData\Roaming\mozilla\Extensions
[2012/04/24 17:26:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steven\AppData\Roaming\mozilla\Firefox\Profiles\0wxw6brr.default\extensions
[2010/09/06 20:31:50 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Steven\AppData\Roaming\mozilla\Firefox\Profiles\0wxw6brr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/07/09 16:56:52 | 000,000,000 | ---D | M] (Personas for Firefox) -- C:\Users\Steven\AppData\Roaming\mozilla\Firefox\Profiles\0wxw6brr.default\extensions\personas@christopher(47).beard
[2009/07/16 10:35:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steven\AppData\Roaming\mozilla\Firefox\Profiles\0wxw6brr.default\extensions\[email protected]
[2012/04/24 17:26:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/16 18:12:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/29 17:56:30 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2012/04/12 18:07:01 | 000,000,019 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [rAYBrQVgIl.exe] C:\ProgramData\rAYBrQVgIl.exe File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\.DEFAULT..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found
O4 - HKU\S-1-5-18..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found
O4 - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000..\Run: [credpaint] C:\Users\Steven\AppData\Roaming\credpaint.exe File not found
O4 - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil11e_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Steven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EventGhost.lnk = C:\Program Files\EventGhost\EventGhost.exe (EventGhost Project)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data]
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data]
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.micr.../OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{692410AE-4632-4C0A-A3F8-E889974A644A}: DhcpNameServer = 172.26.38.1 172.26.38.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{73904320-46DD-43BC-A258-590A663A1AF0}: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7AAE985F-0324-4337-B757-777EE685834F}: NameServer = 4.2.2.1,4.2.2.2
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/10/06 19:54:37 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011/10/06 19:28:09 | 000,000,000 | ---D | M] - T:\AutoCAD 2010 -- [ NTFS ]
O33 - MountPoints2\{08036178-5e60-11de-9fef-00219b0441b3}\Shell\AutoRun\command - "" = G:\InstallSeagateManager.exe
O33 - MountPoints2\{7b6e3ffb-fa60-11de-a6ba-00219b0441b3}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (bootdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: hitmanpro36 - Reg Error: Value error.
SafeBootNet: hitmanpro36.sys - Reg Error: Value error.
SafeBootNet: HitmanPro36Crusader - Reg Error: Value error.
SafeBootNet: HitmanPro36CrusaderBoot - F:\HitmanPro36.exe (SurfRight B.V.)
SafeBootNet: Messenger - Service
SafeBootNet: MPSSvc - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - Service
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2012/04/24 17:31:17 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\Steven\Desktop\OTL.exe
[2012/04/24 17:24:19 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Steven\Desktop\aswMBR.exe
[2012/04/17 20:29:31 | 000,000,000 | ---D | C] -- C:\Windows\panther
[2012/04/17 20:24:13 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/04/17 20:18:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/04/17 20:18:19 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012/04/12 17:51:22 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

========== Files - Modified Within 30 Days ==========

[2012/04/24 17:31:18 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Steven\Desktop\OTL.exe
[2012/04/24 17:29:50 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2012/04/24 17:29:48 | 000,000,512 | ---- | M] () -- C:\Users\Steven\Desktop\MBR.dat
[2012/04/24 17:29:31 | 000,597,602 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/24 17:29:31 | 000,101,610 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/24 17:24:20 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Steven\Desktop\aswMBR.exe
[2012/04/24 17:23:37 | 000,079,221 | ---- | M] () -- C:\Users\Steven\Desktop\diskmgmt.jpg
[2012/04/24 17:15:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/24 17:15:20 | 268,435,456 | -HS- | M] () -- C:\Windows\System32\temppf.sys
[2012/04/24 17:13:47 | 000,007,728 | ---- | M] () -- C:\Users\Steven\AppData\Local\d3d9caps.dat
[2012/04/17 21:22:05 | 000,026,400 | ---- | M] () -- C:\Windows\System32\drivers\hitmanpro36.sys
[2012/04/17 20:54:38 | 000,001,905 | ---- | M] () -- C:\Windows\diagwrn.xml
[2012/04/17 20:54:38 | 000,001,905 | ---- | M] () -- C:\Windows\diagerr.xml
[2012/04/12 18:07:54 | 000,003,712 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/12 18:07:54 | 000,003,712 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/12 18:07:01 | 000,000,019 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/04/12 18:06:46 | 000,003,596 | ---- | M] () -- C:\Windows\System32\.crusader
[2012/04/11 18:51:56 | 094,521,641 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2012/04/05 03:10:59 | 000,000,000 | ---- | M] () -- C:\Users\Steven\AppData\Local\prvlcl.dat
[2012/04/04 22:43:15 | 000,029,184 | ---- | M] () -- C:\Users\Steven\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2012/04/24 17:29:48 | 000,000,512 | ---- | C] () -- C:\Users\Steven\Desktop\MBR.dat
[2012/04/24 17:23:37 | 000,079,221 | ---- | C] () -- C:\Users\Steven\Desktop\diskmgmt.jpg
[2012/04/17 20:29:01 | 000,001,905 | ---- | C] () -- C:\Windows\diagwrn.xml
[2012/04/17 20:29:01 | 000,001,905 | ---- | C] () -- C:\Windows\diagerr.xml
[2012/04/12 18:09:06 | 000,026,400 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro36.sys
[2012/04/12 18:09:02 | 268,435,456 | -HS- | C] () -- C:\Windows\System32\temppf.sys
[2012/04/12 18:06:46 | 000,003,596 | ---- | C] () -- C:\Windows\System32\.crusader
[2012/01/17 20:02:09 | 000,000,507 | ---- | C] () -- C:\ProgramData\221b50d
[2011/12/01 23:02:17 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011/01/13 23:38:20 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011/01/13 23:38:20 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/05/11 19:07:16 | 000,024,206 | ---- | C] () -- C:\Users\Steven\AppData\Roaming\UserTile.png
[2010/05/03 23:48:28 | 000,000,000 | ---- | C] () -- C:\Users\Steven\AppData\Local\prvlcl.dat

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2009/05/28 01:05:10 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2008/09/08 10:12:42 | 000,004,859 | R--- | M] () -- C:\dell.sdr
[2012/04/12 17:49:39 | 3533,131,776 | -HS- | M] () -- C:\pagefile.sys
[2009/02/28 21:34:15 | 1073,741,824 | ---- | M] () -- C:\ppsds.pgf
[2012/04/17 20:25:13 | 000,000,348 | ---- | M] () -- C:\TDSSKiller.2.6.25.0_17.04.2012_20.25.07_log.txt
[2012/04/17 20:27:36 | 000,112,058 | ---- | M] () -- C:\TDSSKiller.2.7.28.0_17.04.2012_20.27.00_log.txt
[2009/11/05 18:51:59 | 000,000,455 | ---- | M] () -- C:\UI_Steven.log

< %PROGRAMFILES%\*.* >
[2008/01/20 21:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\*.* >
[2009/06/05 15:36:33 | 000,000,006 | -HS- | M] () -- C:\Users\Steven\AppData\Roaming\desktop.ini
[2010/05/11 19:07:17 | 000,024,206 | ---- | M] () -- C:\Users\Steven\AppData\Roaming\UserTile.png

< %systemroot%\Tasks\*.job >

< End of report >

Edited by Essexboy, 25 April 2012 - 12:48 PM.

  • 0

#4
Amlak
Posted 24 April 2012 - 07:54 PM

Amlak

    Member 1K

  • Member
  • PipPipPipPip
  • 1,470 posts
Please go directly to C: and paste the contents of ComboFix.txt here.

I'll be sure to submit the next fix for you soon.
  • 0

#5
Amlak
Posted 26 April 2012 - 04:20 PM

Amlak

    Member 1K

  • Member
  • PipPipPipPip
  • 1,470 posts
Run OTL.
  • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    :OTL
O4 - HKLM..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found
O4 - HKLM..\Run: [rAYBrQVgIl.exe] C:\ProgramData\rAYBrQVgIl.exe File not found
O4 - HKU\.DEFAULT..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found
O4 - HKU\S-1-5-18..\Run: [dplaysvr] C:\Windows\system32\config\systemprofile\AppData\Local\dplaysvr.exe File not found
O4 - HKU\S-1-5-21-2199769889-3324743020-2979947612-1000..\Run: [credpaint] C:\Users\Steven\AppData\Roaming\credpaint.exe File not found
O33 - MountPoints2\{08036178-5e60-11de-9fef-00219b0441b3}\Shell\AutoRun\command - "" = G:\InstallSeagateManager.exe
O33 - MountPoints2\{7b6e3ffb-fa60-11de-a6ba-00219b0441b3}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup.exe
[2012/01/17 20:02:09 | 000,000,507 | ---- | C] () -- C:\ProgramData\221b50d

:FILES
ipconfig /flushdns /c

:COMMANDS
[emptytemp]
  • Click the Run Fix button at the top.
  • When done, post the content of the resultant log in your next reply.

  • 0

#6
charlietweeder
Posted 05 June 2012 - 06:22 PM

charlietweeder

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Sorry about not getting back to you for so long. I was closing on a house and subsequently moving.

There is no file named "ComboFix.txt" in my C: root directory.

I ran the fix you provided above. There was no new log file created to paste here.

Please advise on the next step.

Thank you for your help!
  • 0

#7
Amlak
Posted 05 June 2012 - 07:30 PM

Amlak

    Member 1K

  • Member
  • PipPipPipPip
  • 1,470 posts
Welcome back, charlietweeder.

Could you paste the contents of each of the following files (if they're still there)?

C:\TDSSKiller.2.6.25.0_17.04.2012_20.25.07_log.txt
C:\TDSSKiller.2.7.28.0_17.04.2012_20.27.00_log.txt
  • 0

#8
charlietweeder
Posted 05 June 2012 - 08:04 PM

charlietweeder

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Sure. Here you go...

Attached Files


  • 0

#9
Amlak
Posted 06 June 2012 - 05:45 PM

Amlak

    Member 1K

  • Member
  • PipPipPipPip
  • 1,470 posts
Hey, charlietweeder. I'm assuming you still can't log into normal Windows. Either way, let me know if you actually can.

Next set of instructions to be posted as soon as it's approved.
  • 0

#10
charlietweeder
Posted 06 June 2012 - 09:46 PM

charlietweeder

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thanks for the reply.

No, I still cannot log in to windows normally. Stuck in a reboot loop. I have been using safe mode with networking to complete the instructions you've given me thus far.
  • 0

#11
Amlak
Posted 07 June 2012 - 04:09 PM

Amlak

    Member 1K

  • Member
  • PipPipPipPip
  • 1,470 posts
Step 1

  • Download Malwarebytes' Anti-Malware here.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, confirm a check mark is placed next to the following:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When done, you will be prompted. Click OK, then click on Show Results.
  • Make sure all items are checked and click on Remove Selected.
  • If asked to restart the computer, please do so immediately.
  • Post the contents of the resultant log in your next reply. You can access the log in the Logs tab.

Step 2

Delete the current OTL.exe that you have and download the newest version of OTL.exe from here and save it to the Desktop.

Run OTL and click Quick Scan.

When done, post the content of the resultant log in your next reply.
  • 0
Back to Computer Won't Boot - Malware Related · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Computer Won't Boot - Malware Related

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP