notepad.exe.mui and RS_Service and more taking over and slowing down m

I did find a MBR.dat file which I cannot open. I attached it just in case you are able to:

See Attachment.

MBR.dat 512bytes 178 downloads

I just now got the C:/ Avast Report to do through. Yay! Thanks for your patience. Here it is:

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software
Run date: 2013-08-17 11:37:15
-----------------------------
11:37:15.736 OS Version: Windows 6.1.7601 Service Pack 1
11:37:15.737 Number of processors: 2 586 0x1C0A
11:37:15.740 ComputerName: STEPH-PC UserName: Steph
11:37:18.031 Initialize success
11:38:33.204 AVAST engine defs: 13081601
11:38:54.599 The log file has been saved successfully to "C:\Users\Steph\Documents\aswMBR.txt-1.txt"
11:42:09.145 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
11:42:09.153 Disk 0 Vendor: ST916031 0001 Size: 152627MB BusType: 3
11:42:10.117 Disk 0 MBR read successfully
11:42:10.126 Disk 0 MBR scan
11:42:10.580 Disk 0 Windows 7 default MBR code
11:42:10.643 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12291 MB offset 63
11:42:10.785 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 101 MB offset 25173855
11:42:10.822 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 140232 MB offset 25382700
11:42:10.963 Disk 0 scanning sectors +312579760
11:42:11.955 Disk 0 scanning C:\Windows\system32\drivers
11:43:41.008 Service scanning
11:44:29.718 Modules scanning
11:46:56.601 AVAST engine scan C:\
12:25:36.521 File: C:\Users\Steph\Documents\XtremeFreeCommissionBot\Xtreme Free Commission Bot\Xtreme Free Commission Bot.exe **INFECTED** Win32:Malware-gen
12:29:33.740 File: C:\Users\Steph\Downloads\RAP2012.zip.exe **INFECTED** Win32:Downloader-TBH [Adw]
13:31:01.042 Scan finished successfully
13:31:53.753 Disk 0 MBR has been saved successfully to "C:\Users\Steph\Desktop\MBR.dat"
13:31:53.878 The log file has been saved successfully to "C:\Users\Steph\Desktop\aswMBR.txt2.txt"

I recommend the free Avast over Microsoft Security Essentials.

http://www.avast.com...ivirus-download
Download, (You want the free version. They will try to talk you in to the paid version and make you a special offer for the paid version but the free, basic version is what I use) Save.

Then uninstall MSSE and reboot.

Now install Avast by right clicking on the installer and Run As Admin.

Avast has a few quirks but they let you customize it to get rid of them.
Some people object to the voice notification of updates. To turn it off, click on the Avast ball then on Settings. Then on Sounds and uncheck Automatic Updates OK. (It will still update it just won't tell you about in a loud voice in the middle of the night.)

The registration is good for 12-14 months then you will need to register again. They will, of course, try to talk you into buying the product but you can always register again for another year free.
They have also started using their info popup to try and get you to upgrade so I go into Settings, Popups and change the first two to 1 second.
You need to register but the registration is free. Again they will try to talk you into the paid version so the free version is not always the The registration is good for 12-14 months then you will need to register again. They will, of course, try to talk you into buying the product and the free version may not be the default choice but you can always register again for another year free.

The thing about Avast that I really like is their boot-time scan. This runs before windows fully loads so catches a lot of viruses before they can hide. It does take a long time so I let it run while I sleep:

To use their boot-time scan: Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. It may take hours.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results and it will tell you if it found anything. A text version of the report is at: C:\ProgramData\Avast Software\Avast\report\aswboot.txt

For really paranoid people I also recommend the free Online Armor firewall. http://www.online-armor.com/
It's a bit of a bother at first since it will ask you if this or that program is allowed to connect but not nearly as much as Zone Alarm or Comodo.

I think we are done and can clean up. You can empty the recycle bin.

Copy the following:


:Commands
[CLEARALLRESTOREPOINTS]
[Reboot]

Right click on OTL and Run As Administrator. In the Custom Scans/Fixes box at the bottom, paste in the copied text (Ctrl + v) and then hit Run Fix.

That will get the last of the malware off the system by removing all of the old restore points (except for the latest one)

You can uninstall or delete any tools we had you download and their logs.

To uninstall combofix, copy the next line:

"c:\users\Steph\Downloads\Adware n Malware Cleaners\ComboFix.exe" /Uninstall

Pause your anti-virus.
Start, All Programs, Accessories then right click on Command Prompt and Run As Administrator.
then right click, Paste, then hit Enter.

OTL has a cleanup tab but DO NOT USE IT!. There are reports that it leaves the PC unbootable. Instead just delete OTL.exe and the folder c:\_OTL.

To hide hidden files again:

Vista or Win7

# Open the Control Panel menu and click Folder Options.
# After the new window appears select the View tab.
# Remove the check in the checkbox labeled Display the contents of system folders.
# Under the Hidden files and folders section select the radio button labeled Do not Show hidden files and folders.
# Check the checkbox labeled Hide protected operating system files.
# Press the Apply button and then the OK button and exit My Computer.

Also make sure you have the latest versions of any adobe.com products you use like Shockwave, Flash or Acrobat.

Whether you use adobe reader, acrobat or fox-it to read pdf files you need to disable Javascript in the program. There is an exploit out there now that can use it to get on your PC. For Adobe Reader: Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript. OK Close program. It's the same for Foxit reader except you uncheck Enable Javascript Actions.

To help keep your programs up-to-date you should download and run the UpdateChecker:
http://www.filehippo.../updatechecker/
(You don't need to download Betas and if there is a program you don't use you can just uninstall it rather than update it. Exception is MSN messenger which appears to be part of Windows.)
If you get a blocked program notice after installing updatechecker then change it to not run at start then manually run it once a week.
Seems to work best if Firefox is the default browser. You can also try Secunia PSI http://secunia.com/v...l/download_psi/ Same kind of info. You don't need both.
If you use Firefox then get the AdBlock Plus Add-on. WOT (Web of Trust) is another you might want to try.
The equivalent to AdBlock Plus for IE is called Simple Adblock and you should install it too: http://simple-adblock.com/
The free version only blocks 200 ads a day so another reason to use Firefox or Chrome.

If Firefox is slow loading make sure it only has the current Java add-on. Then download and run Speedy Fox.
http://www.crystalidea.com/speedyfox . You can run it any time that Firefox seems slow.

Be warned: If you use Limewire, utorrent or any of the other P2P programs you will almost certain be coming back to the Malware Removal forum. If you must use P2P then submit any files you get to http://virustotal.com before you open them.

If you have a router, log on to it today and change the default password! If using a Wireless router you really should be using encryption on the link. Use the strongest (newest) encryption method that your router and PC wireless adapter support especially if you own a business. See http://www.king5.com...-120637284.html and http://www.seattlepi...ted-1344185.php for why encryption is important. If you don't know how, visit the router maker's website. They all have detailed step by step instructions or a wizard you can download.

Special note on Java. Old Java versions should be removed after first clearing the Java Cache by following the instructions in:
http://www.java.com/...lugin_cache.xml
Then remove the old versions by going to Control Panel, Programs and Features and Uninstall all Java programs which are not Java Version 7 update 9 or better. These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE, J2SE. Get the latest version from Java.com. They will usually attempt to foist some garbage like the Ask toolbar, Yahoo toolbar or McAfee Security Scan on you as part of the download. Just uncheck the garbage before the download (or install) starts. If you use a 64-bit browser and want the 64-bit version of Java you need to use it to visit java.com.
Due to multiple security problems with Java we are now recommending that it not be installed unless you absolutely know you need it. IF that is the case then go to Control Panel, Java, Security and slide it up to the highest level. OK.

Make sure Windows Updates is turned and that it works. Go to Control panel, Windows Updates and see if it works.

If you are feeling especially paranoid you can install the free firewall called Online Armor:
http://www.online-armor.com/

My help is free but if you wish to show your appreciation, please donate to Kwiaht instead of me. It's a local environmental organization that I volunteer with: http://www.kwiaht.org/donate.htm
(The name means something like "clean place" in one of the local native-American dialects)

Ron

#16
RKinner

Posted 17 August 2013 - 10:10 AM

Advertisements

#17
sdockery

Posted 17 August 2013 - 12:36 PM

#18
RKinner

Posted 17 August 2013 - 01:46 PM

#19
sdockery

Posted 18 August 2013 - 12:23 AM

#20
RKinner

Posted 18 August 2013 - 07:57 AM

#21
sdockery

Posted 18 August 2013 - 02:14 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

notepad.exe.mui and RS_Service and more taking over and slowing down m

#16 RKinner Posted 17 August 2013 - 10:10 AM