[Joelmosen]

Hiya. Yeah that's correct, but I don't use Firefox anymore. I've changed to Chrome.

 

I've attached the log.

Attached Files

•  cureit.log   3.26MB   644 downloads

Edited by Joelmosen, 19 May 2015 - 07:30 AM.

[Advertisements]

That confirms to me that your machine as clean.

You really need technical assistance to fix this.

I wonder why you can run things without difficulty in Safe Mode though. That is a pointer that something that is not running in Safe Mode is causing the problem.

From a malware perspective that would suggest that the culprit is a security program but there are many other things that could be the cause.

You could try uninstalling ESET, see if that makes a difference and then reinstall it.

Alternatively, if you haven't already done so you could try this one:

Download Windows Repair (All In One) from here.

It will allow you to repair common issues with your computer such as firewall, file permission, and Windows Update problems.  When using this tool you can select the particular fixes you would like to launch and start the repair process.

For now though, just use the default settings.

Please download the tool to somewhere you can find it.

Double click to open and follow the prompts to install.
 

• Once installed click on the tab Start Repairs and the button Start
• Do not make any changes to the check marks.
• Also put a check in the Restart/Shutdown System When Finished (lower right) box.
• and in Restart System
• Then click on the Start button if it doesn't do it automatically
• If it asks you to back up your system click allow it to do so and continue

When it is finished copy and paste the Windows Repair Log back here.  

The log (_windows_repair_log.txt) is located in the following folder:
 
*  64-bit systems file path - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
 
*  32-bit systems file path - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs

Also tell me if the symptoms have been cured.
 

 

[emeraldnzl]

That confirms to me that your machine as clean.

You really need technical assistance to fix this.

I wonder why you can run things without difficulty in Safe Mode though. That is a pointer that something that is not running in Safe Mode is causing the problem.

From a malware perspective that would suggest that the culprit is a security program but there are many other things that could be the cause.

You could try uninstalling ESET, see if that makes a difference and then reinstall it.

Alternatively, if you haven't already done so you could try this one:

Download Windows Repair (All In One) from here.

It will allow you to repair common issues with your computer such as firewall, file permission, and Windows Update problems.  When using this tool you can select the particular fixes you would like to launch and start the repair process.

For now though, just use the default settings.

Please download the tool to somewhere you can find it.

Double click to open and follow the prompts to install.
 

• Once installed click on the tab Start Repairs and the button Start
• Do not make any changes to the check marks.
• Also put a check in the Restart/Shutdown System When Finished (lower right) box.
• and in Restart System
• Then click on the Start button if it doesn't do it automatically
• If it asks you to back up your system click allow it to do so and continue

When it is finished copy and paste the Windows Repair Log back here.  

The log (_windows_repair_log.txt) is located in the following folder:
 
*  64-bit systems file path - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
 
*  32-bit systems file path - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs

Also tell me if the symptoms have been cured.
 

 

[Joelmosen]

Okey. I tried uninstalling ESET but it didn't help. I ran the repair program but unfortunately that didn't help either, but here is the log anyway.

 

 

 

Tweaking.com - Windows Repair v3.2.0

--------------------------------------------------------------------------------

 

System Variables

--------------------------------------------------------------------------------

OS: Windows 7 Professional

OS Architecture: 64-bit

OS Version: 6.1.7601

OS Service Pack: Service Pack 1

Computer Name: JOEL-DATOR

Windows Drive: C:\

Windows Path: C:\Windows

Program Files: C:\Program Files

Program Files (x86): C:\Program Files (x86)

Current Profile: C:\Users\Joel

Current Profile SID: S-1-5-21-3769045198-701428065-4255041945-1000

Current Profile Classes: S-1-5-21-3769045198-701428065-4255041945-1000_Classes

Profiles Location: C:\Users

Profiles Location 2: C:\Windows\ServiceProfiles

Local Settings AppData: C:\Users\Joel\AppData\Local

--------------------------------------------------------------------------------

 

System Information

--------------------------------------------------------------------------------

System Up Time: 0 Days 00:05:04

 

Process Count: 31

Commit Total: 1,43 GB

Commit Limit: 8,00 GB

Commit Peak: 1,50 GB

Handle Count: 8110

Kernel Total: 235,82 MB

Kernel Paged: 189,03 MB

Kernel Non Paged: 46,79 MB

System Cache: 599,91 MB

Thread Count: 378

--------------------------------------------------------------------------------

 

Memory Before Cleaning with CleanMem

--------------------------------------------------------------------------------

Memory Total: 4,00 GB

Memory Used: 1,43 GB(35,6944%)

Memory Avail.: 2,57 GB

--------------------------------------------------------------------------------

 

Cleaning Memory Before Starting Repairs...

 

Memory After Cleaning with CleanMem

--------------------------------------------------------------------------------

Memory Total: 4,00 GB

Memory Used: 810,55 MB(19,7928%)

Memory Avail.: 3,21 GB

--------------------------------------------------------------------------------

 

Starting Repairs...

   Started at (2015-05-20 00:19:26)

 

Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...

Total Missing 'InstallDate' Fixed: 4

 

01 - Reset Registry Permissions 01/03

   HKEY_CURRENT_USER & Sub Keys

   Start (2015-05-20 00:19:28)

 

   Running Repair Under Current User Account

   Done (2015-05-20 00:19:41)

 

01 - Reset Registry Permissions 02/03

   HKEY_LOCAL_MACHINE & Sub Keys

   Start (2015-05-20 00:19:41)

 

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,19 seconds.

 

   Running Repair Under System Account

   Done (2015-05-20 00:23:25)

 

01 - Reset Registry Permissions 03/03

   HKEY_CLASSES_ROOT & Sub Keys

   Start (2015-05-20 00:23:26)

 

   Running Repair Under System Account

   Done (2015-05-20 00:24:27)

 

03 - Reset Service Permissions

   Start (2015-05-20 00:24:27)

 

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:25:50)

 

04 - Register System Files

   Start (2015-05-20 00:25:50)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:26:40)

 

05 - Repair WMI

   Start (2015-05-20 00:26:40)

 

   Starting Security Center So We Can Export The Security Info.

 

   Exporting Antivirus Info...

   No Antivirus Products Reported.

 

   Exporting AntiSpyware Info...

   Windows Defender Exported.

 

   Exporting 3rd Party Firewall Info...

   No Firewall Products Reported.

 

   Running Repair Under Current User Account

   Done (2015-05-20 00:34:39)

 

06 - Repair Windows Firewall

   Start (2015-05-20 00:34:39)

   Running Repair Under Current User Account

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,13 seconds.

 

   Running Repair Under System Account

   Done (2015-05-20 00:35:11)

 

07 - Repair Internet Explorer

   Start (2015-05-20 00:35:11)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:35:26)

 

08 - Repair MDAC/MS Jet

   Start (2015-05-20 00:35:26)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:35:33)

 

09 - Repair Hosts File

   Start (2015-05-20 00:35:33)

   Running Repair Under System Account

   Done (2015-05-20 00:35:34)

 

10 - Remove Policies Set By Infections

   Start (2015-05-20 00:35:34)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:35:38)

 

12 - Repair Icons

   Start (2015-05-20 00:35:39)

   Running Repair Under Current User Account

   Done (2015-05-20 00:35:40)

 

13 - Repair Winsock & DNS Cache

   Start (2015-05-20 00:35:40)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:35:58)

 

15 - Repair Proxy Settings

   Start (2015-05-20 00:35:58)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:36:00)

 

17 - Repair Windows Updates

   Start (2015-05-20 00:36:00)

   Running Repair Under Current User Account

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,14 seconds.

 

   Running Repair Under System Account

   Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.

   Done (2015-05-20 00:37:00)

 

18 - Repair CD/DVD Missing/Not Working

   Start (2015-05-20 00:37:00)

   iTunes not found, not applying UpperFilters iTunes Reg Key

   Done (2015-05-20 00:37:00)

 

19 - Repair Volume Shadow Copy Service

   Start (2015-05-20 00:37:00)

   Running Repair Under Current User Account

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,14 seconds.

 

   Running Repair Under System Account

   Done (2015-05-20 00:37:25)

 

21 - Repair MSI (Windows Installer)

   Start (2015-05-20 00:37:25)

   Running Repair Under Current User Account

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,14 seconds.

 

   Running Repair Under System Account

   Done (2015-05-20 00:37:42)

 

23.01 - Repair bat Association

   Start (2015-05-20 00:37:42)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:37:48)

 

23.02 - Repair cmd Association

   Start (2015-05-20 00:37:48)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:37:52)

 

23.03 - Repair com Association

   Start (2015-05-20 00:37:52)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:37:56)

 

23.04 - Repair Directory Association

   Start (2015-05-20 00:37:56)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:37:59)

 

23.05 - Repair Drive Association

   Start (2015-05-20 00:37:59)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:03)

 

23.06 - Repair exe Association

   Start (2015-05-20 00:38:03)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:06)

 

23.07 - Repair Folder Association

   Start (2015-05-20 00:38:06)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:09)

 

23.08 - Repair inf Association

   Start (2015-05-20 00:38:09)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:12)

 

23.09 - Repair lnk (Shortcuts) Association

   Start (2015-05-20 00:38:12)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:15)

 

23.10 - Repair msc Association

   Start (2015-05-20 00:38:15)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:19)

 

23.11 - Repair reg Association

   Start (2015-05-20 00:38:19)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:23)

 

23.12 - Repair scr Association

   Start (2015-05-20 00:38:23)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:26)

 

24 - Repair Windows Safe Mode

   Start (2015-05-20 00:38:26)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:29)

 

25 - Repair Print Spooler

   Start (2015-05-20 00:38:29)

   Running Repair Under Current User Account

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,14 seconds.

 

   Running Repair Under System Account

   Done (2015-05-20 00:38:37)

 

26 - Restore Important Windows Services

   Start (2015-05-20 00:38:37)

   Running Repair Under Current User Account

 

Decompressing & Updating Windows Permission File services.txt

Done,  0,14 seconds.

 

   Running Repair Under System Account

   Done (2015-05-20 00:38:44)

 

27 - Set Windows Services To Default Startup

   Start (2015-05-20 00:38:44)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:56)

 

   Skipping Repair.

   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

   Current version: 6.1

 

   Skipping Repair.

   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

   Current version: 6.1

 

   Skipping Repair.

   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

   Current version: 6.1

 

31 - Repair Windows 'New' Submenu

   Start (2015-05-20 00:38:56)

   Running Repair Under Current User Account

   Running Repair Under System Account

   Done (2015-05-20 00:38:58)

 

33 - Repair Performance Counters

   Start (2015-05-20 00:38:58)

   Running Repair Under Current User Account

   Done (2015-05-20 00:39:16)

 

Cleaning up empty logs...

 

All Selected Repairs Done.

   Done at (2015-05-20 00:39:16)

   Total Repair Time: 00:19:51

 

 

...YOU MUST RESTART YOUR SYSTEM...

[emeraldnzl]

Hello again Joelmosen,

 

As I mentioned, I believe you need technical assistance to resolve this issue.

I am a malware specialist, not a techie.

I suggest you open a topic here explain the situation and see if someone has a solution. Tell them you have been here first and provide a link back to this topic.

Meantime I will give you some instructions to remove the tools we have been using.

Follow these steps to uninstall Combofix. This will also clean out and reset your Restore Points.

• Press the Windows Key and R on your keyboard. This will bring up the Run window.
• Now type Combofix /Uninstall in the runbox  and click OK.  Note the space between the X and the U, it needs to be there.

• Follow the prompts to uninstall Combofix.

Once done you will receive a message saying Combofix was uninstalled successfully.

 

Step 2

To clear away the remaining tools we have been using download Delfix from here. You will be taken to the download page. Just wait and shortly the download will appear.

Put a check (tick) in the following boxes:
 

• Remove disinfection tools

 

Then click Run

 

The tool will run for a short time. When completed a notepad window will open with a log. Please copy and paste the log back here.

Any remaining tools may be deleted.

-------------------------------------------------------------------------------------------------------------------

A reminder:  Remember to (re-install if uninstalled during cleaning) update and turn back on any anti-malware programs you may have turned off during the cleaning process.
-------------------------------------------------------------------------------------------------------------------

Here are some things that I think are worth having a look at if you don't already know about them:

---------------------------------------------------------------------------------------------------------------------

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article Strong passwords: How to create and use them.

----------------------------------------------------------------------------------------------------------------------

So many of us use Facebook nowadays. Go here for a guide to Facebook security.

-----------------------------------------------------------------------------------------------------------------------

Java warning

Java is a popular point of entry to your computer for malicious programs. Unless you need it to run an important software the safest approach is to completely uninstall Java. Where you do require it, then the next safest option is to disable it in your browsers until you need it, then enable it.

How to disable Java in your web browser and How to unplug Java from the browser

If you do still need Java then regularly check that it is up to date. Older versions are the most vulnerable to malicious attack.
 

• Download Java for Windows
  
  Reboot your computer.
  You also need to unininstall older versions of Java.
  
     
• Click Start > Control Panel > Add or Remove Programs
     
• Remove all Java updates except the latest one you have just installed.

--------------------------------------------------------------------------------------------------------------------

CryptoLocker Warning

There is a particularly nasty infection out there at the moment.

Go here for information about CryptoLocker Ransomeware

Download CryptoPrevent free for home use.

--------------------------------------------------------------------------------------------------------------------

To help protect your computer in the future:



If you do not already have automatic updates set then it is recommended that you do set Windows to check, download and install your updates automatically.

    * Click Start > Control Panel > System and Security > Windows Update
    * Under Windows Update click on Turn automatic updating on or off
    * Check items shown to ensure you receive updates automatically. Click OK.

Be aware of what emails you open and websites you visit.

Go here for some good advice about how to prevent infection.

For some common sense advice about protecting your computer read How to boost your malware defense and protect your PC

A fun way to check your online safety literacy.

Quiz - getsafeonline

Have a safe and happy computing day!
 

 

[Joelmosen]

Okey. Emerlad I really appreciate that you atleast tried to help me fix this issue. I will head over to the other place you linked me too, and see if they can help me as well. Before I forget, here is the log.

 

# DelFix v1.010 - Logfile created 20/05/2015 at 11:25:05

# Updated 26/04/2015 by Xplode

# Username : Joel - JOEL-DATOR

# Operating System : Windows 7 Professional Service Pack 1 (64 bits)

 

~ Removing disinfection tools ...

 

Deleted : C:\Qoobox

Deleted : C:\FRST

Deleted : C:\AdwCleaner

Deleted : C:\RegBackup

Deleted : C:\Users\Joel\Desktop\FRST-OlderVersion

Deleted : C:\Users\Joel\Desktop\mbar

Deleted : C:\ComboFix.txt

Deleted : C:\Users\Joel\Desktop\Addition.txt

Deleted : C:\Users\Joel\Desktop\FRST.txt

Deleted : C:\Users\Joel\Desktop\FRST64.exe

Deleted : C:\Users\Joel\Desktop\MiniToolBox.exe

Deleted : C:\Users\Joel\Desktop\RogueKillerX64.exe

Deleted : C:\Users\Joel\Downloads\tdsskiller.exe

Deleted : C:\Windows\grep.exe

Deleted : C:\Windows\NIRCMD.exe

Deleted : C:\Windows\MBR.exe

Deleted : C:\Windows\SED.exe

Deleted : C:\Windows\SWREG.exe

Deleted : C:\Windows\SWSC.exe

Deleted : C:\Windows\SWXCACLS.exe

Deleted : C:\Windows\Zip.exe

Deleted : HKLM\SOFTWARE\AdwCleaner

Deleted : HKLM\SOFTWARE\Swearware

Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

 

########## - EOF - ##########

[emeraldnzl]

 

Hope you find a solution.

 

I will keep this topic open for a day or two in case you need to come back.