Elise
-
Posts
8,720 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by Elise
-
-
On the Reatogo desktop, please open My Computer and see if you see your C drive listed there.
-
got to the REATOGO Desktop and when I double click on the black and yellow OTLPE icon a box comes up that say "Browse for folder" It gives me different choices in MY Computer
In My Computer, please expand c:\ and locate the Windows folder. This should start OTLPE.
-
As long as ndis.sys is still infected, it makes no sense to go after the other infections. The rootkit will protect them most likely.
Please try to rename c:\windows\ndiscopy.sys to ndis.sys
You can do that by right clicking on ndiscopy.sys and clicking "rename". ONLY if this is succesful, please re-run Combofix. Otherwise, post back here.
-
Hi, lets run one other scan.
ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the
button. - For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on
to download the ESET Smart Installer. Save it to your desktop. - Double click on the
icon on your desktop. - Check
- Click the
button. - Accept any security warnings from your browser.
- Check
- Push the Start button.
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push
- Push
, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created. - Push the
button. - Push
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
-
Can you please let me know how everything is running now?
Before continuing, I want to have a closer look at ndis.sys. It seems that the file replacement we attempted with Combofix somehow did not work.
Please download SystemLook from one of the links below and save it to your Desktop.
- Double-click SystemLook.exe to run it.
- Copy the content of the following codebox into the main textfield:
:filefind
ndis.sys
ndiscopy.sys - Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
- Double-click SystemLook.exe to run it.
-
Hello again, thats looking a lot better
How are things running now? Any problems left?
ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
- Check
- Click the button.
- Accept any security warnings from your browser.
- Check
- Push the Start button.
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push
- Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created. - Push the button.
- Push
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
-
Hello again,
Thats looking awesome! Unless you have any problems left, your computer gets a clean bill of health
One small note, I see you are still using Internet Explorer 6. I recommend you to upgrade to Internet explorer 8 (Microsoft rates the update as High Priority). Even if you use Firefox as main browser, its still a good idea to keep also Internet Explorer up to date. It is still required for some sites (including MS update) and keeping it at IE6 leaves you with certain vulnerabilities that might be exploited when browsing the internet using IE6.
ALL CLEAN
--------------
Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean
Please do the following to remove the remaining programs from your PC:
- Delete the tools used during the disinfection:
- Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
- Delete DDS, GMER (this is a random named file) and Defogger (after any CD emulation software is re-enabled).
- Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
Please read these advices, in order to prevent reinfecting your PC:
- Install and update the following programs regularly:
- an outbound firewall
A comprehensive tutorial and a list of possible firewalls can be found here. - an AntiVirus Software
It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats. - an Anti-Spyware program
Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
SUPERAntiSpyware is another good scanner with high detection and removal rates.
Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions. - Spyware Blaster
A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating. - MVPs hosts file
A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file
- an outbound firewall
[*]Keep Windows (and your other Microsoft software) up to date!
I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.
Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
[*]Keep your other software up to date as well
Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.
[*]Stay up to date!
The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing
.Some more links you might find of interest:
- Miekies' prevention suggestions
- So How did I get infected?
- Microsoft - 'Security at home'
- Calendar of Updates: See which updates have been released.
- How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail :wink:
- Commonly UsedFreeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.
- osalt: Find (free) open source alternatives to known commercial software.
Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.
- Delete the tools used during the disinfection:
-
Okay, good luck with the reinstall
Indeed Avast is a very good antivirus application, its free and has a high detection rate.
-
Please let me know if you have any more questions
I'll list some general advice you might find of interest below.
Please read these advices, in order to prevent reinfecting your PC:
- Install and update the following programs regularly:
- an outbound firewall
A comprehensive tutorial and a list of possible firewalls can be found here. - an AntiVirus Software
It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats. - an Anti-Spyware program
Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
SUPERAntiSpyware is another good scanner with high detection and removal rates.
Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions. - Spyware Blaster
A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating. - MVPs hosts file
A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file
- an outbound firewall
[*]Keep Windows (and your other Microsoft software) up to date!
I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.
Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!
[*]Keep your other software up to date as well
Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.
[*]Stay up to date!
The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing
.Some more links you might find of interest:
- Miekies' prevention suggestions
- So How did I get infected?
- Microsoft - 'Security at home'
- Calendar of Updates: See which updates have been released.
- How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail :wink:
- Commonly UsedFreeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.
- osalt: Find (free) open source alternatives to known commercial software.
Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.
- Install and update the following programs regularly:
-
Hello, welcome back
Please make sure you do the steps below in the order given, otherwise things will not work.
Insert your XP CD in the CD drive (I assume this is d:\, if not, please change the script below accordingly). I notice your log shows no CD drive, if this is the cause, post back here, do NOT continue!
If you can use your infected computers CD drive, you can continue safely.
Click Start > Run, type notepad in the runbox and press enter.
Copy/paste the text in the codebox below into Notepad and save it as copy.bat to your desktop.
@echo off
expand d:\i386\cdrom.sy_ c:\windows\system32\drivers\cdrom.sys
expand d:\i386\ndis.sy_ c:\windows\ndiscopy.sysExit Notepad and doubleclick on copy.bat to run it. This should copy two files to your computer. Afterwards, verify if the following file has been created: c:\windows\ndiscopy.sys
If this file has NOT been created, do NOT continue!
CF-SCRIPT
-------------
We need to execute a CF-script.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:
RenV::
c:\program files\Adobe\Acrobat 7.0\Distillr\acrotray .exe
c:\program files\Common Files\Symantec Shared\ccapp .exe
c:\program files\Malwarebytes' Anti-Malware\tcjnwkjfk .exe
FCopy::
c:\windows\ndiscopy.sys | c:\windows\system32\drivers\ndis.sysSave this as CFScript.txt, in the same location as ComboFix.exe
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
- Close any open browsers.
-
Hi, sorry to hear that. If you want we can try some steps to access your drive again and maybe get it booting properly. This will require you to download an approx 270 MB file and burn it to a CD.
Personally, I would recommend Avira Antivir, Avast or Microsoft Security Essentials. Keep in mind never to install more than one antivirus product.
Please let me know how you want to continue.
-
Hello , thanks for the additional information!
BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.
I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall
We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.
COMBOFIX
---------------
Please download ComboFix from one of these locations:
Bleepingcomputer
ForoSpyware- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
- Double click on Combofix.exe and follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
In your next reply, please include the following:
- Combofix.txt
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
-
Hello , how are things running now?
OTL FIX
------------
We need to run an OTL Fix
- Please reopen
on your desktop. - Copy and Paste the following code into the
textbox. Do not include the word "Code":otl
IE - HKU\S-1-5-21-2369784985-3565334909-3672067247-1006\S-1-5-21-2369784985-3565334909-3672067247-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
:commands
[emtytemp] - Push
- OTL may ask to reboot the machine. Please do so if asked.
- Click
. - A report will open. Copy and Paste that report in your next reply.
INSTALL ANTIVIRUS
---------------------------
I don't see an Anti Virus Program running on your machine
Download and install an antivirus program, and make sure that you keep it updated
New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
Three good antivirus programs free for non-commercial home use are Avast!, Antivir and Microsoft Security Essentials
Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
UPDATE JAVA
------------------
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
- Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
- Look for "Java Runtime Environment (JRE)" JRE 6 Update 18.
- Click the Download button to the right.
- Select your Platform: "Windows".
- Select your Language: "Multi-language".
- Read the License Agreement, and then check the box that says: "Accept License Agreement".
- Click Continue and the page will refresh.
- Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
- Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
- Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.
-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.
Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.
MALWAREBYTES ANTIMALWARE
-------------------------------------------
Please launch MBAM and update the program before performing a scan.
- If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
- If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
- Make sure the "Perform Quick Scan" option is selected.
- Then click on the Scan button.
- If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
- The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
- When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
- Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
- Click on the Show Results button to see a list of any malware that was found.
- Make sure that everything is checked, and click Remove Selected.
- When removal is completed, a log report will open in Notepad.
- The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
- Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
- Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
In your next reply, please include the following:
- OTL report
- MBAM log
- Please reopen
-
Hello , thats looking better already!
First of all, to completely uninstall Norton, follow the steps below. Afterwards you can reinstall it. No need to wait until everything is clean.
Please click HERE and follow the instructions in STEP 2 to download and run the norton removal tool.
UPDATE JAVA
------------------
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
- Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
- Look for "Java Runtime Environment (JRE)" JRE 6 Update 18.
- Click the Download button to the right.
- Select your Platform: "Windows".
- Select your Language: "Multi-language".
- Read the License Agreement, and then check the box that says: "Accept License Agreement".
- Click Continue and the page will refresh.
- Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
- Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
- Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.
-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.
Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.
You are dangerously low on Harddisk space. Besides from running Temp File Cleaner, please uninstall any unused applications and I recommend to move personal data files to external devices.
TFC
--------
Download TFC by OldTimer to your desktop.
(TFC only cleans temp folders. It will not clean URL history, prefetch, or cookies).
Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job.
Once its finished it should automatically reboot your machine, if it doesn't, manually reboot to ensure a complete clean
NOTE:
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder.
MALWAREBYTES ANTIMALWARE
-------------------------------------------
Please launch MBAM and update the program before performing a scan.
- If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
- If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
- Make sure the "Perform Quick Scan" option is selected.
- Then click on the Scan button.
- If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
- The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
- When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
- Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
- Click on the Show Results button to see a list of any malware that was found.
- Make sure that everything is checked, and click Remove Selected.
- When removal is completed, a log report will open in Notepad.
- The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
- Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
- Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
In your next reply, please include the following:
- MBAM log
- Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
-
Okay, please let me know when you are ready to move on!
-
Hello,
Sorry to hear that, but good that you found out what was causing the problem.
Since MBAM still found a few items, let me know if you want to continue with a check up or if this topic can be closed.
-
Yes, you can try to run it in safe mode.
-
Well, your log shows "no action taken" on all items. Please select "remove" for all 4 items and afterwards re-run the quick scan.
-
Please post me the last MBAM log.
-
How are things now? Do you still have the Antimalware dr. popups?
-
Which means things are still not as they shouldSorry, not sure what you mean when you ask if everything is running OK . The antimalware doctor keeps coming up still Lets see if we can change that!OTL FIX
------------
We need to run an OTL Fix
- Please reopen on your desktop.
- Copy and Paste the following code into the textbox. Do not include the word "Code"
:otl
O4 - HKU\S-1-5-21-982137252-2902945743-3686302165-1000..\Run: [dbf70700.exe] C:\Users\Vick\AppData\Roaming\149B04F0CAA6C95B6AA7A0E34FDBC211\dbf70700.exe (MS)
O4 - HKU\S-1-5-21-982137252-2902945743-3686302165-1000..\Run: [userinit] C:\Users\Vick\AppData\Roaming\mskqhe32.exe ()
:commands
[emptytemp] - Push
- OTL may ask to reboot the machine. Please do so if asked.
- Click .
- A report will open. Copy and Paste that report in your next reply.
- Please reopen
-
Hello , that looks a lot better
Please let me know how everything is running now, any problems left?
UPDATE JAVA
------------------
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
- Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
- Look for "Java Runtime Environment (JRE)" JRE 6 Update 18.
- Click the Download button to the right.
- Select your Platform: "Windows".
- Select your Language: "Multi-language".
- Read the License Agreement, and then check the box that says: "Accept License Agreement".
- Click Continue and the page will refresh.
- Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
- Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
- Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
- Repeat as many times as necessary to remove each Java versions.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.
-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.
Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.
ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
- Check
- Click the button.
- Accept any security warnings from your browser.
- Check
- Push the Start button.
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push
- Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created. - Push the button.
- Push
In your next reply, please include the following:- ESET online scan results
- ESET online scan results
- Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
-
Hi again
Can you please re-run Malwarebytes antimalware, update it first and run a quick scan?
-
Hello, please try to follow the steps below. Please do not quote, instead use the "add reply" button.
COMBOFIX
---------------
Please download ComboFix from one of these locations:
Bleepingcomputer
ForoSpyware- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
- Double click on Combofix.exe and follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
BSOD? Thought I had Total PC Defender beat
in Resolved Malware Removal Logs
Posted
No, you did fine, however, it appears there might be some problem with your harddisk.
You're going to need a program called TestDisk. It's a free and open source disk recovery program.
Step 1: Download the TestDisk executable here: Download and save it to a flash drive.
Step 2: On the Reatogo desktop, extract the downloaded zip file using your favorite archive extractor.
Step 3: Double-click on the testdisk_win.exe file (found in the win folder of the extracted archive)
Step 4: You will now be at a scary looking text-based command window:
Press Enter here to create a new log file.
Step 5: TestDisk will now detect all local hard drives, and present them in a list like this:
You have indicated that there is only one hard drive attached to your computer, with two partitions. So, use the arrow (up and down) keys to highlight the disk called /dev/sda.
Note: If /dev/sda isn't listed or you have more than one hard drive, STOP and post back here.
With /dev/sda selected, press Enter
Step 6: Now we need to specify the type of partitions that are on your disk. Select Intel (even if you have an AMD processor).
Press Enter.
Step 7: Select Analyse and press Enter.
Quit TestDisk by pressing Q. Post me the testdisk log please (it can be found in the win folder).