Was told to post my .txt here

[DJFrizzBizz]

So here you go, please let me know what I need to do!

asdf.txt

asdf1.txt

[MrCharlie]

Welcome to the forum.

What are your concerns with the computer?

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system (don't run any other options)

Post back the report.

MrC

------->Logs will be closed if you haven't replied within 3 days!<--------

[DJFrizzBizz]

My apologies for the wait and for the lack of information in the previous post I left, I have been very busy at work so it took a while to reply back

My concern with the computer is that "Malwarebytes" keeps popping up a message saying it has found a trojan agent in the svchost.exe file and it pops up at least twice a day and I am on my computer A LOT!

Here is the report from RogueKiller

RogueKiller V7.3.3 [04/22/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User: USRedefined [Admin rights]

Mode: Scan -- Date: 04/28/2012 03:29:40

¤¤¤ Bad processes: 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 4 ¤¤¤

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDS721050CLA SCSI Disk Device +++++

--- User ---

[MBR] 478cfdd535ea4be06ed8fb97fc6cf8be

[bSP] bd2594b1bf406cdf459a438723ab3fd1 : Windows Vista/7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 466726 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 956061696 | Size: 10112 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1].txt >>

RKreport[1].txt

[MrCharlie]

OK, run RogueKiller again and click Scan

When the scan is done, click on the Bad processes tab

Now put a check next to this one...uncheck the rest

¤¤¤ Bad processes: 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

Now click Delete on the right hand column.

-----------------------------------

Then........

Please make sure system restore is running and create a new restore point before continuing.

XP users > please back up the registry using ERUNT.

-----------------------------------------

Please download and run TDSSKiller to your desktop as outlined below:

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

-------------------------

Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

------------------------

Click the Start Scan button.

-----------------------

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose delete.

----------------------

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

--------------------

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

-------------------

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose delete.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

MrC

[DJFrizzBizz]

Well sadly I am replying to you from my mobile phone because after I did the reset as required my computer now will not load windows it boots up into the loading diagnostics screen and I can't get past that page

[MrCharlie]

Did you run TDSSKiller??

Use system restore, you did create a restore point as asked?

http://windows.micro...ns-in-Windows-7

EDIT: you can try startup repair first, the system restore.

MrC

Edited April 28, 2012 by MrCharlie

[DJFrizzBizz]

Yes I did create a restore point but I do not have my recovery CD so I am not sure how to get system restore on a USB flash drive

[DJFrizzBizz]

And yes I did run TDSSKiller and followed the instructions as you posted

[MrCharlie]

If your computer has a single operating system installed, press and hold the F8 key as your computer restarts. You need to press F8 before the Windows logo appears. If the Windows logo appears, you need to try again by waiting until the Windows logon prompt appears, and then shutting down and restarting your computer.

Then try Startup Repair

If that doesn't work...try System Restore.

MrC

[DJFrizzBizz]

I am sorry for the confusion here, I am pressing the F8 button and nothing is happening, only when I press F10 does my BIOS load up, and my computer won't even make it to the Windows Logo no matter how many times I restart or turn the computer off Via Power Button

[MrCharlie]

No, you don't want the bios, shut the computer off, the start it back up and while it's starting continually tab the F8 button.

MrC

[DJFrizzBizz]

I ensure you that I have been spamming the F8 button from the second i let go of the power button and nothing happens, all that happens is my computer sits at the Diagnostics window showing that it has loaded all of the necessary hardware to boot up and then it stops there, doesn't go past that to the windows screen

[MrCharlie]

Try holding down the control key while it starts.

MrC

[DJFrizzBizz]

I have tried holding down the control key while the computer boots up and nothing happens, neither control nor F8 does anything

[MrCharlie]

That's the only 2 ways I know to get to the repair options.

The keyboard works...correct?

Is this a laptop or desktop?

Do you have another keyboard?

MrC

[MrCharlie]

I have to leave the forum now, be back tomorrow, MrC

[MrCharlie]

Can you get to this menu?

Restart the computer and tap F10 until the Edit Boot Menu options come up.

MrC

[DJFrizzBizz]

My apologies once again for the long reply had to work a busy weekend, well I ended up wiping my computer and putting a copy of windows xp pro

and so far I have no problems, wiped all my partitions so I had to re download drivers for my motherboard and everything else

[MrCharlie]

OK, sorry about that but these things happen from time to time.

Any questions.....please post back.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Maurice Naggar]

@DJfrizzbiz

NOTE: If XP CD is from a pc manufacturer, and they bundled an AV like McAfee or Norton/Symantec trial versions, immediately de-install those, sice they will be outdated & of no use. Install your antvirus immediately after.

Visit MS Windows Updates and make ceratin you have all the latest Critical updates and most especially Service Pack 3 of XP.

and eventually, get Internet Explorer 8 (IE6 of the original XP is way-outdated)

Check in at Windows Update and install any Critical Updates offered.

Make certain that Automatic Updates is enabled.

How to configure and use Automatic Updates in Windows

http://support.microsoft.com/kb/306525

Also see other security references at Microsoft

4 steps to protect your computer

How to boost your malware defense and protect your PC

This topic is closed.