tao22 Posted August 27, 2012 ID:590622 Share Posted August 27, 2012 My wife's laptop has a virus Its a svchost.exe trojan agentMalwarebytes can't remove it and Norton cant see it. Link to post Share on other sites More sharing options...
tao22 Posted August 27, 2012 Author ID:590624 Share Posted August 27, 2012 Sorry for the double postAttach.txtDDS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590629 Share Posted August 28, 2012 Welcome to the forum.Please remove any usb or external drives from the computer before you run this scan!Please download and run RogueKiller to your desktop.For Windows XP, double-click to start.For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.Click Scan to scan the system. When the scan completes > Close out the program > Don't Fix anything!Don't run any other options, they're not all bad!!!!!!!Post back the report which should be located on your desktop.MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590634 Share Posted August 28, 2012 Thank You for your helpRKreport1.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590639 Share Posted August 28, 2012 Please read the directions carefully so you don't end up deleting something that is good!!Please download and run TDSSKiller to your desktop as outlined below:Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.For Windows XP, double-click to start.For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.-------------------------Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.------------------------Click the Start Scan button.-----------------------If a suspicious object is detected, the default action will be Skip, click on ContinueIf you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on Continue----------------------If malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.--------------------A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.-------------------Here's a summary of what to do if you would like to print it out:If a suspicious object is detected, the default action will be Skip, click on ContinueIf you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on ContinueIf malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590647 Share Posted August 28, 2012 some how i have 3 reportsTDSSKiller.2.8.8.0_27.08.2012_20.22.52_log.txtTDSSKiller.2.8.8.0_27.08.2012_20.23.38_log.txtTDSSKiller.2.8.8.0_27.08.2012_20.25.36_log.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590650 Share Posted August 28, 2012 Please reboot the computer before you do this:Run TDSSKiller again and choose Delete for this one only: (no need to post the log)20:28:01.0260 6896 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user20:28:01.0260 6896 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip~~~~~~~~~~~~~~~~~~~Then...............Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingc...to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590690 Share Posted August 28, 2012 Im posting from a second pc, as i can not open any files or programs likeinternet explorer.i get " Illegal operation attempted on a registry key that has been marked for deletion" Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590693 Share Posted August 28, 2012 Im posting from a second pc, as i can not open any files or programs likeinternet explorer.i get " Illegal operation attempted on a registry key that has been marked for deletion"Did you read ALL MY instructions for ComboFix????? MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590702 Share Posted August 28, 2012 sorry ive been a wake for way to manny hours now.i have restarted several times now, i have runn in to a new issue with the wireless network conectivityim getting limited conectivity with my network, under wireless network connections my network shows up but but in the network and sharing center i showunidentified network with no internet conection Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590705 Share Posted August 28, 2012 Try to reset TCP/IP:http://support.microsoft.com/kb/299357Reboot and let me know, MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590712 Share Posted August 28, 2012 no changeunder view your active nework the network is unidentified and public Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590715 Share Posted August 28, 2012 under network troubleshootingi get ether the peer name resolution protocol service or the peer networking identity service is not running Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590718 Share Posted August 28, 2012 Please download Farbar Service Scanner and run it on the computer with the issue.Make sure the following options are checked:Internet Services Windows Firewall System RestoreSecurity Center Windows UpdateWindows Defender [*]Press "Scan". [*]It will create a log (FSS.txt) in the same directory the tool is run. [*]Please copy and paste the log to your reply. MrC (Gone for tonight > be back tomorrow am) Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590721 Share Posted August 28, 2012 doneFSS.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590780 Share Posted August 28, 2012 ComboFix creates a system restore point just be fore it runs.Please use it and see if the problem is gone, MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590965 Share Posted August 28, 2012 I don't show a restore point related to combofix, i do have a windows update restore point that was done on 8/26/12 Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590968 Share Posted August 28, 2012 Yes use it, MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590971 Share Posted August 28, 2012 ok im back on line with my wife's pc. Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590981 Share Posted August 28, 2012 the restore point worked Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590983 Share Posted August 28, 2012 Great, can you post the log from ComboFix and also this log:C:\Qoobox\ComboFix-quarantined-files.txtThanks....MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590984 Share Posted August 28, 2012 Here you goComboFix.txtComboFix-quarantined-files.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:590987 Share Posted August 28, 2012 OK...Thanks~~~~~~~~~~~~~~~Please Update and run a Quick Scan with MBAM, post the report.Make sure that everything is checked, and click Remove Selected.~~~~~~~~~~~~Reboot and run another scan with RogueKiller and post the new log.Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
tao22 Posted August 28, 2012 Author ID:590997 Share Posted August 28, 2012 The pc seems to be running goodRKreport2.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2012 ID:591000 Share Posted August 28, 2012 That I expected (svchost.exe), the log from RogueKiller looks Good. Download TFC to your desktopClose any open windows.Double click the TFC icon to run the programTFC will close all open programs itself in order to run,Click the Start button to begin the process.Allow TFC to run uninterrupted.The program should not take long to finish it's jobOnce its finished it should automatically reboot your machine,if it doesn't, manually reboot to ensure a complete clean~~~~~~~~~~~~~~~Then run another quick scan with Malwarebytes and post the logMake sure that everything is checked, and click Remove Selected.MrC Link to post Share on other sites More sharing options...
Recommended Posts