Virus keeps coming back

[epic1978]

I can not get rid of 2 viruses one is trojan.ransom and another is PUM.UserWLoad. I have ran malawarebytes many times and it keeps finding these same two ones.

dds.txt

attach.txt

[jeffce]

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable (.exe) every time you run them

with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

---------

Please download aswMBR to your desktop.

• Double click the aswMBR icon to run it.
  
• Click the Scan button to start scan.
  
• If you are asked to update the Avast Virus database please allow it to do so.
  
• When it finishes, press the save log button, save the logfile to your desktop and attach its contents in your next reply.

Click the image to enlarge it

----------

[epic1978]

Thank you for helping me! Attached is the logfile from aswMBR.

aswMBR.txt

[jeffce]

Download Combofix from the link below, and save it to your desktop.

Link

**Note: It is important that it is saved directly to your desktop**

If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

• 
  When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.
  

----------

[epic1978]

I ran combofix but it says that it can not find notepad.exe to when it trys to bring up the log and when i look up C:\ComboFix.txt it says application not found. It would not let me download it to my desktop as soon as I saved file and double clicked it started running.

[jeffce]

Sorry...I want to make sure that I understand. You can run ComboFix through but can not open the log?

[epic1978]

Yes i ran it but can not open the log. Says that notepad.exe can not be found to open it and when I look up C:\ComboFix.txt it says application can not be found.

[epic1978]

I got it to open. I have attached the log.

ComboFix.txt

[jeffce]

Look and see if Notepad.exe is found here >> C:\Windows\System32\notepad.exe

[epic1978]

Notepad was not found it says Windows cannot find C:\Windows\System32\notepad.exe. but I opened it in word pad and that worked.

[jeffce]

First open an elevated command prompt > Click Start and type cmd in Start Search.

When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.

Copy the contents of the code box > right click in the command window and select paste >> Press Enter

copy "C:\Windows\Notepad.exe" "C:\Windows\System32\notepad.exe"

Close the Command Prompt box.

Reboot your system and see if you can open Notepad.

[epic1978]

It says it is "not recognized as an internal or external command, operable program or batch file". I restarted, still will not load notepad. I attached the combofix.txt file using wordpad

ComboFix.txt

[jeffce]

Let's see about getting this fixed first.....we need to use Notepad.

Download Windows Repair (all in one) from this site

Install and then run the program.

On the Start Repairs tab, select Advanced Mode and click Start

Select all of the items in the screen shot below (the image below is just an example) and check Restart System When Finished.

----------

Let me know if Notepad is fixed now.

[epic1978]

I just ran it and it restarted. Notepad still is not opening. It says " windows cannot find 'C:\Windows\System32\notepad.exe'. Make sure you typed the name correctly, and then try again.

[jeffce]

Do you have your Windows Vista CD or can you borrow one from a friend? If so, get it out as we may need this during the following steps:

• Click on Start, type cmd in the Start Search bar.
  
• Right click on Command Prompt at the top of the window and select Run as Administrator.
  
• In the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.
  

The scan may take some time, so be patient. Windows will repair any corrupted or missing files that it finds. If information from the installation CD is needed to repair the problem, you may be prompted to insert your Windows Vista CD.

After you run System File Checker, try to run Notepad.

Let me know how that works.

[epic1978]

I do not have my vista CD, should i still follow those steps?

[jeffce]

Sure...go ahead with it.

[epic1978]

It says "verification 100% complete. Windows Resource Protection found corrupt files but was unable to fix some of them."

Notepad is still unable to open.

When I click properties of notepad the Target: %SystemRoot%\system32\notepad.exe and start in: %HOMEDRIVE%%HOMEPATH%

When I go to click out of it, it says "The name %SystemRoot%\system32\notepad.exe specified in the target box is not valid". Could that be the issue?

[epic1978]

I ran MalawareBytes earlier today and it didn't find any viruses. I think you fixed it!!

[jeffce]

I have not forgotten about you....I am checking with some colleagues about your Notepad problem.

[jeffce]

I just want to make sure I understand you correctly. You can not open Notepad at all?

[epic1978]

That is correct, when i click on it in the start menu it gives me an error that states "windows cannot find 'C:\Windows\System32\notepad.exe'. Make sure you typed the name correctly, and then try again.”

[jeffce]

Let's try to open Notepad through the command prompt.

First open an elevated command prompt > Click Start and type cmd in Start Search.

When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.

Copy the contents of the code box > right click in the command window and select paste >> Press Enter (do one line at a time if there are more than one)

C:\Windows\system32\notepad.exe

Does Notepad open?

[epic1978]

Still does not open. It says "C:\Windows\system32\notepad.exe' is not recognized as an internal or external commander, operable program or batch file."

[jeffce]

Ok....go to C:\Windows\notepad.exe and try to open Notepad from there. Let me know what happens.