Jump to content

Cannot boot into Windows

tapirus

By tapirus
in Resolved Malware Removal Logs

 Share

Recommended Posts

tapirus

tapirus

Posted
Posted

Hi All,

Need your help to guide me to close my issue:-

1) Hardware :- Laptop

2) OS :- Windows 7

3) Issue :- I cannot log in to my windows. The reason i need your help because i want to save all my data in desktop before reformat. I did use tools frst.exe and requested to post my scan log. below was my results after scan.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-12-2012 01

Ran by SYSTEM at 12-12-2012 03:41:19

Running from G:\

Windows 7 Home Premium (X86) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe [233472 2009-10-22] (Alps Electric Co., Ltd.)

HKLM\...\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe [1300560 2010-03-03] (Dritek System Inc.)

HKLM\...\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0" [222504 2007-12-23] (CyberLink Corp.)

HKLM\...\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [233472 2009-09-21] (Alcor Micro Corp.)

HKLM\...\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2221352 2008-02-18] (Nero AG)

HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [31016 2006-10-26] (Microsoft Corporation)

HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [417792 2009-09-04] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [305440 2009-09-21] (Apple Inc.)

HKLM\...\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [69216 2006-12-06] (Cyberlink Corp.)

HKLM\...\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [54832 2006-12-05] ()

HKLM\...\Run: [DataMngr] C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE [983480 2010-10-19] (MusicLab, LLC)

HKLM\...\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe [32849 2011-03-22] (MyWebSearch.com)

HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [248552 2010-05-13] (Sun Microsystems, Inc.)

HKLM\...\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=2 /w /h [34336 2011-03-22] (MyWebSearch.com)

HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-03] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-01] (Adobe Systems Incorporated)

HKLM\...\Run: [kaiduaq] C:\Users\user p\kaiduaq.exe /v [x]

HKLM\...\Run: [sonyAgent] C:\Windows\Temp\temp31.exe [x]

HKLM\...\Run: [] [x]

HKLM\...\Run: [searchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe" [1111432 2012-10-15] (Spigot, Inc.)

HKU\user p\...\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe [32849 2011-03-22] (MyWebSearch.com)

HKU\user p\...\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP [2836656 2010-11-18] (SpeedBit Ltd.)

HKU\user p\...\Run: [Facebook Update] "C:\Users\user p\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-12] (Facebook Inc.)

HKU\user p\...\Run: [Google Update] "C:\Users\user p\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-10-21] (Google Inc.)

HKU\user p\...\Run: [kaiduaq] C:\Users\user p\kaiduaq.exe /i [x]

HKU\user p\...\CurrentVersion\Windows: [Load] C:\Users\user p\kaiduaq.exe /x

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1

AppInit_DLLs: C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\DataMngr\IEBHO.dll

Startup: C:\Users\user p\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Services (Whitelisted) ===================

2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [86224 2012-05-09] (Avira Operations GmbH & Co. KG)

2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [110032 2012-05-09] (Avira Operations GmbH & Co. KG)

2 Apple Mobile Device; "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe" [144672 2009-08-28] (Apple Inc.)

2 Application Updater; "C:\Program Files\Application Updater\ApplicationUpdater.exe" [799112 2012-10-09] (Spigot, Inc.)

2 MyWebSearchService; C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe [28762 2011-03-22] (MyWebSearch.com)

2 RichVideo; "C:\Program Files\CyberLink\Shared files\RichVideo.exe" [167936 2007-02-26] ()

==================== Drivers (Whitelisted) ====================

3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [5342208 2010-03-28] (ATI Technologies Inc.)

2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83392 2012-05-09] (Avira GmbH)

1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137928 2012-05-09] (Avira GmbH)

1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2011-09-16] (Avira GmbH)

1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-16] (Avira GmbH)

2 {95808DC4-FA4A-4c74-92FE-5B863F82066B}; \??\C:\Program Files\CyberLink\PowerDVD\000.fcl [13560 2006-11-02] (Cyberlink Corp.)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2012-11-24 02:57 - 2012-12-10 17:49 - 00000000 ____D C:\Users\user p\Desktop\HSR AZWAN

2012-11-23 18:03 - 2012-11-23 18:04 - 00000000 ____D C:\Users\user p\Desktop\prosidur 8 wan

2012-11-23 04:30 - 2012-11-23 08:06 - 00000000 ____D C:\Users\user p\Desktop\MODUL 6 DRCSJ

==================== One Month Modified Files and Folders ========

2012-12-12 03:41 - 2012-12-12 03:41 - 00000000 ____D C:\FRST

2012-12-12 01:18 - 2010-06-06 01:02 - 00000000 ____D C:\Users\user p\AppData\Roaming\Winamp

2012-12-12 01:18 - 2010-06-05 18:36 - 00000000 ____D C:\users\user p

2012-12-12 01:18 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\wfp

2012-12-12 01:18 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\NDF

2012-12-12 01:18 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\DriverStore

2012-12-12 01:18 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\registration

2012-12-12 01:17 - 2010-06-05 23:46 - 00000000 ___HD C:\Program Files\InstallShield Installation Information

2012-12-10 17:49 - 2012-11-24 02:57 - 00000000 ____D C:\Users\user p\Desktop\HSR AZWAN

2012-11-24 03:22 - 2010-06-11 17:42 - 00000000 ____D C:\Users\All Users\boost_interprocess

2012-11-23 18:04 - 2012-11-23 18:03 - 00000000 ____D C:\Users\user p\Desktop\prosidur 8 wan

2012-11-23 08:06 - 2012-11-23 04:30 - 00000000 ____D C:\Users\user p\Desktop\MODUL 6 DRCSJ

2012-11-23 04:52 - 2012-10-18 02:20 - 00000000 ____D C:\Users\user p\Desktop\pendrive

2012-11-23 04:51 - 2012-08-11 19:16 - 00000000 ____D C:\Users\user p\Desktop\pos basic

2012-11-22 01:21 - 2010-06-05 18:28 - 01427171 ____A C:\Windows\WindowsUpdate.log

2012-11-22 01:18 - 2011-10-21 19:42 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148806364-2551746257-723460846-1000UA.job

2012-11-22 01:17 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-11-22 01:17 - 2009-07-13 20:39 - 00253397 ____A C:\Windows\setupact.log

2012-11-22 00:36 - 2009-07-13 20:34 - 00019488 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-11-22 00:36 - 2009-07-13 20:34 - 00019488 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-11-21 22:16 - 2012-07-21 19:50 - 00000000 ___AD C:\Users\user p\Desktop\SPSS Statistics 17

2012-11-21 22:16 - 2009-07-13 23:48 - 00000000 ___RD C:\Users\Public\Recorded TV

2012-11-21 21:39 - 2010-06-17 06:43 - 00000000 ____D C:\Users\user p\Desktop\fadzli

2012-11-21 06:23 - 2010-06-05 18:40 - 00726624 ____A C:\Windows\System32\PerfStringBackup.INI

2012-11-17 13:46 - 2012-11-09 03:37 - 00000000 ____D C:\Users\user p\Desktop\Pos Basic DM AZWANnazri

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-04-16 01:33:44

Restore point made on: 2012-07-19 03:08:02

Restore point made on: 2012-07-21 19:56:56

Restore point made on: 2012-10-17 22:51:52

Restore point made on: 2012-10-17 22:52:54

Restore point made on: 2012-11-04 02:35:00

Restore point made on: 2012-11-22 01:22:13

==================== Memory info ===========================

Percentage of memory in use: 51%

Total physical RAM: 766.17 MB

Available physical RAM: 368.59 MB

Total Pagefile: 766.17 MB

Available Pagefile: 374.45 MB

Total Virtual: 2047.88 MB

Available Virtual: 1960.7 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:148.93 GB) (Free:112.89 GB) NTFS

2 Drive e: () (Fixed) (Total:149.03 GB) (Free:146.8 GB) FAT32

3 Drive f: (GRMCULFRER_EN_DVD) (CDROM) (Total:3.73 GB) (Free:0 GB) UDF

4 Drive g: () (Removable) (Total:1.97 GB) (Free:1.46 GB) NTFS

5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

6 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 298 GB 1024 KB

Disk 1 Online 2015 MB 0 B

Partitions of Disk 0:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 100 MB 1024 KB

Partition 2 Primary 148 GB 101 MB

Partition 3 Primary 149 GB 149 GB

=========================================================

Disk: 0

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y System Rese NTFS Partition 100 MB Healthy

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C NTFS Partition 148 GB Healthy

=========================================================

Disk: 0

Partition 3

Type : 0C

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 E FAT32 Partition 149 GB Healthy

=========================================================

Partitions of Disk 1:

===============

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 2015 MB 64 KB

=========================================================

Disk: 1

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 G NTFS Removable 2015 MB Healthy

=========================================================

Last Boot: 2012-07-19 03:00

==================== End Of Log ============================FRST.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

Link to post
Share on other sites
tapirus

tapirus

Posted
  • Author
Posted

<p>Thanks MrC for the feedback..</p>

<p> </p>

<p>Here the log from fix :-</p>

<p> </p>

<p> </p>

<div>Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2012 01</div>

<div>Ran by SYSTEM at 2012-12-12 10:06:07 Run:1</div>

<div>Running from G:\</div>

<div> </div>

<div>==============================================</div>

<div> </div>

<div>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\kaiduaq Value deleted successfully.</div>

<div>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SonyAgent Value deleted successfully.</div>

<div>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.</div>

<div>HKEY_USERS\user p\Software\Microsoft\Windows\CurrentVersion\Run\\kaiduaq Value deleted successfully.</div>

<div>HKEY_USERS\user p\Software\Microsoft\Windows NT\CurrentVersion\Windows\\Load Value restored successfully.</div>

<div>C:\Users\user p\kaiduaq.exe not found.</div>

<div>C:\Windows\Temp\temp31.exe  not found.</div>

<div> </div>

<div>==== End of Fixlog ====</div>

<div> </div>

<div> </div>

Link to post
Share on other sites
tapirus

tapirus

Posted
  • Author
Posted

<p> </p>

<div>Thanks MrC for the feedback. Below was my fixlog :-</div>

<div> </div>

<div> </div>

<div>Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2012 01</div>

<div>Ran by SYSTEM at 2012-12-12 10:06:07 Run:1</div>

<div>Running from G:\</div>

<div> </div>

<div>==============================================</div>

<div> </div>

<div>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\kaiduaq Value deleted successfully.</div>

<div>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SonyAgent Value deleted successfully.</div>

<div>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.</div>

<div>HKEY_USERS\user p\Software\Microsoft\Windows\CurrentVersion\Run\\kaiduaq Value deleted successfully.</div>

<div>HKEY_USERS\user p\Software\Microsoft\Windows NT\CurrentVersion\Windows\\Load Value restored successfully.</div>

<div>C:\Users\user p\kaiduaq.exe not found.</div>

<div>C:\Windows\Temp\temp31.exe  not found.</div>

<div> </div>

<div>==== End of Fixlog ====</div>

Link to post
Share on other sites
tapirus

tapirus

Posted
  • Author
Posted

Thanks Mr.C For the Feedback.. Here my fixlog:-

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2012 01

Ran by SYSTEM at 2012-12-12 10:06:07 Run:1

Running from G:\

==============================================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\kaiduaq Value deleted successfully.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SonyAgent Value deleted successfully.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.

HKEY_USERS\user p\Software\Microsoft\Windows\CurrentVersion\Run\\kaiduaq Value deleted successfully.

HKEY_USERS\user p\Software\Microsoft\Windows NT\CurrentVersion\Windows\\Load Value restored successfully.

C:\Users\user p\kaiduaq.exe not found.

C:\Windows\Temp\temp31.exe not found.

==== End of Fixlog ====

Fixlog.txt

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.