Jump to content

Deep doodoo - scans attached

Dave ....
 Share

Recommended Posts

MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum, please uninstall these from your add/remove programs:

Anti-phishing Domain Advisor

Windows iLivid Toolbar

Wise Registry Cleaner 7.68

Then.......

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.

You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:

/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Lots of adware found....lets clear it out.....

  1. Please re-run AdwCleaner
  2. Click on Delete button.
  3. Confirm each time with OK if asked.
  4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then......run MBAR:

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that your system is now functioning normally.

MrC

Link to post
Share on other sites
Dave ....

Dave ....

Posted
  • Author
Posted

My first symptom was that I could not search with Windows Explorer - still can't. Google research sad that was registry damage so I don't think we fixed that.

There was some video affects - colors off kilter and screen going dim - those seem to have stopped.

I first noticed the search problems after uninstalling White Smoke freeware.

There were also some strange hyper link and page loading problems that I thought might be a Firefox issue, but I haven't experienced that since the scan/clean.

Looking good so far. Any ideas on restoring the search functions?

Thanks,

Dave

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

See if this works:

Open the Search and Indexing troubleshooter by clicking the Start button 4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818.jpg, and then clicking Control Panel. In the search box, type troubleshooter, and then click Troubleshooting. Click View all, and then click Search and Indexing.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Run this scan............

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

You have a couple of bad files on the system

Please download SystemLook from the link below and save it to your Desktop.

http://jpshortstuff....temLook_x64.exe

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :Filefind
    ntfs.sys
    wininit.exe


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

MrC

Link to post
Share on other sites
Dave ....

Dave ....

Posted
  • Author
Posted

:-O You assume I know too much? Codebox, textfield, script ... and it's Monday. Here's the log ...

SystemLook 30.07.11 by jpshortstuff

Log created at 11:18 on 13/05/2013 by Dave

Administrator - Elevation successful

========== Filefind ==========

Searching for "ntfs.sys"

C:\Windows\erdnt\cache64\ntfs.sys --a---- 1659760 bytes [17:17 13/05/2013] [18:19 31/08/2012] E453ACF4E7D44E5530B5D5F2B9CA8563

C:\Windows\System32\drivers\ntfs.sys --a---- 1659760 bytes [13:52 10/10/2012] [18:19 31/08/2012] E453ACF4E7D44E5530B5D5F2B9CA8563

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.16385_none_02661b64369ca03a\ntfs.sys --a---- 1659984 bytes [23:20 13/07/2009] [01:48 14/07/2009] 356698A13C4630D5B31C37378D469196

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.16778_none_0273f3c63691c4ea\ntfs.sys --a---- 1657216 bytes [15:42 27/04/2011] [06:23 11/03/2011] E78999B86CC2414EA2A94AFCDB53AF2F

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.17119_none_02b5b16c36606152\ntfs.sys --a---- 1656688 bytes [13:52 10/10/2012] [18:02 31/08/2012] 184C189D4FC416978550FC599BB4EDDA

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.20921_none_032ca00d4f8d24c5\ntfs.sys --a---- 1685888 bytes [15:42 27/04/2011] [06:25 11/03/2011] 867C1395F0100CBE9ACD73B1C2741149

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.21316_none_033c4f3f4f80b23e\ntfs.sys --a---- 1680240 bytes [13:52 10/10/2012] [18:19 31/08/2012] FDC7C8346B6D8274631951F1469F95D7

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17514_none_04972f2c338b23d4\ntfs.sys --a---- 1659776 bytes [21:40 09/06/2011] [13:33 20/11/2010] 05D78AA5CB5F3F5C31160BDB955D0B7C

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17577_none_0459508233b9177f\ntfs.sys --a---- 1659776 bytes [15:42 27/04/2011] [06:41 11/03/2011] A2F74975097F52A00745F9637451FDD8

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17945_none_0477c74a33a2859a\ntfs.sys --a---- 1659760 bytes [13:52 10/10/2012] [18:19 31/08/2012] E453ACF4E7D44E5530B5D5F2B9CA8563

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.21680_none_04d11b5b4ce521d9\ntfs.sys --a---- 1659776 bytes [15:42 27/04/2011] [06:19 11/03/2011] F3CBA6518CAB1FA8B260DDD0CB0FD415

C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.22104_none_052b7b9d4ca0cf8b\ntfs.sys --a---- 1687408 bytes [13:52 10/10/2012] [17:57 31/08/2012] B2746D84DDF68D09B41B72DF745CCBA6

Searching for "wininit.exe"

C:\Windows\erdnt\cache64\wininit.exe --a---- 129024 bytes [17:17 13/05/2013] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA

C:\Windows\System32\wininit.exe --a---- 129024 bytes [23:52 13/07/2009] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA

C:\Windows\SysWOW64\wininit.exe --a---- 96256 bytes [23:36 13/07/2009] [01:14 14/07/2009] 86219AB7A02D0BD280457116A44DB7CF

C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe --a---- 129024 bytes [23:52 13/07/2009] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA

C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe --a---- 96256 bytes [23:36 13/07/2009] [01:14 14/07/2009] 86219AB7A02D0BD280457116A44DB7CF

-= EOF =-

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Using ComboFix......

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

4. If ComboFix wants to update.....please allow it to.

FCopy::

C:\Windows\erdnt\cache64\ntfs.sys | c:\windows\SysWow64\drivers\ntfs.sys

C:\Windows\erdnt\cache64\wininit.exe | C:\Windows\SysWOW64\wininit.exe

ClearJavaCache::

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

After reboot, (in case it asks to reboot)......

Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.

MrC

Link to post
Share on other sites
Dave ....

Dave ....

Posted
  • Author
Posted

I still can't search in Windows Explorer - that was the only problem I was aware of coming into this. I'm sure all the clean-up and malware removal has done me good, but I still can't search my own hard drive. I'm flummoxed. Might this be a good time to reload Win7 and call it a week? ;-)

Thanks for all your help.

cleardot.gif

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept