login error message

[whonew]

Removed Top games and when opened up computer this morning got message Error
InvokeMethod: Failed IEmumWemClassObject::Next press OK

 

 

Copy and paste will not work

 

 

[Psychotic]

Hi there,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

• First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
• Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
• Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 
 
 
Scan with Gmer rootkit scanner

Please download Gmer from here by clicking on the "Download EXE" Button.

• Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
• If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
• In the right panel, you will see several boxes that have been checked. Uncheck the following ...
  
  • Sections
  • IAT/EAT
  • Show All ( should be unchecked by default )
    

  [*]Leave everything else as it is. [*]Close all other running programs as well as your Browser. [*]Click the Scan button & wait for it to finish. [*]Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. [*]Save it where you can easily find it, such as your desktop. [*]Please post the content of the ark.txt here.
  

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

[whonew]

The forum will not allow copy and paste

[Psychotic]

Combofix

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================


Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications


====================================================


Double click on ComboFix.exe & follow the prompts.

• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

[whonew]

Thank you, the log did not show up here , I tried to e-mail it

[whonew]

ComboFix 13-07-15.01 - judith 07/16/2013   7:36.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2037.1511 [GMT -7:00]
Running from: c:\documents and settings\judith\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\WinSys.exe
.
.
(((((((((((((((((((((((((   Files Created from 2013-06-16 to 2013-07-16  )))))))))))))))))))))))))))))))
.
.
2013-07-14 02:46 . 2013-07-14 03:04    0    ----a-w-    c:\windows\system32\TempWmicBatchFile.bat
2013-07-13 18:02 . 2013-07-14 02:11    --------    d-----w-    c:\program files\Microsoft
2013-07-13 06:43 . 2013-07-13 06:43    --------    d-----w-    c:\documents and settings\All Users\Application Data\McAfee Security Scan
2013-07-13 05:32 . 2008-05-30 21:19    507400    ----a-w-    c:\windows\system32\XAudio2_1.dll
2013-07-13 05:28 . 2013-07-13 17:47    --------    d-----w-    c:\windows\Logs
2013-07-12 22:55 . 2013-07-12 23:04    --------    d-----w-    c:\documents and settings\All Users\Application Data\HitmanPro
2013-07-12 22:06 . 2013-07-12 22:34    --------    d-----w-    c:\documents and settings\judith\Application Data\ElevatedDiagnostics
2013-07-12 21:41 . 2013-07-13 18:24    71048    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-12 21:41 . 2013-07-13 18:24    692104    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2013-07-12 21:22 . 2013-07-12 21:22    --------    d-----w-    C:\f32b2df44b06da3b14834b91
2013-07-12 20:36 . 2013-07-14 03:03    --------    d-----w-    c:\program files\VS Revo Group
2013-07-12 19:57 . 2013-07-12 19:57    --------    d-----w-    c:\program files\Windows Resource Kits
2013-07-12 10:55 . 2013-07-12 10:55    --------    d-----w-    c:\windows\system32\wbem\Repository
2013-07-12 10:55 . 2013-07-12 20:39    --------    d-----w-    c:\program files\Mozilla Maintenance Service
2013-07-12 10:53 . 2013-07-13 06:45    --------    d-----w-    c:\program files\McAfee Security Scan
2013-07-12 06:56 . 2013-07-12 09:46    --------    d-----w-    c:\documents and settings\judith\Application Data\SUPERAntiSpyware(2).com
2013-07-12 06:56 . 2013-07-12 09:46    --------    d-----w-    c:\documents and settings\All Users\Application Data\SUPERAntiSpyware(2).com
2013-07-12 06:56 . 2013-07-12 09:46    --------    d-----w-    c:\program files\SUPERAntiSpyware(2)
2013-07-11 17:21 . 2013-07-11 17:21    --------    d-----w-    c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2013-07-10 01:36 . 2013-07-10 01:36    --------    d-----w-    c:\documents and settings\judith\Local Settings\Application Data\PCHealth
2013-07-09 05:54 . 2013-07-09 05:55    --------    d-----w-    C:\WINSSLog
2013-07-05 03:25 . 2013-07-05 03:25    --------    d-----w-    c:\documents and settings\judith\Local Settings\Application Data\SlimWare Utilities Inc
2013-06-25 10:33 . 2013-06-25 10:33    --------    d-----w-    c:\documents and settings\All Users\Application Data\NortonInstaller
2013-06-25 09:15 . 2013-07-14 03:11    --------    d-----w-    c:\windows\MATS
2013-06-21 03:56 . 2013-06-21 03:56    --------    d-----w-    c:\documents and settings\judith\Local Settings\Application Data\Ahead
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-11 18:55 . 2013-05-08 21:19    331805736    ----a-w-    C:\Windows XP Service Pack 3 Network Installation Package for IT Professionals and Developers
2013-06-08 06:55 . 2004-08-04 12:00    385024    ----a-w-    c:\windows\system32\html.iec
2013-06-07 21:56 . 2004-08-04 12:00    920064    ----a-w-    c:\windows\system32\wininet.dll
2013-06-07 21:56 . 2004-08-04 12:00    920064    ----a-w-    c:\windows\system32\wininet(2)(2).dll
2013-06-07 21:56 . 2004-08-04 12:00    43520    ----a-w-    c:\windows\system32\licmgr10.dll
2013-06-07 21:56 . 2004-08-04 12:00    1215488    ----a-w-    c:\windows\system32\urlmon(2)(2).dll
2013-06-07 21:56 . 2004-08-04 12:00    105984    ----a-w-    c:\windows\system32\url(2)(2).dll
2013-06-07 21:56 . 2009-03-08 11:32    2005504    ----a-w-    c:\windows\system32\iertutil(2)(2).dll
2013-06-07 21:56 . 2004-08-04 12:00    1469440    ----a-w-    c:\windows\system32\inetcpl.cpl
2013-06-04 07:23 . 2004-08-04 12:00    562688    ----a-w-    c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2004-08-04 12:00    1876736    ----a-w-    c:\windows\system32\win32k.sys
2013-06-04 01:40 . 2004-08-04 12:00    1876736    ----a-w-    c:\windows\system32\win32k(2)(2).sys
2013-05-07 22:30 . 2004-08-04 12:00    920064    ----a-w-    c:\windows\system32\wininet(4).dll
2013-05-07 22:30 . 2004-08-04 12:00    1215488    ----a-w-    c:\windows\system32\urlmon(4).dll
2013-05-07 22:30 . 2004-08-04 12:00    105984    ----a-w-    c:\windows\system32\url(4).dll
2013-05-05 00:56 . 2013-05-04 21:12    21840    ----atw-    c:\windows\system32\SIntfNT.dll
2013-05-05 00:56 . 2013-05-04 21:12    17212    ----atw-    c:\windows\system32\SIntf32.dll
2013-05-05 00:56 . 2013-05-04 21:12    12067    ----atw-    c:\windows\system32\SIntf16.dll
2013-05-04 21:14 . 2013-05-04 21:14    2829    ----a-w-    c:\windows\DiabUnin.pif
2013-05-04 21:14 . 2013-05-04 21:14    118784    ----a-w-    c:\windows\DiabUnin.exe
2013-05-04 20:53 . 2013-05-04 20:53    94208    ----a-w-    c:\windows\DIIUnin.exe
2013-05-04 20:53 . 2013-05-04 20:53    2829    ----a-w-    c:\windows\DIIUnin.pif
2013-05-03 21:50 . 2013-05-03 21:50    388096    ----a-r-    c:\documents and settings\judith\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-03 18:57 . 2013-05-03 18:57    32657495    ----a-w-    C:\WDM_R271.zip
2013-05-03 08:41 . 2013-05-03 08:41    866720    ----a-w-    c:\windows\system32\npDeployJava1.dll
2013-05-03 08:41 . 2013-05-03 08:41    788896    ----a-w-    c:\windows\system32\deployJava1.dll
2013-05-03 01:30 . 2004-08-04 12:00    2149888    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-05-03 00:38 . 2004-08-03 22:59    2028544    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2013-05-02 23:22 . 2013-05-02 23:22    0    ----a-w-    c:\program files\GUM6F.tmp
2013-04-26 00:41 . 2004-08-04 12:00    810496    ----a-w-    c:\windows\system32\wmvdmod.dll
2013-03-07 14:31 . 2013-07-12 19:04    263064    ----a-w-    c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58    121968    ----a-w-    c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"WinSys2"="c:\windows\system32\winsys2.exe" [2006-10-03 217088]
"SW24"="c:\windows\system32\sw24.exe" [2006-09-07 69632]
"SW20"="c:\windows\system32\sw20.exe" [2006-09-07 208896]
"RTHDCPL"="RTHDCPL.EXE" [2013-03-12 20143688]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [6/18/2013 9:34 AM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [6/18/2013 9:34 AM 204784]
R0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [6/18/2013 9:34 AM 49376]
R0 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [6/18/2013 9:34 AM 175176]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [6/18/2013 9:34 AM 104752]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [6/18/2013 9:34 AM 21576]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/18/2013 9:34 AM 770344]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/18/2013 9:34 AM 369584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/18/2013 9:34 AM 29816]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [6/18/2013 9:34 AM 66336]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [6/18/2013 9:34 AM 137960]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [5/3/2013 12:26 PM 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/3/2013 12:26 PM 701512]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [5/3/2013 11:58 AM 1691480]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [6/2/2011 11:08 AM 11336]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/3/2013 12:26 PM 22856]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [2/5/2013 8:48 AM 235216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 18:36    1173456    ----a-w-    c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-12 18:24]
.
2013-07-16 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-06-18 08:58]
.
2013-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-07-13 18:24]
.
2013-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-07-13 18:24]
.
2013-07-16 c:\windows\Tasks\User_Feed_Synchronization-{48B9682E-97BD-4BCC-AC77-CB94340EB02B}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.15.1
FF - ProfilePath - c:\documents and settings\judith\Application Data\Mozilla\Firefox\Profiles\4of2vhrr.default\

FF - ExtSQL: 2013-06-18 09:34; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-16 07:39
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ...
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2013-07-16  07:40:48
ComboFix-quarantined-files.txt  2013-07-16 14:40
.
Pre-Run: 53,840,130,048 bytes free
Post-Run: 54,278,909,952 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 027EC38984C8B417630EDFFFDBF77DAF
8F558EB6672622401DA993E1E865C861
 

[Psychotic]

Please uninstall McAfee Security Scan.

Are you still facing the message on startup?

 

If yes:

 

 

Scan with OTL

1. Download OTL by OldTimer and save it to your desktop.
2. Double click on the OTL.exe icon on your desktop. If you are using Vista, please right-click and select run as administrator
3. Click the "Scan All Users" checkbox.
   
   
   Note: If you are using a Windows 64bit machine, please make sure the checkbox next to Include 64Bit Scans is checked. It will be checked by default.
   
   
4. Push the button.
5. It will now begin to scan, please be paitent while it scans.
6. Two reports will open once it's done.
7. Please copy and paste them in your next reply:
   
   • OTL.txt <-- Will be opened
   • Extras.txt <-- Will be minimized
     

[whonew]

I am having a major problem with copy and paste , but that error is not showing up any longer , I will keep trying to post the results but I find it strange that I can not paste here , I am not being given the option to paste it here

 

[whonew]

I now have several files or folders appear in Avast Anti Virus , passwords protected can't scan and that is what happened before and I had to have the computer reformatted, It will be the fourth time this year to format at a shop , wow

[Psychotic]

Calm down and don´t panic.

Protected files aren´t malware, your antivirus program just cannot scan them.

No need to reformat the whole machine...

 

I´m currently reviewing your log. Please be patient with me in the meantime.

 

Please post up your avast! log files.

[Psychotic]

Fix with OTL

Please double-click OTL.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :OTL
  O3 - HKU\S-1-5-21-583907252-1647877149-839522115-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  :commands
  [emptytemp]

• Return to OTL, right click in the "Custom Scans/Fixes" section and choose Paste.
• Click the red Run Fix button.
• OTL may ask to reboot the machine. Please do so.
• If OTL did not reboot the machine, click OK and the log will open. Post the contents of the log in your next reply.
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
  
  

 

 

Run SilentRunners.vbs as instructed here: http://www.silentrunners.org/scriptuse.html

Post up its results.

[whonew]

Copy and paste is still unsuable in thie forum , I am not sure why it worked one time only but it will not work now

[whonew]

Thank you for you help

 

[Psychotic]

I didn´t want a new OTL log. Please run silentrunners.vbs

[whonew]

I am not sure what is happening here, what is silent runner? I am not given a option to save Target only image

[whonew]

I can not see a option

[whonew]

If I try to download that scriptrunner ,I get a page of type, and if I try to download the latest version I get this " C96B67D981400C4E761AA47550559503" and I had to type that in because copy and paste will no longer work

[Psychotic]

weird, indeed.

 

Scan with adwCleaner


Please download AdwCleaner to your desktop.

• Run adwcleaner.exe.
• Hit delete.
• When the run is finished, it will open up a text file.
• Please post its contents within your next reply.
• You´ll find the log file at C:\AdwCleaner[s1].txt also.
  

[whonew]

I have a log for Hitman Pro , I think that was something that was downloaded by an Avast Technician.  And Malwarebytes picked up Trojan.FakeAlert , not sure when because I did a system restore to try to recover my copy and paste utility

 

 

[Psychotic]

When did you do a system restore?

 

 

 

Scan file(s) via VirusTotal

Please check the file in the code box via Virustotal

• Click browse
• copy the following into the search box

  C:\WINDOWS\system32\SysInfo.sys

• and click open.
• click Send File.

please be patinet until the file is uploade completely. If you get the message

 

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:

click on Reanalyse. Wait until Current status: Finished appears. Now, copy the link from within your browser´s adress bar and poste it here.

[whonew]

I do not think I have much control of this computer, about an hour ago my IE was Sweetstake IE 8 and it looked totally foney a very poor looking Web Brouser and seemed to be somehow related to Bing but I deleted it in add/remove and if I used REVO uninstaller it asked me to delete "My Computer" and other options so I left that alone

[Psychotic]

Why don´t you just follow my instructions and upload the file to virustotal?

[whonew]

Okay I sent that URL, and I could not send any thing or get any where with that goofie web, it even took over firefox, so I had to delete it.

[Psychotic]

Please run Combofix again. If it wants to update, proceed with that.

Post up the log it creates.

[whonew]

I sent it but do not know why it is not here yet the email is very slow it has been 20 minutes