need help with DOJ - no Safe w/cmd. Log included

[westomatic]

cant get into windows with norma;/safe/or safe with command prompt. was hoping i could use the otlpe. also, where would i go to learn how to figure out how to use/diag with this program  myself?

 

OTL.Txt

 

 

[MrCharlie]

Welcome to the forum, we can't use OTLPE on this forum because of copyright reasons involving Microsoft.

Here's how we deal with that malware:

• Please download Farbar Recovery Scan Tool and save it to a flash drive.

  Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  Plug the flash drive into the infected PC.

• If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

  If you are using Vista or Windows 7 enter System Recovery Options.

  To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
  Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

  To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

  To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
• On the System Recovery Options menu you will get the following options:
  • • Startup Repair

      System Restore

      Windows Complete PC Restore

      Windows Memory Diagnostic Tool

      Command Prompt

      Select Command Prompt

      Once in the Command Prompt:

  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter

    Note: Replace letter e with the drive letter of your flash drive.

  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

[westomatic]

thanks for such a fast response!

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-07-2013 03

Ran by SYSTEM on 16-07-2013 17:21:47

Running from G:\Anti

Windows Vista Home Premium Service Pack 2 (X86) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

 

The current controlset is ControlSet001

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.)

HKLM\...\Run: [DisplaySwitch] - C:\Users\owner\AppData\Roaming\Microsoft\Windows\Templates\DisplaySwitch.exe [59392 2013-07-08] (Корпорация  Майкрософт)

HKLM\...\Runonce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [x]

HKLM\...\Winlogon: [shell] C:\Users\owner\AppData\Roaming\Microsoft\Windows\Templates\DisplaySwitch.exe [59392 2013-07-08] (Корпорация  Майкрософт) <=== ATTENTION

AlternateShell: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Templates\DisplaySwitch.exe

 

========================== Services (Whitelisted) =================

 

S3 Amazon Download Agent; C:\Program Files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com)

S3 BNPagent; C:\Program Files\Bradford Networks\Persistent Agent\bndaemon.exe [3063576 2010-07-14] (Bradford Networks)

S2 LexBceS; C:\Windows\System32\LEXBCES.EXE [303104 2003-02-24] (Lexmark International, Inc.)

S2 lxbc_device; C:\Windows\system32\lxbccoms.exe [537520 2007-03-16] ( )

S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)

S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)

S3 catchme; \??\C:\Users\owner\AppData\Local\Temp\catchme.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2013-07-16 17:21 - 2013-07-16 17:21 - 00000000 ____D C:\FRST

2013-07-15 16:40 - 2013-07-15 16:40 - 00131072 _____ C:\Windows\Minidump\Mini071513-04.dmp

2013-07-15 13:29 - 2013-07-15 13:29 - 00000000 ____D C:\_OTL

2013-07-15 13:24 - 2013-07-16 11:49 - 00045124 _____ C:\OTL.Txt

2013-07-15 12:48 - 2013-07-15 12:48 - 00139056 _____ C:\Windows\Minidump\Mini071513-03.dmp

2013-07-15 10:15 - 2013-07-15 10:15 - 00145640 _____ C:\Windows\Minidump\Mini071513-02.dmp

2013-07-15 10:12 - 2013-07-15 10:12 - 00145640 _____ C:\Windows\Minidump\Mini071513-01.dmp

2013-07-09 13:24 - 2013-07-09 13:24 - 00145640 _____ C:\Windows\Minidump\Mini070913-01.dmp

2013-07-08 18:36 - 2013-07-08 18:36 - 00139056 _____ C:\Windows\Minidump\Mini070813-05.dmp

2013-07-08 18:26 - 2013-07-08 18:26 - 00145656 _____ C:\Windows\Minidump\Mini070813-04.dmp

2013-07-08 18:22 - 2013-07-08 18:22 - 00145640 _____ C:\Windows\Minidump\Mini070813-03.dmp

2013-07-08 18:20 - 2013-07-08 18:20 - 00145640 _____ C:\Windows\Minidump\Mini070813-02.dmp

2013-07-08 18:18 - 2013-07-08 18:18 - 00145640 _____ C:\Windows\Minidump\Mini070813-01.dmp

2013-07-08 18:12 - 2013-07-08 18:12 - 00013304 _____ C:\Users\owner\Desktop\hs_err_pid6184.log

2013-06-25 11:03 - 2013-06-25 11:04 - 02287691 _____ C:\Users\owner\Downloads\SCS_Writing_Seminar_Materials.zip

2013-06-25 10:23 - 2013-06-25 10:23 - 00320043 _____ C:\Users\owner\Downloads\photo.htm

2013-06-22 09:43 - 2013-06-22 09:43 - 00145656 _____ C:\Windows\Minidump\Mini062213-01.dmp

 

==================== One Month Modified Files and Folders =======

 

2013-07-16 17:21 - 2013-07-16 17:21 - 00000000 ____D C:\FRST

2013-07-16 11:49 - 2013-07-15 13:24 - 00045124 _____ C:\OTL.Txt

2013-07-15 16:42 - 2006-11-02 02:33 - 00707520 _____ C:\Windows\System32\PerfStringBackup.INI

2013-07-15 16:41 - 2012-10-31 17:06 - 02393025 _____ C:\Windows\WindowsUpdate.log

2013-07-15 16:40 - 2013-07-15 16:40 - 00131072 _____ C:\Windows\Minidump\Mini071513-04.dmp

2013-07-15 16:40 - 2013-05-09 18:41 - 110210855 _____ C:\Windows\MEMORY.DMP

2013-07-15 16:40 - 2012-11-30 15:04 - 00000000 ____D C:\Windows\Minidump

2013-07-15 13:29 - 2013-07-15 13:29 - 00000000 ____D C:\_OTL

2013-07-15 12:48 - 2013-07-15 12:48 - 00139056 _____ C:\Windows\Minidump\Mini071513-03.dmp

2013-07-15 12:22 - 2006-11-02 04:47 - 00003760 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-15 12:22 - 2006-11-02 04:47 - 00003760 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-15 11:18 - 2011-05-13 12:27 - 00000000 ____D C:\users\owner

2013-07-15 10:15 - 2013-07-15 10:15 - 00145640 _____ C:\Windows\Minidump\Mini071513-02.dmp

2013-07-15 10:12 - 2013-07-15 10:12 - 00145640 _____ C:\Windows\Minidump\Mini071513-01.dmp

2013-07-09 13:24 - 2013-07-09 13:24 - 00145640 _____ C:\Windows\Minidump\Mini070913-01.dmp

2013-07-08 18:36 - 2013-07-08 18:36 - 00139056 _____ C:\Windows\Minidump\Mini070813-05.dmp

2013-07-08 18:26 - 2013-07-08 18:26 - 00145656 _____ C:\Windows\Minidump\Mini070813-04.dmp

2013-07-08 18:22 - 2013-07-08 18:22 - 00145640 _____ C:\Windows\Minidump\Mini070813-03.dmp

2013-07-08 18:20 - 2013-07-08 18:20 - 00145640 _____ C:\Windows\Minidump\Mini070813-02.dmp

2013-07-08 18:18 - 2013-07-08 18:18 - 00145640 _____ C:\Windows\Minidump\Mini070813-01.dmp

2013-07-08 18:12 - 2013-07-08 18:12 - 00013304 _____ C:\Users\owner\Desktop\hs_err_pid6184.log

2013-07-08 18:12 - 2011-05-13 12:27 - 00000000 ___RD C:\Users\owner\Desktop

2013-07-07 21:11 - 2012-05-30 19:26 - 00002587 _____ C:\Users\owner\Desktop\Microsoft Office Word 2007.lnk

2013-07-06 06:14 - 2011-06-06 20:07 - 00000000 ____D C:\Users\owner\AppData\Local\Bible Explorer 4

2013-07-05 09:55 - 2011-06-04 15:45 - 00000698 _____ C:\Windows\LEXSTAT.INI

2013-06-25 11:04 - 2013-06-25 11:03 - 02287691 _____ C:\Users\owner\Downloads\SCS_Writing_Seminar_Materials.zip

2013-06-25 10:23 - 2013-06-25 10:23 - 00320043 _____ C:\Users\owner\Downloads\photo.htm

2013-06-22 09:43 - 2013-06-22 09:43 - 00145656 _____ C:\Windows\Minidump\Mini062213-01.dmp

 

==================== Known DLLs (Whitelisted) ============

 

 

==================== Bamital & volsnap Check =================

 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

==================== EXE ASSOCIATION =====================

 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

 

==================== Restore Points  =========================

 

Restore point made on: 2012-10-21 13:47:31

Restore point made on: 2012-10-25 12:38:18

Restore point made on: 2012-10-30 11:42:34

Restore point made on: 2012-10-31 08:53:20

Restore point made on: 2012-11-02 15:00:17

Restore point made on: 2012-11-04 12:30:25

Restore point made on: 2012-11-07 08:53:01

Restore point made on: 2012-11-07 19:21:35

Restore point made on: 2012-11-12 09:22:40

Restore point made on: 2012-11-13 11:00:25

Restore point made on: 2012-11-15 07:31:59

Restore point made on: 2012-11-17 11:12:56

Restore point made on: 2012-11-18 15:07:48

Restore point made on: 2012-11-20 08:43:43

Restore point made on: 2012-11-22 16:36:32

Restore point made on: 2012-11-23 16:33:23

Restore point made on: 2012-11-25 23:14:18

Restore point made on: 2012-11-28 13:27:19

Restore point made on: 2012-11-29 13:57:43

Restore point made on: 2012-11-30 13:03:42

 

==================== Memory info =========================== 

 

Percentage of memory in use: 11%

Total physical RAM: 3963.06 MB

Available physical RAM: 3488.25 MB

Total Pagefile: 3707.27 MB

Available Pagefile: 3539.98 MB

Total Virtual: 2047.88 MB

Available Virtual: 1963 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:231.42 GB) (Free:160.26 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (FRTMCFRE_EN_DVD) (CDROM) (Total:3.02 GB) (Free:0 GB) UDF

Drive e: (TOSHIBA SYSTEM VOLUME) (Fixed) (Total:1.46 GB) (Free:1.31 GB) NTFS

Drive g: (SKYNET) (Removable) (Total:7.19 GB) (Free:2.79 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: C3324990)

Partition 1: (Not Active) - (Size=1 GB) - (Type=27)

Partition 2: (Active) - (Size=231 GB) - (Type=07 NTFS)

 

========================================================

Disk: 2 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)

Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

 

 

LastRegBack: 2013-07-15 13:03

 

==================== End Of Log ============================

[MrCharlie]

OK, here you go......this should get you going:

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now and if so..........

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

[westomatic]

that did the trick. thanks a million. do you have a btc address?

[MrCharlie]

btc address <---not familiar with that. MrC

[westomatic]

ah sorry. bitcoin or litecoin address for donation payments. just curious, i found your paypal link

[MrCharlie]

OK, so you're all set??

 

MrC

[MrCharlie]

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.