logs for Catbyte

[no8to5]

I am here

 

[AdvancedSetup]

You need to posts logs please or otherwise let us know what issue you're having.

[no8to5]

here it ismbar-log-2013-07-11 (22-32-40).txtmbar-log-2013-07-11 (22-32-40).txt

[AdvancedSetup]

Please do not post NEW posts.  Please just reply to this one.

 

Thanks

[CatByte]

my apologies,

 

I had asked the user to post logs for me, thanks

 

I'll take it from here

 

give me a couple minutes to review

[CatByte]

Let's get a new set of diagnostic logs, so we can figure out why MBAR is unable to remove those entries

Please run the following:

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

NEXT

• Download RogueKiller and save it to your desktop.
• Quit all other programs
• Start RogueKiller.exe
• Wait until the Prescan has finished ...
• Click on Scan

  

• Wait for the end of the scan
• A report will be created on your desktop.
• Click on the Delete button

  

• Next click on the ShortcutsFix

  

• another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

[no8to5]

here they are

FRST.txt

RKreport0_D_07172013_205137.txt

RKreport0_S_07172013_204945.txt

RKreport0_SC_07172013_205205.txt

[CatByte]

do these files belong to a game you have installed?

C:\Users\Reagan\Documents\c5gk-riffraff99-2c1a7c78a404673

(CheatHappens) C:\Users\Reagan\Desktop\c5gk-riffraff99.exe

C:\Users\Reagan\Documents\c5bw-riffraff99-33f6d900b11f152

CheatHappens) C:\Users\Reagan\Desktop\c5bw-riffraff99.exe

C:\Users\Reagan\Downloads\civ5-riffraff99-74801d7611cfc2c

It appeared as though those infected files were regenerated as they showed up in the FRST log again although RogueKiller claims to have removed them.

Let's run ComboFix again to make sure they haven't regenerated again:

Refer to the ComboFix User's Guide

• Download ComboFix from the following location:

  Link

  * IMPORTANT !!! Place ComboFix.exe on your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

  You can get help on disabling your protection programs here

• Double click on ComboFix.exe & follow the prompts.
• Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
• When finished, it shall produce a log for you. Post that log in your next reply

  Note:

  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

  ---------------------------------------------------------------------------------------------

• Ensure your AntiVirus and AntiSpyware applications are re-enabled.

  ---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

[no8to5]

those files are game trainers on the desktop. the ones in documents were empty folders. the trainers do not contain a virus.

[no8to5]

do u still want me to run combo fix

[no8to5]

what time do u quit

[CatByte]

Hi,

I will be here till 11:00pm if you can run ComboFix,

we can pick it up tomorrow, make sure you have notifications set to "Immediate notification" so you will get an email when I reply to the thread

[no8to5]

ok

ComboFix.txt

[CatByte]

Please do the following:

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
• They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:

Press the WinKey + R to open a run box, type Notepad > click OK.

This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Folder::c:\programdata\Intel0ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix may request an update; please allow it.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you.
• Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Go here to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activeX control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan completes, press the LIST OF THREATS FOUND button
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
• Include the contents of this report in your next reply.
• Press the BACK button.
• Press Finish

[no8to5]

well it seems that the last thing did it. there is no sign of a rootkit or virus on anything. i am not blocked from any website. good job and thank you.

[CatByte]

That's great to hear, but if you could follow through with the ESET on-line scan just in case there are any leftovers

regards

~CB

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!