Possibly Infected. Please help! <3

[NeoX12]

Hey everyone! 

My PC occasionally hangs, and my games exit and I have the NSIS Error coming up.

 

Thanks! 

attach.txt

dds.txt

[TheDarkKnight]

I am TheDarkKnight and will be assisting you. Please ask questions if anything is unclear.

 

Please follow these instructions to run ComboFix.exe. Please visit this webpage for download links and instructions for running this tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix (CF).

Please go here to see a list of programs that need to be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall.**

**Note 2: If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.**

Please include the C:\ComboFix.txt in your next reply for further review.

[NeoX12]

But last time I heard, when running Combofix, there's actually a risk of your pc crashing??

[NeoX12]

They say the CF doesn't run on Windows 8.. so...

[TheDarkKnight]

Hello NeoX12,

 

Please use this tool instead.

 

Please download OTL.exe by OldTimer to your Desktop.

• Close all windows and double click OTL.exe.
• In the "Custom Scans/Fixes" window (under the light green bar) paste the following in bold:
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
• Click Run Scan and let the program run uninterrupted.
• When the scan completes, it will open two Notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL. Post both logs in this thread.
• You may need to use two posts to get it all.

[NeoX12]

Thank you so much for that!  
OTL and other scanners are awesome! 

 

Couldn't copy/paste or attach bro.

So I did a little pastebin...

 

OTL: http://pastebin.com/pQRqX5TX
Extras: http://pastebin.com/erWdn06j

 

I am extremely grateful to you!  
Thanks pal!

[NeoX12]

Oh and forgot to mention. My keyboard goes haywire at times.

I click t, it says o. I click w, it types a spacebar

[TheDarkKnight]

Good morning NeoX12,

 

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  :OTL
  IE - HKCU\..\SearchScopes\{3420F484-E627-4C38-B8B4-C269EEADF2DA}: "URL" = http://search.us.com/serp?guid={E8FDBADB-36C8-4FD5-97B3-32E1C7F14ECA}&action=default_search&serpv=5&k={searchTerms}
  :Commands
  [EmptyTemp]
• Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
• Click the red Run Fix button.
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

 

=====

 

Also, please download to your Desktop:

• TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

• Click Change parameters.
• Make sure you check the box Loaded modules.
• A window will popup and say Reboot is required. Please click Reboot now.
• Then click Change parameters again. Check the box Detect TDLFS file system.
• Click on the Start Scan button.
   
• If an infected file is detected, the default action will be Cure.  Instead, choose SKIP, then click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• If you are asked to reboot the computer to complete the process, click on the Reboot Now button.
• Once the tool has finished, please click Report. Please copy and paste the contents of that log in your reply.
  Note: A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt).

 

=====

 

Please provide both logs in your reply.


 

[NeoX12]

Good morning!

I did reboot when OTL asked me to, but I can't find the notepad anywhere. When I rebooted, the notepad came up but I closed the window and now I can't find it anywhere... what now?

[NeoX12]

Did the Kaspersky TDSS scan.

 

TDSS: http://pastebin.com/r86ZQHAz

[NeoX12]

Also downloaded KIS 2013 and did the

 

Critical Areas Scan

Full Scan

Vulnerability Scan

 

All safe. No malware/virus detected.

 

Couldn't update the db though. But still 

[NeoX12]

Btw, you wanted these right?
They were in C:/

 

The filenames are the pastebin titles

 

1. http://pastebin.com/J9KAFBZP

2. http://pastebin.com/E1aDxjwN

[TheDarkKnight]

Hello NeoX12,

 

Thank you for the logs.

 

Please do not swear or use vulgar language, as it can be offensive to some people. I would appreciate it if you please edit your earlier post.

 

Your logs are coming back in the clear. What issues are on your computer currently?

[NeoX12]

My computer has frequent blue screens. I want to provide you the logs.

Where can I find them? And sir, how do I edit my earlier log?

Thanks!

[TheDarkKnight]

Hey NeoX12,

 

You may not be able to edit your post.

 

Please download to your Desktop:

• TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

• Click Change parameters.
• Make sure you check the box Loaded modules.
• A window will popup and say Reboot is required. Please click Reboot now.
• Then click Change parameters again. Check the box Detect TDLFS file system.
• Click on the Start Scan button.
   
• If an infected file is detected, the default action will be Cure.  Instead, choose SKIP, then click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• If you are asked to reboot the computer to complete the process, click on the Reboot Now button.
• Once the tool has finished, please click Report. Please copy and paste the contents of that log in your reply.
  Note: A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt).

 

[NeoX12]

Hey NeoX12,

 

You may not be able to edit your post.

 

Please download to your Desktop:

• TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

• Click Change parameters.
• Make sure you check the box Loaded modules.
• A window will popup and say Reboot is required. Please click Reboot now.
• Then click Change parameters again. Check the box Detect TDLFS file system.
• Click on the Start Scan button.

   

• If an infected file is detected, the default action will be Cure.  Instead, choose SKIP, then click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• If you are asked to reboot the computer to complete the process, click on the Reboot Now button.
• Once the tool has finished, please click Report. Please copy and paste the contents of that log in your reply.

  Note: A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt).

Sir I already downloaded and ran that earlier. Do I run it again?

Are there any other scanners I should run, other than Combofix?

And can I send you the BSOD log files somehow?

Thanks!

 

 

[TheDarkKnight]

Please run it again.

 

Don't worry about the BSOD files at the moment.

[NeoX12]

Alright. I guess I'm clean right now.

 

Thank you so much for your help!

 

Anything else I need to do?
Rootkit scanner? Other stuff? 

[TheDarkKnight]

Hey NeoX12,

 

What current issues are on your computer?

[NeoX12]

Well for now, my pc's better than before.

Still hangs a bit at times. 

 

I think I'm fine though.

Any recommendations? I'm running MBAM Full at the moment and no AV

[TheDarkKnight]

Hey NeoX12,

 

Just before I give you recommendations.

 

Please run a free online scan with the ESET Online Scanner.
Note: You can use Internet Explorer or Mozilla Firefox for this scan.

• Tick the box next to YES, I accept the Terms of Use.
• Click Start.
• When asked, allow the ActiveX control to install.
• Click Start.
• Make sure that the option Remove found threats is checked and the option Scan unwanted applications is checked.
• Click Scan.
  Wait for the scan to finish.
• Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!