Jump to content

Tricky removal (Sept 2013)


ellem
 Share

Recommended Posts

Hi, 

 

I have a very tricky removal to conduct: 

 

W7 Pro x64 logs off immediately after booting into any user profile in Safe mode.  SM command prompt will not open.  In normal mode, any app you try to run is "caught" and stopped by the rouge AV software of the infection.

 

I have run

 

(full scan) of Win defender (fully updated), it found a Rogue AV and removed it, reboot - same again.

Kaspersky's live CD wouldn't update - no joy

BitDefender's Live CD didn't find anything

Avira couldn't see the drives (RAID)

HiremsBoot CD BSoD (0x0007e - RAID?)

 

 

I have run a SFC /scannow and it corrected some problems but the infection remains.

 

So, here I am.  I have attached my FRST file in anticipation (Run from a W7 repair command prompt)

 

Thanks in advance!

 

ellem

 

FRST.txt

Link to post
Share on other sites

Hello ellem and :welcome:! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

  • If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
  • I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  • Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  • Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  • Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  • Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.
Open Notepad (Start => All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open Notepad and select Paste). Save it on the flashdrive as fixlist.txt

HKU\gideon\...\Run: [clphepon] - "C:\Users\gideon\AppData\Local\uuxbijrm.exe"

HKLM\...\Winlogon: [userinit] userinit.exe,C:\ProgramData\6VlparnX\6VlparnX.exe -sm,

HKU\gideon\...\Run: [AS2014] - C:\ProgramData\6VlparnX\6VlparnX.exe [716800 2013-09-25] ()

HKU\lisa\...\Run: [AS2014] - C:\ProgramData\6VlparnX\6VlparnX.exe [716800 2013-09-25] ()

2013-09-25 06:19 - 2013-09-25 06:19 - 00056352 _____ C:\Users\gideon\AppData\Local\fegjqwku

2013-09-25 06:18 - 2013-09-25 06:18 - 00000000 _____ C:\Users\gideon\AppData\Roaming\SharedSettings.ccs

2013-09-25 06:16 - 2013-09-26 11:39 - 00000000 ____D C:\ProgramData\6VlparnX

C:\Users\gideon\AppData\Local\Temp\9hg2mrst.dll

C:\Users\gideon\AppData\Local\Temp\c75gw6wn.dll

C:\Users\gideon\AppData\Local\Temp\contentDATs.exe

C:\Users\gideon\AppData\Local\Temp\gaqxi8kb.dll

C:\Users\gideon\AppData\Local\Temp\mdtppjoz.dll

C:\Users\gideon\AppData\Local\Temp\n1vadx4_.dll

C:\Users\gideon\AppData\Local\Temp\nuha3__n.dll

C:\Users\gideon\AppData\Local\Temp\ose00000.exe

C:\Users\gideon\AppData\Local\Temp\qb_92cws.dll

C:\Users\gideon\AppData\Local\Temp\qr1qmzeq.dll

C:\Users\gideon\AppData\Local\Temp\SecurityScan_Release.exe

C:\Users\gideon\AppData\Local\Temp\SMARTKPIS.exe

C:\Users\gideon\AppData\Local\Temp\SMARTSUPPORTB.exe

C:\Users\gideon\AppData\Local\Temp\ygztnibu.dll

C:\Users\gideon\AppData\Local\Temp\zvpuzen3.dll

C:\Users\gideon\AppData\Local\Temp\_is32D2.exe

C:\Users\gideon\AppData\Local\Temp\_is3A34.exe

C:\Users\gideon\AppData\Local\Temp\_isF711.exe

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST (or FRST64 if you have the 64bit version) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Reboot Normally.

Link to post
Share on other sites

  • Root Admin

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.