Jump to content

Malware bytes not responding can't run scan

stonzee

By stonzee
in Resolved Malware Removal Logs

 Share

Recommended Posts

kevinf80

kevinf80

Posted
Posted

Hello and post-32477-1261866970.gif

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

 

  • Double click on AdwCleaner.exe to run the tool.
  • Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Uncheck any elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review.
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted (if necessary):
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Let me see those logs...

 

Kevin

Link to post
Share on other sites
stonzee

stonzee

Posted
  • Author
Posted

As far as I know I'm not using any peer 2 peer programs.  I don't use use share programs and should not have any installed.

I'm not sure what programs to uncheck.  I really don't see that you can uncheck anything.  

 

Sorry, I wouldn't unstall the Farbar Recovery scan tool as it comes with a tool bar and default search engine.  I don't want those and there was no way not to install them. 

 

i don't see any way to attach the log from the first scan. 

Link to post
Share on other sites
stonzee

stonzee

Posted
  • Author
Posted

# AdwCleaner v3.009 - Report created 19/10/2013 at 20:18:32
# Updated 19/10/2013 by Xplode
# Operating System : Windows Vista Home Premium Service Pack 2 (64 bits)
# Username : pamela - PAMELA-PC
# Running from : C:\Users\pamela\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\END
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Found : C:\Users\pamela\AppData\Roaming\Mozilla\Firefox\Profiles\95rtr3zr.default-1380311467759\searchplugins\Conduit.xml
File Found : C:\Users\pamela\AppData\Roaming\Mozilla\Firefox\Profiles\yf6k6yej.default\searchplugins\Conduit.xml
File Found : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
Folder Found C:\Program Files (x86)\Common Files\337
Folder Found C:\Program Files (x86)\Conduit
Folder Found C:\Program Files (x86)\MyPC Backup
Folder Found C:\Program Files (x86)\MyPC Backup
Folder Found C:\Program Files (x86)\optimizer pro
Folder Found C:\Program Files (x86)\Searchprotect
Folder Found C:\Program Files (x86)\SweetPacks_A1
Folder Found C:\ProgramData\BigFishSavedGames
Folder Found C:\ProgramData\Conduit
Folder Found C:\ProgramData\eSafe
Folder Found C:\Users\pamela\AppData\Local\Conduit
Folder Found C:\Users\pamela\AppData\Local\Temp\AirInstaller
Folder Found C:\Users\pamela\AppData\LocalLow\SweetPacks_A1
Folder Found C:\Users\pamela\AppData\Roaming\iWin
Folder Found C:\Users\pamela\AppData\Roaming\Searchprotect
Folder Found C:\Users\pamela\Documents\optimizer pro

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\AppDataLow\Software\smartbar
Key Found : HKCU\Software\AppDataLow\Software\SweetPacks_A1
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\installedbrowserextensions
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Desk 365
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Optimizer Pro_is1
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WSysControl
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B3420A9C-A397-4409-B90D-BCF22DA1A08A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\SearchProtect
Key Found : HKCU\Software\Softonic
Key Found : HKCU\Software\wscontb
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\installedbrowserextensions
Key Found : [x64] HKCU\Software\SearchProtect
Key Found : [x64] HKCU\Software\Softonic
Key Found : [x64] HKCU\Software\wscontb
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKLM\Software\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A997FC8A-2CD8-4027-A226-9A5C0CE4F817}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B3420A9C-A397-4409-B90D-BCF22DA1A08A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3106777
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3314198
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Desksvc
Key Found : HKLM\Software\eSafeSecControl
Key Found : HKLM\Software\InstallIQ
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{42A66563-A97C-4833-A4E3-B19CBE832425}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{79D5154F-C208-48AF-8794-864FA270FCD8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B3420A9C-A397-4409-B90D-BCF22DA1A08A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A997FC8A-2CD8-4027-A226-9A5C0CE4F817}
Key Found : HKLM\Software\PIP
Key Found : HKLM\Software\SearchProtect
Key Found : HKLM\Software\SweetPacks_A1
Key Found : HKLM\Software\V9
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}
Key Found : [x64] HKLM\SOFTWARE\DomaIQ
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{B3420A9C-A397-4409-B90D-BCF22DA1A08A}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{B3420A9C-A397-4409-B90D-BCF22DA1A08A}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{B3420A9C-A397-4409-B90D-BCF22DA1A08A}]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16514



-\\ Mozilla Firefox v24.0 (en-US)

[ File : C:\Users\pamela\AppData\Roaming\Mozilla\Firefox\Profiles\95rtr3zr.default-1380311467759\prefs.js ]

Line Found : user_pref("CT3314198.FF19Solved", "true");
Line Found : user_pref("CT3314198.UserID", "UN42916321416501763");
Line Found : user_pref("CT3314198.browser.search.defaultthis.engineName", "true");
Line Found : user_pref("CT3314198.fullUserID", "UN42916321416501763.IN.20131017200126");
Line Found : user_pref("CT3314198.installDate", "17/10/2013 20:01:44");
Line Found : user_pref("CT3314198.installSessionId", "{A91C9293-E876-49C8-8963-DAFAE7D60A1B}");
Line Found : user_pref("CT3314198.installSp", "TRUE");
Line Found : user_pref("CT3314198.installerVersion", "1.7.1.7");
Line Found : user_pref("CT3314198.keyword", "true");
Line Found : user_pref("CT3314198.originalHomepage", "www.facebook.com");
Line Found : user_pref("CT3314198.originalSearchAddressUrl", "");
Line Found : user_pref("CT3314198.originalSearchEngine", "");
Line Found : user_pref("CT3314198.originalSearchEngineName", "");
Line Found : user_pref("CT3314198.searchRevert", "false");
Line Found : user_pref("CT3314198.searchUserMode", "2");
Line Found : user_pref("CT3314198.smartbar.homepage", "true");
Line Found : user_pref("CT3314198.versionFromInstaller", "10.20.3.20");
Line Found : user_pref("CT3314198.xpeMode", "0");

Line Found : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Found : user_pref("browser.search.defaultthis.engineName", "SweetPacks A1 Customized Web Search");

Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/286965653b415f505622ea74d2bd3bbe_US.value", "%22var%20cat_286965653b415f505622ea7[...]
Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/3518e1eac042730aa1274618984462b3_US.value", "%22var%20cat_3518e1eac042730aa127461[...]
Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/56efa59db92a90199ee92f9743c91714_US.value", "%22var%20cat_56efa59db92a90199ee92f9[...]
Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/5cdf8a7ef2ec84abac286c67587b78d9.value", "%22function%20tcmMarkWindow%28a%29%7Bva[...]
Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/658987e48ed8b4a20fa71afdd0c84454_US.value", "%22var%20cat_658987e48ed8b4a20fa71af[...]
Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/e7395ccc0c22b2cca7bf3e0c7db4d8a6_US.value", "%22var%20cat_e7395ccc0c22b2cca7bf3e0[...]
Line Found : user_pref("extensions.a509508ef0b144616a5570d58601be33dc4a581e90ea646dba18558e021ee138ccom31257.31257.internaldb.cache/eb7a3e6f23795c98b3e36b1cf6d51c29_US.value", "%22var%20cat_eb7a3e6f23795c98b3e36b1[...]
Line Found : user_pref("extensions.crossrider.bic", "141c92acf36716066f9f7cbe6ef394d7");

Line Found : user_pref("smartbar.addressBarOwnerCTID", "CT3314198");


Line Found : user_pref("smartbar.defaultSearchOwnerCTID", "CT3314198");
Line Found : user_pref("smartbar.homePageOwnerCTID", "CT3314198");
Line Found : user_pref("smartbar.machineId", "JTB33+40P7U3TDAW3LYB48EIGKQMG0WESTZNTHJJYGYKKFNNPMYTPIUW9YJDAQBVGW5/TZHXPY6LVSOAOCIEZW");

[ File : C:\Users\pamela\AppData\Roaming\Mozilla\Firefox\Profiles\yf6k6yej.default\prefs.js ]

Line Found : user_pref("browser.search.defaultthis.engineName", "WinZipBar Customized Web Search");


*************************

AdwCleaner[R0].txt - [11956 octets] - [19/10/2013 20:18:32]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [12017 octets] ##########
 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Is it possible you hit the "Uninstall" tab on AdwCleaner GUI... That program is very safe to use, even if an entry was removed in error it does have a recovery option available.

Also you mention earlier that FRST came with unwanted extras, I do not see why that should be so unless your browser is hijacked, the d/l link is direct to Bleeping Computers.

Looking at the AdwCleaner log it would appear the above line is true. OK see if you can do the following:

 

Download Junkware Removal tool from this link:

http://www.bleepingcomputer.com/download/junkware-removal-tool/

Save to your desktop.

 

  • Shut down your Security Protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator. Follow prompts as they come.
  • The tool will open and start scanning your system. (Press any key when prompted to continue)
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post JRT.txt to your next message.

 

Next,

 

Please download RogueKiller from here:

 

http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe <- 32 bit version

 

http://www.sur-la-toile.com/RogueKiller/RogueKillerX64.exe  <- 64 bit version

                                     

  • Make sure to get the correct version for your system.
  • Quit all running programs
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  • Wait until Prescan has finished...
  • The following EULA will appear, please select accept
     
    RKLicence.png
     
  • Ensure MBR scan, Check faked and AntiRootkit are checked
  • Select Scan
     
    RK1A.png
     
  • When the scan completes select Report, copy and paste that to your reply.
     
    RK2A.png
     
  • The log should be found in RKreport[?].txt on your Desktop
  • Exit/Close RogueKiller

Link to post
Share on other sites
stonzee

stonzee

Posted
  • Author
Posted

Since I download that adcleaner program I am having even more problems.  Now I have these  

rvzr-a.akamaihd.net & FLV Player pop-ups

everywhere.  And also there's a black mahnifying class on every picture that takes you to bing.

i don't use bing and never have.    I didn't have these issues before. 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Close Firefox, select start, type Firefox -safemode into the search box then hit enter. Firefox will start in safe mode, no addons or extensions.

 

See if you can d/l and run the two following tools, the links I give are genuine and very safe:

 

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

 

  • Double click on AdwCleaner.exe to run the tool.
  • Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Uncheck any elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review.
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted (if necessary):
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

 

Next,

 

Download Junkware Removal tool from this link:

http://www.bleepingcomputer.com/download/junkware-removal-tool/

Save to your desktop.

 

  • Shut down your Security Protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator. Follow prompts as they come.
  • The tool will open and start scanning your system. (Press any key when prompted to continue)
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post JRT.txt to your next message.

 

Post both logs..

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save that zip file to your Desktop.

 

Double click zip file and extract to your  Desktop:

 

 

Zoekd.jpg

 

 

you will now have 3 versions of the tool on the Desktop:

 

 

Zoeke.jpg

 

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html[/url

 

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

 

 

Zoekb.jpg

 

 

Copy and paste the following script from the code box and paste into the field.

standardsearch;autoclean;

Select the "Run Script" tab. The following window will open:

 

 

 

Zoekc.jpg

 

 

 

Please be patient and do not use the PC when the scan is in progress.

 

When complete you maybe asked to re-boot your PC, if so please do

 

Zoekf.jpg

 

Post the produced log in your next reply…..

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

OK, it would appear some kind of infection has control, see if you can run FRST from the Recovery Environment:

 

download Farbar Recovery Scan Tool from here:                                                                  

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

save it to a USB flash drive. Ensure to get the correct version for your system, 32 bit or 64 bit

 

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

Plug the flash drive into the infected PC.

 

If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt Here: http://www.bleepingcomputer.com/tutorials/windows-8-recovery-environment-command-prompt/ to enter System Recovery Command prompt.

 

If you are using Vista or Windows 7 enter System Recovery Options.

 

Plug the flashdrive into the infected PC.

 

Enter System Recovery Options I give two methods, use whichever is convenient for you.

 

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select Your Country as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

 

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select Your Country as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

 

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

 

  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type  e:\frst64 or e:\frst depending on your version. Press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

 

Kevin

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

I see you chose to run FRST from Normal mode, you just ignore what I ask. No big deal to me, when you run FRST from Normal mode it would have produced two logs, if possible post the other log when you have time.

 

For now do the following:

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST/FRST64 and press the Fix button just once and wait.


The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Next,

 

Open Malwarebytes, check for updates then run a quick scan. select and delete anything found.. Post that log...

 

fixlist.txt

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

I actually asked that FRST was run from the Recovery Environment via USB stick, not safe mode or normal mode. It did seem that an infection was having an adverse effect on tools we try to run.

 

As you chose to run from Normal mode, two logs would have been produced, why not post both. If a USB stick is not available, just tell me, I am trying to help you and would have looked at other options.

 

What is the status of your system at present, was FRST fix successful, did you run Malwarebytes quick scan, was a log produced.....

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.