tom111 Posted July 22, 2014 ID:856031 Share Posted July 22, 2014 I found some information in the formums about removal but wasn't sure if it was up to date. Hopefully someone will be able to help me remove it. Thank you. Link to post Share on other sites More sharing options...
tom111 Posted July 22, 2014 Author ID:856391 Share Posted July 22, 2014 I currently have the premium version of Malwarebytes, is there an add on I can get that will fix the problem? Thanks Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 22, 2014 ID:856398 Share Posted July 22, 2014 Hello, They call me TwinHeadedEagle around here, and I'll be working with you. Before we start please read and note the following: Limit your internet access to posting here, some infections just wait to steal typed-in passwords. Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good. Do not paste the logs in your posts, attachments make my work easier. There is a Attach Files option below which you can use to attach your reports. Always attach reports from all tools. Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational. Note that we may live in totally different time zones, what may cause some delays between answers. Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it. If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything unexpected happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! Please download Farbar Recovery Scan Tool () by Farbar and save it to your desktop. Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Link to post Share on other sites More sharing options...
tom111 Posted July 23, 2014 Author ID:856509 Share Posted July 23, 2014 Thank you for your help. I'm not very computer savvy so bare with me. Here are the FRST and Addition files. FRST.txtAddition.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 23, 2014 ID:856586 Share Posted July 23, 2014 I would like you to first run MalwareBytes We'll search for some remnants that might be hiding. Please download Malwarebytes Anti-Malware and save it to your desktop.Install the progam and select update Once it has updated select Settings > Detection and Protection >Tick Scan for rootkits Go back to the Dashboard and select Scan Now If threats are detected, click the Apply Actions button, MBAM will ask for a reboot On completion of the scan (or after the reboot) select View Detailed LogSelect Export > Select text file and save to the desktop. Please post that log for my review. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857034 Share Posted July 24, 2014 I'm posting this from my phone. I ran the scan as you instructed and just before it was finished the program froze. I shut down the computer and rebooted it. I received a System Shutdown message. I don't remember exactly what it said. Something about a "DCOM server process error and the computer will have to restart". The computer shuts down and when it restarts I get the same message again Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 24, 2014 ID:857075 Share Posted July 24, 2014 Can you enter Safe Mode and try to open MalwareBytes. If you succeed, export its report here. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857223 Share Posted July 24, 2014 I tried the full scan in safe mode but the program froze near the end of the scan. I was able to do a hyper scan. I don't know if this will help but I'm attaching a photo of my recent Quarantine items. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857228 Share Posted July 24, 2014 The full scan freezes in the File Systems scan. I'm attaching a photo of the Review Detections window. Is it possible for me to delete them in the registry? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 24, 2014 ID:857229 Share Posted July 24, 2014 Yes, I would like to see images. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857258 Share Posted July 24, 2014 I'm using my phone to post. I attached the images using the attached file button. Did you see them?I just tried another full scan and am attaching an image of Review Detections. If you don't think we can resolve this let me know so I can take a different approach. Thanks. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 24, 2014 ID:857270 Share Posted July 24, 2014 Unfortunatelly I do not see pictures. Try to enter Safe Mode with networking. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857276 Share Posted July 24, 2014 Thanks, when I'm in safe mode I'm not able to get on the network to access the internet. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857282 Share Posted July 24, 2014 Sorry for the multiple posts. If you think it will help I can rescan and email the images to you. Would removing the threats in the registry help? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 24, 2014 ID:857290 Share Posted July 24, 2014 I would like first to see MalwareBytes reports. Link to post Share on other sites More sharing options...
tom111 Posted July 24, 2014 Author ID:857304 Share Posted July 24, 2014 I can email the photo images of the Quarantine Items. As I mentioned previously the program is freezing but I can send you an image of the Review Detections window via my phone. I'll need an email address. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 24, 2014 ID:857364 Share Posted July 24, 2014 I don't think this would help. Try this to perform system restore http://support.microsoft.com/kb/304449 Link to post Share on other sites More sharing options...
tom111 Posted July 25, 2014 Author ID:857517 Share Posted July 25, 2014 I was able to log on to the internet. Malwarebytes is still freezing up when I perform a full scan but I was able to do a Hyper Scan. I'm attaching that log and some screen shots of the Quarantine History and the Review Detected Items on the freeze. Do you have any ideas as to why the program is freezing before it finishes the full scan? If you don't think we're going to be able to remove the Rovnix Malware and the other malware, please let me know right away. Thanks. hyper scan.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 25, 2014 ID:857587 Share Posted July 25, 2014 I know what is going on, you have severe infections present.Please download Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. When you finish type the following in the edit box after "Search:" rpcss.dllClick Search File(s) button and post the log (Search.txt) it makes to your reply. Link to post Share on other sites More sharing options...
tom111 Posted July 25, 2014 Author ID:857709 Share Posted July 25, 2014 I already downloaded and ran the Farbar Recovery Scan Tool and sent you the FRST and the Addition logs. Did you see them? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted July 25, 2014 ID:857714 Share Posted July 25, 2014 Yes, but I need reports from Safe Mode. Also, I need search report too. Link to post Share on other sites More sharing options...
tom111 Posted July 25, 2014 Author ID:857717 Share Posted July 25, 2014 I appreciate that you're trying to help but we are't getting anywhere. I have the premium version and I've posted that it's freezing during the full scan. Can you put me in contact with the people I bought the Premium Version from so they cyan help with the freezing issue and help me remove the malware? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 26, 2014 Root Admin ID:857929 Share Posted July 26, 2014 Hello Tom My name is Ron Lewis and I will assist you with your issue and see if we can get it resolved. Please run the FRST program again and post back new logs.Make sure you place a check mark in the ADDITIONS.TXT check box to get a new log for that as well. Thank you Link to post Share on other sites More sharing options...
tom111 Posted July 26, 2014 Author ID:857938 Share Posted July 26, 2014 Thanks Ron,I'm posting from my phone. i was booted up and online when I posted earlier. Unfortunately I'm now getting a System Shutdown message when I try to boot up in safe mode or standard. Do you have any suggestions? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 26, 2014 Root Admin ID:857995 Share Posted July 26, 2014 The infection you have is probably causing difficulty for the computer to keep running but assuming that MBAM took out something that made it worse we'll go back in time. Please review the following website which will show you how to restore the sytsem back using a Restore Point.You will probably need to use Option 2 since the computer is shutting down on you.How to Do a System Restore in Windows 7 http://www.sevenforums.com/tutorials/700-system-restore.html Then see if you can start in Normal Mode and if so try posting back the original logs from MBAM. Link to post Share on other sites More sharing options...
Recommended Posts