d0zer Posted October 8, 2014 ID:887682 Share Posted October 8, 2014 Just a few hours ago, my laptop started acting oddly, prompting an "on demand" scan from both my AV program and Malwarebytes. The trouble that elicited the panic was an inability to open first Windows Explorer, and then the Malwarebytes program itself. So I performed an "on demand" scan with my AV program, ESET. This resulted in 2 "inflitrations". They were subsequently "cleaned" supposedly. But just to be sure, I wanted to run Malwarebytes. And it started up and ran with no problem. Further, it found nothing. However, I then ran ESET's scan again, and it came back with 9 "infiltrations". And again, ran Malwarebytes, only to find nothing. I would greatly appreciate some professional guidance as to how to ensure that this system is clean as I use it for everything, including work. Thanks in advance.... Link to post Share on other sites More sharing options...
kevinf80 Posted October 8, 2014 ID:887685 Share Posted October 8, 2014 Hello and P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Next, Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/ Quit all running programs.For Windows XP, double-click to start.For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.Read and accept the EULA (End User Licene Agreement)Click Scan to scan the system.When the scan completes select "Report", log will open. Close the program > Don't Fix anything!Post back the report which should also be located here:C:\Programdata\RogueKiller\Logs <-------- W7/8C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP Let me see those logs in your next reply... Thanks, Kevin... Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887687 Share Posted October 8, 2014 My apologies, here are the files...FRST.txtAddition.txt Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887689 Share Posted October 8, 2014 And then the RogueKiller logs...RKreport_SCN_10082014_040655.log Link to post Share on other sites More sharing options...
kevinf80 Posted October 8, 2014 ID:887691 Share Posted October 8, 2014 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply. Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Download Dr Web Cureit from here http://www.freedrweb.com/cureit save to your desktop. (Scroll to bottom of page) The file will be randomly named Reboot to safe mode Run Dr Web Tick the I agree box and select continue Click select objects for scanning Tick all boxes as shown Click the wrench and select automatically apply actions to threats Press start scan The scan will now commence Once the scan has finished click open report A notepad will open Select File > Save as.. Save it to your desktop This log will be excessive, Attach it to your next reply… Let me see those logs, also give an update on any remaining issues or concerns.... Thanks, Kevin.. Fixlist.txt Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887692 Share Posted October 8, 2014 Fixlog.txt attached...Fixlog.txt Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887696 Share Posted October 8, 2014 OK, RE the Malwarebytes scan, no malicious items detected, and no prompt for restart. Log results attached....mbamLog.txt Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887697 Share Posted October 8, 2014 ADWcleaner log....AdwCleanerS0.txt Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887712 Share Posted October 8, 2014 And the Dr.Web Cureit log....cureit.log Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887713 Share Posted October 8, 2014 Everything seems to be working fine now. I can open both windows explorer and the Malwarebytes software without that security error. You are the man Kevin. I have had to use this site quite a few times in trying to get other peoples computers back up and running again, but, by far, you provided both the quickest response AND resolution time I have yet experienced. So thank you so very much for that. If I may, what did I have? Link to post Share on other sites More sharing options...
kevinf80 Posted October 8, 2014 ID:887717 Share Posted October 8, 2014 Thanks for the logs and the update, there was no obvious malware or infection present on your system. All we remove were remnants from previous installations, drivers, temp files etc. One suspicious task file was also removed, possibly that was causing your security to react... Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Activate UAC Remove disinfection tools Create registry backup Purge System Restore Reset system settings Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Part of the routine will be to create a registry back up with ERUNT, the back up will be created here: C:\Windows\ERUNT When all is known to be well with your system you can delete that back up folder if you consider it as not needed...Any remnant files/logs from tools we have used can be deleted… Next, Read the following link to fully understand PC security and best practices, you may find it useful.... http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 If no remaining issues or concerns are we ok to close out.. Thanks, Kevin... Link to post Share on other sites More sharing options...
d0zer Posted October 8, 2014 Author ID:887822 Share Posted October 8, 2014 I ran Delfix and everything still appears to be working well and as designed. Thank you Kevin. I really appreciate all your help. The Malwarebytes software, AND this forum, have both proved once again to be invaluable lifesavers. Link to post Share on other sites More sharing options...
kevinf80 Posted October 8, 2014 ID:887861 Share Posted October 8, 2014 Thanks for the update and kind words, it was a pleasure to work with you.... Take care and surf safe, Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 17, 2014 Root Admin ID:891227 Share Posted October 17, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts