SuperiorBuff Posted June 15, 2009 ID:89999 Share Posted June 15, 2009 Can you please look at my RootRepeal logs and let me know if I have an issue? I am having problems with McAfee and SuperAntispyware crashing daily and MBAM, previously installed, will not run.RootRepeal_report_06_15_09__14_08_52_.txtRootRepeal_report_06_15_09__14_08_52_.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 16, 2009 Staff ID:90272 Share Posted June 16, 2009 Hi,Please let rootrepeal delete the following:Path: C:\WINDOWS\system32\MSIVXcountStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\MSIVXswligfggfwlsujbinwikkyjwfhdfjysu.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\MSIVXwbrinueaovamgxuesdbmfxknoesjqhkp.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\drivers\ijzhdmuq.sysStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\drivers\MSIVXuusdaqjrhddwmepvavvebathivlxobqe.sysStatus: Invisible to the Windows API!Path: c:\documents and settings\kevin warman\local settings\temp\etilqs_ge6kceforodpxwzibuvmThen after reboot, try to run MalwareBytes again and post the log in your next reply. Link to post Share on other sites More sharing options...
SuperiorBuff Posted June 16, 2009 Author ID:90292 Share Posted June 16, 2009 Hi miekiemoes, Thanks for your help.The logs are attached.mbam_log_2009_06_16__09_37_46_.txtmbam_log_2009_06_16__09_37_46_.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 16, 2009 Staff ID:90294 Share Posted June 16, 2009 Hi,This is much better already, but I want an extra tool / log, this to doublecheck and remove other leftovers..* Please visit this webpage for instructions for downloading and running ComboFix:http://www.bleepingcomputer.com/combofix/how-to-use-combofixPost the log from ComboFix in your next reply.Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how. Link to post Share on other sites More sharing options...
SuperiorBuff Posted June 16, 2009 Author ID:90297 Share Posted June 16, 2009 Whatever is on my PC will not allow combofix to download. I get a message that the disc is write protected then the browser can't find the download site. I saved it to our network but get the same error message when trying to copy it to my desktop even after renaming it. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 16, 2009 Staff ID:90314 Share Posted June 16, 2009 Ok, please delete the file again from your desktop and try this way..Please download ComboFix from Here or Here to your Desktop.**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**If you are using Firefox, make sure that your download settings are as follows:Tools->Options->Main tabSet to "Always ask me where to Save the files".[*]During the download, rename Combofix to Combo-Fix as follows:[*]It is important you rename Combofix during the download, but not after.[*]Please do not rename Combofix to other names, but only to the one indicated.[*]Close any open browsers.[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.-----------------------------------------------------------Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.-----------------------------------------------------------Close any open browsers.WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.If there is no internet connection after running Combofix, then restart your computer to restore back your connection.-----------------------------------------------------------[*]Double click on combo-Fix.exe & follow the prompts.[*]When finished, it will produce a report for you. [*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**If you still cannot get this to run, try booting into Safe Mode, and run it there.To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode." Link to post Share on other sites More sharing options...
SuperiorBuff Posted June 16, 2009 Author ID:90320 Share Posted June 16, 2009 No luck, I get a can not copy error that says "Cannot copy ComboFix [1]: Access is Denied. I tried a second time to make sure that I changed the name to Combo-Fix and received the same error. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 16, 2009 Staff ID:90322 Share Posted June 16, 2009 You're doing something wrong imho.Did you also disable your Mcafee? Because I know McAfee blocks it.Try it again from Windows safe mode with networking support and make sure all references of Combofix are deleted and you do it exactly the way I describe. Link to post Share on other sites More sharing options...
SuperiorBuff Posted June 16, 2009 Author ID:90335 Share Posted June 16, 2009 I had disabled McAfee earlier and the time limit must have expired.The logs are attached.ComboFix.txtComboFix.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 16, 2009 Staff ID:90339 Share Posted June 16, 2009 Hi,Please make sure McAfee is disabled, because I see in your log it's interfering with Combofix already. If it's causing too many issues, it may be better to temporary uninstall, just to make sure it doens't break anything while running Combofix.Then, * Open notepad - don't use any other texteditor than notepad or the script will fail.Copy/paste the text in the quotebox below into notepad:File::c:\windows\system32\drivers\ijzhdmuq.sysDriver::vatubisqSave this as txtfile CFScript Then drag the CFScript into ComboFix.exe as you see in the screenshot below.This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply. Link to post Share on other sites More sharing options...
SuperiorBuff Posted June 17, 2009 Author ID:90569 Share Posted June 17, 2009 I did end up having to uninstall McAfee. The log is attached.ComboFix.txtComboFix.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 17, 2009 Staff ID:90570 Share Posted June 17, 2009 Hi,I already thought that would be needed to uninstall McAfee. I normally post this already along with my combofix post if I see McAfee installed, but wanted to see if it still interfered with Combofix that much. This looks OK again.* Go to start > run and copy and paste next command in the field:ComboFix /uMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.Let me know in your next reply how things are now. Link to post Share on other sites More sharing options...
SuperiorBuff Posted June 17, 2009 Author ID:90584 Share Posted June 17, 2009 Done. Thanks a ton, I don't see any of the issues that I was having. I would like to know how to get the add ons working in IE again. The Manage Add Ons selection under Tools is grayed out. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 17, 2009 Staff ID:90592 Share Posted June 17, 2009 I would like to know how to get the add ons working in IE again. The Manage Add Ons selection under Tools is grayed out.Do you have the same when you run IE from start > run?So go to start > run and type: iexplore.exe there.If you dont have the same problem, then you need to replace your IE shortcut. http://www.tipandtrick.net/2008/restore-mi...windows-xp-sp3/Or just create a shortcut from C:\program Files\Internet Explorer\iexplore.exe Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 20, 2009 Staff ID:91702 Share Posted June 20, 2009 Still with us? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted June 25, 2009 Staff ID:93170 Share Posted June 25, 2009 Due to the lack of feedback, this Topic is closed.If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.Everyone else please begin a New Topic. Link to post Share on other sites More sharing options...
Recommended Posts