lochloy Posted June 2, 2016 Author ID:1043282 Share Posted June 2, 2016 Farbar Recovery Scan Tool (x64) Version:01-06-2016 Ran by Marty (2016-06-02 02:21:33) Running from C:\Users\Marty\Downloads Boot Mode: Normal ================== Search Files: "dnsapi.dll;ds*.bin" ============= C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_0d0987cfb6756063\dnsapi.dll [2016-04-13 10:15][2016-03-29 10:28] 0535080 ____A (Microsoft Corporation) 6A7ACABAE92C837F5C1330188EAE36AE [File is digitally signed] C:\Windows\WinSxS\wow64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.0_none_2c65f66b01dd8f12\dnsapi.dll [2015-10-30 08:18][2016-04-14 10:43] 0017780 ____A () 4C8C167B131EBE7A4D94504F82DAD316 [File not signed] C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.212_none_02b4dd7d82149e68\dnsapi.dll [2016-04-13 10:15][2016-03-29 11:11] 0686976 ____N (Microsoft Corporation) 9A3E17CDB177913C2A111C80F3D0DBB4 [File is digitally signed] C:\Windows\WinSxS\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.10586.0_none_22114c18cd7ccd17\dnsapi.dll [2015-10-30 08:18][2016-04-14 10:30] 0010782 ____A () E4E48EFBCF7DF993A1377CB0518411BC [File not signed] C:\Windows\SysWOW64\dnsapi.dll [2016-04-13 10:15][2016-03-29 10:28] 0535080 ____A (Microsoft Corporation) 6A7ACABAE92C837F5C1330188EAE36AE [File is digitally signed] C:\Windows\System32\dnsapi.dll [2016-04-13 10:15][2016-03-29 11:11] 0686976 ____A (Microsoft Corporation) 9A3E17CDB177913C2A111C80F3D0DBB4 [File is digitally signed] ====== End of Search ====== Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 2, 2016 Root Admin ID:1043317 Share Posted June 2, 2016 (edited) Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well. Basically the same scan as before but this time add the check mark for the Drivers MD5 check and the Addition.txt Edited June 2, 2016 by AdvancedSetup Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 2, 2016 Root Admin ID:1043324 Share Posted June 2, 2016 Then after you save your log files to attach please do the following. Please visit the following page on how to run the SFC tool and run it on your system.Use the System File Checker tool to repair missing or corrupted system files https://support.microsoft.com/en-us/kb/929833 Link to post Share on other sites More sharing options...
lochloy Posted June 2, 2016 Author ID:1043330 Share Posted June 2, 2016 Reports from FBAR Screenshot of SFC result Copy of CBS.LOG Addition.txt CBS.log FRST.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 2, 2016 Root Admin ID:1043336 Share Posted June 2, 2016 Getting late. Let me check on this tomorrow and get back to you. Thanks Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 2, 2016 Root Admin ID:1043414 Share Posted June 2, 2016 The end of the repair log says it did complete successfully some updates so it should be okay on that part. Still reviewing your other logs. Be back a bit later for an update for you. Link to post Share on other sites More sharing options...
lochloy Posted June 2, 2016 Author ID:1043425 Share Posted June 2, 2016 Hi Ron, I forgot to thank you for all your help so far - you have been invaluable in getting my computer back to health... Just happened to run a scan with Avast - for the first time it is no longer showing any viruses! Great news... However, I am concerned about the errors which appeared in the SFC scan last night... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 3, 2016 Root Admin ID:1043478 Share Posted June 3, 2016 You're quite welcome. Since you've scanned with Avast and it's showing okay - can you please reboot one more time and then run me a new set of scans and attach the logs for FRST as previously run. Having SFC find and report such is sort of normal. It does say though that it finished properly. I am concerned about a couple of files that are not signed that are in your controlled folders for the operating system that I want to see if they're showing up again or not. Please run the FRST as in POST 27 Thanks Link to post Share on other sites More sharing options...
lochloy Posted June 3, 2016 Author ID:1043554 Share Posted June 3, 2016 Addition.txt FRST.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 7, 2016 Root Admin ID:1044112 Share Posted June 7, 2016 How is the computer running now? Are there still any signs of an infection? The logs look pretty good overall. Link to post Share on other sites More sharing options...
lochloy Posted June 7, 2016 Author ID:1044152 Share Posted June 7, 2016 Computer is now working well. No virus or malware appears to be present. The only issue I have is that some apps are no longer working, however I am working my way through them all and reinstalling as necessary. thanks again for all your help and support. Very much appreciated ? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 7, 2016 Root Admin ID:1044194 Share Posted June 7, 2016 You're quite welcome At this time there are no more signs of an infection on your system.However if you are still seeing any signs of an infection please let me know. Let's go ahead and remove the tools and logs we've used during this process. Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time. They are often updated daily so if you went to use them again in the future they would be outdated anyways. The following procedures will implement some cleanup procedures to remove these tools. Download Delfix from here and save it to your desktop. (you may already have this) Ensure Remove disinfection tools is checked. Click the Run button. Reboot Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete) IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall. If there are any other left over Folders, Files, Logs then you can delete them on your own. Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.How to Delete System Protection Restore Points in Windows 7 and Windows 8 Remove all but the most recent Restore Point on Windows XP As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsersHow do I disable Java in my web browser? - Disable Java A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data. Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor. How Malware Spreads - How did I get infected Best Practices for Safe Computing - Prevention of Malware Infection Avoiding those unwanted free applications A close look at how Oracle installs deceptive software with Java updates IAC / Ask.com toolbars Malwarebytes Unpacked Blog If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted June 7, 2016 Root Admin ID:1044195 Share Posted June 7, 2016 Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts