(Resolved)cxEAIe.exe (requesting access), "RZRWSO~1.EXE has stopp

I was able to get the program onto my computer, but when I tried to run it with your spec's it was stopped after 4 lines of red text showed up in the display box on the original program. If there is another way around that I'm open ears, otherwise, we need to go around that some how. Awaiting your response. Thanks SD

what was the error given exactly? are you able to post a screenshot did you try it in safe mode?

hahaha, you're too fast.. I just got finished trying it in safe mode and it worked! Let me see if I can finish all the steps and then I can get you those logs. Although I don't see a log in any of the folders.. I'm searching for them now. Thanks SD

Ok, wasn't able to complete them at all, I thought it was finished, but instead was able to Screen shot the first one at the time it was stopped. I'll attach the SS for you to take a look. 📎AVZ.jpg That's where it stopped, and the entire program just shut off completely. I would love some advice to help, unless I did it right and my issue is still there in full force? SD

Here's the latest. I WAS able to get the advanced search done, but the first step you gave me will no continue. The only message I get is that one you saw in my last post, or the same old "something has stopped this program from running" I used to get all the time when i first booted up. I've attached the log I was able to get. Hope it tells you something. SD

Hi Sunidaze,

We would first like to do a test…we are putting a suspicious file into quarantine……
don't allow your system to reboot yet, just do the following instructions then try and access the AV sites that you have been unable to access before.

If that seems to cure your woes…we will kill the file with another script…if that doesn't do anything or worsens the situation, please advise.

Also please advise what other issues you may be having with your computer at the moment.

Please do the following

• Double click on AVZ.exe
• Click File > Custom scripts
• Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('?','');
TerminateProcessByName('?');
end.

ON COMPLETION

• Start AVZ.
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post

I don't think I'm having any issues. I went to all the AV sites I could think of and not one caused a problem. Here's the log you asked for, hope it gives good news. Thanks, SD

Just so we're clear that it was the script that 'fixed' that…can you confirm that you 'could not' do that before the script - or did the last run of MBAM fix those issues… can you just verify at which point you were able to do what (sorry - I should have been more specific)

oh no, it's quite alright. Here's exactly what I did in the past 48 hours. I got a little trigger happy I think. I did that MBAM first, then after we went through those other things, I ran HJThis again, and saw that one line of code that you had pointed out to me. I checked it, and clicked on fix it, and it was removed successfully. Then we did this new program, and you saw both copies of the log that I posted. The before and after from what I was instructed to do. So technically the only things I did without being prompted was the last run of MBAM and HJThis. Other than that, somewhere around the MBAM and this last program I stopped getting pop ups completely, but continued to have issues running that one scan. Was able to get the log that you saw, but not the other log requested in the posts. If there is another test or scan you'd like to see then I'd love to help, or provide logs for it. Thanks, SD

Hi Sunidaze

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Let's reboot your computer at this point - then do the following:

Please open MalwareBytes Antimalware

• Update Malwarebytes' Anti-Malware
• Once the program has loaded, select "Perform Full Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


NEXT

Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

NEXT

open HJT and run a fresh scan.

In your next reply I need

• MBAM log
• Kaspersky report
• HJT log

hey there, sorry about the long wait, was out of town, then back and had quite a few things to get done. Here are the 2 logs, from MBAM and HJThis, Kaspersky reported nothing as well on every scan I did. I couldn't figure out how to get the log out of it though.. Probably something I overlooked, but no infections and nothing that looked suspicious. Thanks, SD

Hi Sunidaze,

Good news, your logs look clean,


Thanks for following all our procedures, we finally found the combination that works on the 64bit system for a Vundo infection - AVZ and MBAM, we appreciate all your efforts.

We just have a little clean up to do now


First

Open the AVZ4 program, go to File > Standard scripts > Check #6 "Delete all drivers and reg keys"
Press OK/Enter

Next

Please download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

• Click the Pt. Restauration button and press OK to the prompts.
• Click the Corbeille button and press OK to the prompt.
• Click the Fichiers temp button and press OK to the prompt.
• Click the Recherche button and let it run ( it may look like it freezes but let it continue )
• Once it is done click the Suppression button and let it remove anything it finds.
• Close the program

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more.  Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
• For Firefox - I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories.  This article is full of good information on alternatives for home backup solutions.
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
• Please read the guide by Rorschach112 on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

If you have any other questions or concerns please ask.

Thank you so much for all your assistance! It was greatly appreciated, and I'm glad to aid in the new findings that may help others that use Windows Vista 64 bit OS's. I can't thank you enough for the further information and programs that you've provided to assist me to maintain a clean computer. I hope everyone can benefit from the findings in this tech thread about 64 bit systems and the issues that can occur. SD

You are most welcome sunidaze and it will be of great benefit yes, so thank-you for that. Stay safe CB Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.