[Resolved] HJT Log Attached - McAfee No Longer Working

Combofix doesn't normally take more that 20 minutes including the reboot if malware is detected.

open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

Okay, I ended the processes. The blue run window is still open. In task manager, the only application that is running is: c:\\ . that looks odd to me, but maybe that is what combofix looks like. Nothing is getting any cpu time at the moment. Question: Should I check for a log? Is it possible it completed? I just don't see any special windows or messages.

Yes. It's a little odd…but look in the root directory C:\ for a folder called ComboFix…if a log has produced it will be there called Combofix.txt

no .txt file. I do see a ComboFix directory but no logfile. Ugh.

OK.

Can you try it in safe mode.

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY repeatedly,
• this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode
• Then press the Enter Key on your Keyboard
• go into your usual account

If this doesn't work, we'll try another tool

Same command from the run window or try to run from the desktop?

try the run command

I came up in SAFEMODE with no networking. It started to run then I got a beeping on my computer and this CAUTION window message: *BleepingComputer.com *foroSpyware.com *Geekstogo.com Combofix may be downloaded from any of the above sites. If you have downloaded from some other site, there's a likely chance it may be tainted. For peace of mind, I suggest that you delete the current copy and get a fresh one. It is waiting for me to click ok.

exit out - go into safe mode with networking allow combofix to update

Appears to be running now. Attempting to create a system restore point.

Autoscan is running. Going on half an hour now. I believe it is still running, because I can hear the CPU. I have to run out for a while, so I am just going to leave the machine up and running while I am out. There has been no reboot as of yet. Thank you for getting me this far. I will check back when I return.

Did you change one of your responses to me? I could have sworn you said to click okay after my post 23. Regardless, that is what I did. It appeared to start running. It ran for almost 2 hours and nothing. I checked for a logfile - nothing. I just rebooted in safemode with networking as the response above indicated. Thought I should check with you before going further.

It's 11:30 PM so I am heading to bed now. Thank you for your help. I will check in here tomorrow to see what next steps should be. For now, I have just shut the PC down. To recap: I cannot get a Combofix file to run and create a .txt file in the root directory. (I did run it as combo-fix by the way). Thank you in advance.

Hi,

Ok, It appears as though the infection is preventing combofix from running, so we will try another tool.


Please do the following:

Download Dr.Web CureIt to the desktop:

• Doubleclick the drweb-cureit icon to start the program.
• press start
• Allow the program to run the initial express scan
• This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
  Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
  
• Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
• Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take several hours)
• During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
  • Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
• Once the scan is complete, on the menu bar, click file and choose report list.
• Save the report to your desktop. The report will be called DrWeb.csv
• Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
• Close Dr.Web Cureit.
• Please post the Dr.Web.txt report in your next reply