[Resolved] my windows defender says everything is fine

Volume in drive C is ACER Volume Serial Number is 0881-F80E Directory of C:\WINDOWS\System32 01/19/2008 03:36 AM 177,152 scecli.dll 1 File(s) 177,152 bytes Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e 11/02/2006 05:46 AM 176,640 scecli.dll 1 File(s) 176,640 bytes Here it is: Directory of C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12 01/19/2008 03:36 AM 177,152 scecli.dll 1 File(s) 177,152 bytes Total Files Listed: 3 File(s) 530,944 bytes 0 Dir(s) 59,356,454,912 bytes free

Hi,

Please do the following:


Download ComboFix, renaming it as per the instructions but do not run it just yet.

You will need to follow this procedure first before combo-Fix will run.

• Close all programs so that you are at your desktop.
• Open the Control Panel menu and click Folder Options.
• After the new window appears select the View tab.
• Put a checkmark in the checkbox labeled Display the contents of system folders.
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
• Press the Apply button and then the OK button and exit My Computer.
• Now your computer is configured to show all hidden files.

NEXT:

Navigate to C:\Documents and Settings\All Users\Application Data\

Look for a folder with 8 random numbers

ie C:\Documents and Settings\All Users\Application Data\19285624\19285624.exe (your numbers will be different)

Drag this file/folder c:\documents and settings\all users\application data\19285624\19285624.exe to the desktop (drag - not delete)

Reboot.
Combo-Fix should now run.

Combofix instructions:

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
• Tools->Options->Main tab
• Set to "Always ask me where to Save the files".

Link 1
Link 2



During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–

• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.

———————————————————–

• Double click on Combo-Fix.exe & follow the prompts.
  
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" for further review.
  **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
  
  
  

  ———————————————————–

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  ———————————————————–

Hi, I have a question will it be alright for me to uncheck the hide protected operating system files because, there was an alert that came saying that if I were to do it it could make my computer unoperable. Another question I dont see a Display the contents of system folders. There are Display file icon on thumbnails, and Display file size information in folder tips, and Display simple folder view in Navigation pane, and a Display the full path in title bar(Classic folders only) but nothing saying Display the contents of system folders

Yes, unhide every option that it will allow you to do so, we will restore the settings when we are done, do not be alarmed by all the extra files you will see

ok i did the first part but I dont see the folder with 8 numbers. I copied the drive and paste it in the start search box but it said their are no items matching it. Where do i need to go?

This is the folder where it could be present C:\Documents and Settings\All Users\Application Data\ It may also be present in the user name in which you are logged on, whatever name that may be. Go to C: > Documents and settings >(the name you are logged in with ) (could be administrator?) then look for "Application Data" once you are in application data…look for a random named folder with 8 numbers…that is the folder that has to be dragged to the desktop

ok I did that it says access is denied when i tried to open up application data

Can you log in with the Administrators account - show the hidden files and folders and try it again?

How do i do that? and do u if i do do u want me to log off but first change all the settings back?

Hi,

while we are trying to clean your machine of malware, leave the settings as they are, we will set them back to default when we are done

To Enable the Administrator Account

• Open the command prompt with Administrative privileges by opening the Start Menu, and typing cmd in the search box, and then press Ctrl+Shift+Enter or click the Start orb, All Programs, Accessories, > right-click Command Prompt and select Run as administrator.
  
  
• Type the following command in the command prompt and then press Enter:
  

  
  net user administrator /active:yes

• Restart your computer and logon as Administrator.

Ok im on as administrator and when i restarted as an administrator there were 2 things that popped up saying they need to be closed which are Microsoft C Register Server and Rundll32.

I went under administrator opened up documents nothing came up nothing is under anything i typed in appalication data in search box under administrator and nothing came up is it because of rindll32 because it keeps popping up. The message will say rundll32 is not working and the optiona are to either check online for a solution and close the program or close the program.

rather than typing the folder into the search…can you actually navigate your way to that location…… go to your c drive > click on the documents and Settings folder > then click on all users . then click on Application Data and see if you can see the 8digit numbered folder there.

Hi, there was no documents and settings folder. This is what I did I went to Start clicked on computer then clicked on Acer (C:) and opened that up once I did that i typed in documents and setting nothing came up so, I typed documents 3 folders came up all were empty then i typed settings nothing came up. Next, I put in all users in the search box when i did that it brought up 12 folders each starting with 90120000 except 1 which starts as 91120000 the first folder is this 90120000-00A1-04 none of the folders says application data. Next i type in application data and a folder comes up saying SalesMon i click on that it a folder opens up saying data then i click on that and it says folder is empty.So what do i do now?

Ok

Are you still logged on in the Administors account?

Try running the reg and batch fixes I gave you in post #10