My computer seems to be infected with many viruses. The most obvious one is PC Antispyware 2010. Occasionally the browser is taken over and sometimes audio sounding like a television station plays from my speakers. Also, my computer seems to be randomly rebooting itself.
Currently I am not able to install most programs relating to helping my computer. When I run the installation files, nothing happens. No windows pop up. This has happened with the following programs: HighjackThis, Malwarebytes' Anti-Malware, AVG AntiVirus, and SUPERAntiSpyware. I was able to install AdAware and Spybot - Search & Distroy, but unfortunately, those programs don't run. When trying to run AdAware, I get the message "Connection error, check your settings." I tried renaming the Spybot program to explorer.exe, like I read on another site. I was then able to run the program once until it crashed. Now it gives me the messege "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."
Please help.
-Beau Carnes
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
NEXT
We Need to check for Rootkits with RootRepeal
Download RootRepeal from the following location and save it to your desktop.
Open [external image: Posted Image] on your desktop.
Click the [external image: Posted Image] tab.
Click the [external image: Posted Image] button.
Check all seven boxes: [external image: Posted Image]
Push Ok
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.
NEXT
Please download Sysprot Antirootkit from >>>HERE<<<
Unzip it into a folder on your desktop.
Double click Sysprot.exe to start the program.
Click on the Log tab.
In the Write to log box select ALL ITEMS
Look near the bottom left, and Check Hidden Objects Only
Click on the Create Log button on the bottom right.
After a few seconds a new window should appear.
Select Scan Root Drive. Click on the Start button.
When it is complete a new window will appear to indicate that the scan is finished.
The log will be saved automatically in the same folder Sysprot.exe was extracted to.
Running DDS gave me a screen of text that talked about what the program was going to do but no reports ever popped up or appeared on my system.
GMER did nothing upon double-clicking the program.
I got this error upon running RootRepeal: "Could not read the boot sector. Try adjusting the Disk Access Level in the Opeions dialog." After clicking 'OK' on this many times, the program finally loaded. In the middle of the scan the program closed. Now when I try to load the program I get the message: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item."
Sysprot Antirootkit didn't work completely in Safe Mode, but in regular mode I was able to get this log:
********************************************************************************
**********
********************************************************************************
**********
No SSDT Hooks found
********************************************************************************
**********
********************************************************************************
**********
Kernel Hooks:
Hooked Function: ZwFlushInstructionCache
At Address: 805769AB
Jump To: 82286894
Module Name: _unknown_
Hooked Function: ZwEnumerateKey
At Address: 8056F76A
Jump To: 822DE3DC
Module Name: _unknown_
Hooked Function: IofCompleteRequest
At Address: 804E418A
Jump To: 821ECB9B
Module Name: _unknown_
Hooked Function: IofCallDriver
At Address: 804E3D45
Jump To: 821BAAF3
Module Name: _unknown_
Object: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\E397BF3M\UACA4URE6NCA08HDU1CA8SQY4FCAO6WAD6CAP3KAV4CART7TUICA2L3DAOCAGJXVRSCARD39I3C
AR19LR9CAQB80HECA3X0X0WCAKE1NZMCA6557JNCA7Q8W1RCAGT532HCAJXPIVFCAU328D4CATFLF59
Status: Hidden
Object: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\G5OBCJOB\UACAHE26ZRCAX65RBCCACCBG0LCA3ECZI0CA26TNM5CAXXNP4HCAABKYO7CATRP668CA3COXM6C
ACJ68U6CAUV9N8GCAU1N63RCANNG4LVCA6ZS7XLCAUM6R68CA5LJFCVCACCLAZGCAVNNNJWCAEJM2LH
Status: Hidden
Object: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IVSPKFI1\UACAGTD261CA4MIPI1CA0XQ40NCAD9G4PXCAOYZXZSCAHY0618CAGRDN2YCA3EH8T6CA7Z0AJ1C
A90RWE1CA3XYVPLCAT6MT1QCAGTE69PCA8R8N3ZCAVSYIPHCAD5YZEYCAEZJGS8CA1VTPN7CAEPBEPQ
Status: Hidden
Hi,
For this next tool, please make sure all your security programs are disabled and all other programs closed.
Download sVchost from HERE and run it.
Follow the prompts. ALLOW it's requests to run.
Post the resulting log.
Upon running sVchost, a blue dos prompt apears, then I dialog box saying "ComboFix in uninstalled". Then the program deletes itself. This happens in regular mode and safe mode.
Download Combofix from either of the links below. Youmustrename it before saving it.
Save it to your desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".
Link 1 Link 2
During the download, rename Combofix to Combo-Fix as follows:
It is important you rename Combofix during the download, but not after.
Please do not rename Combofix to other names, but only to the one indicated.
———————————————————–
Double click on Combo-Fix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
———————————————————–
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click onthis linkto see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
———————————————————–
NOTE: ComboFix shall request to install the Recovery Console, please ALLOW it to do so.
Unfortunately, these programs don't work either. I had all security programs disabled.
After running !sLSc: "Machine does not appear to be infected."
Combo-Fix shows a loading bar and then nothing happens.
ComboFix 09-08-10.06 - Administrator 08/13/2009 16:50.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.194 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-
52D74245D6BF}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\-1333731407
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\jotoca._sy
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\mifu.pif
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\okodan.vbs
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\uxuze.dll
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\vovysisa.inf
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\wujomo.bin
c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\zake.dl
C:\p2hhr.bat
C:\vkywt.exe
c:\windows\braviax.exe
c:\windows\cru629.dat
c:\windows\msa.exe
c:\windows\run.log
c:\windows\system32\_scui.cpl
c:\windows\system32\braviax.exe
c:\windows\system32\cru629.dat
c:\windows\system32\drivers\UACyrndgxtbir.sys
c:\windows\system32\hs7f3uhduhfukde.dll
c:\windows\system32\net.net
c:\windows\system32\UACabglkyebth.dat
c:\windows\system32\UAChesotxifik.db
c:\windows\system32\UACiibgakcova.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACmfkkwyvttt.dll
c:\windows\system32\UACmpdrtfpuoi.log
c:\windows\system32\UACordltmjbfo.dll
c:\windows\system32\UACrpawulxjsa.dll
c:\windows\system32\UACvkqovjxymj.dll
c:\windows\system32\wbem\proquota.exe
c:\windows\system32\wisdstr.exe
c:\windows\system32\drivers\beep.sys . . . is infected!!
c:\windows\system32\proquota.exe . . . is missing!!
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.
CAUTION:Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
Ensure you are connected to the internet and click OK on the message box.
Note: If combofix asks you to update - allow it and if it asks to install the recovery console - ALLOW it
Note: Please uncheck WORDWRAP from note pad
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}