WE'RE SURE THAT YOU'LL LOVE US!
Hey there! 
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.
Try What the Tech -- It's free!
[Resolved] Computer Infected Please Help...
Started by
Joecastle
, Oct 21 2009 05:39 PM
This topic is locked
118 replies to this topic
#76
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 03:00 PM
Register to Remove
#77
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 03:47 PM
Hi,
Please do the following:
download the following tool, save it to your desktop. Right click on it and run it as an Administrator:
http://noahdfear.net/downloads/fix.exe
then do this in an elevated command window
Go to Start menu.
Type cmd in the Search Menu
Press Ctrl + SHIFT and Click on the cmd shortcut on the Start Menu. Ctrl-Shift-Enter is the general keyboard shortcut that triggers elevation to “Run as Administrator”.
Press Alt+C from the keyboard or click Continue to confirm the UAC elevation warning prompt and the administrative privileged command prompt will be opened.
Then highlight and copy the contents of the codebox then right click in the command window and Paste
after you get a finished message do this at the command prompt:
To readers of this topic:
NOTE: Please be advised the above instructions are for this user only...DO NOT use this on your machine as it could render your computer inoperable. If you are having similar issues - please start a new topic
Please do the following:
download the following tool, save it to your desktop. Right click on it and run it as an Administrator:
http://noahdfear.net/downloads/fix.exe
then do this in an elevated command window
Go to Start menu.
Type cmd in the Search Menu
Press Ctrl + SHIFT and Click on the cmd shortcut on the Start Menu. Ctrl-Shift-Enter is the general keyboard shortcut that triggers elevation to “Run as Administrator”.
Press Alt+C from the keyboard or click Continue to confirm the UAC elevation warning prompt and the administrative privileged command prompt will be opened.
Then highlight and copy the contents of the codebox then right click in the command window and Paste
cd "%userprofile%\desktop" inherit.exe C:\Windows\winsxs\Temp
after you get a finished message do this at the command prompt:
rmdir /s/q C:\Windows\winsxs\Temp\PendingDeletes\PendingDeletes
To readers of this topic:
NOTE: Please be advised the above instructions are for this user only...DO NOT use this on your machine as it could render your computer inoperable. If you are having similar issues - please start a new topic
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
#78
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 04:21 PM
When clicking on fix.exe all i get is an empty note pad box.. I get no finish message when doing the other 2 codes.. The first one gives me a OK box only after pressing enter and the second nothing...
#79
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 04:28 PM
Did you run it as Admin?
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
#80
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 04:42 PM
I right clicked on it, clicked on Compatibility tab and down on the Privilege Level section the Run this program as an administrator is faded out and I can not click the box...
#81
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 05:43 PM
Hi, delete that copy and redownload it again.
save it to your desk top, save as file type "All files"
Right click on it, do nothing else but choose to Run it as Administrator, then allow it to run.
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
#82
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 06:03 PM
Here it is..
C:\Windows\SOFTWA~1\Download\D46572~1\X8A8AD~1.225\X86_MI~1.225 Deleted Successfully !!
#83
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 06:07 PM
Hi,
we need a fresh win32kdiag log now.
we need a fresh win32kdiag log now.
- Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
- When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
- Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
#84
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 06:30 PM
Running from: C:\Users\Viper1\Desktop\Win32kDiag.exe
Log file at : C:\Users\Viper1\Desktop\Win32kDiag.txt
WARNING: Could not get backup privileges!
Searching 'C:\Windows'...
Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Backup.etl
[1] 2009-10-31 16:49:25 0 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Backup.etl ()
Found mount point : C:\Windows\winsxs\Temp\PendingRenames\PendingRenames
Mount point destination : \Device\__max++>\^
Finished!
#85
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 06:36 PM
Hi,
Please do this in an elevated command window
Go to Start menu.
Type cmd in the Search Menu
Press Ctrl + SHIFT and Click on the cmd shortcut on the Start Menu. Ctrl-Shift-Enter is the general keyboard shortcut that triggers elevation to “Run as Administrator”.
Press Alt+C from the keyboard or click Continue to confirm the UAC elevation warning prompt and the administrative privileged command prompt will be opened.
Then highlight and copy the contents of the codebox then right click in the command window and Paste
after you get a finished message do this at the command prompt:
Once that is complete...please run win32kdiag again.
Once you have completed that, please download a fresh copy of combofix to your desktop, run it in normal mode.
Here are the links again - save you going back through the thread.
Link 1
Link 2
You can also delete fix.exe and the logs from your desktop.
Please do this in an elevated command window
Go to Start menu.
Type cmd in the Search Menu
Press Ctrl + SHIFT and Click on the cmd shortcut on the Start Menu. Ctrl-Shift-Enter is the general keyboard shortcut that triggers elevation to “Run as Administrator”.
Press Alt+C from the keyboard or click Continue to confirm the UAC elevation warning prompt and the administrative privileged command prompt will be opened.
Then highlight and copy the contents of the codebox then right click in the command window and Paste
"%userprofile%\desktop\Inherit.exe" C:\Windows\winsxs
after you get a finished message do this at the command prompt:
rd /s/q C:\Windows\winsxs\Temp\PendingRenames\PendingRenames
Once that is complete...please run win32kdiag again.
Once you have completed that, please download a fresh copy of combofix to your desktop, run it in normal mode.
Here are the links again - save you going back through the thread.
Link 1
Link 2
You can also delete fix.exe and the logs from your desktop.
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
Register to Remove
#86
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 06:56 PM
I do not get a finish message when running those 2 codes..
Running from: C:\Users\Viper1\Desktop\Win32kDiag.exe
Log file at : C:\Users\Viper1\Desktop\Win32kDiag.txt
WARNING: Could not get backup privileges!
Searching 'C:\Windows'...
Cannot access: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Backup.etl
[1] 2009-10-31 16:49:25 0 C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Backup.etl ()
Finished!
#87
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 06:58 PM
That's OK, we were after the removal of the max++ mountpoint, which is now gone.
Reboot and try combofix.
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
#88
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 07:28 PM
Combofix is still a no go.....
#89
CatByte
-
- Classroom Admin
-
- 21,060 posts
Classroom Administrator
Posted 31 October 2009 - 07:33 PM
Did you delete the existing copy that you had on your desktop?
Did you disable your security programs totally?
Did you download a fresh copy?
Exactly what happens when you try and run it?
Microsoft MVP 2010, 2011, 2012, 2013, 2014, 2015
#90
Joecastle
-
- Authentic Member
-
- 215 posts
Authentic Member
Posted 31 October 2009 - 07:44 PM
Yes, I deleted and downloaded a fresh copy, disabled eset smart security, deleted combo fix in C drive and ran it... Same thing as before.. It runs and states attempting to make a restore point... I left it without moving mouse for this time period since last post and nothing... How long should it take to run?
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users
