Absence of symptoms does not indicate the absence of infection. I can definitely see a malware entry in your log, and while rebooting during Combofix is normal, seeing recovery from a "serious error" is definitely not. Something is definitely still going on here.
Download DeFogger
Please download DeFogger to your desktop.
Double click DeFogger to run the tool.
The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.
Download and Run GMER
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
In the right panel, you will see several boxes that may have been checked. Uncheck the following …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one - make sure it is UNCHECKED)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and paste it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please right-click and delete the copy of Combofix from your desktop and download a fresh one as per the following instructions:
Download and Install Combofix
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Only IF Combofix still does not complete properly, can you please locate the following file and copy/paste the contents in your next reply c:\qoobox\combofix-quarantined-files.txt
Hello again, Doris! I downloaded Defogger.exe, run it. PC was restarted, and this screen appears 📎daemon_tools.jpg
There wasn't appeared errors. But, when I run that gmer.exe, after 2-3 seconds PC restarted!! Last time it was working something, and then all possible colors on screen, I mean first time, when you recommended it to me to run. Now, just - RESTART. when came back, this
📎serious_error.jpg
I tried one more time, I disabled anti virus, but, again the same thing..
I don't know what unlikes gmer.exe in my PC. What next, commander? Do I run ComboFix? Or we must see what is happening with gmer.exe? Do you want from me to send you a log of defogger? But, I think it was ok…
Go ahead with Combofix again and see if it produces a report. Please do not do anything else on the computer while it is running, even mouse clicking anywhere on the screen could cause it to stall. It may reboot the computer as a part of what it does and that is normal.
Let me know the results.
Hi again! I run ComboFix, but the same thing happened… This time I have two screens of "…Serious error." First is from Defogger probably, and second is from ComboFix. That is very strange, because I turned off every service in system tray! I cannot find log of ComboFix in C:/. You mentioned to me c:\qoobox\combofix-quarantined-files.txt, but I cannot find it either. Folder qoobox exists, and few folders. There is folder Quarantine, and I found catcheme.log
——– 2011-11-24 - 13:09:06 ————-
file zipped: C:\WINDOWS\$NtUninstallKB967$\3818578562 -> _3818578562_.zip -> 3818578562 ( 0 bytes )
error: C:\WINDOWS\$NtUninstallKB967$\3818578562 is not a PE file
kill file error: C:\WINDOWS\$NtUninstallKB967$\3818578562, The file can not be accessed by the system.
——– 2011-11-24 - 13:18:13 ————-
——– 2011-11-27 - 14:22:39 ————-
——– 2011-11-27 - 14:48:04 ————-
——– 2011-11-27 - 22:00:36 ————-
——– 2011-12-02 - 09:20:11 ————-
——– 2011-12-02 - 09:24:15 ————-
driver loading error error: 6
Can this help?
I did as you told me, at next windows start there was only one "…serious error.", from Defogger, I think. ComboFix log is not there yet. I got only this
——– 2011-11-24 - 13:09:06 ————-
file zipped: C:\WINDOWS\$NtUninstallKB967$\3818578562 -> _3818578562_.zip -> 3818578562 ( 0 bytes )
error: C:\WINDOWS\$NtUninstallKB967$\3818578562 is not a PE file
kill file error: C:\WINDOWS\$NtUninstallKB967$\3818578562, The file can not be accessed by the system.
——– 2011-11-24 - 13:18:13 ————-
——– 2011-11-27 - 14:22:39 ————-
——– 2011-11-27 - 14:48:04 ————-
——– 2011-11-27 - 22:00:36 ————-
——– 2011-12-02 - 09:20:11 ————-
——– 2011-12-02 - 09:24:15 ————-
driver loading error error: 6
——– 2011-12-02 - 16:10:44 ————-
I can show you what is in my qoobox folder
📎qoobox1.jpg
If you wish, I can make more pics, that might be useful…
To re-enable your Emulation drivers, double click DeFogger to run the tool.
The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.
Your Emulation drivers are now re-enabled.
I'm still not thrilled that we can't get a Combofix log, but since you say the computer is behaving better than it was, let's try an online scan and see if it finds anything. It may look in different places than the tools we've used so far.
This scan make take awhile depending on how many items are on the computer. You may want to run it at a time you won't be needing the machine. It should be run from IE and I'd recommend not doing anything else while it's running.
Please go to here to run the online scannner from ESET.
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click on Advanced Settings and ensure these options are ticked:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Click Scan
Wait for the scan to finish
If any threats were found, click the 'List of found threats' , then click Export to text file….
Save it to your desktop, then please copy and paste that log as a reply to this topic.
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP457\A0136972.exe a variant of Win32/Keygen.AO application
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP519\A0150381.exe multiple threats
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP533\A0153412.sys a variant of Win32/Rootkit.Kryptik.FB trojan
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP533\A0153433.sys a variant of Win32/Rootkit.Kryptik.FB trojan
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP534\A0153511.sys a variant of Win32/Rootkit.Kryptik.FB trojan
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP534\A0153532.sys a variant of Win32/Rootkit.Kryptik.FB trojan
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP535\A0153562.sys a variant of Win32/Rootkit.Kryptik.FB trojan
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP536\A0153590.sys a variant of Win32/Rootkit.Kryptik.FB trojan
C:\System Volume Information\_restore{188D60D9-B3E7-4889-B66B-CA984CA72AD5}\RP536\A0153608.sys a variant of Win32/Rootkit.Kryptik.FB trojan C:\WINDOWS\system32\config\systemprofile\Application Data\q0enev4828\rplh.exe a variant of Win32/Kryptik.VJM trojan
I do not like the last one, I think that the other has already caught by my antivirus. I scanned it momentaly after ESET scan, antivirus didn't found it, but Malwarebytes did! I Quarantined it emediately! I think this is it! For now…
Patndoris is going to be away for a bit. My name is Jeff and I will continue with helping you with your malware problems if that is alright?
—————-
I see that you have already been given the instructions for downloading and running ComboFix? I would like for you to do it a bit differently and let's see if we can get that running.
Please delete your copy of ComboFix from your Desktop using right-click > Delete.
Please download a fresh copy of ComboFix from either of the following two links: Link 1 Link 2
I would like for you to rename the file to svchost.exe BEFORE saving it.
Then save it directly to your C:\ drive so it will look like this when downloaded > C:\svchost.exe
Attempt to run ComboFix and then post the log that is created into your next reply.
I downloaded Defogger.exe, run it. PC was restarted, and this screen appears 
Last time it was working something, and then all possible colors on screen, I mean first time, when you recommended it to me to run. Now, just - RESTART. 
when came back, this
I don't know what unlikes gmer.exe in my PC. 
What next, commander? Do I run ComboFix? Or we must see what is happening with gmer.exe? Do you want from me to send you a log of defogger? But, I think it was ok…
I Quarantined it emediately! I think this is it! 
For now… 
![[external image: Posted Image]](http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_screen2-1.gif){kind=link}
