maldini
ok that went smoothly. Let me know if it is clear enough for you to read. See attachment
Spyware / Malware / Virus Removal
"The specified device does not exist as an installed service"
53 min read
patndoris
Please boot into safe mode WITH NETWORKING again (if it bugs you about McAfee just ignore it:
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the quotebox below into it:
Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Refering to the picture above, drag CFScript into ComboFix.exe. ComboFix may request an update; please allow it.
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Then reboot the computer and see if it behaves normally or not now.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\Users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}\L
C:\Users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}\U
Folder::
C:\Users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}
ClearJavaCache::
Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Refering to the picture above, drag CFScript into ComboFix.exe. ComboFix may request an update; please allow it.
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Then reboot the computer and see if it behaves normally or not now.
maldini
After performing the combofix step and rebooting, the computer is still exhibiting the same symptoms.
Here is the latest log
========
ComboFix 12-11-19.02 - T61p 11/20/2012 15:23:05.2.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2531 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\T61p\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}\L"
"c:\users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}\U"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}
.
.
((((((((((((((((((((((((( Files Created from 2012-10-20 to 2012-11-20 )))))))))))))))))))))))))))))))
.
.
2012-11-20 20:28 . 2012-11-20 20:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-11-20 17:26 . 2012-11-20 17:26 ——– d—–w- C:\FRST
2012-11-20 00:32 . 2012-11-20 20:28 ——– d—–w- c:\users\T61p\AppData\Local\temp
2012-11-09 22:13 . 2012-11-09 22:15 ——– d—–w- c:\programdata\SOPAgent
2012-11-09 21:55 . 2012-11-09 21:55 ——– d—–w- c:\users\T61p\Applications
2012-11-09 21:54 . 2012-11-09 22:05 ——– d—–w- c:\users\T61p\AppData\Roaming\Avex
2012-11-09 21:54 . 2012-11-09 21:54 ——– d—–w- c:\users\T61p\AppData\Roaming\Ugovyh
2012-11-09 21:45 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2EA3C82-6638-4962-BF63-C9B2B9C8B509}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 23:20 . 2012-04-28 23:46 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 23:20 . 2012-04-28 23:46 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 18:28 . 2012-10-10 19:30 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-07 21:04 . 2011-08-28 22:37 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 17:18 . 2012-10-10 19:29 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 19:28 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 19:28 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 16:57 . 2012-10-10 19:30 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-08-24 06:59 . 2012-09-22 07:00 1800704 —-a-w- c:\windows\system32\jscript9.dll
2012-08-24 06:51 . 2012-09-22 07:00 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-08-24 06:51 . 2012-09-22 07:00 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 07:00 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 07:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-08-24 06:43 . 2012-09-22 07:00 2382848 —-a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (cleanup)"="c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll" [2012-09-07 1089608]
.
c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKLM\~\startupfolder\C:^Users^T61p^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
KEY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
VSTARTUP [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
E [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-27 03:10 1657376 —-a-w- c:\windows\System32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOPAgent]
2012-11-11 21:48 8 —-a-w- c:\programdata\SOPAgent\sopag_oxgmvte.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-06-23 15:01 1830128 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.1
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(1344)
c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2012-11-20 15:30:27
ComboFix-quarantined-files.txt 2012-11-20 20:30
ComboFix2.txt 2012-11-20 00:32
.
Pre-Run: 182,314,663,936 bytes free
Post-Run: 182,195,048,448 bytes free
.
- - End Of File - - 24B97884E7C8D79879655D66215705DF
Here is the latest log
========
ComboFix 12-11-19.02 - T61p 11/20/2012 15:23:05.2.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2531 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\T61p\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}\L"
"c:\users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}\U"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\T61p\AppData\Local\{d6d6eb2d-74e4-8bfe-b2da-58eacbda3349}
.
.
((((((((((((((((((((((((( Files Created from 2012-10-20 to 2012-11-20 )))))))))))))))))))))))))))))))
.
.
2012-11-20 20:28 . 2012-11-20 20:28 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-11-20 17:26 . 2012-11-20 17:26 ——– d—–w- C:\FRST
2012-11-20 00:32 . 2012-11-20 20:28 ——– d—–w- c:\users\T61p\AppData\Local\temp
2012-11-09 22:13 . 2012-11-09 22:15 ——– d—–w- c:\programdata\SOPAgent
2012-11-09 21:55 . 2012-11-09 21:55 ——– d—–w- c:\users\T61p\Applications
2012-11-09 21:54 . 2012-11-09 22:05 ——– d—–w- c:\users\T61p\AppData\Roaming\Avex
2012-11-09 21:54 . 2012-11-09 21:54 ——– d—–w- c:\users\T61p\AppData\Roaming\Ugovyh
2012-11-09 21:45 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2EA3C82-6638-4962-BF63-C9B2B9C8B509}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 23:20 . 2012-04-28 23:46 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 23:20 . 2012-04-28 23:46 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 18:28 . 2012-10-10 19:30 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-07 21:04 . 2011-08-28 22:37 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 17:18 . 2012-10-10 19:29 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 19:28 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 19:28 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 16:57 . 2012-10-10 19:30 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-08-24 06:59 . 2012-09-22 07:00 1800704 —-a-w- c:\windows\system32\jscript9.dll
2012-08-24 06:51 . 2012-09-22 07:00 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-08-24 06:51 . 2012-09-22 07:00 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 07:00 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 07:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-08-24 06:43 . 2012-09-22 07:00 2382848 —-a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (cleanup)"="c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll" [2012-09-07 1089608]
.
c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKLM\~\startupfolder\C:^Users^T61p^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
KEY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
VSTARTUP [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
E [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-27 03:10 1657376 —-a-w- c:\windows\System32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOPAgent]
2012-11-11 21:48 8 —-a-w- c:\programdata\SOPAgent\sopag_oxgmvte.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-06-23 15:01 1830128 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.1
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(1344)
c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2012-11-20 15:30:27
ComboFix-quarantined-files.txt 2012-11-20 20:30
ComboFix2.txt 2012-11-20 00:32
.
Pre-Run: 182,314,663,936 bytes free
Post-Run: 182,195,048,448 bytes free
.
- - End Of File - - 24B97884E7C8D79879655D66215705DF
patndoris
This is very odd, we just removed what I could see of remnants of the Zero Access infection but you are still having the problems. I don't expect to find anything with this step but then again, this is proving to be a bit of a challenging one. Let's go ahead and do this step anyway and see if it shows me something I'm not expecting.
Reboot and press the F10 to bring up 'Edit Boot Options' screen. If you presses it too early he might get the bios screen instead.
If it says /minint or int/min after /NOEXECUTE=OPTIN,
hit the Backspace key until that entry reads:
/NOEXECUTE=OPTIN
Click to load external image (Posted Image)
When windows to loads:
click start
type cmd into the search box
right click on cmd that appears at the top and click Run as adminstrator
type bcdedit /enum all >%userprofile%\desktop\log.log
(there is a space after bcdedit and one after all)
hit enter
When it's finished a notepad named log.log will be on the desktop.
Post the log, but please try NOT to shut the computer down again. If you do, we will likely need to edit the boot options again.
Reboot and press the F10 to bring up 'Edit Boot Options' screen. If you presses it too early he might get the bios screen instead.
If it says /minint or int/min after /NOEXECUTE=OPTIN,
hit the Backspace key until that entry reads:
/NOEXECUTE=OPTIN
Click to load external image (Posted Image)
When windows to loads:
click start
type cmd into the search box
right click on cmd that appears at the top and click Run as adminstrator
type bcdedit /enum all >%userprofile%\desktop\log.log
(there is a space after bcdedit and one after all)
hit enter
When it's finished a notepad named log.log will be on the desktop.
Post the log, but please try NOT to shut the computer down again. If you do, we will likely need to edit the boot options again.
maldini
I have tried almost 20 times now and I can not bring up this menu.
Should I be pressing F10 before or after I see the memory diagnostic test during reboot?
I will keep trying.
I noticed that just after the memory test, I can stop the machine with a control-s which brings me into a setup menu in case that is of any help.
Note this is a Thinkpad/lenovo laptop.
patndoris
What options show on the setup menu?
maldini
Network Boot Protocol
Boot Order
Show Setup Prompt
Setup Menu Wait Time
However, none of the variables have any choices other than the default except for the last option (wait time).
maldini
I have tried f10 before, during and after the memory diag test and this menu will not pop for me.
F8 works, F12 works and control-s works but F10 does nothing.
patndoris
OK - that clarifies the setup menu. That's not what we want. I'm a little perplexed as to why a memory diagnostic is running that doesn't normally happen unless there is a hardware problem.
Let's take a step back. Make sure you are rebooting into normal mode and there is no CD in the drive when you are doing this. We want to be loading Windows as "normally" as we can, you want to hit the F10 at the same time as if you were booting into safe mode. So basically, when you hear the system start to boot, but before Windows starts to load.
If F10 isn't working does the F8 or F12 offer you the Edit Boot Options menu? What type of computer is this (Brand and model?)
maldini
Model is Thinkpad Lenovo T61P
I am booting into normal mode and there is no cd in drive.
The memory diags are running because they are enabled in the Bios Setup Utility (F12). I can disabled them if you want.
I am pressing F10 at the same time as F12 and nothing happens.
The F12 menu is big but I can not find the Edit Boot Options menu.
f12 contains the following high level menus
config
date/time
Security
startup
Restart
Hdd diagnostic program
Inside of startup there is
boot
Network
Inside of boot is just the boot priority order we had to change earlier
maldini
Ok I got to it via F1 of all things.
I did not have to remove anything after optin in the command line.
I am booting now and will run the cmd prompt next.
maldini
>right click on cmd that appears at the top and click Run as adminstrator
Still the same problem here. When I do this I get the "The specified service does not exist as an installed service"
Should I retry these steps in safe mode since we know the bios option does not need to be edited?
patndoris
Fantastic! I was just going to tell you to skip it and we'd move on. But I'm glad you got it. I'll feel better if it comes back with nothing, If it shows something then we will definitely need to clean it out before moving on.
patndoris
OK let's just skip that step. I doubt it would show me anything anyway. Let's reset the USB ports and see what happens.
Since your repair disc is from a 64 bit Windows 7 system it isn't going to work on the 32 bit system.
Let's manually reset the USB ports and see how things are after that.
Reinstall USB controllers
—————————–
Use the Mouse
================
First, please disconnect all USB devices and then perform the following steps:
1. Click "Start" button, type "devmgmt.msc" (without quotation marks) in the "Search" bar and press "Enter". Click "Continue" if necessary.
2. In Device Manager, double click to expand "Universal Serial Bus controllers", right click on the Host Controller, click "Uninstall" and click "OK".
3. Repeat the step 2 to uninstall all items under "Universal Serial Bus controllers".
Then, restart your computer and Windows 7 will reinstall all USB controllers automatically.
Use the Keyboard
================
First, please disconnect all USB devices. Then, go through the following steps:
1. Press "Ctrl + Esc" to open the "Start" menu.
2. Type "devmgmt.msc" in the Search bar and press "Enter". Click "Continue" if necessary.
3. In Device Manger, press Tab and use "Up" and "Down" to move the highlight to "Universal Serial Bus Controllers".
4. Press "Right" and expand it.
5. Press "Down" to move to the first item and press "Delete" to remove it.
6. Repeat the step 5 and uninstall all items under "Universal Serial Bus Controllers".
Then, restart your computer and Windows 7 will reinstall all controllers automatically.
What's the result?
maldini
I can not bring up devmgmt.msc for the same symptom (….does not exist as an installed service)
Note that I am in normal boot mode right now.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI