patndoris
You can try it in safe mode but it may not work. Only critical services start in safe mode. I'm not sure if this service will start in safe mode or not. It's worth trying.
Spyware / Malware / Virus Removal
"The specified device does not exist as an installed service"
53 min read
patndoris
I don't suppose you have an original Windows 7 disc that came with your niece's computer do you? A 32-bit version?
maldini
I do not have the disc but I can ask my brother if he has one or I can ask him to create the 32 bit repair disc for me if you feel we need it at this point.
I am going to try the devmgmt in safe mode now
patndoris
I need to get an opinion on something from my colleagues before we go any further. I will be back with you shortly. Please sit tight.
maldini
As expected device manager has nothing to control in safe mode.
I will await your next instructions. I will be leaving for a couple of hours in 10 minutes so I will work on the next task when I get back.
Thank you again for all of your help and I am sorry this is such a difficult one.
patndoris
Don't apologize! It's fine - that's what we are here for. I have an idea of what needs to happen next I just want to be sure. If I'm right (crossing fingers) it's an easy step. But some fixes can do more harm than good and in this case I just want to double check before doing it. (Better safe than sorry!)
You are doing great. I know this has to be frustrating for you. Many of the steps so far have been to ensure that I have a clear understanding of what we are or aren't dealing with. I appreciate your patience and diligence in carrying out the steps.
maldini
No frustration on my part at all. I am happy to continue this as long as needed.
I have been through similar tough issues on some other computers that this wonderful site has helped with so I know how many steps can be needed.
Thanks again 
patndoris
Edit: Hang tight….will be back to you shortly.
patndoris
As before you'll need to do this from safe mode with NETWORKING for now.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the quotebox below into it:
Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Refering to the picture above, drag CFScript into ComboFix.exe. ComboFix may request an update; please allow it.
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.
Then try booting normally and let me know if there is any change please.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the quotebox below into it:
Folder::
c:\users\t61p\appdata\roaming\Ugovyh
c:\users\t61p\appdata\roaming\Avex
Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe
[external image: Posted Image]
Refering to the picture above, drag CFScript into ComboFix.exe. ComboFix may request an update; please allow it.
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.
- Click on the tab labeled Update and then click on the button Check for updates.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image] - When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected .
- When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
- Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Then try booting normally and let me know if there is any change please.
maldini
>As before you'll need to do this from safe mode with NETWORKING for now.
just so you know, even though I am booting into safe mode with networking, the machine will not connect to the wireless port in this mode
>I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.
>Click on the tab labeled Update and then click on the button Check for updates.
Malwarebytes does appear to be on the machine but there is no icon on the desk top. Is it ok to run it from the start menu?
Also, since the machine is not connected to the internet, I won't be able to update the program as requested.
Here is the combofix log and I will await your instructions before proceeding with Malwarebytes
============================================================
ComboFix 12-11-19.02 - T61p 11/21/2012 9:38.3.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2528 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\T61p\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\t61p\appdata\roaming\Avex
c:\users\t61p\appdata\roaming\Ugovyh
c:\users\t61p\appdata\roaming\Ugovyh\idpa.wii
.
.
((((((((((((((((((((((((( Files Created from 2012-10-21 to 2012-11-21 )))))))))))))))))))))))))))))))
.
.
2012-11-21 14:43 . 2012-11-21 14:43 ——– d—–w- c:\users\T61p\AppData\Local\temp
2012-11-21 14:43 . 2012-11-21 14:43 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-11-20 17:26 . 2012-11-20 17:26 ——– d—–w- C:\FRST
2012-11-09 22:13 . 2012-11-09 22:15 ——– d—–w- c:\programdata\SOPAgent
2012-11-09 21:55 . 2012-11-09 21:55 ——– d—–w- c:\users\T61p\Applications
2012-11-09 21:45 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2EA3C82-6638-4962-BF63-C9B2B9C8B509}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 23:20 . 2012-04-28 23:46 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 23:20 . 2012-04-28 23:46 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 18:28 . 2012-10-10 19:30 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-07 21:04 . 2011-08-28 22:37 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 17:18 . 2012-10-10 19:29 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 19:28 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 19:28 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 16:57 . 2012-10-10 19:30 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-08-24 06:59 . 2012-09-22 07:00 1800704 —-a-w- c:\windows\system32\jscript9.dll
2012-08-24 06:51 . 2012-09-22 07:00 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-08-24 06:51 . 2012-09-22 07:00 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 07:00 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 07:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-08-24 06:43 . 2012-09-22 07:00 2382848 —-a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (cleanup)"="c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll" [2012-09-07 1089608]
.
c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKLM\~\startupfolder\C:^Users^T61p^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
KEY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
VSTARTUP [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
E [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-27 03:10 1657376 —-a-w- c:\windows\System32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOPAgent]
2012-11-11 21:48 8 —-a-w- c:\programdata\SOPAgent\sopag_oxgmvte.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-06-23 15:01 1830128 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.1
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-11-21 09:45:33
ComboFix-quarantined-files.txt 2012-11-21 14:45
ComboFix2.txt 2012-11-20 20:30
ComboFix3.txt 2012-11-20 00:32
.
Pre-Run: 182,312,009,728 bytes free
Post-Run: 182,186,795,008 bytes free
.
- - End Of File - - AA9C2A780A6C8EAFD188240BBA202C23
just so you know, even though I am booting into safe mode with networking, the machine will not connect to the wireless port in this mode
>I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.
>Click on the tab labeled Update and then click on the button Check for updates.
Malwarebytes does appear to be on the machine but there is no icon on the desk top. Is it ok to run it from the start menu?
Also, since the machine is not connected to the internet, I won't be able to update the program as requested.
Here is the combofix log and I will await your instructions before proceeding with Malwarebytes
============================================================
ComboFix 12-11-19.02 - T61p 11/21/2012 9:38.3.2 - x86 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3054.2528 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\T61p\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\t61p\appdata\roaming\Avex
c:\users\t61p\appdata\roaming\Ugovyh
c:\users\t61p\appdata\roaming\Ugovyh\idpa.wii
.
.
((((((((((((((((((((((((( Files Created from 2012-10-21 to 2012-11-21 )))))))))))))))))))))))))))))))
.
.
2012-11-21 14:43 . 2012-11-21 14:43 ——– d—–w- c:\users\T61p\AppData\Local\temp
2012-11-21 14:43 . 2012-11-21 14:43 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-11-20 17:26 . 2012-11-20 17:26 ——– d—–w- C:\FRST
2012-11-09 22:13 . 2012-11-09 22:15 ——– d—–w- c:\programdata\SOPAgent
2012-11-09 21:55 . 2012-11-09 21:55 ——– d—–w- c:\users\T61p\Applications
2012-11-09 21:45 . 2012-10-12 05:56 6918632 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2EA3C82-6638-4962-BF63-C9B2B9C8B509}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 23:20 . 2012-04-28 23:46 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-08 23:20 . 2012-04-28 23:46 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-14 18:28 . 2012-10-10 19:30 2048 —-a-w- c:\windows\system32\tzres.dll
2012-09-07 21:04 . 2011-08-28 22:37 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 17:18 . 2012-10-10 19:29 1211760 —-a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 19:28 3968880 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 19:28 3914096 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-08-24 16:57 . 2012-10-10 19:30 172544 —-a-w- c:\windows\system32\wintrust.dll
2012-08-24 06:59 . 2012-09-22 07:00 1800704 —-a-w- c:\windows\system32\jscript9.dll
2012-08-24 06:51 . 2012-09-22 07:00 1129472 —-a-w- c:\windows\system32\wininet.dll
2012-08-24 06:51 . 2012-09-22 07:00 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 07:00 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 07:00 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-08-24 06:43 . 2012-09-22 07:00 2382848 —-a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-15 00:32 94208 —-a-w- c:\users\T61p\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (cleanup)"="c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll" [2012-09-07 1089608]
.
c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\T61p\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKLM\~\startupfolder\C:^Users^T61p^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\T61p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
KEY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
VSTARTUP [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
E [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2009-08-27 03:10 1657376 —-a-w- c:\windows\System32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SOPAgent]
2012-11-11 21:48 8 —-a-w- c:\programdata\SOPAgent\sopag_oxgmvte.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-06-23 15:01 1830128 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-28 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.1
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-11-21 09:45:33
ComboFix-quarantined-files.txt 2012-11-21 14:45
ComboFix2.txt 2012-11-20 20:30
ComboFix3.txt 2012-11-20 00:32
.
Pre-Run: 182,312,009,728 bytes free
Post-Run: 182,186,795,008 bytes free
.
- - End Of File - - AA9C2A780A6C8EAFD188240BBA202C23
patndoris
OK, I misunderstood that we still weren't getting internet with safe mode with Networking. I thought you were. So the only difference in safe mode is really that the tools will run, we still have no USB and no internet. You just aren't getting the device error when you try to do things - is that correct?
And yes, please go ahead and run Malwarebytes even if it isn't updated. It should tell you how outdated it is. Can you please let me know how far out of date it is when you post the log and we'll decide if we need to transfer a more recent download as well.
One other thing I'd like you to try if you can is to uninstall McAfee. If you can get to the Control Panel in Safe mode, please go ahead and attempt to remove it completely. It may be causing some conflicts. We can reinstall it later, or I can recommend another free alternative, but I'd like to take it out of the equation for the moment. Please remove SuperAntiSpyware as well if you can. If you run into issues removing them please let me know.
maldini
OK, I misunderstood that we still weren't getting internet with safe mode with Networking. I thought you were. So the only difference in safe mode is really that the tools will run, we still have no USB and no internet. You just aren't getting the device error when you try to do things - is that correct?
that is correct.
I will remove the programs you requested if I can and run malwarebytes right now. I will post shortly.
maldini
I was not able to remove either McAfee or SUPERAntiSpyware.
The error I get is as follows in safe mode
The Windows Installer Service could not be accessed.
This can occur if the Windows Installer is not correctly installed.
===============================
Malware Bytes is more than 60 days out of date.
I ran it and it found no issues. Here is the log file
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org
Database version: v2012.09.22.02
Windows 7 Service Pack 1 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
T61p :: T61P-PC [administrator]
11/21/2012 11:59:45 AM
mbam-log-2012-11-21 (11-59-45).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 182685
Time elapsed: 3 minute(s), 41 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
maldini
I went back into normal mode to try and remove the programs and got the following error which was different from safe mode
"The System Administrator has set policies to prevent this installation"
I believe the normal way to fix this issue would be to to go into the 'Local Security Policy" but of course when I try and open that in normal mode I get the "device does not exist" error.
patndoris
I'd like to see if we can run this tool to "try" and easily reset some items that may have been modified by malware. (Yes, I know - so far not much has been easy). Let's move it over via CD. And give it a whirl. Try in normal mode please - I'm not sure it will run in safe mode.
You can skip step 1. (We've already done what we can for infections at this point I do believe). Until we get some other issues addressed we are at a bit of a standstill in that respect)
Please DO STEPS 2, 3 and 4.
When you get to the actual repairs, in addition to those shown, I'd like you to also check "register system files" and "repair hosts"
Please let me know if there are any changes after running this tool.
You can skip step 1. (We've already done what we can for infections at this point I do believe). Until we get some other issues addressed we are at a bit of a standstill in that respect)
Please DO STEPS 2, 3 and 4.
When you get to the actual repairs, in addition to those shown, I'd like you to also check "register system files" and "repair hosts"
Please let me know if there are any changes after running this tool.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI