IRP Hook Rootkit help [Solved]

Hi!

Good job!

Ok go ahead and get your Windows disk out in case you need to use it.

• Click on Start> Run > type CMD and press Enter.
• In the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.
• Accept any prompts that are shown.

The scan may take some time, so be patient. Windows will repair any corrupted or missing files that it finds. If information from the installation CD is needed to repair the problem, you may be prompted to insert your Windows CD.

Once that completes, please run a new scan with ComboFix and post the new log.

As sson as I started the sfc /scannow, it asked for the Windows XP disk! It had a pop-up box with something along the lines of "Files required for Windows to operate correctly have been replaced by unrecognisable files. Please insert Windows XP Installation disk". Once the disk was inserted it then finished the scan, and took me back to the black prompt screen. I exited and ran ComboFix. Report is attached.

I have just tried to get a new programme to convert ebook formats for my Kindle and downloaded Calibre. When I tried to open it, the Windows Installer window came up but then disappeared and a new box opened saying "The windows installer service could not be accessed. This can occur if you are running Windows in safe mode(which I'm not) or if the WIndows Installer is not correctly installed. Contact your suport personnel for assistance". I don't know if this is related to anything we have been doing. I have never had this happen before.

It also seems that Internet explorer was not working at all. Wouldn't load up, said it couldn't find the server. I went to the Microsoft website and downloaded Internet explorer 8. I usually use Firefox anyway but Windows Update wouldn't work without IE. Automatic updates are still set to run, but I thought that some of the files that came off the XP installation disk might need updating and tried to check for updates. I guess I should wait for you really! Update: I was able to run Windows Update and there were 81 updates! I installed them, hope I did the right thing.

Yes you did the right thing. How is your system running?

That's a relief! It seems fine but then I didn't notice anything wrong before yesterday really. Still can't run Calibre from my Downloads using Windows Installer. Same mesage as yesterday. Maybe seems a little less responsive than before. How is it looking to you from the report?

It's definitely looking better. The problem that I am seeing is that your system is not updating itself correctly or possibly corrupted files that are not being replaced. I am speaking with colleagues about your system and will return as soon as I can.

I will try to wait patiently and not fiddle with anything I shouldn't

Please visit the page found here and then use the Fix It button halfway down the page.

Once complete with it, please run a new scan with ComboFix and post the new log.

I can't run this fix because it needs the Windows Installer. I still get this message: "The Windows Installer Service could not be accessed. This can occur if you are running Windows in Safe mode, or if the Windows Installer is not correctly installed. Contact your support personnel for assistance." Also, when I open the Downloads page, it briefly shows the icons, then goes blank. I have to go out and reneter the page, sometimes several times to see the items in the Downloads folder. I have downloaded the fixit file but can't do anything with it. Any suggestions? UPDATE: I have just unregistered and reregistered the Windows Installer using instructions from the Microsoft website and it seems to have worked! I am able to run the Fix it and it says it has been processed. I will now run Combo Fix

Here's the latest report after running the FixIt program

Fantastic! That fixed up what I was seeing in ComboFix….how is your system running?

It seems okay, but like I said, I didn't really notice a problem before except when I had AVG on there and I had that box keep popping up. I've been able to run programs with Windows Installer now it's fixed. What else should I be looking for? You were also going to recommend some free antivirus for me. I am currently using Microsoft Security Essentials after removing AVG free. I am wondering about the effectiveness of MSE after what has happened. Are you able to enlighten me as to what the problem was and how I can avoid it in future?

I am currently using Microsoft Security Essentials after removing AVG free.

Good choice.
———

what the problem was and how I can avoid it in future?

An infection had gotten onto your system at some point and seems to have broken and corrupted some files that were not allowing the proper update of Windows. Looks like that is fixed up now.
——–

[external image: Posted Image]Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.
————-

[external image: Posted Image] Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
———-

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.

———-

Do you mean in 'Add or Remove Programs' in the Control Panel? And am I supposed to remove Java completely? I got myself in to trouble for removing Java once before and it's made me a bit wary about touching it now! Just double checking that I should remove all Java items? I have Java 7 Update 7 and Jave 6 update 35 on there. That is all.