What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected laptop? [Solved]

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
I have now run the windows repair, first in scan mode, had to reboot to safe mode. Then i performed the remainder of the steps you outlined. The pc attempted to reboot, but locked up after displaying the desktop without any items that's usually present on the laptop. Had to reboot to safe mode again to be able to access the computer.
Post #18
reboot into normal mode again until it reaches that blank desktop press ctrl + alt + Del to open task manager click on File > New Task (Run) > type explorer.exe > OK let me know if your desktop loads
Post #19
I have now attempted several reboots in normal mode, but did not reach the desktop at all… Immediately after entering my password and pressing enter the computer locks up again. I am now back in the safe mode.
Post #20
your machine may have the Recovery environment preinstalled

Boot into the recovery environment:

  • Restart the computer > tap F8 repeatedly to boot into the Advanced Boot Options screen
  • Select Repair your computer and press Enter
  • Select your keyboard language preferences and click on Next
  • Select your user name and type in the password, and then click on OK (if there is no password set, just hit enter)
  • On the System Recovery Options menu you will get the following options:
  • Startup Repair
  • System Restore
  • System Image Recovery
  • Windows Memory Diagnostic
  • Command Prompt


If it is not pre-installed, then you will need to make a repair disk


When prompted, press a key to boot from the DVD. In the "Install Windows" screen, click Repair your computer
[external image: Posted Image]

Select your Windows installation, and click Next

Make a note of the drive-letter of your Windows 7 installation, as seen from Windows RE. This is the drive-letter you want to reference when running Sfc.exe (ie: if your OS is C:\ in normal mode it will likely be D:\ in the recovery environment)

NEXT
  • Click on the Command Prompt
  • To scan the integrity of all system files and repair them, run this command:

    sfc /scannow /offbootdir=d:\ /offwindir=d:\windows
where d: is the drive letter of your OS as seen in the RE - if it is another letter make the appropriate change)


This process takes some time

let me know how that goes and if you are now able to boot normally
Post #21
Hello again. I have now executed sfc from command promt in the recovery environment according to the previous post. The program ended by saying something like: "Windows resource protection could not find any integrity violations" (please note this is translated from Norwegian by me and is therefore not necessarily 100% correctly translated). Upon attempting a normal boot, I get to enter my code, press enter and then the computer locks up like before (on the welcome screen). Again I am using safe mode featuring network connections to write this.
Post #22 last edited
ok boot back into the Recovery Environment this time choose "Startup Repair" allow the machine to make the repairs and see if you can now boot normally (this is not a reformat - your programs and documents will be in tact)
Post #23
The startup repair has been run and afterwards the pc attempted to reboot into normal mode but as usual the computer hung up again after entering my password and pressing enter.
Post #25
have now run the FRST again. This is the log: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-01-2013 (ATTENTION: FRST version is 6 days old) Ran by [removed] at 21-01-2013 21:20:22 Running from G:\ Windows 7 Home Premium (X64) OS Language: Norwegian Bokmal The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\…\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [9913376 2009-12-29] (Realtek Semiconductor) HKLM\…\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-04-16] (Egis Technology Inc.) HKLM\…\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [17412200 2010-04-07] (NVIDIA Corporation) HKLM\…\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated) HKLM\…\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860704 2010-03-17] (Acer Incorporated) HKLM\…\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe /a [1984832 2011-06-21] (FSPro Labs) HKLM-x32\…\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation) HKLM-x32\…\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-04-16] (Egis Technology Inc.) HKLM-x32\…\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d [201584 2010-03-10] (Egis Technology Inc.) HKLM-x32\…\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-10] (Egis Technology Inc.) HKLM-x32\…\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED [588648 2009-07-24] (Symantec Corporation) HKLM-x32\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2010-09-23] (Adobe Systems Incorporated) HKLM-x32\…\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [260608 2010-03-08] (NewTech Infosystems, Inc.) HKLM-x32\…\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [908368 2010-04-07] (Dritek System Inc.) HKLM-x32\…\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\…\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-09-21] (Adobe Systems Incorporated) HKLM-x32\…\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\…\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-09] (Hewlett-Packard) HKLM-x32\…\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun [688128 2011-07-06] () HKLM-x32\…\Run: [CLX3180_Scan2Pc] C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe [1990144 2011-04-28] () HKLM-x32\…\Run: [3180 Scan2PC] "C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe" [1990144 2011-04-28] () HKLM-x32\…\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-02] (Sun Microsystems, Inc.) HKU\Bromm\…\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-04-21] (Google Inc.) HKU\Bromm\…\RunOnce: [Report] C:\AdwCleaner[S1].txt [647 2013-01-19] () HKU\Bromm\…\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe -update activex [247968 2011-10-31] (Adobe Systems, Inc.) HKU\Bromm\…\Policies\system: [LogonHoursAction] 2 HKU\Bromm\…\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\Default\…\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] () HKU\Default User\…\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-01-14] () Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ==================== Services (Whitelisted) =================== 2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [398184 2012-12-14] (Malwarebytes Corporation) 2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [682344 2012-12-14] (Malwarebytes Corporation) 3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-04-16] (Egis Technology Inc.) 2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\diMaster.dll" /prefetch:1 [135032 2010-04-29] (Symantec Corporation) 3 OpenVPNService; "C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe" [36352 2011-07-13] () 2 SesamService; "C:\Program Files (x86)\Telenor\mobilt bredband\Sesam\BIN\SecMIPService.exe" [1237800 2009-02-17] (Swisscom) ==================== Drivers (Whitelisted) ===================== 1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130111.001\BHDrvx64.sys [1384608 2012-10-23] (Symantec Corporation) 1 ccHP; C:\Windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [593544 2011-08-03] (Symantec Corporation) 2 DgiVecp; C:\Windows\System32\Drivers\DgiVecp.sys [53816 2009-07-13] (Samsung Electronics Co., Ltd.) 1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation) 3 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [138752 2010-08-27] (Huawei Technologies Co., Ltd.) 0 FSProFilter; C:\Windows\System32\Drivers\FSPFltd.sys [54848 2010-07-22] (FSPro Labs) 1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130117.001\IDSvia64.sys [513184 2012-08-31] (Symantec Corporation) 3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) 3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130118.007\ENG64.SYS [126192 2013-01-18] (Symantec Corporation) 3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130118.007\EX64.SYS [2087664 2013-01-18] (Symantec Corporation) 0 SMR311; C:\Windows\System32\Drivers\SMR311.sys [95392 2013-01-17] (Symantec Corporation) 1 SRTSP; C:\Windows\System32\Drivers\NISx64\1109000.00C\SRTSP64.SYS [505392 2010-04-21] (Symantec Corporation) 1 SRTSPX; C:\Windows\system32\drivers\NISx64\1109000.00C\SRTSPX64.SYS [32304 2010-04-21] (Symantec Corporation) 0 SymDS; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation) 0 SymEFA; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [221304 2011-08-21] (Symantec Corporation) 3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2010-10-16] (Symantec Corporation) 1 SymIRON; C:\Windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [150064 2010-04-28] (Symantec Corporation) 1 SYMTDIv; C:\Windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [451704 2011-08-21] (Symantec Corporation) 2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] () 3 wtsmpadap; C:\Windows\System32\Drivers\wtsmpadap.sys [56104 2009-01-30] (Swisscom) 3 WtSmpFlt; C:\Windows\System32\Drivers\WtSmpFlt.sys [383784 2009-01-30] (Swisscom) 3 catchme; \??\C:\ComboFix\catchme.sys [x] ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2013-01-20 09:42 - 2008-05-07 21:03 - 00303616 ____A ( ) C:\SetACL.exe 2013-01-20 09:41 - 2004-06-11 15:33 - 00290304 ____A (Microsoft Corporation) C:\subinacl.exe 2013-01-20 09:40 - 2013-01-20 09:40 - 00000207 ____A C:\Windows\tweaking.com-regbackup-BROMM-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat 2013-01-20 09:40 - 2013-01-20 09:40 - 00000000 ____D C:\RegBackup 2013-01-20 07:48 - 2013-01-20 07:48 - 00006576 ____N C:\bootsqm.dat 2013-01-20 07:34 - 2013-01-20 07:34 - 05419212 ____A C:\Users\Bromm\Desktop\tweaking.com_windows_repair_aio_setup.exe 2013-01-20 07:34 - 2013-01-20 07:34 - 00002291 ____A C:\Users\Public\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2013-01-20 07:34 - 2013-01-20 07:34 - 00000000 ____D C:\Program Files (x86)\Tweaking.com 2013-01-20 00:48 - 2013-01-20 00:48 - 00000173 ____A C:\Users\Bromm\Desktop\Esetscanresults.txt 2013-01-19 22:01 - 2013-01-19 22:01 - 00000000 ____D C:\FRST 2013-01-19 17:23 - 2013-01-19 17:23 - 00000000 ____D C:\Program Files (x86)\ESET 2013-01-19 16:58 - 2013-01-19 16:58 - 00574677 ____A C:\Users\Bromm\Desktop\AdwCleaner.exe 2013-01-19 16:58 - 2013-01-19 16:58 - 00000647 ____A C:\AdwCleaner[S1].txt 2013-01-19 16:53 - 2013-01-19 16:53 - 00000684 ____A C:\Users\Bromm\Desktop\JRT.txt 2013-01-19 16:50 - 2013-01-19 16:50 - 00499065 ____A (Oleg N. Scherbakov) C:\Users\Bromm\Desktop\JRT.exe 2013-01-19 16:50 - 2013-01-19 16:50 - 00000000 ____D C:\Windows\ERUNT 2013-01-19 16:50 - 2013-01-19 16:50 - 00000000 ____D C:\JRT 2013-01-19 15:52 - 2013-01-19 15:52 - 00020425 ____A C:\ComboFix.txt 2013-01-19 15:39 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe 2013-01-19 15:39 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe 2013-01-19 15:39 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-01-19 15:39 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-01-19 15:39 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-01-19 15:39 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe 2013-01-19 15:39 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe 2013-01-19 15:39 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe 2013-01-19 15:35 - 2013-01-19 15:52 - 00000000 ____D C:\Qoobox 2013-01-19 15:34 - 2013-01-19 15:51 - 00000000 ____D C:\Windows\erdnt 2013-01-19 15:19 - 2013-01-19 15:19 - 05023971 ____R (Swearware) C:\Users\Bromm\Desktop\ComboFix.exe 2013-01-19 09:38 - 2013-01-19 09:38 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Desktop\HiJackThis.exe 2013-01-19 09:04 - 2013-01-19 09:38 - 00014471 ____A C:\Users\Bromm\Desktop\hijackthis.log 2013-01-19 09:02 - 2013-01-19 09:02 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Downloads\HiJackThis.exe 2013-01-18 12:51 - 2013-01-18 12:51 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-01-18 12:51 - 2012-12-14 07:49 - 00024176 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2013-01-18 12:49 - 2013-01-18 12:50 - 10156344 ____A (Malwarebytes Corporation ) C:\Users\Bromm\Downloads\mbam-setup-1.70.0.1100.exe 2013-01-18 04:40 - 2013-01-18 12:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\Malwarebytes 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\All Users\Malwarebytes 2013-01-17 23:14 - 2013-01-17 23:14 - 00095392 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SMR311.SYS 2013-01-17 14:58 - 2013-01-17 23:33 - 00000000 ____D C:\Users\Bromm\AppData\Local\NPE 2013-01-17 14:49 - 2013-01-17 14:50 - 02957840 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\NPE.exe 2013-01-17 11:25 - 2013-01-17 11:25 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS (1).exe 2013-01-17 11:18 - 2013-01-17 11:18 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS.exe 2013-01-16 12:24 - 2013-01-11 18:30 - 00095648 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-01-16 12:24 - 2013-01-11 18:26 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-01-16 12:24 - 2013-01-11 18:24 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-01-16 12:23 - 2013-01-16 12:24 - 00004509 ____A C:\Windows\SysWOW64\jupdate-1.7.0_11-b21.log 2013-01-15 03:02 - 2013-01-17 11:35 - 00000000 ____D C:\Program Files (x86)\NirSoft 2013-01-15 03:01 - 2013-01-15 03:01 - 00260969 ____A C:\Users\Bromm\Downloads\wnetwatcher_setup.exe 2013-01-15 02:29 - 2013-01-15 02:29 - 20967680 ____A (Wireshark development team) C:\Users\Bromm\Downloads\Wireshark-win32-1.8.4.exe 2013-01-09 03:58 - 2012-11-22 19:45 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-01-09 03:58 - 2012-11-19 21:55 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2013-01-09 03:58 - 2012-11-19 21:10 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-01-09 03:58 - 2012-11-08 21:34 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll 2013-01-09 03:58 - 2012-11-08 20:49 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2013-01-09 03:58 - 2012-11-01 21:30 - 02001408 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2013-01-09 03:58 - 2012-11-01 21:30 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2013-01-09 03:58 - 2012-11-01 20:50 - 01388544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2013-01-09 03:58 - 2012-11-01 20:50 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2013-01-07 13:25 - 2013-01-03 21:31 - 00000000 ____D C:\Users\Bromm\Downloads\ppb 2013-01-06 14:35 - 2013-01-06 00:30 - 00000000 ___RD C:\Users\Bromm\Downloads\BG 2013-01-06 14:10 - 2012-10-07 21:27 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.9 2013-01-06 14:00 - 2012-09-30 20:34 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.8 2013-01-06 13:50 - 2012-09-23 18:47 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.7 2013-01-06 13:41 - 2012-09-16 10:14 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.6 2013-01-06 13:36 - 2012-09-09 20:48 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.5 2013-01-06 13:28 - 2012-09-06 04:04 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.4 2013-01-06 13:21 - 2012-09-06 04:04 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.3 2013-01-06 13:14 - 2012-09-06 04:04 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.2.2 2013-01-06 13:06 - 2012-09-06 04:03 - 00000000 ___RD C:\Users\Bromm\Downloads\HLW.1.2 2013-01-06 10:28 - 2013-01-20 12:58 - 00000000 ___RD C:\Users\Bromm\Downloads\PSS 2013-01-05 07:35 - 2013-01-05 07:58 - 00000000 ____D C:\Users\Bromm\Documents\B1 2013-01-05 07:31 - 2013-01-18 12:00 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-01-05 07:31 - 2013-01-05 08:15 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\FileZilla 2013-01-05 07:29 - 2013-01-05 07:30 - 04702459 ____A (FileZilla Project) C:\Users\Bromm\Downloads\FileZilla_3.6.0.2_win32-setup.exe 2013-01-05 06:21 - 2011-01-18 21:30 - 00000000 ___RD C:\Users\Bromm\Downloads\M.C 2013-01-05 06:13 - 2011-09-19 07:39 - 00000000 ___RD C:\Users\Bromm\Downloads\Tri 2013-01-05 05:25 - 2012-05-01 04:22 - 00000000 ___RD C:\Users\Bromm\Downloads\LegFa 2013-01-05 02:53 - 2012-05-27 02:07 - 00000000 ___RD C:\Users\Bromm\Downloads\EH 2013-01-05 02:23 - 2012-06-27 23:27 - 00000000 ___RD C:\Users\Bromm\Downloads\SITW 2013-01-05 02:01 - 2013-01-02 23:44 - 00000000 ___RD C:\Users\Bromm\Downloads\T2 2013-01-05 01:30 - 2011-11-05 11:13 - 00000000 ___RD C:\Users\Bromm\Downloads\C.B 2013-01-04 13:33 - 2013-01-04 13:34 - 00000000 ___RD C:\Users\Bromm\Downloads\T.con 2013-01-04 13:06 - 2011-06-12 20:25 - 00000000 ___RD C:\Users\Bromm\Downloads\A.L 2012-12-22 17:59 - 2012-12-16 08:52 - 00046080 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll 2012-12-22 17:59 - 2012-12-16 06:40 - 00367616 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll 2012-12-22 17:59 - 2012-12-16 06:25 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2012-12-22 17:59 - 2012-12-16 06:25 - 00034304 ____A (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll ==================== One Month Modified Files and Folders ======= 2013-01-21 18:44 - 2013-01-20 23:48 - 00000000 ____A C:\Recovery.txt 2013-01-21 10:10 - 2010-06-11 19:25 - 00456728 ____A C:\Windows\System32\perfh014.dat 2013-01-21 10:10 - 2010-06-11 19:25 - 00077234 ____A C:\Windows\System32\perfc014.dat 2013-01-21 10:10 - 2009-07-13 21:13 - 01248852 ____A C:\Windows\System32\PerfStringBackup.INI 2013-01-21 09:50 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-01-21 09:50 - 2009-07-13 20:51 - 00136574 ____A C:\Windows\setupact.log 2013-01-20 23:48 - 2010-08-15 13:43 - 00000000 ____D C:\Recovery 2013-01-20 14:58 - 2010-06-11 18:39 - 01371148 ____A C:\Windows\WindowsUpdate.log 2013-01-20 12:58 - 2013-01-06 10:28 - 00000000 ___RD C:\Users\Bromm\Downloads\PSS 2013-01-20 10:50 - 2010-08-15 14:51 - 00000988 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-01-20 09:40 - 2013-01-20 09:40 - 00000207 ____A C:\Windows\tweaking.com-regbackup-BROMM-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat 2013-01-20 09:40 - 2013-01-20 09:40 - 00000000 ____D C:\RegBackup 2013-01-20 07:48 - 2013-01-20 07:48 - 00006576 ____N C:\bootsqm.dat 2013-01-20 07:34 - 2013-01-20 07:34 - 05419212 ____A C:\Users\Bromm\Desktop\tweaking.com_windows_repair_aio_setup.exe 2013-01-20 07:34 - 2013-01-20 07:34 - 00002291 ____A C:\Users\Public\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2013-01-20 07:34 - 2013-01-20 07:34 - 00000000 ____D C:\Program Files (x86)\Tweaking.com 2013-01-20 00:48 - 2013-01-20 00:48 - 00000173 ____A C:\Users\Bromm\Desktop\Esetscanresults.txt 2013-01-19 22:01 - 2013-01-19 22:01 - 00000000 ____D C:\FRST 2013-01-19 17:23 - 2013-01-19 17:23 - 00000000 ____D C:\Program Files (x86)\ESET 2013-01-19 17:20 - 2012-03-27 10:29 - 00000000 ____D C:\Users\Bromm\Desktop\Guns 2013-01-19 16:58 - 2013-01-19 16:58 - 00574677 ____A C:\Users\Bromm\Desktop\AdwCleaner.exe 2013-01-19 16:58 - 2013-01-19 16:58 - 00000647 ____A C:\AdwCleaner[S1].txt 2013-01-19 16:53 - 2013-01-19 16:53 - 00000684 ____A C:\Users\Bromm\Desktop\JRT.txt 2013-01-19 16:50 - 2013-01-19 16:50 - 00499065 ____A (Oleg N. Scherbakov) C:\Users\Bromm\Desktop\JRT.exe 2013-01-19 16:50 - 2013-01-19 16:50 - 00000000 ____D C:\Windows\ERUNT 2013-01-19 16:50 - 2013-01-19 16:50 - 00000000 ____D C:\JRT 2013-01-19 15:59 - 2010-06-11 18:36 - 00084472 ____A C:\Windows\PFRO.log 2013-01-19 15:52 - 2013-01-19 15:52 - 00020425 ____A C:\ComboFix.txt 2013-01-19 15:52 - 2013-01-19 15:35 - 00000000 ____D C:\Qoobox 2013-01-19 15:51 - 2013-01-19 15:34 - 00000000 ____D C:\Windows\erdnt 2013-01-19 15:50 - 2009-07-13 18:34 - 00000215 ____A C:\Windows\system.ini 2013-01-19 15:50 - 2009-07-13 18:34 - 00000027 ____A C:\Windows\System32\Drivers\etc\hosts_bak_521 2013-01-19 15:19 - 2013-01-19 15:19 - 05023971 ____R (Swearware) C:\Users\Bromm\Desktop\ComboFix.exe 2013-01-19 12:01 - 2009-07-13 20:45 - 00009216 _____ C:\Windows\System32\umstartup.etl 2013-01-19 09:38 - 2013-01-19 09:38 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Desktop\HiJackThis.exe 2013-01-19 09:38 - 2013-01-19 09:04 - 00014471 ____A C:\Users\Bromm\Desktop\hijackthis.log 2013-01-19 09:02 - 2013-01-19 09:02 - 00388608 ____A (Trend Micro Inc.) C:\Users\Bromm\Downloads\HiJackThis.exe 2013-01-18 17:40 - 2010-08-15 14:51 - 00000992 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-01-18 12:51 - 2013-01-18 12:51 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-01-18 12:51 - 2013-01-18 04:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-01-18 12:50 - 2013-01-18 12:49 - 10156344 ____A (Malwarebytes Corporation ) C:\Users\Bromm\Downloads\mbam-setup-1.70.0.1100.exe 2013-01-18 12:11 - 2009-07-13 20:45 - 00009920 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-01-18 12:11 - 2009-07-13 20:45 - 00009920 ____A C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-01-18 12:03 - 2011-08-23 07:15 - 00000000 ____D C:\Users\Bromm\Tracing 2013-01-18 12:02 - 2010-08-15 13:45 - 00000000 ____D C:\users\Bromm 2013-01-18 12:00 - 2013-01-05 07:31 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client 2013-01-18 12:00 - 2012-03-31 09:24 - 00000000 ____D C:\Program Files (x86)\SamsungPrinterLiveUpdate 2013-01-18 12:00 - 2011-02-23 13:59 - 00000000 ____D C:\Program Files (x86)\Vuze 2013-01-18 12:00 - 2010-10-16 02:55 - 00000000 ____D C:\Users\All Users\Norton 2013-01-18 12:00 - 2010-04-21 02:59 - 00000000 ____D C:\Program Files (x86)\EgisTec IPS 2013-01-18 12:00 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-01-18 12:00 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration 2013-01-18 12:00 - 2009-02-14 09:48 - 00000000 ____D C:\Users\Bromm\Desktop\GBD-0.1.0.alpha8 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\Malwarebytes 2013-01-18 04:40 - 2013-01-18 04:40 - 00000000 ____D C:\Users\All Users\Malwarebytes 2013-01-18 02:04 - 2010-09-25 08:04 - 00000000 ____D C:\Users\Bromm\Desktop\kvitteringer 2013-01-17 23:33 - 2013-01-17 14:58 - 00000000 ____D C:\Users\Bromm\AppData\Local\NPE 2013-01-17 23:14 - 2013-01-17 23:14 - 00095392 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SMR311.SYS 2013-01-17 14:50 - 2013-01-17 14:49 - 02957840 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\NPE.exe 2013-01-17 11:35 - 2013-01-15 03:02 - 00000000 ____D C:\Program Files (x86)\NirSoft 2013-01-17 11:25 - 2013-01-17 11:25 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS (1).exe 2013-01-17 11:18 - 2013-01-17 11:18 - 01931088 ____A (Symantec Corporation) C:\Users\Bromm\Downloads\FixTDSS.exe 2013-01-17 07:08 - 2010-09-05 03:28 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\PrimoPDF 2013-01-17 06:12 - 2012-07-03 02:43 - 00000000 ____D C:\Users\Bromm\Desktop\Nitfrust 2013-01-17 03:09 - 2012-06-01 05:19 - 00000000 ____D C:\Users\Bromm\Desktop\Golf 2 Reparasjoner 2013-01-16 23:47 - 2012-03-07 15:17 - 00000000 ____D C:\Users\Bromm\Desktop\Energiteknologi 2013-01-16 12:24 - 2013-01-16 12:23 - 00004509 ____A C:\Windows\SysWOW64\jupdate-1.7.0_11-b21.log 2013-01-16 12:24 - 2012-09-06 14:46 - 00000000 ____D C:\Program Files (x86)\Java 2013-01-15 03:01 - 2013-01-15 03:01 - 00260969 ____A C:\Users\Bromm\Downloads\wnetwatcher_setup.exe 2013-01-15 02:29 - 2013-01-15 02:29 - 20967680 ____A (Wireshark development team) C:\Users\Bromm\Downloads\Wireshark-win32-1.8.4.exe 2013-01-14 06:41 - 2012-11-01 03:19 - 00000000 ____D C:\Users\Bromm\Desktop\Diverse papirer CV 2013-01-13 06:12 - 2010-08-23 07:13 - 00000000 ____D C:\Program Files (x86)\JDownloader 2013-01-12 15:20 - 2010-10-28 09:23 - 00000000 ____D C:\Users\Bromm\AppData\Local\CrashDumps 2013-01-11 18:30 - 2013-01-16 12:24 - 00095648 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-01-11 18:26 - 2013-01-16 12:24 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-01-11 18:24 - 2013-01-16 12:24 - 00174496 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-01-10 03:23 - 2009-07-13 20:45 - 00426184 ____A C:\Windows\System32\FNTCACHE.DAT 2013-01-09 17:05 - 2010-04-21 02:48 - 00000000 ____D C:\Users\All Users\Microsoft Help 2013-01-09 16:56 - 2010-09-03 00:53 - 67599240 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-01-09 09:07 - 2002-07-04 03:20 - 00000494 ____A C:\Windows\Hsc5.ini 2013-01-06 00:30 - 2013-01-06 14:35 - 00000000 ___RD C:\Users\Bromm\Downloads\BG 2013-01-05 08:15 - 2013-01-05 07:31 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\FileZilla 2013-01-05 07:58 - 2013-01-05 07:35 - 00000000 ____D C:\Users\Bromm\Documents\B1 2013-01-05 07:30 - 2013-01-05 07:29 - 04702459 ____A (FileZilla Project) C:\Users\Bromm\Downloads\FileZilla_3.6.0.2_win32-setup.exe 2013-01-04 13:34 - 2013-01-04 13:33 - 00000000 ___RD C:\Users\Bromm\Downloads\T.con 2013-01-03 21:31 - 2013-01-07 13:25 - 00000000 ____D C:\Users\Bromm\Downloads\ppb 2013-01-03 13:46 - 2011-10-22 15:12 - 00000632 _RASH C:\Users\Bromm\ntuser.pol 2013-01-03 04:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\spool 2013-01-03 03:39 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF 2013-01-02 23:44 - 2013-01-05 02:01 - 00000000 ___RD C:\Users\Bromm\Downloads\T2 2012-12-27 17:58 - 2010-08-27 13:15 - 00000000 ____D C:\Users\Bromm\AppData\Roaming\vlc ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2012-12-11 23:25] - [2012-09-06 09:38] - 0295792 ____A (Microsoft Corporation) 9E425AC5C9A5A973273D169F43B4F5E1 ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-01-16 12:23:15 Restore point made on: 2013-01-17 23:27:01 ==================== Memory info =========================== Percentage of memory in use: 17% Total physical RAM: 3958.71 MB Available physical RAM: 3249.8 MB Total Pagefile: 3956.86 MB Available Pagefile: 3237.83 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ==================== Partitions ============================= 1 Drive c: (Acer) (Fixed) (Total:451.66 GB) (Free:139.95 GB) NTFS 2 Drive e: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.94 GB) NTFS 4 Drive g: (KINGSTON) (Removable) (Total:14.78 GB) (Free:0.19 GB) FAT32 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 6 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Disknr. Status Str. Ledig Dyn GPT ——– ————- ——- ——- — — Disk 0 Tilkoblet 465 G byte 0 byte Disk 1 Tilkoblet 14 G byte 0 byte Partitions of Disk 0: =============== Partisjonsnr. Type Str. Forskyvning ————- —————- ——- ———– Partisjon 1 Gjenoppretting 14 G 31 K byte Partisjon 2 Prim‘r 101 M 14 G byte Partisjon 3 Prim‘r 451 G 14 G byte ================================================================================ == Disk: 0 Partisjon 1 Type : 27 Skjult: Ja Aktiv : Nei Forskyvning i byte: 32256 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 3 E PQSERVICE NTFS Partisjon 14 G OK Skjult ========================================================= Disk: 0 Partisjon 2 Type : 07 Skjult: Nei Aktiv : Ja Forskyvning i byte: 15035811840 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 1 Y SYSTEM RESE NTFS Partisjon 101 M OK ========================================================= Disk: 0 Partisjon 3 Type : 07 Skjult: Nei Aktiv : Nei Forskyvning i byte: 15142740480 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 2 C Acer NTFS Partisjon 451 G OK ========================================================= Partitions of Disk 1: =============== Partisjonsnr. Type Str. Forskyvning ————- —————- ——- ———– Partisjon 1 Prim‘r 14 G 4032 K byte ================================================================================ == Disk: 1 Partisjon 1 Type : 0C Skjult: Nei Aktiv : Nei Forskyvning i byte: 4128768 Volumnr. Bks Etikett Fs Type Str. Status Info ———- — ———– —– ———- ——- ——— ——– * Volum 4 G KINGSTON FAT32 Flyttbar 14 G OK ========================================================= Last Boot: 2013-01-05 16:38 ==================== End Of Log =============================
Post #26
There is nothing obvious in the log that could be causing the boot issue in normal mose, so we will need to do some troubleshooting in order to find out what process is causing the issue

follow these steps:


Perform a Clean Boot and troubleshoot the Startup and Services item(s)s in your configuration until you have identified the entry that may be causing that issue. Here are the instructions.
Post #27
The clean boot procedure has now been performed according to specifics of the link you posted. Strange as it may sound, I have tried various combinations using this procedure and even after the first one, the computer actually displayed the desktop, the strange part being that no matter what combination I tried, the computer booted this far, could this be interpreted as the combinations being insignificant? Even now after returning to standard settings, the computer boots to display the desktop. However in every case after displaying the desktop the computer locks up again. I tried to enter the task manager by pressing ctrl+alt+del, but nothing happened (in every above stated case). I suddenly remembered that a program called "Norton Power Eraser" was run a along with a program called "fixtdss.exe" short while after the redirecting occured. Both programs were found on the norton support forums and was suggested as a remedy for redirecting. The "Norton Power Eraser" apparently did find something which I think was called "makecabs.dll" which was "fixed". Could this be responsible for such troubles?
Post #28
Please uninstall all the security programs (Norton etc.) as you may be experiencing conflict somewhere

(leave the malware tools that I had you download as we may need them)

after you have removed all the security programs, see if combofix will run in normal mode

if you have no icons on the desktop you can run combofix via a run command

Press the WinKey + R to open a run box > type the following into the run box and press OK

"%userprofile%\desktop\combofix.exe" /killall


let me know if it runs, please post the log
Post #29
The desktop is still unaccessible in normal mode and none of the key combinations work. Even the slightest motion of the pointer and the system locks up, leaving me unable to perform the action you requested. To boot into normal mode is also extremely slow (~10 mins.)
Post #30
OK, please try running the following in safe mode:

Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page for performing a scan.
  • Caution: This is a beta version so also read the disclaimer and back up all your data before using.
  • When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
  • Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
  • Copy and paste the contents of these two log files in your next reply.
Note: Further documentation can be found in the ReadMe.rtf file which is located in the Malwarebytes Anti-Rootkit folder.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI