I have a virus on my computer thats a pain. Its a popup icon in the middle of the screen. But when you x it out, it pops up again. It does that and won't go away. On the top line it says:
DriverWhiz.exe- Bad Image
Then in the box it says:
"The application or DLL c:\WINDOWS\Microsoft.NET\Framework\v.2.0.50727\diasymreader.dll is not a valid windows image. Please check this against your installation diskette."
I ran malwarebytes and it registered nothing on my computer.
Hi
mikej62 ,
My name is
OCD . I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. Copy and Paste logs directly into the reply window. DO NOT attach the logs IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so. DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.
Please stay with this topic until I let you know that your system appears to be "
All Clear "
Important: All tools MUST be run from the Desktop .
========================= [external image: bullseye_zpse9eaf36e.gif] Security Check Download
Security Check by screen317 from
here or
here .
Save it to your Desktop.Windows XP Double click on the icon to run it Windows Vista, Windows 7 & 8 Right click and select "Run as Administrator" A Notepad document should open automatically called checkup.txt ; please post the contents of that document. ========================= [external image: bullseye_zpse9eaf36e.gif] aswMBR Download
aswMBR.exe and save it to your desktop.
Windows XP Double click on the icon to run it Windows Vista, Windows 7 & 8 Right click and select "Run as Administrator" When asked if you want to download Avast's virus definitions please select Yes Click Scan Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet. You will also notice another file created on the desktop named MBR.dat . Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well. ========================= [external image: bullseye_zpse9eaf36e.gif] OTL Download
OTL to your desktop.
Make sure all other windows are closed and to let it run uninterrupted.Windows XP Double click on the icon to run it Windows Vista, Windows 7 & 8 Right click and select "Run as Administrator" When the window appears, underneath Output Minimal Output . Check the boxes beside LOP Check and Purity Check . Under Custom Scan paste this innetsvcs Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt . These are saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in. ========================= In your next post please provide the following :
checkup.txt aswMBR.txt attach MBR.zipOTL.txt Extras.txt
Here are the logs. I couldn't get the OTL to work
Hi
mikej62 ,
Please copy and paste logs directly into your reply, do not attach unless specifically asked to do so. I couldn't get the OTL to work
Try this tools instead.
[external image: bullseye_zpse9eaf36e.gif] Download
Farbar Recovery Scan Tool and save to your desktop.
Note : You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Right click and select "Run as Administrator Yes to disclaimer. Press Scan button. It will make a log (FRST.txt ) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt ). Please attach it to your reply ========================= You overlooked the
Security Check log
(checkup.txt) in your last reply.
========================= In your next post please provide the following :
checkup.txt FRST.txt Addition.txt
I couldn't attach the checkup.txt because the program did run but it kept saying "preparing" for like an hour.
Hi mikej62 Important Please copy and paste the logs directly into the reply window. When you attach them I have to download them in order to view them which takes additional time. If I need you to attach a log I will ask you specifically to do so. I appreciate your cooperation.
Don't worry about the Security Check ========================= [external image: bullseye_zpse9eaf36e.gif] TDSSKiller TDSSKiller.zip
Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
Only if Malicious Cure is selected
Then click Continue > Reboot now
Copy and paste the log in your next reply
A copy of the log will be saved automatically to the root of the drive (typically C:\)
========================= [external image: bullseye_zpse9eaf36e.gif] ComboFix ComboFix User's Guide
Download ComboFix from the following location:Link * IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next replyNote: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Ensure your AntiVirus and AntiSpyware applications are re-enabled .NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.========================= In your next post please provide the following TDSSKiller log Combofix.txt
Sorry for attaching the files.
Combofix log:
ComboFix 14-01-12.01 - Nashih 01/12/2014 14:44:34.4.2 - x86http://www.gmer.net
TDSSKiller:
14:40:01.0109 2860 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
Hi
mikej62 ,
You may think I am being overly particular, but it is important that you read the instructions carefully and follow them precisely. Tools need to be saved and run from the Desktop. Saving and running the tools from somewhere other than the desktop doesn't provide a complete or accurate log for review. It is not necessary to place your reply in quote tags, just copy and paste into the reply window. ========================= With that in mind kindly re-run Combofix and provide the log generated in your next reply.
My bad.
Log:
ComboFix 14-01-13.01 - Nashih 01/13/2014 12:02:49.6.2 - x86http://www.gmer.net
Hi
mikej62 ,
Firewall & Anti-Virus software is missing from the header of your ComboFix log.
What programs are you using to protect your computer from infection? Have you run ComboFix in the past? (recently) ========================= Your log also shows a network proxy, did you make this selection?
========================= [external image: bullseye_zpse9eaf36e.gif] P2P - (Peer to Peer) I see you have/had
P2P software
BitTorrent &
SteamTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly
Identity Theft . It likely contributed to your current situation.
This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
I would strongly recommend that you uninstall this now.
Click
Start >
Control Panel >
Programs and Features . Locate and select the following that are present on the list and click the
Remove button:
BitTorrent StreamTorrent 1.0 If you choose to not remove this programs please refrain from using it until we have finished cleaning your computer. ========================= You stated in your original post that you were receiving error messages from Driver Wizard. Let's remove it and re-install it and see if that corrects the problem.
[external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features Click
Start >
Control Panel >
Programs and Features . Locate and select the following that are present on the list and click the
Remove button:
========================= [external image: bullseye_zpse9eaf36e.gif] Reboot ========================= If you would like to re-install it please visit this
website and re-download and install a fresh copy.
[external image: bullseye_zpse9eaf36e.gif] Reboot If you don't re-install there is no need to reboot.
========================= Test and see if problem is still present.
The programs I use for computer protection is Spysweeper though its expired. I also use Malwarebytes.
I ran combofix 3 times in the past 2 days. Before that it was like a year since I had to use combofix (for another virus)
As far as removing driver whiz. When I try to that, it freezes the second I click the remove button. It did that a few times. Is there any other way to remove the program?
Hi
mikej62 ,
MalwareBytes is not an Anti-Virus program. You should have one Firewall and one Anti-Virus program installed and running at all times to help prevent infection.
[external image: bullseye_zpse9eaf36e.gif] Firewall or Anti-Virus AntiVirus Program I noticed that you don't have an Antivirus program installed on your system. As a rule of thumb one should run one firewall, one antivirus program in memory, and one antispyware utility in memory. It's fine to have other security tools available on an as-needed or on-demand basis, but when multiple tools simultaneously perform the same function, you're asking for trouble.
I would recommend that you install one of these free Antivirus programs immediately. Just choose one:
Microsoft Security Essentials Avast Firewall Program If you have not already done so, turn on your
Windows Firewall .
Start >
Control Panel >
Windows Firewall > select
On >
OK OR If you would care to choose from a few free firewalls there are some, with the links, below.
Just choose one :
Online Armor Free
Agnitum Outpost Firewall Free
Zone Alarm Free ========================= [external image: bullseye_zpse9eaf36e.gif] Revo Uninstaller Pro Please download
Revo Uninstaller Pro and save it to your desktop.
(This version is a fully functional, 30 day free trial) Windows XP Double click on the icon to run it Windows Vista, Windows 7 & 8 Right click and select "Run as Administrator" From the list of programs click onDriver Whiz Chose "Uninstall ". When prompted click Yes . Make sure the advanced option is checked… then click Next . The program will run, when prompted… click Yes … then Next . Once the program has searched for leftovers click Next . Check ONLY Next … then Yes. When done click Finish . ========================= [external image: bullseye_zpse9eaf36e.gif] Reboot ========================= Test performance and report back
I tried revo uninstaller and it seemed to work. I reboote d the computer and the driverwhiz.exe pop up hasn't come up. Thanks so much.
Hi mikej62
If Security Check still will not run, continue on with the FRST scanIn your next post please provide the following
check-up.txt FRST.txt How is the computer running?
I tried the security check scan and when I click it to start, I got a popup similar to the one I had before but this its says "Autolt v3: Objlist.exe- Bad Image". Though fortunately when I click x twice, it goes away unlike the problem I previously had.
here is the finished security check log that popped up after the scan finished.
Results of screen317's Security Check version 0.99.78 ``````````````Antivirus/Firewall Check:`````````````` `````````Anti-malware/Other Utilities Check:````````` Java version out of Date! Adobe Reader out of Date! Firefox out of Date! ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` ````````````````````End of Log``````````````````````
Here is the frst.txt log:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-01-2014 03http://www.microsoft.com/isapi/redir.dll?prd=ie&pver;=6&ar;=msnhome http://www.microsoft.com/isapi/redir.dll?prd=ie&ar;=iesearch http://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Let's retry Security Check and a fresh FRST scan.