****** problem
- Thread starter dasos
- Start date
- Status
Something is definitely wrong here, whether it's a simple hijack or malware we'll find out 
. Nothing to worry about we'll deal with this.
Please read this post and post your results here:
http://www.computerforum.com/224967-please-read-before-requesting-malware-removal-help.html
In the meantime I will ask a mod to move your thread to the computer security section
. Nothing to worry about we'll deal with this.Please read this post and post your results here:
http://www.computerforum.com/224967-please-read-before-requesting-malware-removal-help.html
In the meantime I will ask a mod to move your thread to the computer security section
Ok, this is gonna be a multi step post here. Please do the following in order.
1. Please open OTL again and copy and paste the following into the custom scan/fixes box.
Then click on run fix.
Then please do the following.
2. Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
If for some reason, if you try to run a program or open a file and you get an error message saying "illegal operation attempted on a registry key that has been marked for deletion", please just reboot your pc and you'll be fine.
In your next reply please post:
The combofix log.
3. I need you to post a log that comofix produces but doesn't show you. Please navigate to C:\Qoobox and in that folder will be a file named add-remove programs.txt. Open that file and copy and paste the contents back here.
So when you return, I need to see 3 logs.
1. The new otl fix log
2. combofix log
3. add-remove progams list
1. Please open OTL again and copy and paste the following into the custom scan/fixes box.
Code:
:OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
@Alternate Data Stream - 169 bytes -> C:\ProgramData\TEMP:B3D74A13
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:07F6D9E4Then click on run fix.
Then please do the following.
2. Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
- Download this file here :
Combofix
- When the page loads click on the blue combofix download link next to the BleepingComputer Mirror.
- Save the file to your windows desktop. The combofix icon will look like this when it has downloaded to your desktop.
- We are almost ready to start ComboFix, but before we do so, we need to take some preventative measures so that there are no conflicts with other programs when running ComboFix. At this point you should do the following:
- Close all open Windows including this one.
- Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. Instructions on disabling these type of programs can be found here.
Once these two steps have been completed, double-click on the ComboFix icon found on your desktop. Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all. The scan could take a while, so please be patient.
- Please click on I agree on the disclaimer window.
- ComboFix will now install itself on to your computer. When it is done, a blue screen will appear as shown below.
- ComboFix is now preparing to run. When it has finished ComboFix will automatically attempt to create a System Restore point so that if any problems occur while using the program you can restore back to your previous configuration. When ComboFix has finished creating the restore point, it will then backup your Windows Registry as shown in the image below.
- Once the Windows Registry has finished being backed up, ComboFix will attempt to detect if you have the Windows Recovery Console installed. If you already have it installed, you can skip to this section and continue reading. Otherwise you will see the following message as shown below:
- At the above message box, please click on the Yes button in order for ComboFix to continue. Please follow the steps and instructions given by ComboFix in order to finish the installation of the Recovery Console.
- Please click on yes in the next window to continue scanning for malware.
- ComboFix will now disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.
- ComboFix will now start scanning your computer for known infections. This procedure can take some time, so please be patient.
- While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. You will also see the text in the ComboFix window being updated as it goes through the various stages of its scan. An example of this can be seen below.
- When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
- This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
- When ComboFix has finished, it will automatically close the program and change your clock back to its original format. It will then display the log file automatically for you.
- Now you just click on the edit menu and click on select all, then click on the edit menu again and click on copy. Then come to the forum in your reply and right click on your mouse and click on paste.
If for some reason, if you try to run a program or open a file and you get an error message saying "illegal operation attempted on a registry key that has been marked for deletion", please just reboot your pc and you'll be fine.
In your next reply please post:
The combofix log.
3. I need you to post a log that comofix produces but doesn't show you. Please navigate to C:\Qoobox and in that folder will be a file named add-remove programs.txt. Open that file and copy and paste the contents back here.
So when you return, I need to see 3 logs.
1. The new otl fix log
2. combofix log
3. add-remove progams list
Those logs are basic information that'll help us see what the problem is. I don't see why you deleted them though, they have no personal information. Good for you that you deleted it with spyhunter, if you want us to check if everything is gone follow John's instructions.
Are you actually looking for help? If you don't trust us then I suggest you take a look at the computer security section, it has tons of people coming here for virus and got helped 99% by John successfully (and what would you ask for help if you don't trust us?).
Anyway yeah more than one A-V is not good, one will conflict with the other.
Why u had to wait so much time before answer about my OLT log?
U cant say that useful commercial software 'shouldnt be'.
I had more than 1 antivirus the time I was trying solve a problem. I now have only NIS.
Why normally doesnt fix it?
U asked me 4 logs, I posted them immidiately. U didnt answer.
After 1 day u asked more logs.
Last edited:
Because CF is where I hang on my free time. I have a life you know, and right now lots of exams so studying is my priority. It takes time to go through logs, time which I hadn't. I asked for them so that if someone else has the time you'll get their answer.
I have never heard of NIS, free A-V I would suggest would be Avast.
And as far as useful commercial software goes, if you're using it then keep it. But trust me in one thing. If John says it's harmful, it is.
You can always post your log and we'll see with you what is harmful and what is not.
NIS is Norton. The best suite, according many labs (Avast was my previous AV-I think we have talked about that in the past. Second time Avast was unable to block a warm. Besides Avast has no antispyware, no firewall).
Do u really believe that commercial software is harmful? People pay money for them and get their systems infected?...
Anyway, I dont want to search for harmful things now. I want to make a repair in my Win 7 Ult 64 SP1.
I m all ears!
Do u really believe that commercial software is harmful? People pay money for them and get their systems infected?...
Anyway, I dont want to search for harmful things now. I want to make a repair in my Win 7 Ult 64 SP1.
I m all ears!
Last edited:
Yeah Norton is good, I used to have it but stopped since it wasn't free.
I'm not getting you, you want to repair your OS but you don't want to look for what's wrong? What software are you talking about by the way?
If a warm has destroyed some windows files, I have to repair them, right?
Warm gone but left behind a file corruption. Can this happen?
I dont think I have warms now.
Do I have to follow this for a repair?
That sentence is not clear, what r u talking about?
Last edited:
You're talking about commercial softwares, which ones?
And as far as the worms goes, viruses can do a lot of things, from pop ups to corrupting files. Which file is corrupted?
- Status