AVG Free partially removed Win32/Cryptor virus + many .exe files will not run

by: rpggamergirlPosted on 2009-09-06 at 00:57:05ID: 25269079

UAC rootkit is present and that blocks scanners from running.

Try redownloading MalwareBytes and renaming it before saving the file to your desktop.

Also run Combofix... again also rename its file before actually downloading it(not after)
Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

by: rpggamergirlPosted on 2009-09-06 at 01:00:26ID: 25269084

Also run this diagnostic tool... and post the log.

Please download this tool and run it.
http://ad13.geekstogo.com/Win32kDiag.exe
Double-click on Win32Diag.exe to run it. If you are using Windows Vista, please right-click and select Run As Administrator
A black command prompt window shall appear.
It will now begin to scan. This may take a while, please be paitent until the scan is complete.
Once it's done, in the black screen it will say "Finished! Press any key to exit....
A log file called Win32KDiag.txt will be created on your desktop.
Please copy and paste the contents of that log file here in your next reply please.

by: LeighWardlePosted on 2009-09-06 at 02:27:11ID: 25269264

Hi rpggamergirl,

I got Combofix to go, that let me run MalwareBytes.
I am running full AVG scan again.

The only thing that wouldn't work was Win32KDiag - see output below...

Regards,
Leigh

Win32kDiag.txt:
 
Log file is located at: C:\Documents and Settings\Administrator\Desktop\Win32kDiag.txt
 
WARNING: Could not get backup privileges!
 
Searching 'C:\WINDOWS'...
 
Finished!

1:
2:
3:
4:
5:
6:
7:
8:
9:

Select all Open in new window

by: rpggamergirlPosted on 2009-09-06 at 03:03:14ID: 25269324

Does Win32kdiag.exe run if you rename it?

Can we look at the Combofix.txt?

by: LeighWardlePosted on 2009-09-06 at 03:48:07ID: 25269396

Win32kdiag.exe gives same output as above when I rename it.

ComboFix.txt is below....

ComboFix 09-09-05.02 - Administrator 06/09/2009 18:26.1.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.511.222 [GMT 10:00]
Running from: f:\combofix\x.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\documents and settings\Administrator\Application Data\FunWebProducts
c:\documents and settings\Administrator\Application Data\FunWebProducts\Data\Administrator\avatar.dat
c:\documents and settings\Administrator\Application Data\FunWebProducts\Data\Administrator\register.dat
c:\documents and settings\Administrator\Application Data\FunWebProducts\Data\Administrator\zbucks.dat
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search2
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\recycler\S-1-5-21-0196923154-9227342625-363838730-6010
c:\recycler\S-1-5-21-0243636035-3055115376-381863306-1556
c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1811
c:\recycler\S-1-5-21-0568542523-8683114151-565992320-9472
c:\recycler\S-1-5-21-1078228486-4115420631-153232269-3407
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1733731869-3198486971-470128949-3307
c:\recycler\S-1-5-21-1813874402-6320599614-743123368-3635
c:\recycler\S-1-5-21-2056267640-0736222515-671115353-5764
c:\recycler\S-1-5-21-2355408238-2901610135-945611573-6151
c:\recycler\S-1-5-21-2579083342-0963105071-498224516-2351
c:\recycler\S-1-5-21-3933733927-3511409413-585641459-4875
c:\recycler\S-1-5-21-3966058869-5044633525-021200349-4698
c:\recycler\S-1-5-21-3991514073-8568012449-323748595-7008
c:\recycler\S-1-5-21-4612577924-0444449980-193867562-4518
c:\recycler\S-1-5-21-5259388998-7060809129-099296428-2631
c:\recycler\S-1-5-21-6330610660-6732057477-837011738-0747
c:\recycler\S-1-5-21-6473554114-0096506188-053095592-5551
c:\recycler\S-1-5-21-7781814662-2128807059-616343043-6471
c:\recycler\S-1-5-21-8051376481-3921493758-848853040-5913
c:\recycler\S-1-5-21-8451751359-4751977809-805059531-7631
c:\recycler\S-1-5-21-8713739319-4677650432-224423476-1250
c:\recycler\S-1-5-21-8888732878-1775465074-078699578-8098
c:\recycler\S-1-5-21-9114212864-7015419785-107435675-2620
c:\recycler\S-1-5-21-9172233110-1945331784-326381305-4295
c:\recycler\S-1-5-21-9685795485-7496394442-233221212-4064
c:\recycler\S-1-5-21-9869661283-1414761572-150532591-4940
c:\windows\Installer\4bb8e.msi
c:\windows\Installer\WinRMSrv.msi
c:\windows\system32\drivers\ndisrd.sys
c:\windows\system32\drivers\UACiuwqppyokk.sys
c:\windows\system32\msconfig.exe
c:\windows\system32\msxmlm.dll
c:\windows\system32\ndisapi.dll
c:\windows\system32\UACcpxmemxidq.dat
c:\windows\system32\uacinit.dll
c:\windows\system32\UACmovhoewmrq.dll
c:\windows\system32\UACnkqfwbqddr.dll
c:\windows\system32\UACpxmpjwiouy.dll
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Service_UACd.sys
-------\Legacy_UACd.sys
-------\Legacy_BNDMSS
-------\Legacy_NDISRD
-------\Service_BNDMSS
-------\Service_NDISRD
 
 
(((((((((((((((((((((((((   Files Created from 2009-08-06 to 2009-09-06  )))))))))))))))))))))))))))))))
.
 
2009-10-04 07:26 . 2009-09-06 08:04	--------	d--h--w-	C:\$AVG8.VAULT$
2009-10-04 07:12 . 2009-10-04 07:12	335240	----a-w-	c:\windows\system32\drivers\avgldx86.sys
2009-10-04 07:12 . 2009-10-04 07:12	11952	----a-w-	c:\windows\system32\avgrsstx.dll
2009-10-04 07:12 . 2009-10-04 07:12	108552	----a-w-	c:\windows\system32\drivers\avgtdix.sys
2009-10-04 07:12 . 2009-10-04 07:12	27784	----a-w-	c:\windows\system32\drivers\avgmfx86.sys
2009-10-04 07:11 . 2009-09-05 23:53	--------	d-----w-	c:\windows\system32\drivers\Avg
2009-10-04 07:11 . 2009-10-04 07:11	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-04 07:11 . 2009-10-04 07:11	--------	d-----w-	c:\program files\AVG
2009-10-04 07:11 . 2009-09-03 19:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\avg8
2009-10-03 09:58 . 2009-10-03 09:58	--------	d-----w-	c:\program files\Common Files\Uninstall
2009-10-03 09:57 . 2009-09-03 19:40	--------	d-----w-	c:\program files\PersonalAV
2009-09-30 06:45 . 2009-09-30 06:45	--------	d-----w-	c:\windows\Sun
2009-09-06 03:48 . 2009-08-03 03:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-06 03:48 . 2009-09-06 08:10	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-09-06 03:48 . 2009-09-06 03:48	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-06 03:48 . 2009-08-03 03:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-12 23:34 . 2009-08-12 23:34	--------	d-----w-	c:\windows\ServicePackFiles
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-01 09:16 . 2005-11-08 10:28	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Canon
2009-08-05 09:11 . 2006-02-28 12:00	204800	----a-w-	c:\windows\system32\mswebdvd.dll
2009-07-25 07:05 . 2009-07-25 07:05	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Elluminate
2009-07-17 18:55 . 2006-02-28 12:00	58880	----a-w-	c:\windows\system32\atl.dll
2009-07-13 00:08 . 2006-02-28 12:00	286720	----a-w-	c:\windows\system32\wmpdxm.dll
2009-06-26 16:18 . 2006-02-28 12:00	659456	----a-w-	c:\windows\system32\wininet.dll
2009-06-26 16:18 . 2006-02-28 12:00	81920	----a-w-	c:\windows\system32\ieencode.dll
2009-06-25 18:36 . 2006-02-28 12:00	95744	----a-w-	c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2006-02-28 12:00	661504	----a-w-	c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2006-02-28 12:00	517120	----a-w-	c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2006-02-28 12:00	48640	----a-w-	c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2006-02-28 12:00	471552	----a-w-	c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2006-02-28 12:00	47104	----a-w-	c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2006-02-28 12:00	225280	----a-w-	c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2006-02-28 12:00	186880	----a-w-	c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2006-02-28 12:00	177152	----a-w-	c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2006-02-28 12:00	16896	----a-w-	c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2006-02-28 12:00	138240	----a-w-	c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2006-02-28 12:00	123392	----a-w-	c:\windows\system32\mqrtdep.dll
2009-06-22 11:49 . 2006-02-28 12:00	19968	----a-w-	c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2006-02-28 12:00	117248	----a-w-	c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2006-02-28 12:00	4608	----a-w-	c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2006-02-28 12:00	91776	----a-w-	c:\windows\system32\drivers\mqac.sys
2009-06-16 14:55 . 2006-02-28 12:00	82432	----a-w-	c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2006-02-28 12:00	119808	----a-w-	c:\windows\system32\t2embed.dll
2009-06-12 11:50 . 2006-02-28 12:00	80896	----a-w-	c:\windows\system32\tlntsess.exe
2009-06-12 11:50 . 2006-02-28 12:00	76288	----a-w-	c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2006-02-28 12:00	84992	----a-w-	c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2006-02-28 12:00	132096	----a-w-	c:\windows\system32\wkssvc.dll
2007-11-20 05:53 . 2007-11-20 05:53	3193770	----a-w-	c:\program files\Tom_Mabe.wmv
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-23 1090816]
 
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
 
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-23 22:55	1090816	----a-w-	c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-23 1090816]
 
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-23 1090816]
 
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2005-08-31 1658592]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 36975]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-14 344064]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"DiskeeperSystray"="c:\program files\Executive Software\Diskeeper\DkIcon.exe" [2004-10-04 176216]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-10-06 278528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-12-10 286720]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-04 2007832]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-15 68856]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
 
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2008-10-21 385024]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
PowerMenu.lnk - c:\program files\PowerMenu\PowerMenu.exe [2005-11-6 57344]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-11-6 118784]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-10-04 07:12	11952	----a-w-	c:\windows\system32\avgrsstx.dll
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\Msmsgs.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Neoteris\\Juniper Terminal Services Client\\dsTermServ.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Java\\jre1.5.0_05\\bin\\javaw.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
 
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/10/2009 5:12 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/10/2009 5:12 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [4/10/2009 5:11 PM 297752]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
.
------- File Associations -------
.
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
.
 
**************************************************************************
 
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 18:33
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"
 
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
 
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
 
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(676)
c:\windows\system32\Ati2evxx.dll
 
- - - - - - - > 'explorer.exe'(1608)
c:\program files\PowerMenu\PowerMenuHook.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Executive Software\Diskeeper\DkService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-09-06 18:35 - machine was rebooted
ComboFix-quarantined-files.txt  2009-09-06 08:35
 
Pre-Run: 88,468,738,048 bytes free
Post-Run: 88,784,257,024 bytes free
 
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
 
263	--- E O F ---	2009-09-06 04:35

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:

Select all Open in new window

by: rpggamergirlPosted on 2009-09-06 at 04:12:16ID: 25269441

Thanks for the log.
c:\program files\PersonalAV <-- in the Program Files folder check if this folder is still listed there, delete it if still present

Also download RootRepeal from the following location and save it to your desktop.
Zip Mirrors: (Recommended)
http://rootrepeal.googlepages.com/RootRepeal.zip
http://ad13.geekstogo.com/RootRepeal.zip

Rar Mirror:
http://ad13.geekstogo.com/RootRepeal.rar

Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.
Click the "Report" tab.
Click the "Scan" button.
Check all seven boxes:

o Drivers
o Files
o Processes
o SSDT
o Stealth Objects
o Hidden Services
o Shadow SSDT

Push Yes
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the "Save Report" button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt.
Include this report in your next reply, please.

by: LeighWardlePosted on 2009-09-06 at 05:01:08ID: 25269530

c:\program files\PersonalAV was deleted previously.

The RootRepeal log is below...

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:		2009/09/06 21:38
Program Version:		Version 1.3.5.0
Windows Version:		Windows XP SP2
==================================================
 
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xEF93B000	Size: 98304	File Visible: No	Signed: -
Status: -
 
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8B91000	Size: 8192	File Visible: No	Signed: -
Status: -
 
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEC7F9000	Size: 49152	File Visible: No	Signed: -
Status: -
 
==EOF==

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:

Select all Open in new window

by: rpggamergirlPosted on 2009-09-06 at 05:42:15ID: 25269599

Root Repeal log is clean.

How is the pc going?

by: pankusareenPosted on 2009-09-06 at 07:51:22ID: 25270130

Scan ur system with Malwarebytes
http://www.malwarebytes.org/

by: LeighWardlePosted on 2009-09-06 at 20:28:35ID: 31625398

Many thanks, rpggamergirl, for you excellent advice.

The PC is going fine again, it was also scanned fully with Online Armor++.

Regards, Leigh

by: rpggamergirlPosted on 2009-09-07 at 01:09:30ID: 25273431

Leigh,

No problem, glad to know it's now resolved.

To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u

Thanks!

Question

AVG Free partially removed Win32/Cryptor virus + many .exe files will not run

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Anti-Virus

Windows XP Operating System

AVG

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press