Remove AntivirusPro 2010

Check this:

http://www.2-spyware.com/remove-antivirus-pro-2010.html

if you still unable to run exe files, then you might want to repair your windows:


http://michaelstevenstech.com/XPrepairinstall.htm

Once you run the rootkitbuster, run malwarebytes.

Previous EE questions on similar subject:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Q_24711205.html?sfQueryTermInfo=1+2010+antiviru+pro

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Desktop_Anti-Virus/Q_24710047.html?sfQueryTermInfo=1+2010+antiviru+pro

Cant get on the internet to run anything

bbbb2

Do you have another PC you can download the files to?

Sometimes you can download mbam-setup.exe and then rename it on another computer to say test.com and then run it on the infected computer.  This may well get past the software stopping you.

Can you run msconfig on the problem computer?

Can you kill the two processes that are causing the problems (press CTRL + SHIFT + ESC for task manager - processes tab):

1. antiviruspro2010.exe 
2. uninstall.exe 

@houssam_bailout I read the first artical and it sound about like the same problem I am having. But how did he fix it? Malwarebytes normally gets most of it off the first run but know I cant even install it.

bbbb2

Please do not download combofix from the above link - use this one.  The link above may be a link to a dodgy version:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

PLEASE people, I CAN NOT INSTALL ANYTHING ON THE BAD LAPTOP. Please read what I HAVE written first before replying with your suggestions.

I dont intend for this to sound rude but what some of you are saking me to do would know I cant do them if they looked at MY messages.

Thank you

bbbb2

Did you try to kill the process I listed?

I really cant do much of any thing on the bad laptop, cant go to task manager, cant get on the internet even though it says I am connected, can't install any programs, its asking me to choose the program I wast to open this file. I then clicked on browse ans selected malwarebytes. It then went to install and when I got to update and then run malwarebytes I got an error message saying to contact malwarebytes support. Then The window came up to scan. I clicked on scan  and ti said "Preparing to scan" an then just disappeared. I did that twice with the same result.

bbbb2

alan how can I kill the process? I cant get into task manager. Is there antoher way?

Thanks

bbbb2

Can you boot into safe mode?

If so - try running msconfig from there and disabling all non-microsoft processes on the processes tab and all items in the startup list.

I am going to type every error message I get. I am booting up in safe mode. (1.)Error message one after I yes to go to safe mode.(rundll32.exe) Application not found. (2.) I go to "Run" and type in msconfig and get the "OPEN WITH" screen asking to choose a program to open msconfig with.

Okay - it has really got under the bonnet!

Try the following link to restore the ability to run .exe files:

http://support.microsoft.com/default.aspx?scid=kb;en-us;555067&Product=winxp

OK alahardisty, I got msconfig up in safe mode unchecked anything that wasnt microsoft and also in start up unchecked everything. Alot of the stuff in startup was antivirus and antiviruspro 2010 so I unchecked all of them. Anything else from here?

bbbb2 -
This sounds like quite a problem.
You can try downloading "Stinger" from McAfee - it is a very small executable file which won't have to be loaded on your computer.
Download it on your good computer and then copy it to USB stick drive or a CD, then run it on the bad one.

You might also want to consider pulling the HDD off the bad computer and 'slaving' it on the good one - then running your AV application against it.

Nope - that should do.

As long as you have ticked hide all microsoft services, then disabled the rest and disabled all startup items, you should then be able to save and reboot.

At that point, you should hopefully be able to run malwarebytes and nuke the little beast.

BTW - "Stinger" is only a first step in this process - not the solution.
There will be other utilities to run - if - we can get your computer running with some semblance of normality.

I went to install and run Malwarebytes and I get an error message at the very end after it installs and ask me if I want to run Malwarebytes. I click yes and I wait a few seconds and I get an error message stating: Error Code 732(0,0) Please report the following error code the the malwarebytes support team.

alanhardisty - I haven't had to treat this one (yet), but does the user need to 'rename' MBAM before copying/saving it to the infected computer?

You can download MalwareBytes and Combofix using another pc into a USB as already suggested, rename them before saving or before transfering it to the infected pc so malware can't block them from running.

If you can't run any .exes you can also use this fix.
* Download Fixswen and save it to your desktop
* Right-click on the file and choose "install"
http://download.nai.com/products/mcafee-avert/Fixswen.inf

Well - beaten to my answer by the best person who could have turned up to the party.

bbbb2 - you are in the best of hands now with rpggamegirl.  If she cannot get you sorted - then no-one can!

Sounds GREAT. rpggamegirl, I dont think I can run any exe. I was going to do a print screen but I couldnt open up paint to copy it to without the open with window opening up and it still would work . Error message was that it was a valid win32 application.Should I download and rename Malwawarebytes and Combofix first or atleast try to or skip it and got to your second and Download Fixswen?

bbbb2

You can try running the renamed tools first if you like, either way won't hurt.

Also try running this diagnostic tool(once you can run .exes) to check if a particular infection is present.

Please download this tool and run it.
http://ad13.geekstogo.com/Win32kDiag.exe

Double-click on Win32Diag.exe to run it. If you are using Windows Vista, please right-click and select Run As Administrator
A black command prompt window shall appear.
It will now begin to scan. This may take a while, please be paitent until the scan is complete.
Once it's done, in the black screen it will say "Finished! Press any key to exit....
A log file called Win32KDiag.txt will be created on your desktop.
Please copy and paste the contents of that log file here in your next reply please.



@ alanhardisty,
Thanks for that boost of confidence in me, :)

Anytime.  Sorry if that adds lots of pressure, but I am sure you will cope :-)

Here is the Win32Diag log file:

Log file is located at: C:\Documents and Settings\Peter Colby\Desktop\Win32kDiag.txt
WARNING: Could not get backup privileges!
Searching 'C:\WINDOWS'...
 
Found mount point       : C:\WINDOWS\$hf_mig$\KB912945\KB912945
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\$hf_mig$\KB918899\KB918899
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\$hf_mig$\KB931784\KB931784
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\BCMCommon\BCMCommon
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\BCMRes\BCMRes
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\BusinessLayer\BusinessLayer
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Iris.DataDictionary\Iris.DataDictionary
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Iris.Mapi.MessageStore\Iris.Mapi.MessageStore
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.BusinessSolutions.eCRM.OutlookAddIn\Microsoft.BusinessSolutions.eCRM.OutlookAddIn
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.BusinessSolutions.eCRM.OutlookAddIn.CSUtils\Microsoft.BusinessSolutions.eCRM.OutlookAddIn.CSUtils
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.eCRM.Office\Microsoft.eCRM.Office
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.Interop.eCRM.Outlook\Microsoft.Interop.eCRM.Outlook
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.Interop.Mapi.Impl\Microsoft.Interop.Mapi.Impl
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.Interop.Mapi.Interfaces\Microsoft.Interop.Mapi.Interfaces
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\temp\temp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\assembly\tmp\tmp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Config\Config
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Connection Wizard\Connection Wizard
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d1\d1
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d2\d2
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d3\d3
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d4\d4
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d5\d5
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d6\d6
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d7\d7
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\CSC\d8\d8
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ftpcache\ftpcache
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\chsime\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\CHTIME\Applets\Applets
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\imejp\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\imejp98\imejp98
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\imjp8_1\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\imkr6_1\applets\applets
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\imkr6_1\dicts\dicts
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\ime\shared\res\res
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Installer\$PatchCache$\Managed\4301AEBD288588A40833184CFEC0AF92\4.0.0\4.0.0
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\java\classes\classes
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\java\trustlib\trustlib
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Temporary ASP.NET Files\Bind Logs\Bind Logs
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\msapps\msinfo\msinfo
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\batch\batch
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\Config\News\News
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\pchealth\helpctr\Temp\Temp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Registration\CRMLog\CRMLog
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\setup.pss\setupupd\temp\temp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backup
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Sun\Java\Deployment\Deployment
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1025\1025
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1028\1028
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1031\1031
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1037\1037
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1041\1041
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1042\1042
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\1054\1054
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\2052\2052
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\3076\3076
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\3com_dmi\3com_dmi
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\appmgmt\MACHINE\MACHINE
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\appmgmt\S-1-5-21-2089121605-3431182245-3358814019-1006\S-1-5-21-2089121605-3431182245-3358814019-1006
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\ATI\ACE\ACE
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch1\ch1
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch2\ch2
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch3\ch3
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch4\ch4
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch5\ch5
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch6\ch6
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Gtek\instch_gdql_d_cache\instch_gdql_d_cache
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Identities\{4E3254D7-522A-412A-9296-3F4767B3A2CB}\{4E3254D7-522A-412A-9296-3F4767B3A2CB}
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield\ISEngine12.0\ISEngine12.0
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-2089121605-3431182245-3358814019-500\S-1-5-21-2089121605-3431182245-3358814019-500
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-343818398-1004336348-839522115-500\S-1-5-21-343818398-1004336348-839522115-500
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Crypto\RSA\S-1-5-21-2089121605-3431182245-3358814019-500\S-1-5-21-2089121605-3431182245-3358814019-500
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\MMC\MMC
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Google Desktop\875e327b0e19\875e327b0e19
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Google Desktop\c666c1323235\c666c1323235
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\MediaDirect\IEPG\IEPG
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\CD Burning\CD Burning
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-2089121605-3431182245-3358814019-500\S-1-5-21-2089121605-3431182245-3358814019-500
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-343818398-1004336348-839522115-500\S-1-5-21-343818398-1004336348-839522115-500
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\ehome\ehome
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\OFFICE\OFFICE
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Yahoo\YMP\YMP
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\My Documents\My Music\My Yahoo! Music\My Yahoo! Music
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\dhcp\dhcp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\drivers\disdn\disdn
Mount point destination : \Device\__max++>\^
Cannot access: C:\WINDOWS\system32\eventlog.dll
[1] 2004-08-10 06:00:00 55808 C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll (Microsoft Corporation)
[1] 2008-04-13 19:11:53 56320 C:\WINDOWS\ServicePackFiles\i386\eventlog.dll (Microsoft Corporation)
[1] 2008-04-13 19:11:53 61952 C:\WINDOWS\system32\eventlog.dll ()
[2] 2008-04-13 19:11:53 56320 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation)
[1] 2004-08-10 06:00:00 55808 C:\i386\eventlog.dll (Microsoft Corporation)
 
Found mount point       : C:\WINDOWS\system32\export\export
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\FxsTmp\FxsTmp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\GroupPolicy\Machine\Machine
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\GroupPolicy\User\User
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNT
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNT
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNT
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\mui\dispspec\dispspec
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\oobe\html\oemcust\oemcust
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\oobe\html\oemhw\oemhw
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\oobe\html\oemreg\oemreg
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\oobe\sample\sample
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\DriverFiles
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\DriverFiles
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\i386
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\ShellExt\ShellExt
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\spool\drivers\IA64\IA64
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\spool\drivers\W32ALPHA\W32ALPHA
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\spool\drivers\WIN40\WIN40
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\spool\drivers\x64\x64
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\wbem\mof\bad\bad
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\wbem\mof\good\good
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\wbem\snmp\snmp
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\wins\wins
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\system32\xircom\xircom
Mount point destination : \Device\__max++>\^
Found mount point       : C:\WINDOWS\Temp\TempRec\TempSBE\TempSBE
Mount point destination : \Device\__max++>\^
 
Finished!
 

Remember, I am typing with you on a different PC than the one that is giving me trouble.

bbbb2

Should I just type C:\WINDOWS\system32\logevent.dll C:\eventlog.dll /y in the command prompt?

No. you need to also type the word "copy" like below:

copy C:\WINDOWS\system32\logevent.dll C:\eventlog.dll /y

take note of the spaces as well...
If you like we can do it with a batchfile that you can just doubleclick.

ok got it...  file copied

rpggamegirl, I have aquestion. Should I do step 2 on the bad laptop or on the PC I am talking to you from?

Do all the steps in the infected laptop.

Step 2 -- Avenger will replaced the patched file....
then Step 3 -- Win32kDiag.exe will removed mountpoints created by the malware.....

then step 4 -- is the cleanup

Oh you  mean download Avenger using the laptop you're using to post here at EE???

Yes, if the infected laptop can't connect online...
but the Avenger script must be run from the infected laptop to replace the patched file.

I am speaking to you on a desktop and then going to the infected laptop and doing what you ask. I tyed in the command prompt on the infected laptop what you told me to do and I got the results you where expecting. Now I am wondering what you want me to do from here. Are you wanting me to do everything else from the infected laptop?

bbbb2

I still cant get online from the infected laptop so you want me to download Avenger from the desktop(not laptop) that is running great. So download and copy it to a flash drive?

bbbb2

Yes.

I want you to download Avenger using the desktop into a USB drive and try to put it in the desktop of the infected laptop and run this script in Avenger window.

Files to move:
C:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll




then do Step 3 in the infected laptop.

Click on Start-> Run, and copy-paste the following command into the "Open:" box, and click OK.


"%userprofile%\desktop\win32kdiag.exe" -f -r



And after you've done those... you should be able to run the renamed MalwareBytes and Combofix to cleanup the infection.
Run a renamed MBAM and renamed Combofix and attach the logs.

I mean use any pc wth internet connection to download Avenger into a flash drive... then transfer it into the infected laptop and run the script for Avenger to replace the patched file.

I am getting an error messge after I click execute. It says: Error: Invalid script. A  must begin with a command directive.

bbbb2

You need to include this line as well including the colon ":" this is the command directive --> Files to move:

You need to paste all the bolded text(characters) below into the Avenger window.


Files to move:
C:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll

rpggamegirl  could you send me the good link to Combofix. And BTW When I open the renamed malwarebytes the open with window opens up. Do I click for it to open up with malwarebtyes or the renamed. I am not sure that is going to make a defference.

Also, thanks so much for all your time and help.

bbbb2

Still getting the same error message from Malwarebytes "Error Code 732(0,0) Please report the following error code the the malwarebytes support team." :-(

bbbb2

I dont knwo what else to do but back up with my goclickfree external hard drive and reinstall operating system. Unless you have an easier solution. I understand if you say go ahead and back it up. I am giving you an out :-)

bbbb2

MalwareBytes still won't run?

Did Avenger successfully move the file to replace the patched one?
Can you please let us see the Avenger log?

Can we also look at the latest log of the Win32kDiag.txt?


Here's the direct combofix.exe link
ComboFix by sUBs:(rename before saving or rename before installing to the infected pc)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If Combofix will run, don't worry about MalwareBytes, sometimes even a renamed MalwareBytes and it manages to install sometimes the mbam.exe still have to be renamed again.

<<<"I am giving you an out :-)">>>

I'm not giving up unless you are.
The only infection I would give-in and suggest a reformat is virut or sality, unless the system is so messed up and becomes unbootable.

I have seen and dealt with this infection before.
So long as the patched file has been replaced, it's okay from there on....

Here is an Antivirus Pro 2010 removal guide:

http://www.geekpolice.net/malware-removal-guides-f12/remove-antivirus-pro-2010-removal-guide-t13977.htm

If it doesn't work, scroll down, and delete the listed files manually.

DoctorInferno,
There are a couple of things wrong with the post you just made.
First - that advice has already been posted (MBAM).
Second - please don't try to send our Members to some other web site for assistance.

The Experts here on EE (most of them) know what they are doing and can help our Members - based on what we post - NOT on what you found on some other forum.

rpggamegirl,

Everytime I try to open any program, for example combofix, the open with window asking me to CHoose a program you want to use to oopen this file. I choose Kombophix(renamed) but the it pops up again with Open With File iexplore.exe and saying "Choose the program you wnat to use to open this file. I am confused as to why it is doing this.

Another thing is after I ran Avenger and rebooted I go to c:\avenger and nothing is there.

Please get back with me when you can and the time differences are probably going to be a problem. I am usually up late. I am in central standard time zone. Probably 12 hours dfference.

Talk to you whenever, hopefully soon because the person whose laptop is going to want it back soon.

thanks

bbbb2

Can anyone tell me what the process name for PC-cillin Internet Security -Virus Protection is/ I am about to run combo fix and cant figure out which process is PC-cillin Internet Security

There are instructions at the ComboFix download site, but if those don't help try these:
http://www.ctimls.com/Support/KB/How%20To/Configure_PCcillin.htm

Here is the Combo Fix Report. I can now get online and everything is fixed. Thanks alot rpggamegirl.

She went above her duty to help me and I really appreciated it. Thanks again.
bbbb2

Now I told you that you were in good hands ;-)  Glad you are all sorted and well done rpggamegirl!

Alan

@rpg - thank you for the kind words.
I've managed to get my 3,000 points for the month already, so I'm all set until October.
If the Asker wants to award some points to alanhardisty, I won't object - but for me it was just fun to just watch "The Huntress" at work.