Reply to thread

Message: <blockquote data-quote="Jack" data-source="post: 62853" data-attributes="member: 1">Hi and welcome to the MALWARE TIPS forums!I'm Jack and I am going to try to assist you with your problem. Please take note of the below: <ul> <li data-xf-list-type="ul">I will start working on your malware issues, this may or may not, solve other issues you have with your machine.</li> <li data-xf-list-type="ul">The fixes are specific to your problem and should only be used for this issue on this machine!</li> <li data-xf-list-type="ul">The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.</li> <li data-xf-list-type="ul">If you don't know, stop and ask! Don't keep going on.</li> <li data-xf-list-type="ul">Please reply to this thread. Do not start a new topic.</li> <li data-xf-list-type="ul">Refrain from running self fixes as this will hinder the malware removal process.</li> <li data-xf-list-type="ul">It may prove beneficial if you print of the following instructions or save them to notepad as I post them.</li> </ul>Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.Before we start:Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop. Because of this, I advise you to backup any personal files and folders before you start. <hr />STEP 1. Run a scan with Kaspersky Virus Removal ToolClick <a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow external" rel="nofollow"><>here</></a> to download the Kaspersky Virus Removal Tool.<ol>    <li>Save it to your desktop.</li>    <li>Double click the setup file to run it.</li>    <li>Follow the onscreen prompts until it is installed</li>    <li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:<ul>    <li>System Memory</li>    <li>Hidden startup objects</li>    <li>Disk boot sectors</li>    <li>Local Disk (C: )</li>    <li>Also any other drives (Removable that you may have)</li></ul></li>    <li>Then click on <>Actions</> on the left hand side</li>    <li>Click <>Select Action</>, then make sure both <>Disinfect</> and <>Delete if disinfection fails</> are ticked</li>    <li>Click on <>Automatic Scan</></li>    <li>Now click the <>Start Scanning</> button, to run the scan</li>    <li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>    <li>Click <>Detected threats</> on the left</li>    <li>Now click the <>Save</> button, and save it as <>kaslog.txt</> to your <>Desktop</></li>    <li>Please attach kaslog.txt in your next reply.</li></ol><hr />STEP 2: Run a scan with RogueKiller<ol>    <li>Please <>download the latest official version of </><>RogueKiller</>.<a href="http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe" rel="nofollow" target="_blank">RogueKiller Download Link</a> (This link will automatically download RogueKiller on your computer)</li>    <li><>Double click on RogueKiller.exe</> to start this utility and then <>wait for the Prescan to complete</>.This should take only a few seconds and then you can <>click the Start button</> to perform a system scan.<img title="Click on the Start button to perform a system scan" src="http://malwaretips.com/blogs/wp-content/uploads/2012/04/roguek-1.png" alt="[Image: roguekiller-1.png]" width="600" height="450" border="0" /></li>    <li>After the scan has completed, <>press the Delete button</> to remove any malicious registry keys.<img title="Press Delete to remove the malicious registry keys" src="http://malwaretips.com/blogs/wp-content/uploads/2012/04/roguek-2.png" alt="[Image: roguekiller-2.png]" width="600" height="450" border="0" /></li>    <li>Next we will need to restore your shortcuts, <>so click on the ShortcutsFix button </>and allow the program to run.<img title="Click on the Start button to perform a system scan" src="http://malwaretips.com/blogs/wp-content/uploads/2012/04/roguek-3.png" alt="[Image: roguekiller-1.png]" width="600" height="450" border="0" /></li></ol>The report has been created on the desktop.In your next reply please post:    All RKreport.txt text files located on your desktop.<hr />STEP 3: Run a scan with Eset Online Scanner.<ol>    <li>Download ESET Online Scanner utility.<><a title="External link" href="http://download.eset.com/special/eos/esetsmartinstaller_enu.exe" rel="nofollow">ESET Online Scanner Download Link</a></> (This link will automatically download ESET Online Scanner on your computer.)</li>    <li>Double click on the Eset installer program (esetsmartinstaller_enu.exe).</li>    <li>Check <>Yes, I accept the Terms of Use</></li>    <li>Click the <>Start</> button.</li>    <li>Check <>Scan archives</></li>    <li>Push the <>Start</> button.</li>    <li>ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.</li>    <li>When the scan completes, push <>List of found threats</></li>    <li>Push <>Export to Text file </> and save the file to your desktop using a unique name, such as <>ESET Scan</>. Include the contents of this report in your next reply.Note - when ESET doesn't find any threats, no report will be created.</li>    <li>Push the <>back</> button.</li>    <li>Push <>Finish</></li></ol><hr />STEP 4: Run Windows Repair All in OneDownload <><a title="External link" href="http://www.tweaking.com/content/page/windows_repair_all_in_one.html" rel="nofollow">Windows Repair by Tweaking.com</a></> to your desktop. Use the direct download link for the Portable version of Windows Repair by Tweaking.com<ol>    <li>Double-click <>tweaking.com_windows_repair_aio.zip</> and extract the <>Tweaking.com - Windows Repair</> folder to your desktop.</li>    <li>Now open this folder and double-click <>Repair_Windows.exe</>.</li>    <li>Click the <>Start Repairs</> tab on the far right.</li>    <li>Click the <>Start</> button (bottom right)Note: When asked if you would like to create a restore point. It is recommended just in-case something does not go as planned.</li>    <li>Click <>Unselect All</></li>    <li>Put a checkmark in the following items:<ul>    <li>Repair Hosts File</li>    <li>Remove Temp Files</li>         <li>Repair CD/DVD Missing/Not working</li>    <li>Remove Policies Set By Infections</li>    <li>Set Windows Services To Default Startup</li></ul>Note: Leave everything else unchecked</li>    <li>Put a checkmark in <>Restart System When Finished</></li>    <li>Now click the <>Start</> button (bottom right)</li></ol><hr />STEP 5: Download and run OTL<ol> <li data-xf-list-type="ol">Please download the OTL utility from here : <a href="http://oldtimer.geekstogo.com/OTL.exe" target="_blank">http://oldtimer.geekstogo.com/OTL.exe</a></li> <li data-xf-list-type="ol">Right-click on OTL.exe and select Run as Administrator to start OTL.</li> <li data-xf-list-type="ol">Double click on OTL.exe to run it.</li> <li data-xf-list-type="ol">Under the Custom Scan box paste this in: [code]%SYSTEMDRIVE%\*.exe %ALLUSERSPROFILE%\Application Data\*.exe %APPDATA%\*. /md5start atapi.sys explorer.exe winlogon.exe Userinit.exe svchost.exe csrss.exe PrintIsolationHost.exe consrv.dll /md5stop %systemroot%\*. /mp /s hklm\software\clients\startmenuinternet|command /rs hklm\software\clients\startmenuinternet|command /64 /rs %systemroot%\system32\*.dll /lockedfiles %systemroot%\Tasks\*.job /lockedfiles %systemroot%\system32\drivers\*.sys /lockedfiles CREATERESTOREPOINT[/code] </li> <li data-xf-list-type="ol">Click the Quick Scan button.The scan wont take long. </li> <li data-xf-list-type="ol">When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL. Please post this 2 logs in your first reply.</li> </ol><hr />What's next?Attach the following logs to your post (You can find <a href="http://malwaretips.com/Thread-How-to-use-the-attachment-system?pid=16072#pid16072" target="_blank">here</a> details on how to use the Attachment System): 1.Kaspersky log2.RogueKiller log3.ESET log4.OTL logs5.Let me know if you had any problems with the above instructions and also let me know how things are running now!</blockquote>

Verification

Top