Unable to Execute the Desired Program Pleaseget Another Copy of the Installer and Try Again
#1 
KevinZ
-
- Members
- xx posts
- OFFLINE
- Local time: 10:46 AM
Posted 12 January 2013 - 11:18 AM
-The laptop is unable to connect to the internet
-On startup it opens a number of IE windows and a number of View Downloads windows with random ,exe files listed in them
-She was working with i of her friends and had tried to load spybot seek/destroy, conbofix, and who knows what else.
-The laptop will non run those exe files
-It brings upward the View Downloads window and asks if you want to run or salvage the programme
-If you cull run or save it responds with the programs publisher couldn't be verified. Are you sure yous want to run the programme?
-Hitting run only creates another entry in the View Downloads box
-Renaming combo fix did nothing at all
-When combofix and spybot seek/destroy were saved to the desktop they save with the ie (blue eastward) icon instead of their ain specific trademark icons
-Her friend did something with OTL (I am not also familiar with OTL), only it didn't work then she gave up
-Attempting to open up a make clean ie window once again opens a View Downloads box with the iexplore.exe request if y'all wany to run or save the program
DDS (Ver_2012-11-xx.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16457
Run by gibason at 8:43:22 on 2013-01-12
Microsoft Windows seven Domicile Premium 6.1.7601.ane.1252.1.1033.18.6051.4960 [GMT -7:00]
.
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -m DcomLaunch
C:\windows\system32\svchost.exe -1000 RPCSS
C:\windows\System32\svchost.exe -chiliad LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -thousand LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -m LocalService
C:\windows\system32\svchost.exe -m NetworkService
C:\windows\System32\spoolsv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\ii.0.13.eleven\ccSvcHst.exe
C:\Plan Files (x86)\Microsoft Awarding Virtualization Client\sftvsa.exe
C:\windows\system32\ThpSrv.exe
C:\windows\system32\TODDSrv.exe
C:\Programme Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Plan Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Microsoft Awarding Virtualization Client\sftlist.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Programme Files (x86)\Mutual Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\windows\System32\WUDFHost.exe
C:\windows\system32\taskhost.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.xiii.11\ccSvcHst.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\SearchIndexer.exe
C:\Programme Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Norton Net Security\Engine\19.viii.0.xiv\ccSvcHst.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Intel\Intel® Direction Engine Components\UNS\UNS.exe
C:\Programme Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\$Recycle.Bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\U
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Folio = hxxp://xfinity.comcast.net/?cid=xfrtem&cid=mtmh02202012
uDefault_Page_URL = hxxp://start.toshiba.com/
uProxyOverride = <local>
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.eight.0.14\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Cyberspace Security\Engine\19.8.0.xiv\ips\ipsbho.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Mutual Files\Microsoft Shared\Windows Alive\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Role Document Enshroud Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Plan Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java™ Plug-In ii SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme Files (x86)\Coffee\jre6\bin\jp2ssv.dll
BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Plan Files (x86)\Norton Internet Security\Engine\19.viii.0.14\coieplg.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [swg] "C:\Plan Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [pcdfsvc] C:\ProgramData\pcdfdata\~!#7906.tmp /min
mRun: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
mRun: [KeNotify] "C:\Plan Files (x86)\TOSHIBA\Utilities\KeNotify.exe" LPCM
mRun: [TSleepSrv] C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
mRun: [ToshibaServiceStation] "C:\Programme Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:lx
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Fill-in\Activation\TOBuActivation.exe" UNATTENDED
mRun: [ToshibaAppPlace] "C:\Plan Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"
mRun: [Adobe ARM] "C:\Programme Files (x86)\Common Files\Adobe\ARM\i.0\AdobeARM.exe"
mPolicies-Explorer: NoActiveDesktop = dword:i
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-Arrangement: ConsentPromptBehaviorAdmin = dword:5
mPolicies-Arrangement: ConsentPromptBehaviorUser = dword:3
mPolicies-Organisation: EnableUIADesktopToggle = dword:0
IE: East&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Part\Office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://coffee.sun.com/update/1.half-dozen.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sunday.com/update/ane.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/i.six.0/jinstall-1_6_0_25-windows-i586.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{9B953D95-ACF2-4C00-B03A-8CDFDA457970} : DHCPNameServer = 100.100.0.102
TCP: Interfaces\{D86FB9AB-D92D-4D79-8D85-F45430FBBEF2} : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{D86FB9AB-D92D-4D79-8D85-F45430FBBEF2}\24F6E66696C63744F6E6F627 : DHCPNameServer = 208.67.222.222 208.67.220.220
TCP: Interfaces\{D86FB9AB-D92D-4D79-8D85-F45430FBBEF2}\34963736F66303834323 : DHCPNameServer = 192.168.1.one
TCP: Interfaces\{D86FB9AB-D92D-4D79-8D85-F45430FBBEF2}\3586F6274735973616D6F62756D27657563747 : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{D86FB9AB-D92D-4D79-8D85-F45430FBBEF2}\84967686C616E646370234F627B602620234F666665656 : DHCPNameServer = 192.168.0.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photograph Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
x64-mStart Page = hxxp://start.toshiba.com/
x64-mDefault_Page_URL = hxxp://starting time.toshiba.com/
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Function Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Plan Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [IgfxTray] C:\windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\windows\System32\igfxpers.exe
x64-Run: [TPwrMain] C:\Programme Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
x64-Run: [HSON] C:\Program Files (x86)\TOSHIBA\TBS\HSON.exe
x64-Run: [TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Sound\HDA\RAVCpl64.exe -s
x64-Run: [RtHDVBg] C:\Plan Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 /MAXX3
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [ThpSrv] C:\windows\System32\thpsrv /logon
x64-Run: [Teco] "C:\Programme Files (x86)\TOSHIBA\TECO\Teco.exe" /r
x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
x64-Run: [TosWaitSrv] C:\Program Files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
x64-Run: [TosVolRegulator] C:\Plan Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
x64-Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
x64-Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Role\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Mutual Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\windows\System32\drivers\thpdrv.sys [2011-three-23 36992]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\windows\System32\drivers\Thpevm.sys [2009-half-dozen-29 14784]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\System32\drivers\tos_sps64.sys [2011-12-23 482384]
R2 cvhsvc;Customer Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-one-4 822624]
R2 NIS;Norton Net Security;C:\Program Files (x86)\Norton Net Security\Engine\xix.eight.0.14\ccsvchst.exe [2012-8-14 138272]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Plan Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe [2012-12-6 132056]
R2 PCCUJobMgr;Mutual Client Job Manager Service;C:\Programme Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2011-12-23 126392]
R2 sftlist;Application Virtualization Customer;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2011-5-24 294848]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and Full general Purpose Device Filter Driver;C:\windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-23 2656280]
R3 CeKbFilter;CeKbFilter;C:\windows\System32\drivers\CeKbFilter.sys [2011-12-23 20592]
R3 IntcDAud;Intel® Brandish Audio;C:\windows\System32\drivers\IntcDAud.sys [2010-x-fifteen 317440]
R3 JMCR;JMCR;C:\windows\System32\drivers\jmcr.sys [2011-1-31 174168]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\windows\System32\drivers\nusb3hub.sys [2011-2-10 82432]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Commuter;C:\windows\System32\drivers\nusb3xhc.sys [2011-2-x 181760]
R3 PGEffect;Pangu effect commuter;C:\windows\System32\drivers\PGEffect.sys [2011-12-23 38096]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2011-12-23 413800]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\System32\drivers\rtl8192ce.sys [2011-12-23 1109096]
R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-ane 25960]
R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-x-one 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-x-1 219496]
S2 clr_optimization_v4.0.30319_32;Microsoft .Internet Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.Internet\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.Net\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.half dozen.2.10\Definitions\BASHDefs\20120919.001\BHDrvx64.sys [2012-9-twenty 1385120]
S3 ccSet_NIS;Norton Internet Security Settings Manager;C:\windows\System32\drivers\NISx64\1308000.00E\ccsetx64.sys [2012-viii-xiv 167072]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-viii 138912]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-x-12 206072]
S3 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.6.2.10\Definitions\IPSDefs\20120926.001\IDSviA64.sys [2012-nine-26 513184]
S3 SymDS;Symantec Data Store;C:\windows\System32\drivers\NISx64\1308000.00E\symds64.sys [2012-8-xiv 451192]
S3 SymEFA;Symantec Extended File Attributes;C:\windows\System32\drivers\NISx64\1308000.00E\symefa64.sys [2012-eight-14 1129120]
S3 SymIRON;Symantec Iron Driver;C:\windows\System32\drivers\NISx64\1308000.00E\ironx64.sys [2012-8-14 190072]
S3 SymNetS;Symantec Network Security WFP Driver;C:\windows\System32\drivers\NISx64\1308000.00E\symnets.sys [2012-8-14 405624]
S3 TMachInfo;TMachInfo;C:\Programme Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-12-23 57216]
S3 TOSHIBA HDD SSD Warning Service;TOSHIBA HDD SSD Warning Service;C:\Plan Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-6-9 138152]
S3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2011-7-1 828856]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-eleven-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-twenty 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2012-2-24 1255736]
S4 wlcrasvc;Windows Alive Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
FileExt: .exe: Applications\iexplore.exe="C:\Program Files (x86)\Internet Explorer\iexplore.exe" %ane [UserChoice]
FileExt: .scr: scrfile="%1" %*
.
=============== Created Last 30 ================
.
2013-01-12 15:17:47 -------- d-----w- C:\_OTL
2013-01-12 02:49:xix 388096 ----a-r- C:\Users\gibason\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-01-12 02:49:19 -------- d-----w- C:\Program Files (x86)\Trend Micro
2013-01-ten 02:eleven:19 750592 ----a-westward- C:\windows\System32\win32spl.dll
2013-01-10 02:11:nineteen 492032 ----a-w- C:\windows\SysWow64\win32spl.dll
2013-01-x 02:09:58 3149824 ----a-due west- C:\windows\System32\win32k.sys
2013-01-09 00:45:29 4422016 ----a-west- C:\Users\gibason\avg_avct_stb_all_2013_2805_ppc2.exe
2013-01-08 nineteen:40:53 -------- d-----w- C:\Users\gibason\AppData\Local\Apps
2013-01-07 13:00:05 -------- d-sh--w- C:\windows\System32\%APPDATA%
2013-01-07 12:53:11 -------- d-----westward- C:\ProgramData\pcdfdata
2013-01-01 18:26:14 514560 ----a-w- C:\windows\SysWow64\qdvd.dll
2013-01-01 eighteen:26:fourteen 366592 ----a-west- C:\windows\System32\qdvd.dll
2012-12-24 03:55:45 -------- d-----w- C:\Users\gibason\AppData\Roaming\WildTangent
2012-12-22 fourteen:10:56 34304 ----a-w- C:\windows\SysWow64\atmlib.dll
2012-12-22 fourteen:x:55 46080 ----a-westward- C:\windows\System32\atmlib.dll
2012-12-22 14:x:54 367616 ----a-due west- C:\windows\System32\atmfd.dll
2012-12-22 14:ten:53 295424 ----a-w- C:\windows\SysWow64\atmfd.dll
2012-12-14 thirteen:31:17 2048 ----a-w- C:\windows\SysWow64\tzres.dll
2012-12-14 thirteen:31:17 2048 ----a-w- C:\windows\System32\tzres.dll
2012-12-14 13:30:51 478208 ----a-w- C:\windows\System32\dpnet.dll
2012-12-14 13:30:51 376832 ----a-w- C:\windows\SysWow64\dpnet.dll
.
==================== Find3M ====================
.
2013-01-10 04:28:28 74248 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-01-10 04:28:28 697864 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2012-12-07 13:20:xvi 441856 ----a-w- C:\windows\System32\Wpc.dll
2012-12-07 xiii:15:31 2746368 ----a-w- C:\windows\System32\gameux.dll
2012-12-07 12:26:17 308736 ----a-w- C:\windows\SysWow64\Wpc.dll
2012-12-07 12:20:43 2576384 ----a-due west- C:\windows\SysWow64\gameux.dll
2012-12-07 11:20:04 30720 ----a-west- C:\windows\System32\usk.rs
2012-12-07 eleven:xx:03 43520 ----a-due west- C:\windows\System32\csrr.rs
2012-12-07 11:20:03 23552 ----a-west- C:\windows\System32\oflc.rs
2012-12-07 11:20:01 45568 ----a-west- C:\windows\System32\oflc-nz.rs
2012-12-07 eleven:20:01 44544 ----a-w- C:\windows\System32\pegibbfc.rs
2012-12-07 11:20:01 20480 ----a-westward- C:\windows\System32\pegi-fi.rs
2012-12-07 xi:twenty:00 20480 ----a-w- C:\windows\System32\pegi-pt.rs
2012-12-07 xi:19:59 20480 ----a-westward- C:\windows\System32\pegi.rs
2012-12-07 eleven:19:58 46592 ----a-w- C:\windows\System32\fpb.rs
2012-12-07 11:19:57 40960 ----a-w- C:\windows\System32\cob-au.rs
2012-12-07 11:19:57 21504 ----a-westward- C:\windows\System32\grb.rs
2012-12-07 11:xix:57 15360 ----a-w- C:\windows\System32\djctq.rs
2012-12-07 xi:19:56 55296 ----a-w- C:\windows\System32\cero.rs
2012-12-07 11:19:55 51712 ----a-w- C:\windows\System32\esrb.rs
2012-eleven-xxx 05:45:35 362496 ----a-w- C:\windows\System32\wow64win.dll
2012-11-thirty 05:45:35 243200 ----a-w- C:\windows\System32\wow64.dll
2012-11-thirty 05:45:35 13312 ----a-west- C:\windows\System32\wow64cpu.dll
2012-11-30 05:45:14 215040 ----a-due west- C:\windows\System32\winsrv.dll
2012-xi-thirty 05:43:12 16384 ----a-w- C:\windows\System32\ntvdm64.dll
2012-xi-xxx 05:41:07 424448 ----a-westward- C:\windows\System32\KernelBase.dll
2012-eleven-xxx 04:54:00 5120 ----a-westward- C:\windows\SysWow64\wow32.dll
2012-11-30 04:53:59 274944 ----a-westward- C:\windows\SysWow64\KernelBase.dll
2012-11-30 03:23:48 338432 ----a-w- C:\windows\System32\conhost.exe
2012-11-thirty 02:44:06 25600 ----a-w- C:\windows\SysWow64\setup16.exe
2012-11-30 02:44:04 7680 ----a-westward- C:\windows\SysWow64\instnm.exe
2012-11-30 02:44:04 14336 ----a-due west- C:\windows\SysWow64\ntvdm64.dll
2012-xi-30 02:44:03 2048 ----a-west- C:\windows\SysWow64\user.exe
2012-xi-xxx 02:38:59 6144 ---ha-west- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59 3584 ---ha-westward- C:\windows\SysWow64\api-ms-win-cadre-xstate-l1-ane-0.dll
2012-11-thirty 02:38:59 3072 ---ha-westward- C:\windows\SysWow64\api-ms-win-cadre-util-l1-1-0.dll
2012-11-23 03:13:57 68608 ----a-west- C:\windows\System32\taskhost.exe
2012-eleven-22 05:44:23 800768 ----a-west- C:\windows\System32\usp10.dll
2012-xi-22 04:45:03 626688 ----a-due west- C:\windows\SysWow64\usp10.dll
2012-11-twenty 05:48:49 307200 ----a-w- C:\windows\System32\ncrypt.dll
2012-11-20 04:51:09 220160 ----a-west- C:\windows\SysWow64\ncrypt.dll
2012-eleven-xiv 06:11:44 2312704 ----a-w- C:\windows\System32\jscript9.dll
2012-11-14 06:04:xi 1392128 ----a-due west- C:\windows\System32\wininet.dll
2012-11-14 06:02:49 1494528 ----a-w- C:\windows\System32\inetcpl.cpl
2012-eleven-14 05:57:46 599040 ----a-westward- C:\windows\System32\vbscript.dll
2012-11-fourteen 05:57:35 173056 ----a-w- C:\windows\System32\ieUnatt.exe
2012-11-14 05:52:40 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2012-11-14 02:09:22 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll
2012-11-14 01:58:15 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2012-11-14 01:57:37 1129472 ----a-w- C:\windows\SysWow64\wininet.dll
2012-11-14 01:49:25 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe
2012-11-14 01:48:27 420864 ----a-westward- C:\windows\SysWow64\vbscript.dll
2012-xi-14 01:44:42 2382848 ----a-west- C:\windows\SysWow64\mshtml.tlb
2012-eleven-01 05:43:42 2002432 ----a-w- C:\windows\System32\msxml6.dll
2012-eleven-01 05:43:42 1882624 ----a-west- C:\windows\System32\msxml3.dll
2012-11-01 04:47:54 1389568 ----a-w- C:\windows\SysWow64\msxml6.dll
2012-11-01 04:47:54 1236992 ----a-westward- C:\windows\SysWow64\msxml3.dll
2012-10-16 08:38:37 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38:34 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39:52 561664 ----a-west- C:\windows\apppatch\AcLayers.dll
.
============= Cease: viii:44:10.06 ===============
Attached Files
-
attach.txt fourteen.43KB 0 downloads
-
Back to peak
BC AdBot (Login to Remove)
-
- BleepingComputer.com
- Register to remove ads
#two
nasdaq
-
- Malware Response Squad
- 47,793 posts
- OFFLINE
- Gender: Male
- Location: Montreal, QC. Canada
- Local time: 01:46 PM
Posted 17 January 2013 - 11:00 AM
Hello, Welcome to BleepingComputer.
I'm nasdaq and will exist helping you.
If you tin please print this topic it will make it easier for you to follow the instructions and consummate all of the necessary steps.
===
Distressing for this delay.
Some infection changes settings on your computer so that when yous launch an executable, a file ending with .exe, information technology will instead launch the infection rather than the desired program. To fix this we must kickoff download a Registry file that will ready these changes. From a clean computer, please download the post-obit file and salvage it to a removable media such as a CD/DVD, external Bulldoze, or USB wink drive.
FixNCR.reg http://download.bleepingcomputer.com/reg/FixNCR.reg
Once that file is downloaded and saved on a removable devices, insert the removable device into the infected computer and open the binder the drive letter associated with information technology. You lot should at present see the FixNCR.reg file that you had downloaded onto it. Double-click on the FixNCR.reg file to fix the Registry on your infected figurer. You should now be able to run your normal executable programs and tin can proceed to the next step.
If you lot do non have any removable media or another clean reckoner that you can download the FixNCR.reg file onto, you tin can try and download information technology to your infected computer using some other method. On the infected computer, right click on the Internet Explorer's icon, or any other browser'south icon, and select Run As or Run as Ambassador. If you lot are using Windows XP, you lot will be prompted to select a user and enter its password. It is suggested that y'all attempt to login every bit the Administrator user. For Windows 7 or Windows Vista, you will exist prompted to enter your Administrator business relationship password.
One time you enter the password, your browser volition start and y'all can download the above FixNCR.reg file. When saving it, make certain you lot save it to a binder that tin can exist accessed by your normal account. Remember, that you volition be launching the browser as some other user, and so if you save it to a My Documents binder, it volition not be your normal My Documents folder that it is downloaded into. Instead it will be the My Documents folder that belongs to the user y'all ran the browser equally. In one case the download has finished, close your browser and observe the FixNCR.reg file that you downloaded. Now double-click on it and permit the data to exist merged. You should now be able to run your normal executable programs and can proceed to the next step.
===
See if you can at present run the ComboFix tool.
You may be asked to exercise an update please do.
Mail the log if y'all can and let me know if you are now able to run .exe files.
- Back to top
#iii
KevinZ
- Topic Starter
-
- Members
- xx posts
- OFFLINE
- Local time: 10:46 AM
Posted 17 January 2013 - 11:06 AM
I will requite it a try nasdaq - thank you for your help. I will let yous know.
Kevin
- Dorsum to elevation
#4
KevinZ
- Topic Starter
-
- Members
- 20 posts
- OFFLINE
- Local time: 10:46 AM
Posted 17 January 2013 - 09:36 PM
Nasdaq,
After running FixNCR I am still unable to run exe files. I did get the response that "The keys and values in East:\FixNCR.reg have been successfully added to the registry." but when I go to run the exe files it does the exact aforementioned thing I described earlier. I ran information technology in safemode, I also ran it, rebooted and tried again. No alter.
Kevin
- Back to top
#five
nasdaq
-
- Malware Response Team
- 47,793 posts
- OFFLINE
- Gender: Male
- Location: Montreal, QC. Canada
- Local time: 01:46 PM
Posted 18 January 2013 - 01:25 PM
- Back to top
#6
KevinZ
- Topic Starter
-
- Members
- 20 posts
- OFFLINE
- Local time: 10:46 AM
Posted 18 Jan 2013 - 07:47 PM
Nasdaq I still become the same thing. Even later last known good configuration.
- Dorsum to pinnacle
#7
nasdaq
-
- Malware Response Team
- 47,793 posts
- OFFLINE
- Gender: Male person
- Location: Montreal, QC. Canada
- Local fourth dimension: 01:46 PM
Posted 19 January 2013 - 09:29 AM
Please download and run the post-obit tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are iii different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to correct click and cull Run as Admin
You just demand to get ane of them to run, not all of them.
rkill.exe
rkill.com
rkill.scr
It is possible that the infection you are trying to remove will not allow y'all to download files on the infected computer. If this is the case, then y'all will demand to download the files requested on another computer and then transfer them to the desktop of the infected computer. You lot can transfer the files via a CD/DVD, external bulldoze, or USB flash drive.
When completed information technology will create a log. Delight post the content on your next reply.
p.southward. get-go with the .com or .scr download file.
Try to run an .exe file.
Go on me posted.
- Back to height
#8
KevinZ
- Topic Starter
-
- Members
- 20 posts
- OFFLINE
- Local time: ten:46 AM
Posted 20 January 2013 - 01:31 AM
nasdaq,
I was able to run rkill.com. I have attached the txt of the log. I was still not able to run a exe later on information technology completed. Hopefully the log volition prove you why.
Kevin
Rkill two.4.6 by Lawrence Abrams (Grinler)
http://world wide web.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill tin can exist found at this link:
http://world wide web.bleepingcomputer.com/forums/topic308364.html
Program started at: 01/nineteen/2013 11:21:33 PM in x64 style.
Windows Version: Windows 7 Domicile Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to end.
Checking for processes to stop:
* C:\windows\system32\ThpSrv.exe (PID: 1896) [WD-HEUR]
i proccess terminated!
Checking Registry for malware related settings:
* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]
Backup Registry file created at:
C:\Users\gibason\Desktop\rkill\rkill-01-nineteen-2013-11-21-45.reg
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\exefile\shell\open\control\\IsolatedCommand was inverse. It was reset to "%1" %*!
* HKLM\Software\Classes\exefile\shell\runas\control\\IsolatedCommand was inverse. It was reset to "%1" %*!
Performing miscellaneous checks:
* Windows Defender Disabled
[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001
* Alert: ZEROACCESS rootkit symptoms plant!
* HKEY_CLASSES_ROOT\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32 [ZA Reg Hijack]
* HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 [ZA Reg Hijack]
* C:\$Recycle.Bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\ [ZA Dir]
* C:\$Recycle.Bin\Southward-one-five-18\$a3c7f05987bf105b8fe8c45a7615290e\@ [ZA File]
* C:\$Recycle.Bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\50\ [ZA Dir]
* C:\$Recycle.Bin\Due south-1-5-eighteen\$a3c7f05987bf105b8fe8c45a7615290e\n [ZA File]
* C:\$Recycle.Bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\U\ [ZA Dir]
* C:\$Recycle.Bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\U\00000001.@ [ZA File]
* C:\$Recycle.Bin\Due south-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\U\80000000.@ [ZA File]
* C:\$Recycle.Bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\U\800000cb.@ [ZA File]
* C:\$Recycle.Bin\S-1-five-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\ [ZA Dir]
* C:\$Recycle.Bin\S-ane-v-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\@ [ZA File]
* C:\$Recycle.Bin\S-1-5-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\L\ [ZA Dir]
* C:\$Recycle.Bin\South-1-five-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\n [ZA File]
* C:\$Recycle.Bin\S-1-5-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\U\ [ZA Dir]
Checking Windows Service Integrity:
* Windows Firewall Potency Driver (mpsdrv) is not Running.
Startup Type set to: Manual
* BFE [Missing Service]
* iphlpsvc [Missing Service]
* MpsSvc [Missing Service]
* WinDefend [Missing Service]
* wscsvc [Missing Service]
* SharedAccess [Missing ImagePath]
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* No problems found.
Programme finished at: 01/nineteen/2013 11:22:06 PM
Execution time: 0 hours(south), 0 minute(s), and 33 seconds(s)
Fastened Files
- Rkill.txt 6.39KB 2 downloads
Edited by nasdaq, 20 January 2013 - 12:02 PM.
Rkill log posted.
- Back to top
#nine
nasdaq
-
- Malware Response Squad
- 47,793 posts
- OFFLINE
- Gender: Male
- Location: Montreal, QC. Canada
- Local time: 01:46 PM
Posted 20 Jan 2013 - 12:07 PM
Y'all have a very bad ZeroAccess infection. May be a new variant.
Please download RogueKiller� by Tigzy from i of the links beneath and salvage information technology to your desktop.
Link 1 Bleepingcomputer
Link ii RogueKiller (par Tigzy)
Quit all running programs.
For Windows XP, double-click to offset.
For Vista or Windows 7, practise a right-click on the program, select Run as Ambassador to offset, & when prompted Allow to run.
Click Scan to browse the system.
When the browse completes > Close out the plan > Don't Fix anything!
Don't run any other options, they're non all bad!!!!!!!
Mail dorsum the report which should be located on your desktop.
====
If you are unable to run it, execute RKill again and without restarting the estimator try to run this RogueKiller tool.
Post the log if y'all can.
If possible do not restar the computer until I suggest a prepare.
- Back to peak
#10
KevinZ
- Topic Starter
-
- Members
- twenty posts
- OFFLINE
- Local time: x:46 AM
Posted 20 January 2013 - 02:36 PM
Unfortunately it won't allow me to run the exe of Rogue Killer. Even if I run the rkill first. i tried in safemode too.
- Back to top
#11
nasdaq
-
- Malware Response Team
- 47,793 posts
- OFFLINE
- Gender: Male person
- Location: Montreal, QC. Canada
- Local time: 01:46 PM
Posted 20 Jan 2013 - 02:42 PM
Become to this site:
http://dougknox.com/xp/file_assoc.htm
Download this file
EXE File Clan Fix (Restore default association for EXE files)
Follow the instructions on the page to extract and run the .reg file
===
If that fails to run any .exe file endeavor this.
What if you change the extention of the RogueKiller tool from .exe to .com?
- Back to meridian
#12
KevinZ
- Topic Starter
-
- Members
- xx posts
- OFFLINE
- Local fourth dimension: ten:46 AM
Posted 20 Jan 2013 - 10:37 PM
Ha! Nasdaq we are getting somewhere. Information technology would non let me run the nix file, but I was able to run Roguekiller after renaming information technology to .com. File is attached. I did not set anything and I will not restart the laptop until I hear back.
RogueKiller V8.iv.3 [Jan 10 2013] past Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows vii (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal way
User : gibason [Admin rights]
Style : Browse -- Date : 01/20/2013 20:29:44
¤¤¤ Bad processes : 1 ¤¤¤
[SVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe -> KILLED [TermProc]
¤¤¤ Registry Entries : vii ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : pcdfsvc (C:\ProgramData\pcdfdata\~!#7906.tmp /min) -> Plant
[RUN][SUSP PATH] HKUS\S-i-5-21-3142383209-4133851715-4028101743-grand[...]\Run : pcdfsvc (C:\ProgramData\pcdfdata\~!#7906.tmp /min) -> FOUND
[HJ Desk-bound] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (i) -> FOUND
[HJ Desk] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-i-5-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\north) -> FOUND
[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-five-18\$a3c7f05987bf105b8fe8c45a7615290e\n) -> FOUND
[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-v-18\$a3c7f05987bf105b8fe8c45a7615290e\n) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-18\$a3c7f05987bf105b8fe8c45a7615290e\n --> Institute
[ZeroAccess][FILE] n : C:\$recycle.bin\S-i-5-21-3142383209-4133851715-4028101743-1000\$a3c7f05987bf105b8fe8c45a7615290e\n --> Institute
[ZeroAccess][FILE] @ : C:\$recycle.bin\S-i-five-18\$a3c7f05987bf105b8fe8c45a7615290e\@ --> FOUND
[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-five-18\$a3c7f05987bf105b8fe8c45a7615290e\U --> Institute
[ZeroAccess][Folder] L : C:\$recycle.bin\S-ane-5-xviii\$a3c7f05987bf105b8fe8c45a7615290e\50 --> FOUND
¤¤¤ Driver : [Not LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK6475GSX +++++
--- User ---
[MBR] a7e0b95e3524175fc84db50334f68ff0
[BSP] 9ea1ced1571f36b81b112b3982abe1b2 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Get-go (sectors): 2048 | Size: 1500 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 593552 Mo
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Outset (sectors): 1218668544 | Size: 15427 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: Patriot Memory USB Device +++++
--- User ---
[MBR] e37bbf7b5a5a06e3f9a54609988855d2
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Lawmaking
Sectionalisation table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 8064 | Size: 7636 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[i]_S_01202013_02d2029.txt >>
RKreport[1]_S_01202013_02d2029.txt
Edited past nasdaq, 21 January 2013 - x:27 AM.
log posted.
- Back to peak
#xiii
nasdaq
-
- Malware Response Team
- 47,793 posts
- OFFLINE
- Gender: Male
- Location: Montreal, QC. Canada
- Local fourth dimension: 01:46 PM
Posted 21 January 2013 - ten:34 AM
Run the RogueKiller tool and remove everything that has been identified in the original log.
Can you now run .exe files?
- Back to top
#14
KevinZ
- Topic Starter
-
- Members
- xx posts
- OFFLINE
- Local time: 10:46 AM
Posted 21 Jan 2013 - 08:42 PM
ok so I removed everything with RogueKiller, just I notwithstanding cannot run exes. I renamed ComboFix to .com and it starts to run, but and then disappears and takes the desktop icon with it. I did this all in safemode because out of safemode RogueKiller would show the files removed, but would flash a zero access alarm sign.
- Back to top
#15
nasdaq
-
- Malware Response Team
- 47,793 posts
- OFFLINE
- Gender: Male
- Location: Montreal, QC. Canada
- Local fourth dimension: 01:46 PM
Posted 22 January 2013 - 08:34 AM
Endeavour to run this tool.
Change the filename from otl.exe to otl.com.
- Download OTL to your Desktop.
- Double click on the icon to run it. Brand certain all other windows are closed and to permit it run uninterrupted.
- When the window appears, underneath Output at the elevation alter information technology to Minimal Output.
- Check the boxes beside LOP Check and Purity Check.
- Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\system32\drivers\*.sys /90
%systemroot%\*. /mp /southward
c:\$recycle.bin\*.* /southward
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
explorer.exe
svchost.exe
userinit.exe
qmgr.dll
proquota.exe
kernel32.dll
ndis.sys
autochk.exe
spoolsv.exe
xmlprov.dll
ntmssvc.dll
mswsock.dll
Beep.SYS
ntfs.sys
termsrv.dll
sfcfiles.dll
st3shark.sys
ahcix86.sys
srsvc.dll
/md5stop
- Click the Run Scan push. Do not change whatsoever settings unless otherwise told to do so. The scan wont have long.
- When the scan completes, it volition open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location equally OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, 1 at a time, and post it with your adjacent respond. You may demand two posts to fit them all in.
===
- Back to top
Source: https://www.bleepingcomputer.com/forums/t/481495/virus-unable-to-run-any-exe-files/
0 Response to "Unable to Execute the Desired Program Pleaseget Another Copy of the Installer and Try Again"
Post a Comment