Originally posted by narcismo:

---

Hey folks, I got a tough one to remove. I ran every everything i could, but it's still hanging on my machine. So I'm respectfully asking for a little help. I ran ...
Superantispyware
Comodo av
Malwearebytes
Panda Scan
Housecall
Hijack This
KillBox
Combo Fix (wouldn't run)
and of course defragged, and scrubbed everything as clean as possible between scans.
Thanks 1,000,000 in advance
Narcismo

---

Originally posted by narcismo:

---

Originally posted by narcismo:

---

Hey folks, I got a tough one to remove. I ran every everything i could, but it's still hanging on my machine. So I'm respectfully asking for a little help. I ran ...
Superantispyware
Comodo av
Malwearebytes
Panda Scan
Housecall
Hijack This
KillBox
Combo Fix (wouldn't run)
and of course defragged, and scrubbed everything as clean as possible between scans.
Thanks 1,000,000 in advance
Narcismo

---

WhiteSmoke and Sweetpacks toolbars(not sure where they came from) wont uninstall, Java won't update, pop-ups everywhere, computer slow and slower, pages being redirected.
This is frustrating. Maybe I should just re-format this thing and count my losses. I'll, loose a lot of stuff... man this is a bummer...

---

Originally posted by narcismo:

---

it tells me the system is inaccessible of encrypted. cant access.

---

Originally posted by 2oldGeek:

---

Let?s try AntiVir Rescue disk

Using a clean computer:
Use this guide to download and burn a rescue disk to, hopefully,clean your machine enough that we can work with it to finishing cleaning:
http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163

Let me know the outcome and we will see???.

I hope not here but, there is one ?Bad? rootkit out there that completely destroys the operating system making it impossible to repair. It?s called ZeroAccess Rootkit.

2oG

---

Originally posted by 2oldGeek:

---

Looks like a Chinese fire drill!

Tell me what you got done and how it's doing?
all the info you got... please

2oG

---

Originally posted by 2oldGeek:

---

Well Narcismo,

It appears that your operating system has taken a beating and I have little faith in returning it to good condition.

First try to run this one and then maybe we can see if it would do any good to run the rescue disc.

--AdwCleaner--

Please download AdwCleaner by Xplode to your Desktop.
? Close all open programs and internet browsers.
? Double click on AdwCleaner.exe to run the tool.
? Click on Delete tab follow the prompts.
? A log file will automatically open after the scan has finished.
? Please post the content of that log file with your next answer.
? You can find the log file at C:\AdwCleaner[Rn].txt (n is a number).


2oG

---

Originally posted by 2oldGeek:

---

Well Narcismo,

It appears that your operating system has taken a beating and I have little faith in returning it to good condition.

First try to run this one and then maybe we can see if it would do any good to run the rescue disc.

--AdwCleaner--

Please download AdwCleaner by Xplode to your Desktop.
? Close all open programs and internet browsers.
? Double click on AdwCleaner.exe to run the tool.
? Click on Delete tab follow the prompts.
? A log file will automatically open after the scan has finished.
? Please post the content of that log file with your next answer.
? You can find the log file at C:\AdwCleaner[Rn].txt (n is a number).


2oG

---

Originally posted by 2oldGeek:

---

check my last post

Originally posted by 2oldGeek:

---

Well Narcismo,

It appears that your operating system has taken a beating and I have little faith in returning it to good condition.

First try to run this one and then maybe we can see if it would do any good to run the rescue disc.

--AdwCleaner--

Please download AdwCleaner by Xplode to your Desktop.
? Close all open programs and internet browsers.
? Double click on AdwCleaner.exe to run the tool.
? Click on Delete tab follow the prompts.
? A log file will automatically open after the scan has finished.
? Please post the content of that log file with your next answer.
? You can find the log file at C:\AdwCleaner[Rn].txt (n is a number).


2oG

---

---

Originally posted by 2oldGeek:

---

narcismo, I didn't see it in the list you gave.. But would like to run it again after MBAR.

If we're going to clean you like an Old Maid's Parlor we have to run a few more :)

You said you didn't get Combofix to work I may have you run it later.

After you run AdwCleaner, here's some more and post the logs back to me:

--JRT--

Please download Junkware Removal Tool to your Desktop.
? Please close your security software to avoid potential conflicts.
? Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
? The tool will open and start scanning your system.
? Please be patient as this can take a while to complete, depending on your system's specifications.
? On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
? Please post the contents of JRT.txt into your reply.



--RogueKiller--

? Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
? Quit all programs that you may have started.
? Please disconnect any USB or external drives from the computer before you run this scan!
? For Vista or Windows 7, right-click and select "Run as Administrator to start"
? For Windows XP, double-click to start.
? Wait until pre-scan has finished ...
? Then Click on "Scan" button
? Wait until the Status box shows "Scan Finished"
? click on "delete"
? Wait until the Status box shows "Deleting Finished"
? Click on "Report" and copy/paste the content of the Notepad into your next reply.
? The log should be found in RKreport[1].txt on your Desktop
? Exit/Close RogueKiller+


--OTL--
Please download OTL by OldTimer to your Desktop.

If you already have a copy of OTL delete it and use this version.
? Double click OTL.exe to launch the program.
? Check the following.
o Scan all users.
o Standard Output.
o Lop check.
o Purity check.
? Under Extra Registry section, select Use SafeList
? Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).
? When finished it will produce two logs.
o OTL.txt (open on your desktop).
o Extras.txt (minimised in your taskbar)
? Please post me both logs


Please paste the logs in your next reply.
Let me know what problem persists.

2oG

---

Originally posted by 2oldGeek:

---

narcismo,

Well your looking better.. I found an alternate data stream in a Temp file and your MBR master boot record seems a little screwed up. It will take me some time to analize the OTL Logs and build a fix for you so don't give up :)

I was thinking that the avira rescue disc will repair your MBR so it might be a good idea now to go ahead and run it. You just need to follow the guide that I had you DL. It takes 30 minutes+ to run and when finished you can download Avira Free, turn off your Comodo AV and install and scan with Avira. when done you can just uninstall Avira and go back to your Comodo.

I'll be working on a OTL Fix and will get it to you as soon as I can. I guess you can see from the size of the OTL logs that it is like eating an elephant.. just one small byte at a time. lol

Go ahead and run the Avira rescue disc and we'll move right along...

till later,
2oG

---

Originally posted by narcismo:

---

Originally posted by 2oldGeek:

---

narcismo,

Well your looking better.. I found an alternate data stream in a Temp file and your MBR master boot record seems a little screwed up. It will take me some time to analize the OTL Logs and build a fix for you so don't give up :)

I was thinking that the avira rescue disc will repair your MBR so it might be a good idea now to go ahead and run it. You just need to follow the guide that I had you DL. It takes 30 minutes+ to run and when finished you can download Avira Free, turn off your Comodo AV and install and scan with Avira. when done you can just uninstall Avira and go back to your Comodo.

I'll be working on a OTL Fix and will get it to you as soon as I can. I guess you can see from the size of the OTL logs that it is like eating an elephant.. just one small byte at a time. lol

Go ahead and run the Avira rescue disc and we'll move right along...

till later,
2oG

---

Thanks 1,000,000 2oG. I obviously cant read your OTL Logs, but I know what "ERROR" means, and there were a ton. Not Good I know.
My problem now is... I dont have access to a clean machine until tomorrow. Should I go for that Rescue Disc now, on what I have? Or wait ?
Thanks
Narcismo

P.S. I ran another Mbar Scan(negative) and RogueKiller (showed the same results, -the fake). Heres a HJT wich looks fine...

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:07:02 PM, on 9/21/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Comodo\Dragon\dragon_updater.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\COMODO\COMODO Internet Security\cis.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\My Documents\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s...ash/swflash.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 6341 bytes

---

Originally posted by 2oldGeek:

---

If you were able to burn the cd from that computer, it's probably ok to run it..
The only thing I was concerned about was your MBR boot record. Does it boot and load the windows OK? If it boots ok then it's your choice.. If I had trouble with it booting, I'd run it....

Edit I decided to skip the otl fix for the moment and see how you are running and if you have any problems please let me know..


2oG

---

Originally posted by narcismo:

---

Originally posted by 2oldGeek:

---

If you were able to burn the cd from that computer, it's probably ok to run it..
The only thing I was concerned about was your MBR boot record. Does it boot and load the windows OK? If it boots ok then it's your choice.. If I had trouble with it booting, I'd run it....

Edit I decided to skip the otl fix for the moment and see how you are running and if you have any problems please let me know..


2oG

---

Hi 2oG, sorry for the slow reply, it's been one of those days. I haven't had a chance to make a rescue disk from a different machine yet. Not enough hours in the day.
However I had no trouble at all making one with this machine. My comp boots just fine, never had trouble in that area. I'll boot up from the rescue disk if you want. Unless you have a different idea.
Honestly it's been running fine, not sure for how long, but so far so good.
Let me know what your thinking, thanks again.
Narcismo

---

Originally posted by 2oldGeek:

---

Originally posted by narcismo:

---

Originally posted by 2oldGeek:

---

If you were able to burn the cd from that computer, it's probably ok to run it..
The only thing I was concerned about was your MBR boot record. Does it boot and load the windows OK? If it boots ok then it's your choice.. If I had trouble with it booting, I'd run it....

Edit I decided to skip the otl fix for the moment and see how you are running and if you have any problems please let me know..


2oG

---

Hi 2oG, sorry for the slow reply, it's been one of those days. I haven't had a chance to make a rescue disk from a different machine yet. Not enough hours in the day.
However I had no trouble at all making one with this machine. My comp boots just fine, never had trouble in that area. I'll boot up from the rescue disk if you want. Unless you have a different idea.
Honestly it's been running fine, not sure for how long, but so far so good.
Let me know what your thinking, thanks again.
Narcismo

---

Yeah, I know what you mean about one of those days. me too

I wouldn't worry about doing anything else if it seems to be running ok without errors.
Just let it be for a few days and if no problems show up skip the rescue. If it does give problems, you can always run it. Then give me a shout on here...

Happy Computing,
2oG

---

Originally posted by 2oldGeek:

---

The only thing I was concerned about was your MBR boot record.

---