-
-
-
Hi Ken,
30 minutes ago the timer on eset rolled from 2400 to zero. 2 hours ago it appeared to still be looking at files. It has been at 99% all day. Now it is stuck on a file named USA_Canada_and_Mexico_P.zip with no threats found?
Kevin
-
As I hit submit, it started scanning 256048 files scanned.
-
Lets try to run Malwarebytes again
Run this program first
- Please download rkill (Courtesy of Bleepingcomputer.com).
- There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
- Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
- Note: You only need to get one of the tools to run, not all of them.
- Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.
Run rkill repeatedly until it's able to do it's job. This may take a few tries.
You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.
Please download Malwarebytes from Here or Here
- Double-click mbam-setup.exe and follow the prompts to install the program.
- At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select Perform quick scan, then click Scan.
- When the scan is complete, click OK, then Show Results to view the results.
- Be sure that everything is checked, and click Remove Selected .
- When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
- Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please
-
-
Yes, you said it found no threats, we can run it again later or try a different one
-
I can get rkill to run. Sometimes it finds nothing. Sometimes it finds below.
This log file is located at E:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Rkill was run on 02/01/2012 at 18:22:59.
Operating System: Windows 7 Home Premium
Processes terminated by Rkill or while it was running:
E:\Windows\system32\SearchProtocolHost.exe
E:\Windows\system32\SearchFilterHost.exe
E:\Windows\System32\InfDefaultInstall.exe
E:\Windows\system32\runonce.exe
Rkill completed on 02/01/2012 at 18:23:20.
When I dnld and run mbam install as admin it installs, when the install completes it looks like an update window pops up for 1/2 sec then goes away. Then a window pops that says mbam out of date xx days do you want to update, if I click yes the update window shows for 1/2 sec then disappears, if I click no on the update, mbam opens. If I go into mbam and click on the update tab, the update window pops again for 1/2 sec then mbam goes away. If I open mbam and try a scan it immediately closes. This is what I tried the day I discovered the emails had been sent and it is still the same?
-
Lets see if Combofix will run, try it in normal windows and if it wont run boot to safemode
To Enter Safemode
- Go to Start> Shut off your Computer> Restart
- As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu. - Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
- Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
- See this Link for programs that need to be disabled and instruction on how to disable them.
- Remember to re-enable them when we're done.
- Double click on ComboFix.exe & follow the prompts.
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
-
This is getting disheartening, I don't feel like I have been able to give you anything to even look at. Kinda reenforces my scorched earth take on it in the beginning. If this had not required two installs, XP then the 7 upgrade, it would be done.
I'm posting this from a netbook. The infected machine dnld'd combofix and fired it up in normal mode with no trouble. It states typically a 10 minute run maybe double. In 45 minutes that's still what it said so I booted into safe mode and It has been running for 25 minutes in the same condition with no HD activity.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
0MB )mb No Media USB MBR
button.
to download the ESET Smart Installer. Save it to your desktop.
icon on your desktop.
button.
, and save the file to your desktop using a unique name, such as
button.
