Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Hijackthis log

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Hijackthis log

Unread postby melboy » May 23rd, 2011, 7:30 pm

Hi

Doesn't seem to have effected anything.

Do you mean the general workings of the computer, or the symptoms of the malware?

It shouldn't have impacted on the running of the computer, but should have alleviated the symptoms of the malware - Let me know how things are running. ;)



aswMBR

You should still have this on your desktop.

  • Double click aswMBR.exe to run it.
  • Click the Scan button.
  • After a short while when the scan reports "Scan finished successfully", click Save log & save the log to your desktop.
  • Click OK
  • Click EXIT.
  • Copy & Paste the contents of aswMBR.txt into your next reply.


SystemLook

You should still have this on your desktop.

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code: Select all
    :filefind
    beep.*
    Winur57.sys
    Winwm12.sys

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK
Advertisement
Register to Remove

Re: Hijackthis log

Unread postby mavrik8511 » May 23rd, 2011, 8:49 pm

Everything seems to be working normally! No script errors, no background ads. Computer itself seems to be faster!

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-23 17:39:10
-----------------------------
17:39:10.701 OS Version: Windows 5.1.2600 Service Pack 3
17:39:10.701 Number of processors: 2 586 0x604
17:39:10.701 ComputerName: D7YJVNB1 UserName: Maverick
17:39:11.013 Initialize success
17:39:16.998 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
17:39:16.998 Disk 0 Vendor: HDS728080PLA380 PF2OA63A Size: 76293MB BusType: 3
17:39:19.029 Disk 0 MBR read successfully
17:39:19.029 Disk 0 MBR scan
17:39:19.044 Disk 0 unknown MBR code
17:39:21.044 Disk 0 scanning sectors +156232125
17:39:21.076 Disk 0 scanning C:\WINDOWS\system32\drivers
17:39:30.201 Service scanning
17:39:31.216 Disk 0 trace - called modules:
17:39:31.232 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:39:31.248 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a24bab8]
17:39:31.248 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8a299b00]
17:39:31.248 Scan finished successfully
17:39:44.201 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Maverick\Desktop\MBR.dat"
17:39:44.201 The log file has been saved successfully to "C:\Documents and Settings\Maverick\Desktop\aswMBR.txt"


SystemLook 04.09.10 by jpshortstuff
Log created at 17:44 on 23/05/2011 by Maverick
Administrator - Elevation successful

========== filefind ==========

Searching for "beep.*"
C:\i386\beep.sys --a--c- 4224 bytes [14:52 31/08/2006] [10:00 04/08/2004] DA1F27D85E0D1525F6621372E7B685E9
C:\WINDOWS\system32\beep.sys --a--c- 4224 bytes [16:33 22/07/2008] [10:00 04/08/2004] DA1F27D85E0D1525F6621372E7B685E9

Searching for "Winur57.sys"
No files found.

Searching for "Winwm12.sys"
No files found.

-= EOF =-
mavrik8511
Active Member
 
Posts: 9
Joined: May 18th, 2011, 10:17 pm

Re: Hijackthis log

Unread postby melboy » May 24th, 2011, 3:49 pm

Hi

Good. Keep me updated on how things are running - We should be nearly done soon.



COMBOFIX-Script

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.

If combofix prompts you that an update is available, please allow it to update.


  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Code: Select all
    FCOPY::
    c:\windows\system32\beep.sys | c:\windows\System32\drivers\beep.sys 
    c:\windows\system32\beep.sys | c:\windows\system32\dllcache\beep.sys
    

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    Image
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Hijackthis log

Unread postby melboy » May 26th, 2011, 4:49 pm

Hi mavrik8511

It has been two days since my last post.

  • Do you still need help?
  • Do you need more time?
  • Are you having problems following my instructions?
  • According to Malware Removal's latest policy, topics can be closed after 3 days without a response. If you do not reply within the next 24 hours, this topic will be closed.
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Hijackthis log

Unread postby Cypher » May 28th, 2011, 5:32 am

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 14959
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 13 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware