MalWare Removal Forum

Hi GhostRider11,

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
• Click the Re-enable button to re-enable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

Remove GMER

Delete the GMER icon from your desktop.

Clean up with OTL

• Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

Create a new, clean System Restore point which you can use in case of future system problems:

• Press Start >> All Programs >> Accessories >>System Tools >> System Restore
• Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
• Now remove old, infected System Restore points:
• Next click Start >> Run and type cleanmgr in the box and press OK
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
• Press OK and Yes to confirm

Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Happy surfing and stay clean!

I've done everything except this step: Press Start >> All Programs >> Accessories >>System Tools >> System Restore
It gave me an error... I will show you some screens (Sorry for the language, it is italian, if you need help to translate tell me)




_________________

Hi GhostRider11,



Here are some instructions that are better suited to Windows 7, please let me know how you get on.

Create a System Restore Point

1. Right-click on Computer ... select Properties.
2. In the left pane under Tasks ... click System protection.
   If UAC prompts for an administrator password or approval, type the password or give your "permission to continue".
3. Select System Protection ...then choose Create.
4. In the System Restore dialog box, type a description for the restore point ... click Create, again.
   A window will pop up with "The Restore Point was created successfully" confirmation message.
5. Click OK ...then close the System Restore dialog.
   Now you have a clean restore point to use if you need to restore your system.

Perform Disk Cleanup
Note: You have to have administrative rights to run Disk Cleanup for "All" users.

1. Click the Start... button. Type disk in the Start Search text entry box.
2. Double click the Disk Cleanup entry, from the matching program list.
3. In the Disk Cleanup options...select "Files from all users on this computer"
   If the Disk Cleanup: Drive Selection dialog box appears:
   • Select the drive where Windows Vista is installed. (Normally, this would be C:\ drive)
   • Press the "OK"...button.
   Disk Cleanup will begin space saving calculations.
4. When the calculations are finished... Press the More Options tab.
5. In the "System Restore and Shadow Copies" section... select "Clean up" button.
6. Press the "Delete"... button, at the "Are you sure..." prompt.
   Disk Cleanup will begin cleaning up old files and restore points.
7. Exit Disk Cleanup.
   This will remove all restore points except the one you just created.

Same error...

Create a System Restore Point

1. Right-click on Computer ... select Properties.
2. In the left pane under Tasks ... click System protection.

When I click System protection gave me exactly the same error as the 2nd screen before
_________________

Could you translate the errors for me please ?

The first screen says:

There isn't any system restore point on your computer. To create one, open System Protection.

The second screen says:

Unexpected error of the page of properties:

Error of System restore. Retry to run
System restore. (0x81000203)

Close the page of properties and retry.

Hi GhostRider11,

1. Click on Start button, now type in services.msc in the search programs and files and hit enter.
   
2. Now you need to check for the “volume shadow copy” service present in the services windows.
   
3. After selecting the “volume shadow copy” service you need to right click on the service and select properties and make the startup type as automatic and start the service.
   
4. Click ok, restart the computer.

Now please try again and let me know.

Same error :-(

Hi GhostRider11,

Download SystemLook and save it to your Desktop.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:
  :service
  VSS
  
• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook 30.07.11 by jpshortstuff
Log created at 23:31 on 17/03/2012 by Remus
Administrator - Elevation successful

========== service ==========

VSS
Copia shadow del volume
"Gestisce e implementa le copie shadow del volume utilizzate a scopo di backup e altro. Se il servizio è stato arrestato, le copie shadow non saranno disponibili per il backup e il backup potrebbe non riuscire. Se il servizio è disabilitato, i servizi da esso dipendenti non verranno avviati."
Current Status: Stopped
Startup Type: Automatic
Error Control: Severe
Binary: C:\Windows\system32\vssvc.exe
Group: (none)
SafeBoot:
Dependencies:
->RPCSS
Dependant Services:
(none)

-= EOF =-

Hi GhostRider11,



There is the problem, the VSS service (Copia shadow del volume) is set to automatic start but it is stopped.

This is not a malware issue but what I would recommend is to follow the Microsoft knowledge base article here
to run sfc /scannow to attempt to fix the VSS service.

If that does not resolve the issue, then try again to create a system restore point then check the event logs and post any related entries in your next post.

It says that nothing is missing and everything is fine...
Then i retry to do system restore point but the same problem.

Hi GhostRider11,



Not a Malware Issue
Your remainig issue does not appear to be "malware" related. The Malware Removal forum deals with removing malware.
I suggest you try a PC troubleshooting forum. Links for some are provided below.
These sites have a variety of experts, that are better equipped to investigate and resolve these kinds of issues.
Registration is free, it only takes a few minutes.
The Elder Geek on Windows
BleepingComputer.com
WhattheTech...formerly TomCoyote

If you have any questions or require additional malware help, please let me know.

Thank you a lot for helping me during these days to clean my PC.
I will look up in those sites to make a system restore point.

You're welcome!