Vista - BSOD + other issues

[Odd dude]

Hi Joe

will look through the cf log later, however the message you got is bad - it may mean your hard drive is failing, which means you'll have to replace it as soon as possible.

to check:
click start>run (or press windows key+r), copy and paste

Code: Select all

chkdsk c: /r/f/v

press ctrl+shift+enter and allow the UAC prompt

if the computer asks you whether you want the check to schedule on reboot answer Y and press enter, then reboot the comp. (it will then perform a disk test and will be unusable for ~half an hour)

log will be located in the event viewer, to access:
click start>run (or press windows key+r), copy and paste:

Code: Select all

eventvwr

click ok

the log will be on the tab labeled 'system' - double click the relevant entry and copy and paste the contents of the report in your next post (I only require the information in the lower pane of the window which opens once you double click the entry - it should say chkdsk has run and it will show a small report)

[jsam]

I tried running the chkdsk command you provide several times but nothing happened. I am using Vista. Not sure if it works the same way. I used the F8 button during booting to get to "Startup Repair". Then ran chkdsk again (with the switches). It asked me whether i wanted to recheck next time I rebooted. So something worked. I said Yes. When it rebooted nothing happens. I went through this cycle 4 times.
So I stopped and ran the eventwr command anyway. Got to the System folder. It had several recent information entries but none related to chdsk.

I looked under Administrative event and found this:

The following boot-start or system-start driver(s) failed to load:
ntcdrdrv
tclondrv

The npkcrypt service failed to start due to the following error:
The system cannot find the file specified.

I realize this is not what you asked for but since I could not get the chkdsk log, I am providing you other info that may yield some clues?

Joe

[Odd dude]

Hi Joe

I'm not sure what is going on there, however I can say that it looks like your hard drive may be in need of replacement. I strongly urge you to back up any important files, because if this is the case, then you may just at one time fire up your computer and notice Windows fails to start and a bunch of system files (and personal files too) might be missing! (I've been there )

I will ask whether chkdsk needs to be run differently in Vista. In the meantime, please back up any personal files.

In case I'm wrong and all this is just a hiccup, post a new hijackthis log and a new uninstall list. However, it is of critical importance that you make backups NOW!

If you use an USB flash drive (can be USB HDD, can be memory stick, .....) run this tool first just to be safe (after all, we are talking about a computer which has been attacked by malware):
Flash_Disinfector
Download Flash_Disinfector by sUBs.

• Disconnect from the internet and disable all antivirus/antimalware programs. That ensures they won't interfere.
• Run Flash_Disinfector. When asked, plug in the flash drive.
• Your desktop will disappear as the program starts cleaning the flash drives.
• When done, a message box will appear. Click OK
• If your desktop does not come up, press Ctrl + Shift + Esc to bring up Task Manager. Click File > New task (Run...) and enter:
  

  Code: Select all

  explorer

• Then click OK and your desktop will appear.

Summary of what I want you to do:
- (only if you use an external drive for backups) run flash_disinfector
- make backups (if your medium isn't big enough to hold everything you can use WinRAR to compress and split up your backups
- post a new HJT log and a new uninstall list

[Odd dude]

In addition to the above - do you still have your Windows Vista DVD?

[jsam]

I will do as you have indicated later today and post a new HJT log. I never got a Windows Vista DVD with my Dell Laptop system (it is 2 to 3 years old).

Thanks again

Joe

[jsam]

Hi

I tried to download the Flash Disinfector but McAfee prevented me from downloading it. Should I try again with McAfee turned off?

Meanwhile here are the logs

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:46:55 AM, on 3/8/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Common Files\AOL\1178322383\ee\aolsoftware.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\McAfee\Anti-Theft\McPvTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Rajiv\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1178322383\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [McPvTray] C:\Program Files\McAfee\Anti-Theft\McPvTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Rajiv\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Startup: QuickSet.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O15 - Trusted Zone: http://download.windowsupdate.com
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Google Update Service (gupdate1c98fc2ec2bb25e) (gupdate1c98fc2ec2bb25e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\Windows\SYSTEM32\Rpcnet.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 8108 bytes
------------------


List of progams

¡En español! Level 1 Take-Home Tutor
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.1.0
Adobe Shockwave Player 11
AGEIA PhysX v7.09.13
AIM 6
Apple Software Update
ArcSoft PhotoImpression 5
Bonjour
CDisplay 1.7
Conexant HDA D110 MDC V.92 Modem
Corel Snapfire Plus
Creative MediaSource 5
Dell Games
Dell Support Center (Support Software)
Dell System Customization Wizard
Dell Wireless WLAN Card
DellSupport
Digital Line Detect
Documentation & Support Launcher
E.M. DVD Copy 2.01
EPSON Printer Software
EPSON Scan
EPSON Stylus CX5000 Scanner Driver Update
Games, Music, & Photos Launcher
Google Gears
Google Update Helper
HijackThis 2.0.2
Inpaint
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 12
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
LiveUpdate Notice (Symantec Corporation)
Macromedia Dreamweaver 8
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
McAfee Anti-Theft
McAfee SecurityCenter
MediaDirect
Microsoft Combat Flight Simulator 3.0
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft SharedView
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Modem Diagnostic Tool
Mozilla Firefox (3.0.7)
Mozilla Thunderbird (2.0.0.19)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
NetWaiting
Nuclear Coffee - ConvertVid
OutlookAddinSetup
Photosynth 2.0.1403.12
Picasa 3
QuickSet
QuickTime
Ringtone Maker 1.1
RocketDock 1.3.5
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Drag-to-Disc
Roxio MyDVD DE
Roxio Update Manager
SAMSUNG Mobile Composite Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio
Samsung New PC Studio
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
SharpReader 0.9.7.0
SigmaTel Audio
Smart Defrag 1.10
Sonic Activation Module
Sound Blaster Audigy ADVANCED MB
Synaptics Pointing Device Driver
System Requirements Lab
TextAloud
Thinkwell
Unreal Tournament 3
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Access 2007 Help (KB957241)
Update for Microsoft Office Excel 2007 Help (KB957242)
Update for Microsoft Office InfoPath 2007 Help (KB957243)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Publisher 2007 Help (KB957249)
Update for Microsoft Office Word 2007 Help (KB957252)
Update for Microsoft Script Editor Help (KB957253)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb959634)
User's Guides
WIDCOMM Bluetooth Software 6.0.1.3100
Windows Media Player Firefox Plugin
WinZip 12.0

[Odd dude]

Yes, please try with Mcafee disabled.

HJT looks fine.

You can open hijackthis, click do a system scan only, and fix this line:
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
It's not bad but a leftover. Doesn't hurt to fix.

Uninstall these through add/remove:
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6

you already have the latest version



I would like to retry a disk check, as it's important.

Right click Computer>properties>Tools>Error checking>if you see anything like 'do an extensive test for bad clusters' (I don't know how it's called in vista) mark that. if you see anything like 'automatically fix errors' mark that too. then click check now.
If asked to reboot say yes and tell me whether you have seen it run a scan (black DOS-like screen with the Vista logo on top saying "chkdsk is ..... (doing something)").

[jsam]

Thanks.

I completed these steps:
----------------------
You can open hijackthis, click do a system scan only, and fix this line:
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
It's not bad but a leftover. Doesn't hurt to fix.

Uninstall these through add/remove:
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
------------------------

I was unable to download the Flash Disinfector. Even with McAfee turned off, now I cannot get to that site. I was able to the first time but McAfee cut me off. I wonder if that site is now permanently blocked for me?
-------------------------

I did to these steps:
Right click Computer>properties>Tools>Error checking>'do an extensive test for bad clusters' (I don't know how it's called in vista) mark that. if you see anything like 'automatically fix errors' mark that too. then click check now.
If asked to reboot say yes and tell me whether you have seen it run a scan
---------
But when I reboot nothing happens. I did this twice.

So I ran just the plain chkdsk command from the command line. That worked, in read-only mode. A black DOS screen popped up. It ran I saw the %age covered increasing 43, 55, etc. I saw that the errors flagged was zero. Then it finished and the black screen went away. No leftover screen messages. I checked the Event Viewer and don't see any logs relating to Chkdsk.

Joe

[jsam]

I was able to download and run Flash Disinfector. It ran, asked me to plug in my USB drive. It came back very quickly with a "Done" message.

Joe

[jsam]

I also ran the chkdsk c: /r/f/v command as Administrator and said Yes to check next time the PC booted. When the PC rebooted no black screen popped up.

Joe

[Odd dude]

OK.

I am not surprised that there are no errors found - when in read-only mode chkdsk does not perform the extensive read/write test, which is the test we need.

There are two things we can do.

1) You can manually create a rescue CD containing the Vista Recovery Environment and run chkdsk from there to obtain the extensive report which is needed.
2) We can leave this be, however if your hard drive is indeed corrupting and we don't find out, you may one day just find yourself in a very sticky situation.

I, of course, strongly recommend option #1, but if you don't wish to go through the hassle and don't have anything important on this PC, you may want to opt for option 2.

Logs are clean malware-wise.

Let's first clean up used tools + I will give you the standard all clear post. Then I can, if you wish me to do so, provide instructions for making the recovery cd and obtaining the report.

Clean up tools

• Flash_Disinfector: no longer needed - just delete the file
• Malwarebytes Anti-Malware: great tool, I recommend running a quick scan once a week. You can uninstall it if you wish
• GMER: Click start>run, copy and paste:
  

  Code: Select all

  gmer_uninstall

  
  Press Ctrl+Shift+Enter to run the command with administrative privileges
• Combofix: Disable antimalware software, click start>run, copy and paste:
  

  Code: Select all

  Combofix /u

  
  Press Ctrl+Shift+Enter
  Reenable antimalware software

Standard all clear post

Congratulations! As far as I can tell, you are CLEAN!




Have a big cup of , sit back & relax, and now please follow a few of the following tips; they will dramatically reduce your chance of getting infected again.

• Turn on Automatic Updates if you have not done so. It is MANDATORY to keep your Windows updated, otherwise you are vulnerable to exploits! To turn on Automatic Updates: click Start > Control Panel > Security Centre > Automatic Updates.

Below are optional items. They will increase your security, but are not really "needed". That said, I recommend following at least one of these tips.

• Install WinPatrol from here. Instructions for use are here.
  
  
• Install a custom hosts file. Let's say I have a directory of 640kb's worth of bad sites. Let's say I can make sure you will never be able to access those sites, so you will never get any infection from those sites. It's like blocking a site - without site blocking tools. How would you like to never be able to visit (a lot, but not all of the) malware-infected sites again? Well, now you can!
  First, we must disable a service, as Windows cannot work with a very large hosts file while that service is active. This will not affect anything else.
  The disabling routine:
  
  • Click Start, then Run
  • Copy and paste the following:
    

    Code: Select all

    sc config dnscache start= disabled

  • Click OK
  Next, you can download the custom hosts file from here. Installation instructions can be found there as well.

Let me know what you want to do re chkdsk

[Odd dude]

Do you still need help?

If you haven't responded in 48hrs I will assume you have decided to leave the situation as is and choose to not make the rescue cd to perform that disk check.

[jsam]

Yes. I would like to do both items you have suggested. How should I proceed?

Can I do #2 first and close out the malware issue and then come to #1 or do #1 first?


Joe

[Odd dude]

Malware issue already has been closed out, so let's skip to the disk check

Click Start > All programs > Maintenance > Create a Recovery Disc.

Follow instructions there. (You'll need a writable cd-rom).

Stick the CD into the disc drive and reboot. If needed, adjust the BIOS settings to set the CD-ROM as the first boot device. See if you can start up from the CD.

[Odd dude]

Do you still need help?