15 replies to this topic

[SuperiorBuff]

Can you please look at my RootRepeal logs and let me know if I have an issue? I am having problems with McAfee and SuperAntispyware crashing daily and MBAM, previously installed, will not run.

Attached Files

•  RootRepeal_report_06_15_09__14_08_52_.txt   2.72K   25 downloads

[miekiemoes]

Hi,

Please let rootrepeal delete the following:

Path: C:\WINDOWS\system32\MSIVXcount
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\MSIVXswligfggfwlsujbinwikkyjwfhdfjysu.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\MSIVXwbrinueaovamgxuesdbmfxknoesjqhkp.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\ijzhdmuq.sys
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\MSIVXuusdaqjrhddwmepvavvebathivlxobqe.sys
Status: Invisible to the Windows API!

Path: c:\documents and settings\kevin warman\local settings\temp\etilqs_ge6kceforodpxwzibuvm

Then after reboot, try to run MalwareBytes again and post the log in your next reply.

[SuperiorBuff]

Hi miekiemoes, Thanks for your help.

The logs are attached.

Attached Files

•  mbam_log_2009_06_16__09_37_46_.txt   3.23K   20 downloads

[miekiemoes]

Hi,

This is much better already, but I want an extra tool / log, this to doublecheck and remove other leftovers..

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingc...to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

[SuperiorBuff]

Whatever is on my PC will not allow combofix to download. I get a message that the disc is write protected then the browser can't find the download site. I saved it to our network but get the same error message when trying to copy it to my desktop even after renaming it.

[miekiemoes]

Ok, please delete the file again from your desktop and try this way..

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
  • Tools->Options->Main tab
    
  • Set to "Always ask me where to Save the files".
• During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  
  
• It is important you rename Combofix during the download, but not after.
  
• Please do not rename Combofix to other names, but only to the one indicated.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combo-Fix.exe & follow the prompts.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

[SuperiorBuff]

No luck, I get a can not copy error that says "Cannot copy ComboFix [1]: Access is Denied. I tried a second time to make sure that I changed the name to Combo-Fix and received the same error.

[miekiemoes]

You're doing something wrong imho.
Did you also disable your Mcafee? Because I know McAfee blocks it.

Try it again from Windows safe mode with networking support and make sure all references of Combofix are deleted and you do it exactly the way I describe.

[SuperiorBuff]

I had disabled McAfee earlier and the time limit must have expired.

The logs are attached.

Attached Files

•  ComboFix.txt   13.91K   13 downloads

[miekiemoes]

Hi,

Please make sure McAfee is disabled, because I see in your log it's interfering with Combofix already. If it's causing too many issues, it may be better to temporary uninstall, just to make sure it doens't break anything while running Combofix.

Then, * Open notepad - don't use any other texteditor than notepad or the script will fail.
Copy/paste the text in the quotebox below into notepad:

Quote

File::
c:\windows\system32\drivers\ijzhdmuq.sys
Driver::
vatubisq

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.



This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

[SuperiorBuff]

I did end up having to uninstall McAfee. The log is attached.

Attached Files

•  ComboFix.txt   13.94K   21 downloads

[miekiemoes]

Hi,

I already thought that would be needed to uninstall McAfee. I normally post this already along with my combofix post if I see McAfee installed, but wanted to see if it still interfered with Combofix that much.

This looks OK again.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

[SuperiorBuff]

Done. Thanks a ton, I don't see any of the issues that I was having. I would like to know how to get the add ons working in IE again. The Manage Add Ons selection under Tools is grayed out.

[miekiemoes]

Quote

I would like to know how to get the add ons working in IE again. The Manage Add Ons selection under Tools is grayed out.

Do you have the same when you run IE from start > run?
So go to start > run and type: iexplore.exe there.
If you dont have the same problem, then you need to replace your IE shortcut.
http://www.tipandtrick.net/2008/restore-mi...windows-xp-sp3/
Or just create a shortcut from C:\program Files\Internet Explorer\iexplore.exe

[miekiemoes]

Still with us?

[miekiemoes]

Due to the lack of feedback, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.