Malware Discussions

[fussyfene]

Just like the other topic on here my TM AV hangs at DCT_FAKEAV. I have begun the process described in the other thread and this is the Combofix log. I am now working on the AVPTool. I am on Windows XP SP3 Home Edition.

[malwarekiller · Accepted solution]

Hi please avoid running combofix unless adviced.We dont need to avptool now.

Download aswmbr.exe ( 1.8mb ) to your desktop. 

http://public.avast.com/~gmerek/aswMBR.htm
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan.

• 

• Click the [Scan] button to start scan

  

• On completion of the scan click [Save log], save it to your desktop and post in your next reply.

[fussyfene]

Unfortunatly avptool has been running since I posted that 7 hours ago, It has three hours to go. Will do what you have posted once it has finished.It has already been running for 7 hours 9 minutes. I needed help ASAP and the other thread has exactly the same issue and no words in red saying not to do this step like some of the posts do, so I thought it was safe to at least get a head start.

[malwarekiller]

Just cancel AVP and continue with aswmbr

[fussyfene]

Ok AVP stopped Log coming up soon for aswmbr

[fussyfene]

As requested.

[malwarekiller]

I keep my eyes open for people seeking help so expect my replies in 5 minutes from your log unless i am offline.

[malwarekiller]

Everything is fine in the log....

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

THEN

Download OTL  to your Desktop.

http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U\*.* /s
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

[fussyfene]

OTL Link doesnt work, gives me a oops google chrome cant find error... am doing the malwarebytes scan now 

[fussyfene]

And:

Malwarebytes Anti-Malware (PRO) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.24.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
user :: USER-635CB6885B [administrator]

Protection: Disabled

25/02/2012 5:47:32 PM
mbam-log-2012-02-25 (17-47-32).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 195401
Time elapsed: 3 minute(s), 54 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)