Anti-virus download problems

Mr_Linnet

I use Mozilla Firefox as my browser but lately I`ve been using my old Internet Explorer browser after starting up in safe mode with networking. This is the only way I seem to be able to reply to messages but even this is very limited and temperamental as The Grandmaster found out last night.

The_Grandmaster

hmm... If registry was corrupted I'm thinking combofix needs to be run.
Best to wait for someone with more experience for now.

GunJack

Combofix would be the next port of call....

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

save file on desktop, and double-click to run it...follow the instructions and post the log back on here when done. You may need to rename combofix in order to get it to run, depending on what nasties you have on your system, just rename as qwerty.exe if you have to...

sorry RIK, can't put my finger on one of your posts to plagarise at the mo , hence the less eloquent instructions

The_Grandmaster

Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out
If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download

(written by alienRIK - and it's not plagiarism if you cite the author! )

Mr_Linnet

Thankyou very much GunJack and The Grandmaster for your replies

Since I last posted I have carried out an Avira AntiVir scan. It found 1 alert and 1 warning so I thought it might be worth mentioning :-

Warning. media/devices/hdg1/documents and settings/Steve/LocalSettings/Temp/b264d3a6-bef3-4913-862a-736a02f36000d.tmp

Alert (quoted as Trojan Horse TR/PatchedGen){TR/PatchedGen}/media/devices/hdg1/windows/system32/drivers/pci.sys


I`ll download COMBOFIX in the morning from my friends computer and post the scan records later in the morning. In the meantime I would be more than happy to hear from anyone who has any suggestions on dealing with the warning and alert that Avira found. Avira stated at the end of the scan that alert couldn`t be removed.

Many thanks again for everyones continued interest and help

aliEnRIK

Aviras found a standard trojan in the temp files

Combofix will tell us a lot more

Mr_Linnet

Damn and blast :mad:

Combofix otherwise known as Qwerty.exe on my computer won`t run.

I`ve disabled AVG, even tried opening in safe mode but still won`t run. Comes up with Microsoft error box. The main quote being :-
Module 1
Qwerty.exe
Image Base 0x004000000
Image Site 0x00000000
Checksum 0x00393417
Time Stamp 0x4a6427af

File included
C:\Docume~1\Steve\Local~1\Temp\37d9-appcompat.txt

I don`t know if that information is relevent or tells anyone anything?

The problem is where do I go from here??

Many sincere thanks again in advance for all replies

fiddiwebb

Are you still having download problems on your computer?

Try following these instructions for Combofix, download it to your own computer to your desktop without renaming it and see what happens (there's a download link for Combofix in the instructions)

Combofix instructions........

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Mr_Linnet

I have printed off 9 pages of instructions to hep me but still can`t get Combofix to run.

I have tried to run it with and without renaming it :mad:

I tried to run it in safe mode without success :mad:

It seems Combofix is the best solution to date to try and cure/solve my problems but I can`t get it to run. Just a thought, now I`ve loaded onto my desktop, Could I open and run it from the Command Prompt ?

Many thanks again and please keep your suggestions coming. I feel I`m so close yet so far away from resolving my issues.

The_Grandmaster

This is a wild guess but may be worth a try for the time being. You have disabled AVG right? Have you also disabled spysweeper? (also if you restart computer are the programmes still disabled - maybe check)