Major laptop problems and can't start in safe mode!

stilltheone

Mikki wrote: »

OK, copied to disc and transferred over and it seems to have fixed things - thanks.

Have now downloaded Microsoft Security Essentials and am running a full scan at the moment. Should I still do a system restore? I've no idea when the computer got infected (I'm assuming recently) so no idea when to go back to.

Did you download the latest updates before running the scan?

Follow RJK's instructions and then;

Download, install, update and run a Quick Scan with Malwarebytes' AntiMalware. When complete, choose 'Remove Selected' if there is anything to remove and Reboot your computer.

After restart, open the program again and go to 'Logs'. Double click on the log produced for today and post the contents here.

Mikki

OK, tried to do a system restore to the 28th Apr and I got the message:

"The exception unknown software exception (0xc000070a) occured in the application at location 0x77cdd009. Click OK to terminate the program."

I clicked OK and it seemed to continue regardless, shutting down and restarting. I got a message saying system restore completed successfully!

Have now updated Security Essentials. Next will download Malwarebytes. Thanks for help!

Mikki

Hello,

Downloaded, updated and ran Malwarebytes. Here is the log:

Malwarebytes' Anti-Malware 1.50.1.1100
https://www.malwarebytes.org

Database version: 6514

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

05/05/2011 17:43:41
mbam-log-2011-05-05 (17-43-41).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 280292
Time elapsed: 36 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 16
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{CDC73256-A88D-4642-844E-A8F20B76789C} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{D1063603-F045-475F-AFBC-8CBA7D5797FB} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47FD-81F3-EE91287F9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarWeather.WeatherController (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\HotbarWeather.WeatherController.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ResultBar (Adware.ResultBar) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Value: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790277B2765B5336AD94 (Malware.Trace) -> Value: SRS_IT_E8790277B2765B5336AD94 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790477B0765B5A3EAE99 (Malware.Trace) -> Value: SRS_IT_E8790477B0765B5A3EAE99 -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\programdata\resultbar (Adware.ResultBar) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7} (Adware.BarDiscover) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\chrome (Adware.BarDiscover) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\defaults (Adware.BarDiscover) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\defaults\preferences (Adware.BarDiscover) -> Quarantined and deleted successfully.

Files Infected:
c:\Users\Jodie\AppData\Local\Temp\nsa7B9C.tmp\Setup.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
c:\Users\Jodie\AppData\Local\Temp\nspFBC8.tmp\uninstall.exe (Adware.ResultBar) -> Quarantined and deleted successfully.
c:\Users\Jodie\AppData\Local\Temp\nsvBC6B.tmp\Setup.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
c:\Users\Jodie\AppData\Local\Temp\nsyAA80.tmp\Setup.dll (Adware.Seekmo) -> Quarantined and deleted successfully.
c:\Users\Jodie\downloads\ichobots version 3.exe (HackTool.Agent.Gen) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\chrome.manifest (Adware.BarDiscover) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\install.rdf (Adware.BarDiscover) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\chrome\bardiscover.jar (Adware.BarDiscover) -> Quarantined and deleted successfully.
c:\program files (x86)\mozilla firefox\extensions\{ac57fcaf-e6fc-4be9-adc0-d00129c4c1e7}\defaults\preferences\prefs.js (Adware.BarDiscover) -> Quarantined and deleted successfully.


Is all ok with that? Thanks for your help guys!

RussJK

Good work.

1. Next run two quick scans:
Kapersky TDSSKiller
http://support.kaspersky.com/downloads/utils/tdsskiller.exe
Hitman Pro: Second Opinion Malware Scanner
http://www.surfright.nl/en/hitmanpro

2. Post a Hijackthis log (download Hijackthis to the desktop, then hold down SHIFT and right click on it, select Run as Administrator):
http://www.trendmicro.com/ftp/products/hijackthis/HijackThis.exe, and one of us will look through it. It's very quick.

3. After you post the Hijackthis log, do a longer scan with just one of the following:
Superantispyware (http://www.superantispyware.com/sasportable.php), Dr Web CureIt (https://www.freedrweb.com/download+cureit/gr/?lng=en), or Kapersky Virus Removal Tool (http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/).