Old version of command prompt and cannot run scannow

[jtkm]

Greetings!
I found this forum because of multiple, random BSOD screens related to athr.sys
http://www.sevenforums.com/bsod-help-support/283233-bsod-random-intervals-arthr-sys.html

Now when I open the comand prompt, the version is old, I have it - but without the capacity to
'Run as Administrator'. And I still cannot run scannow.

 

[UsernameIssues]

While we are waiting for a trained malware expert to help you, please consider running a full scan via WDO:
What is Windows Defender Offline?

Also, could you post a screenshot of the cmd prompt window that you see:
http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

::goes back to lurking::

 

[Anak]

Until you get this straightened out, you should be seeing C:\Users\(Your user name)> at your unelevated CMD prompt.

At the end of that prompt, type/copy/paste: cd\Windows\system32 then touch enter or return.

You should then see: C:\Windows\System32> which is the elevated CMD prompt.

   Information

The elevated CMD resides in the System 32 folder as C:\Windows\System32\cmd.exe

The cd\ CMD signifies Change Directory, and Windows\System32 tells windows where to look.

Going to C:\Windows\System32\, and left clicking on cmd.exe should also result in an elevated prompt.

I be interested to know if you do go to C:\Windows\System32\, if you right click on cmd.exe; would "Run as Administrator" be in that context menu?

C:\Users\([I]Your user name[/I])>[COLOR=DarkRed]cd\Windows\system32[/COLOR]

Touching enter or return results in:

C:\Windows\System32>

EDIT:

jtkm, I have posted a link to this thread back at http://www.sevenforums.com/bsod-help-support/283233-bsod-random-intervals-arthr-sys.html

 

[jtkm]

THANKS for the f/u to this thread and please tell me if you want to take the discussion back to the OT - I'm here because I was redirected here.

To open an unelevated command prompt I go to start/programs/accessories

To get to the elevated prompt I type 'command prompt' into the search bar - the only way I can get to it.

Screenshots attached.

I did run an offline Windows Defender - a short scan reveals a clean system

 

[Anak]

THANKS for the f/u to this thread and please tell me if you want to take the discussion back to the OT - I'm here because I was redirected here.

Your welcome.

No we can stay here. I believe you were redirected here so as not to distract attention from your problem in the other thread.

By the way.... Is f/u shorthand for follow up?

To open an unelevated command prompt I go to start/programs/accessories

To get to the elevated prompt I type 'command prompt' into the search bar - the only way I can get to it.

So you can get to an elevated prompt, but it doesn't look right, it looks like an older x86 version?

Reference to Noel's post about an odd CMD prompt: http://www.sevenforums.com/bsod-hel...random-intervals-arthr-sys-2.html#post2354533

Screenshots attached.

I did run an offline Windows Defender - a short scan reveals a clean system

I must apologize, when I made my earlier post I thought you were only having trouble reaching an elevated CMD prompt and didn't realize this thread tied into your other thread.

I'm going to ask one of our malware gurus to take a look at both threads to get some history of what's going on, but in the meantime I would like you to see this post in this thread: http://www.sevenforums.com/system-s...s-firewall-disabled-code-5-a.html#post2356057
And only follow the instructions to download and run the Farbar Service Scanner then post the results (FSS.txt file) here in this thread.

cottonball may also want you to download and run Windows Repair, but we'll leave that up to him, he has more experience with that utility than I do.

 

[cottonball]

jtkm,

Per Anak's instructions:

...in the meantime I would like you to see this post in this thread: Windows Firewall Disabled Code 5
And only follow the instructions to download and run the Farbar Service Scanner then post the results (FSS.txt file) here in this thread.

Please post an updated Farbar Service Scanner, and, at this time, please do not use Windows Repair.
If used, we may need additional options that were not presented on the thread referenced.



>>Also if you ran TDSSKiller, by default, the tool outputs its log to the disk with the Windows operating system, normally C:\).

Logs have a name like:
C:\TDSSKiller.X.X.X_08.04.2012_15.31.43_log.txt (X = a number)

Please, also provide this log in your reply.

 

[jtkm]

YES, "f/u" = "follow up"

Both FSS and TDSS killer find nothing.
as a BTW, the firewall IS working again as is WUpdate which automatically launched itself this morning
even though it wouldn't launch for me the other day.


Farbar Service Scanner Version: 03-03-2013
Ran by BuddhaT00 (administrator) on 08-04-2013 at 17:20:00
Running from "C:\Users\BuddhaT00\Desktop"
Windows 7 Starter Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

Kaspersky TDSS killer log attached - it was too long to paste.

 

[cottonball]

jtkm,

Hmmmm...so far, so good.

Let's see what your system shows with the following short scan...

Please download RogueKiller:
Tlcharger RogueKiller (Site Officiel)

When you get to the website, go to where it says:
(Download link) Lien de téléchargement:

Select the version for your 32-bit system. (The button without x64.)
Click the dark-blue button to download.
Save to the Desktop.

Close all windows and browsers.

Right-click and select: Run as Administrator

At the program console, wait for the prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the Desktop: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.

 

[Anak]

Lurking and learning guys. I'll stay outa' your way unless I have a question.

 

[whs]

If I understood your initial question right, you cannot run cmd as admin. Did you try to run it from the system32 folder? The path is:

C: > Windows > System32 > cmd.exe > right click on that

 

[jtkm]

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : BuddhaT00 [Admin rights]
Mode : Scan -- Date : 04/08/2013 19:34:57
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{688f0573-f1cc-a70b-789f-badcb2e4c372}\U --> FOUND
[ZeroAccess][FOLDER] $NtUninstallKB61064$ : C:\Windows\$NtUninstallKB61064$ --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1600BEVT-60ZCT1 +++++
--- User ---
[MBR] 1cb07c561ad9b7538eee1861c86d3b57
[BSP] 2a447a0415e677fbe5238de08c9a35ef : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 140770 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 288299008 | Size: 11654 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 312166400 | Size: 201 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_04082013_02d1934.txt >>
RKreport[1]_S_04082013_02d1934.txt

 

[jtkm]

the cmd.exe runs and opens the elevated command prompt when
I go to the Windows/system32 folder and use Run As...

sorry. took me awhile to find it.

 

[cottonball]

@jtkm,

Hmmmmm...not good:

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{688f0573-f1cc-a70b-789f-badcb2e4c372}\U --> FOUND
[ZeroAccess][FOLDER] $NtUninstallKB61064$ : C:\Windows\$NtUninstallKB61064$ --> FOUND

¤¤¤ Infection : ZeroAccess ¤¤¤


Let's press on with RogueKiller...
•Please quit all programs
•Right-click the RogueKiller file and select: Run as Administrator
•Wait until the Prescan finishes
•Press: Scan
•Once the scan is done, press the [Delete] button.

Please post the new RKreport (Mode: Delete) in your reply. It is created on the Desktop.
(The RKreport also opens using the Report button on the console.)

 

[whs]

the cmd.exe runs and opens the elevated command prompt when
I go to the Windows/system32 folder and use Run As...

sorry. took me awhile to find it.

So you are OK, right ??

 

[jtkm]

Cleaned!

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : BuddhaT00 [Admin rights]
Mode : Scan -- Date : 04/08/2013 19:59:19
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1600BEVT-60ZCT1 +++++
--- User ---
[MBR] 1cb07c561ad9b7538eee1861c86d3b57
[BSP] 2a447a0415e677fbe5238de08c9a35ef : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 140770 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 288299008 | Size: 11654 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 312166400 | Size: 201 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[4]_S_04082013_02d1959.txt >>
RKreport[1]_S_04082013_02d1934.txt ; RKreport[2]_S_04082013_02d1952.txt ; RKreport[3]_D_04082013_02d1954.txt ; RKreport[4]_S_04082013_02d1959.txt

 

[cottonball]

jtkm,

The report provided is in Mode : Scan

Please post the one in Mode : Delete

 

[jtkm]

My bad, already deleted that and the other reports as desktop was getting cluttered. so the 'delete' file is gone.

 

[Anak]

Unless you cleared the recycle bin, couldn't you go back into the recycle bin and restore it if it's still there?

 

[cottonball]

Thanks Anak...didn't think about that.



jtkm,

Where are you at now, as far as problems are concerned?

 

[jtkm]

Already emptied the recycle bin, they are not recoverable. As I said, Deleted.

Still can't run scannow. Do I even need to?