Solved Win7 x64 Sp1 (have sfc log) crashes and errors after updates-malware?

[Jacee]

Okay, good! Post the ESET log (finally )

 

[circumvent]

lol...sorry Master Jedi...I just ran sooo many scans, what were the odds? However, I have a rule about taking work home with me so I normally leave my laptop in the office, and scan is at 37% so I figure I'll quit and run it first thing in the morning and use my other computer and then post log *bowing profusely* (even Obi Wan sometimes forgot to listen to yoda if that helps in my weak defence...

 

[andrew129260]

@jacee I want to personally thank you as well for continuing to work with him, as I was the one who sent him here.

So thanks.

 

[Jacee]

I love what I do, andrew129260!

 

[circumvent]

Thanks to Andrew...dude you were instrumental in putting me on the right track, and luck held with Jacee (running scan as we speak 7 infections, 46% and 2 and half hours in)...and I am actually beginning to think Jacee is secretly amused at reading my log results...thank God you love what you do Master Jedi...(and I'm a fan of the original 3 but not obsessed..just to clarify my star wars analogies)...

 

[circumvent]

Okay, good! Post the ESET log (finally )

Ummm....master Yoda...this is embarrassing...that eset scan was going for over 9 hours and got to 46%

So I tried to delete as many old backup files and folders I could this morning and going to try...again...

but here's the log from yesterday

 

[Jacee]

Download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
ComboFix: A guide and tutorial on using ComboFix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe

 

[circumvent]

Download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
ComboFix: A guide and tutorial on using ComboFix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe

Ok, gotcha..already downloaded combofix but eset is still going and I'm actually back at 46%...but I do know it is scanning...but not sure if I stop if it will remove the malware, PUP, and other stuff.

Will let you know results of both...think I should abandon eset for the while and run combofix?

 

[Jacee]

Okay.

 

[andrew129260]

Let eset finish, and then run combo fix. You could try scanning in safe mode as well for a possibly quicker scan.

 

[circumvent]

Let eset finish, and then run combo fix. You could try scanning in safe mode as well for a possibly quicker scan.

Ok Andrew129260, umm...got that message on my phone as combofix was running...was a little too late...but planning to run eset tomorrow now that I ran combofix.

 

[circumvent]

Okay.

Well here we are ladies and gentlemen...combofix ran faster than I thought..and Jacee, I really do hope you love this stuff...here's the log file, and the log file from eset (at 46% again) today...

Please tell me that we've made progress, because computer froze after it restarted and combofix generated the log, when I was trying to enable realtime protection on MSessentials...had to do power off/on...but no freezes upon reboot...

pleh!

 

[andrew129260]

A dash of conduit, a sprinkle of some nasty toolbars, and a trojan. Wow.

Looks like its bad guy christmas and you got stuck with a lot of coal.

Shes not the only one who enjoys busting malware

Anyways, I will wait for jacee's thoughts and what she wants you to do from here.

While were waiting, I suggest another round of scans: (Your loving this aren't you? sorry for all the scans ha)

For now, try manually updating Microsoft security essentials. Then run another quick scan with that.

Run a full scan with malware bytes again.

Let me (us) know the results.

Also wondering if you could run a http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html and tell me if it finds any integrity violations.

 

[Jacee]

This looks like the same .txt log you attached earlier. It also doesn't look like you had Eset quarantine the infected files.

eset 20-11-13 46 percent.txt

 

[circumvent]

A dash of conduit, a sprinkle of some nasty toolbars, and a trojan. Wow.

Looks like its bad guy christmas and you got stuck with a lot of coal.

Shes not the only one who enjoys busting malware

Anyways, I will wait for jacee's thoughts and what she wants you to do from here.

While were waiting, I suggest another round of scans: (Your loving this aren't you? sorry for all the scans ha)

For now, try manually updating Microsoft security essentials. Then run another quick scan with that.

Run a full scan with malware bytes again.

Let me (us) know the results.

Also wondering if you could run a http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html and tell me if it finds any integrity violations.

Lol Andrew...I think Santa made a serious mistake and put me on the naughty list and personally came and mucked up my system ...he's in for a strongly worded email...I'm a nice guy, polite and it's not like I go to "naughty" sites or download porn *sheesh* :sarc:

I am quite enjoying all of the scanning... feels like I'm finally doing something, thank to you and Jacee's guru-like guidance *bowing profusely*...

I actually got MSessentials running last night before I left office, after setting it up in safe mode with networking (even though it doesn't run real time in safe mode), so when I booted in normal mode, it was running real time again protection again and updated on its own...
something I can hopefully contribute as a fix for anyone who encounters that little problem.

As soon as I got in this morning I didn't even go online, just started eset and will let it run to the end.

It actually occurred to me to run scannow /sfc (so you answered a question before I asked it master Jedi)...when I looked at the combofix log.

Will hopefully have a lot of scan logs to attach...hope you and Jacee enjoy reading them as much as I enjoy providing them...

 

[circumvent]

This looks like the same .txt log you attached earlier. It also doesn't look like you had Eset quarantine the infected files.

eset 20-11-13 46 percent.txt

Hi Jacee and Andrew...well, I ran the eset and Jacee, at 46% in the prior report, it didn't give me the option to quarantine the infected files, and I managed to run eset and actually complete this time, as I didn't include check archives (I know, I know, and I'm running it right now with that checked again to see if it will go beyond 48%)..

I made notes of what I did in the eset log, and as per Andrew's advice, I ran sfc, and posting the log as it found errors (why me santa??)..

Attaching both logs now and this weekend, once eset actually finishes with all options checked, I'll run malwarebytes and msessentials full scans and forward logs...sigh...but I am actually learning to read these logs a little and interpret. Thanks for all the help so far and hopefully this learning experience will allow me to help others eventually

 

[Jacee]

Tell me how your computer is running now.

 

[circumvent]

Tell me how your computer is running now.

Wow...I actually forgot to tell the doctor how the patient is doing lol...my bad, sorry...well, it is a bit early to tell, but I haven't had a freeze where I had to power off and on, and so far, no "not responding" on folders and stuff yet.

However, I am still getting the error message at the beginning (after logging on as administrator), that I do not have elevated rights and if I want to restart to enable...when I click yes, computer doesn't restart, I think it's just the explorer shell that restarts.

I'll be able to say if there is a definitive change/improvement in a few days I'm guessing, since I'm not using the laptop as I would normally, given all of the scanning.

But thanks to you, I can say compared to inception, definite improvement

 

[Jacee]

Okay, let me know ....

Now, un-install Combofix:

• 
  Click START then RUN
• Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

 

[andrew129260]

.....However, I am still getting the error message at the beginning (after logging on as administrator), that I do not have elevated rights and if I want to restart to enable...when I click yes, computer doesn't restart, I think it's just the explorer shell that restarts.

Can you take a screenshot of this?