43 replies to this topic

[ShadowPuterDude]

I highly recommend that you uninstall the following applications:

SpyHunter
RegHunter
ID Toolbar Remover 3.5.0.0
My Defragmenter
Window Shopper
NoVirusThanks Malware Remover Free 3.1
Copperhead AntiSpyware 2.1.0
Autorun Eater v2.5
BlackHawk Web Browser
Disk Defrag 2.3.2.351
Eusing Cleaner
Free Registry Defrag
FreeFixer
Immunos
Lock My PC 4.9
Messenger Detect 3
MSN Checker Sniffer
MSN Recorder Max
Spyware Process Detector v3.22.2
Your Uninstaller! 7
VirtuaGirl version 1.0.8.0

Use a reputable browser Google Chrome or FireFox, if you do not wish to use IE. Using an alternate browser from a source that is not easily verifiable can lead to security risks.

I can tell from your logs that you have downloaded a whole bunch of tools, trying to fix this problem yourself. That is not advisable, many of the tools available either just plain don't work or cause more problems then they claim to fix.

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  

  SEE ATTACHED OTLfix.txt

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Attach the new log produced by OTL (C:\_OTL). (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Attached Files

•  OTLfix.txt   138.33K   64 downloads

[ShadowPuterDude]

Then simply remove them from the fix. However, any program that captures and saves that many images, would be a serious candidate for uninstall IMHO.

[ShadowPuterDude]

Download ComboFix from one of these locations:

Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

Link 1
Link 2

* IMPORTANT !!! Save Combo-Fix to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  See HERE for help
• Double click on ComboFix.exe & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: (This applies to Windows XP systems only) If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, ComboFix will produce a log.

Note:
1. Do not mouseclick combofix's window while it's running. That may cause it to stall!
2. Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Attach logs for: (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

• ComboFix (C:\combofix.txt)

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

[ShadowPuterDude]

Read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Double-click on TDSSKiller.exe to run the application.
  
  
• Click Change parameters
  
  
• Check the boxes next to Verify Driver Digital Signature and Detect TDLFS file system, then click OK
  
  
• Click on the Start Scan button to begin the scan and wait for it to finish.
  NOTE: Do not use the computer during the scan!
  
• During the scan it will look similar to the image below:
  
  
• When it finishes, you will either see a report that no threats were found like below:
  
  
  If no threats are found at this point, just click the Report selection on the top right of the form to generate a log. A log file report will pop which you can just close since the report file is already saved.
  
• If any infection or suspected items are found, you will see a window similar to below:
  
  
  • If you have files that are shown to fail signature check do not take any action on these. Make sure you select Skip. I will tell you what to do with these later. They may not be issues at all.
  • If Suspicious objects are detected, the default action will be Skip. Leave the default set to Skip.
  • If Malicious objects are detected, they will show in the Scan results. TDSSKiller automatically selects an action (Cure or Delete) for malicious objects
    Make sure that Cure is selected. Important! - If Cure is not available, please choose Skip instead. Do not choose Delete unless instructed to do so.
• Click Continue to apply selected actions.
  
• A reboot may be required to complete disinfection. A window like the below will appear:
  
  Reboot immediately if TDSSKiller states that one is needed.
  
• Whether an infection is found or not, a log file should have already been created on your C: drive (or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run.
  
• Attach this log to your next reply.

[ShadowPuterDude]

Your logs are fine. How are things running?

[ShadowPuterDude]

Let me know what you want removed.

[ShadowPuterDude]

Download:
- ISeeYouXP by ShadowPuterDude

Double-click ISeeYouXP.exe, ISeeYouXp will be extracted to C:\ISeeYouXP; and a shortcut to ISeeYouXP.bat will be placed on the Desktop.

Double-click the ISeeYouXP shortcut to run ISeeYouXP.

Possible Error Messages

• If your ISeeYouXP.txt log appears to be empty or semi-empty or you get an error message similar to the below when running ISeeYouXP.bat and you are running Windows XP or Windows 2000, follow the steps further down that relate to your OS
  

  C:\WINDOWS\SYSTEM32\AUTOEXEC.NT. The system file is not suitable for running MS-DOS and Microsoft Window applications.

  
  To fix the above error message, choose the download below which is appropriate for your system
  
  • For Windows XP Pro: download and run: XPproFix
  • For Windows XP Home: download and run: XPHomeFix
  • For Windows 2000: download and run: W2KFix
  Then run ISeeYouXP.bat again and attach the log.
  
• A possible second type of error message may occur as shown in the quote box below! If you get either of these two messages, perform the Resolution steps given in this: Virtual Device Driver Error Message in 16-Bit MS-DOS Subsystem

16 bit MS-DOS Subsystem
drive:\program path
XXXX. An installable Virtual Device Driver failed DLL initialization. Choose 'Close' to terminate the application.

-or-

16 bit MS-DOS Subsystem
drive:\program path
SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers. VDD. Virtual Device Driver format in the registry is invalid. Choose 'Close' to terminate the application.

After attempting to fix the above errors, run ISeeYouXP.bat and attach the log.

IMPORTANT NOTE:

Vista Users

UAC must be turned off to run this script.

Turning Off/On UAC in Vista
1. Open the Control Panel.
2. Under User Account and Family settings click on the "Add or remove user account".
3. Click on your user account.
4. Under the user account click on the "Go to the main User Account page" link.
5. Under "Make changes to your user account" click on the "Change security settings" link.
6. In the "Turn on User Account Control (UAC) to make your computer more secure" click to unselect the "Use User Account Control (UAC) to help protect your computer". Click on the Ok button.
7. You will be prompted to reboot your computer. Do so.

In order to re-enable UAC just select the above checkbox and reboot.

To Run ISeeYouXP right-click on the batch file and select "Run as Administrator"

[ShadowPuterDude]

Run a fresh scan with OTL and attach the new OTL log.

[ShadowPuterDude]

Run OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  

  :OTLPRC - C:\VEXPLite\VIRITSVC.EXE (TG Soft Sas   www.tgsoft.it)SRV - (viritsvclite) -- C:\VEXPLite\VIRITSVC.EXE (TG Soft Sas   www.tgsoft.it)DRV - (VIRAGTLT) -- C:\WINDOWS\system32\drivers\VIRAGTLT.SYS (TG Soft S.a.s.)O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO32 - AutoRun File - [2011/10/16 09:46:18 | 000,000,000 | ---D | M] - D:\Autorun.inf -- [ NTFS ]@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5DF2864D:Commands[Purity][EmptyTemp][EmptyFlash][EmptyJava][Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Attach the new log produced by OTL (C:\_OTL). (USE THE "MORE REPLY OPTIONS" BUTTON TO BE ABLE TO DO THIS)

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

[ShadowPuterDude]

Boot to Safe Mode and run ISeeYouXP. Also run GetUnKeys.bat inside the ISeeYouXP folder (C:\ISeeYouXP).

Attach both logs to your next reply.

[ShadowPuterDude]

OK, try booting to Normal Mode. Still get a Blue Screen?

[ShadowPuterDude]

Then it would appear that the system is corrupted to the point that a "Clean Install" of Windows is necessary.

[ShadowPuterDude]

I do not want to do this and this is not the first time that I get the same problem and many of the blue screen of death ......

The problem is being created by everything you have installed, and that wasn't uninstalled properly. The system corruption is beyond my ability to repair. At some point you have to decide if the effort is worth the time to fix the system.

A clean install is the fastest way to fix the problem, and then only installing those applications you absolutely need to install.

[ShadowPuterDude]

Thanks for the advice but I know that you get all these problems again, although the formating my computer is not a solution! Why? For the simple reason every time I install a new system and do not say it's a clean system 'because of the many crooks we have in the market .........
However, these problems occur every time when I install a new system .....

The problems are not being caused by the "Clean Install". Which you have not done. Why do I know that? Your logs show me that an in-place upgrade was performed. You never performed a "Clean Install" which requires the removal of the partition and a new partition being created during the installation process.

You have way too many questionable applications installed on your computer. Get your programs from reputable download locations. I do not have the time to trouble shoot the issues you have created with your computer. Your system in beyond repair in a reasonable period of time. Do a "Clean Install"

[ShadowPuterDude]

I can advise you on what are decent protection applications.

[ShadowPuterDude]

Firewall: Online Armor
Anti-Virus & Anti-Spyware: Emsisoft Anti-Malware
Anti-Trojan: Malwarebytes' Anti-Malware
Browser: Chrome, Firefox, or Iron
VPN: GPass, CyberGhost, or Hotspot Shield
Packet Capture: Wireshark

You don't need anything else for security. You don't even need Wireshark, unless you plan on doing some packet analysis.

Whether or not you get infected again, is completely dependent on your surfing habits.

[ShadowPuterDude]

Short answer, No.

Most of those tools you have listed are not what I would recommend someone install on their system. In fact I recommend that you avoid most of them.

This is not a case of more is better. A layered defense means using the appropriate tools to protect the system against a variety of threats. Not using several tools that do the same exact thing, and will fight each other for the same system resources.

[ShadowPuterDude]

You do not need more than 1 Anti-Virus, Anti-Spyware application on your system. You will create conflicts and cause performance issues. Almost all the Rouge applications require user action to install, and many trojans are designed to evade detection and disable protection applications.

HijackThis is not a malware removal application and should be used with caution.

[ShadowPuterDude]

Backup services provide users and companies the ability to backup the data on their systems. Unless you are a developer, researcher, business and such; I don't recommend using backup services. However, if you wish to use a service then Mozy is very affordable. If you have the hardware, then Acronis True Image would be a better backup solution. As you have complete control over your data. No one else, but you, has your files.

[ShadowPuterDude]

Registry cleaners are more harmful than beneficial. I do not recommend registry cleaners to anyone.

[ShadowPuterDude]

Your system still has problems. That is why I recommended a "Clean Install". There are more problems than I can troubleshoot and fix in a realistic period of time.

[ShadowPuterDude]

Thread Closed

Reason: Posters inability or refusal to follow instructions.

Clean Install is advised.

The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread.