ANTI virus programmes not downloading or updating
rohitkhaitan I have quick heal antivirus installed on my PC which is not updating. No other antivirus programme is getting installed either. Also i often get a windows prompt saying some dll file image is invalid. When i run yahoo messenger a programme runs and sends a link to all contacts on my friends list. At times the whole system shuts down and a blue screen appears with a message saying that its beginning physical memory dump. Please help. The following are the log files..gif (Worm.Downadup) -> Quarantined and deleted successfully. Back to Top
rohitkhaitan My winzip is not working. I can email of post the DDS attach file here if required. Back to Top
Touch Forum Moderator Hello rohitkhaitan and welcome
You have some suspicious files in the log, therefore ->
Please download Combofix from:
And save to the desktop.
Close all other browser windows.
Double-click on the combofix icon found on your desktop.
Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.
When finished, it will produce a logfile located at C:\combofix.txt.
Post the contents of that log in your next reply
The logs will be reasonably large so you may have to divide them into sections and make several posts to post them.
Back to Top
rohitkhaitan The virus it seems is not letting me download combofix. I am getting the same error message that i get when i try to download any antivirus. Thanks for your help. I have a lot of sensitive data on my pc which i cannot afford to loose. Back to Top
Touch Forum Moderator Ok.
by Swandog46 to your Desktop.
Click on Avenger.zip to open the file
Extract avenger2.exe to your desktop
Start Avenger
Begin copying here:
Copy/Paste all the text in the above codebox into the main window
Click Execute
The Avenger will automatically do the following:
It will Restart your computer.
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions.
This log file will be located at C:\avenger.txt
Post C:\avenger.txt in next reply. If you can combofix now, please post that log as well.
Back to Top
rohitkhaitan After repeated attempts i was successful in downloading and running combofix. While scanning it once said that it cannot find C:/ system 32 drivers. (something like that) and after the scan was finished the quick heal anti virus on my pc detected some NIRCMD.exe file and quarantined it. Meanwhile you have posted another reply. Should i do what u asked me to do in your last reply? I shall wait for your next reply before doing anything further. The following is the log of combofix Back to Top
rohitkhaitan The following is the avenger log. All the data on my pc appears to have gone.[:(] Can it be recovered? Back to Top
Touch Forum Moderator
All the data on my pc appears to have gone
My bad. I´m very sorry
Try a systemrestore, and see if it get your data back ?
Back to Top
rohitkhaitan Ok. I got most of my data back. It was stored in a folder called avenger in my C drive. (You were helping me so u dont have to be sorry). Pls help me fix the virus. Back to Top
Touch Forum Moderator
I got most of my data back
Good
Download these two tools:
Back to Top
rohitkhaitan The following are the logs of combofix and tdskiller respectively. Back to Top
Touch Forum Moderator
Open notepad and copy/paste the bold text in the codebox below into it:
Name the file as CFScript Save it on the desktop
Killall::
Snapshot::
File:: c:\windows\system32\Drivers\rmiybqql.sys
c:\docume~1\Rohit\LOCALS~1\Temp\10463463\26300.sys
c:\docume~1\Rohit\LOCALS~1\Temp\musbehco.sys
c:\windows\system32\kxbvcgv.dll
Filelook::
c:\windows\system32\drivers\kernelx86.sys
Dirlook::
c:\docume~1\Rohit\LOCALS~1\Temp\10463463
Driver::
Rmiybqql
26300
musbehco
Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gwgtie]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gwgtie]
Once saved, refering to the picture above, drag CFScript.txt into ComboFix.exe.
Back to Top
rohitkhaitan Ok. I have done that. The following is the new combofix log. Back to Top
Touch Forum Moderator
Open notepad and copy/paste the text in the codebox below into it:
Name the file as CFScript Save it on the desktop.
Killall::
Once saved drag CFScript.txt into ComboFix.exe.
Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please post it to your next reply
Back to Top
rohitkhaitan I have done as u asked me to do. The following is the combofix log file. Back to Top
Touch Forum Moderator It behave like there is a rootkit hiding.
Click http://www.gmer.net/download.php and download the installer for Gmer to your desktop, then click that file to run Gmer. hidden " or "rootkit ", stop there, and click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please. We don't want any crashes just from taking an initial look at things.Scan (before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan).
You can break logs into parts and use separate posts here when replying and posting the log files, if needed.
Back to Top
rohitkhaitan I tried hard but the virus is not letting me download it. [:(] Back to Top
rohitkhaitan After running avenger earlier my system appeared to stabilize some what and the blue screen saying physical dump of memory newer appeared. Also quick heal antivrus began updating but stopped half way in an abrupt manner. But since yesterday the blue screen has started recurring. Also quick heal antivirus detected a virus named msrpc02.exe. Other programmes have also started running slow. Anti virus is also not updating at all. Back to Top
Touch Forum Moderator
and download Win32kDiag.exe directly to your Desktop
cmd (and press OK). At the prompt type or copy/paste the following, pressing Enter after:cd\
Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK.
"%userprofile%\desktop\win32kdiag.exe" -f -r
When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
Back to Top
rohitkhaitan Running from: C:\Documents and Settings\Rohit\desktop\win32kdiag.exe 2009-12-23 10:18:48 40128 C:\WINDOWS\system32\drivers\ojimbaff.sys () 2009-12-23 10:17:58 71168 C:\WINDOWS\system32\secupdat.dat () Back to Top
rohitkhaitan A new problem has also occured in my system. Internet suddenly disconnects and i cannot open the connect icon. I have to restart my pc to reconnect it to the internet. I am trying to share all possible information with u as i dont know what is relevant and what is not. So kindly excuse me if it sounds absurd. [:)] Back to Top
Forum Information Currently it is Friday, May 24, 2013 10:45 PM (GMT +3)View Active Threads Who's Online This forum has 34621 registered members. Please welcome our newest member, ACSIUS .Details 5 Latest Threads
|
Forum Help Manual
