#1
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
This operation has been canceled due to restrictions in effect on this.....
I am getting the error this operation has been canceled due to restrictions in effect on this computer. Please contact systm administrator. I have Norton Internet Security 2008, Spybot S&D, and Adaware. None of these programs have helped. I posted my hijackthis log below. It was just ran. Please help!!! Thank you.SP2 (WinNT 5.01.2600)SP2 (7.00.5730.0013)Ad -Aware 2007\aawservice.exehttp://securityresponse.symantec.com.../fix_homepage/ http://www.dell.com www.ewido.net www.zonelabs.com www.bitdefender.com www.spywareinfo.com www.merijn.org www.sysinternals.com www.onguardonline.gov www.avast.com www.paretologic.com www.webroot.com http://lads.myspace.com/upload/MySpaceUploader.cab http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
Didn't find the information you thought to find?Similar Threads
#2
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Just another side not on this. I am getting the error when accessing control panel and add/remove programs. My control panel has disappeared out of my start menu.
#3
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Welcome to WindowsBBS tylerho here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#4
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Here is the ComboBox log file:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! The following files were disabled during the run: http://www.gmer.net Ad -Aware 2007\aawservice.exe
#5
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Here is the updated hijackthis log file:SP2 (WinNT 5.01.2600)SP2 (7.00.5730.0013)Ad -Aware 2007\aawservice.exehttp://securityresponse.symantec.com.../fix_homepage/ http://www.dell.com http://lads.myspace.com/upload/MySpaceUploader.cab http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Tyler, I've had a very long day and am now exhausted, so it will be tomorrow evening before I have further cleanup instructions (and it's needed). In the meantime, we need to run another tool to get a log for one of the infections you have or had.FindAWF FindAWF icon. Press 1 then Enter to scan for bak folders
#7
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Find AWF report by noahdfear ©2006
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
You had an AWF infection that replaced legitmate files on your system with rogue copies and placed the originals in a different location. Lets get them restored.all quotes included.FindAWF icon once again.Press 2 then Enter to restore files from bak folders files.txt below the line then right click and paste the list of files to be restored.Yes to save the changes. awf.txt log here.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
KillAll::
File::
C:\WINDOWS\pss\autorun.exeCommon Startup
C:\WINDOWS\pss\lsass.lnkStartup
C:\WINDOWS\pss\system.exeStartup
C:\WINDOWS\system32\aybeg.bak1
C:\WINDOWS\system32\aybeg.bak2
C:\WINDOWS\system32\E9C880C2B8.sys
C:\WINDOWS\system32\smouvqhd.ini2
Rootkit::
C:\WINDOWS\system32\sysrest.sys
C:\WINDOWS\system32\sysrest32.exe
Folder::
C:\Documents and Settings\Rick Longtin\Application Data\WinIFixer.com
C:\Documents and Settings\Sage Longtin\Application Data\WinIFixer.com
C:\Documents and Settings\Mary Longtin\Application Data\WinIFixer.com
C:\Program Files\Spy-Rid
C:\Program Files\InfeStop
C:\Program Files\EasySpywareCleaner
C:\Documents and Settings\Sage Longtin\Application Data\spy-rid.com
C:\Documents and Settings\Sage Longtin\Application Data\InfeStop.com
C:\Documents and Settings\Sage Longtin\Application Data\EasySpywareCleaner.com
C:\Documents and Settings\Mary Longtin\Application Data\spy-rid.com
C:\Documents and Settings\Mary Longtin\Application Data\InfeStop.com
C:\Documents and Settings\Mary Longtin\Application Data\EasySpywareCleaner.com
C:\Documents and Settings\Courtney Longtin\Application Data\spy-rid.com
C:\Documents and Settings\Courtney Longtin\Application Data\InfeStop.com
C:\Documents and Settings\Courtney Longtin\Application Data\EasySpywareCleaner.com
C:\Documents and Settings\Rick Longtin\Application Data\InfeStop.com
C:\Documents and Settings\Rick Longtin\Application Data\spy-rid.com
C:\Documents and Settings\Rick Longtin\Application Data\EasySpywareCleaner.com
DirLook::
C:\Documents and Settings\Rick Longtin\Application Data\BrowserObjects
C:\Documents and Settings\Rick Longtin\Application Data\Autorun
Driver::
ndisrd
sysrest.sys
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysrest32.exe"=-
"WinIFixer"=-
"RRT-Auto"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bantool]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ckbm]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\clcl14]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\g4356cbvy63]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\i34yuc387]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsass]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfKg6w]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\startdrv]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Cleaner]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAVX]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTouch]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zxaptcqA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{2E-E3-36-6E-ZN}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\winav.exe"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^autorun.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mary Longtin^Start Menu^Programs^Startup^lsass.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mary Longtin^Start Menu^Programs^Startup^system.exe] Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a new HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#9
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Find AWF report by noahdfear ©2006
#10
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Double-click the FindAWF icon once againPress 3 then Enter to remove bak folders folders.txt below the line of folders.txt and paste the list.Yes to save the changes.
#11
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
ComboFix 08-02-25.3 - Rick Longtin 2008-02-27 22:43:31.2 - NTFSx86WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! The following files were disabled during the run: http://www.gmer.net Ad -Aware 2007\aawservice.exe
#12
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)SP2 (7.00.5730.0013)Ad -Aware 2007\aawservice.exehttp://securityresponse.symantec.com.../fix_homepage/ http://www.dell.com http://lads.myspace.com/upload/MySpaceUploader.cab http://gfx1.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
#13
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
Find AWF report by noahdfear ©2006
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Looks much better! Did you install GoToAssistDownloadHelper?contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
Folder::
C:\Documents and Settings\Rick Longtin\Application Data\BrowserObjects
C:\Documents and Settings\Rick Longtin\Application Data\Autorun
C:\Program Files\InetGet2
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"fmfm"=- Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#15
Senior Member
Profile: Join Date: Feb 2008
Posts: 65
Computer Experience:
I have not installed anything on the machine, since I started working on the issue with you. Below is the combo log:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! The following files were disabled during the run: http://www.gmer.net
All times are GMT +1. The time now is 09:57 .
