1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Task Scheduler - shows corrupt files

Discussion in 'Malware and Virus Removal Archive' started by AirHead, 2012/05/30.

Page 2 of 5
  1. 2012/06/06
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Checkup Log.
    Results of screen317's Security Check version 0.99.24
    Windows Vista Service Pack 2 x86 (UAC is enabled)
    Internet Explorer 9
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    avast! Free Antivirus
    Microsoft Security Essentials
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    SUPERAntiSpyware
    Secunia PSI
    Advanced WindowsCare Personal
    Gmer
    Tizer™ Rootkit Razor
    CCleaner
    Java(TM) 6 Update 29
    Java(TM) 7 Update 4
    Out of date Java installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Alwil Software Avast5 AvastSvc.exe
    Alwil Software Avast5 AvastUI.exe
    ``````````End of Log````````````

    I removed MSE, the log still shows it?
    Proceeding with Service scanner.
     
    AirHead,
    #21
  2. 2012/06/06
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Farbar Service Scanner Version: 05-06-2012
    Ran by Ralph K (administrator) on 06-06-2012 at 10:03:02
    Running from "C:\Users\Ralph K\Desktop\WinBBS\Progs "
    Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo IP is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys
    [2012-05-09 07:45] - [2012-03-30 05:39] - 0914304 ____A (Microsoft Corporation) EE7E10BED85C312C1D5D30C435BDDA9F

    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll => MD5 is legit
    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
     
    AirHead,
    #22


  3. to hide this advert.

  4. 2012/06/06
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Hi Broni,
    ESET. 01:30:00, 18% complete 139000 files scaned, 1 threat. Win32.OpenInstall application.
    I need to use the computer, at this rate it will not finish for about 6 to 7 Hrs. Is it supposed to be this slow?
     
    AirHead,
    #23
  5. 2012/06/06
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Hi Broni,
    I was wrong! program concluded with "Fixed ", No Log generated.

    R
     
    AirHead,
    #24
  6. 2012/06/06
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Hi Broni,
    Will check again tomorrow, to see if I posted all that you need.
    Thanks,
    R.
     
    AirHead,
    #25
  7. 2012/06/06
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I still need a log from OTL fix.

    Uninstall Java(TM) 6 Update 29.

    Uninstall Advanced WindowsCare Personal .
    Registry cleaners/optimizers are not recommended for several reasons:

    • Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

      The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
    • Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry ". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
    • Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
    • Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
    • The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results ".
    Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

     
    broni,
    #26
  8. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    wrong log
     
    Last edited by a moderator: 2012/06/07
    AirHead,
    #27
  9. 2012/06/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    That's incorrect log.
    You clicked on "Scan" button instead of "Fix" button.
     
    broni,
    #28
  10. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    wrong log
     
    AirHead,
    #29
  11. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    OK, I'll try again, Sorry.
     
    AirHead,
    #30
  12. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Hi Broni,
    I reran OTL, after inserting the code you provided.
    Pressed "Fix ", after it ran it asked to reboot now, I said yes.
    It rebooted as it should but did not create any Logs.
    Is this because I did something wrong?
    R
     
    AirHead,
    #31
  13. 2012/06/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run the fix from safe mode.
     
    broni,
    #32
  14. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Do you want me to insert your code again?
     
    AirHead,
    #33
  15. 2012/06/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yes. There is no fix without my script.
     
    broni,
    #34
  16. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    OK!
    I reran OTL in safe mode w/script. At the end it asked for OK to reboot, (no other options available.
    I clicked yes, It rebooted, when it finished there was a notepad which I tried to save.
    When I clicked on File the window dropped down and then erased the whole file.
    I searched C:/ drive to see if it automatically saved it, but found No files from 06/07/2012.
    What next?????
    R.
     
    AirHead,
    #35
  17. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    I will try one more time to run otl & see if I can save it, I'll be back.
     
    AirHead,
    #36
  18. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    WOW! Hope this is it.

    All processes killed
    ========== OTL ==========
    Error: No service named YN was found to stop!
    Service\Driver key YN not found.
    Error: No service named YFRUYUCYIBCZFKNV was found to stop!
    Service\Driver key YFRUYUCYIBCZFKNV not found.
    Error: No service named UMZL was found to stop!
    Service\Driver key UMZL not found.
    Error: No service named SKVNHOFXOY was found to stop!
    Service\Driver key SKVNHOFXOY not found.
    Error: No service named MQOCNO was found to stop!
    Service\Driver key MQOCNO not found.
    Error: No service named IKU was found to stop!
    Service\Driver key IKU not found.
    Error: No service named FGTUJADLD was found to stop!
    Service\Driver key FGTUJADLD not found.
    Error: No service named MpKsl82676c98 was found to stop!
    Service\Driver key MpKsl82676c98 not found.
    File c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FFE24E44-6367-49BB-ADD9-FC5229EC2754}\MpKsl82676c98.sys not found.
    Error: No service named MpKsl59b03a8c was found to stop!
    Service\Driver key MpKsl59b03a8c not found.
    File c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FFE24E44-6367-49BB-ADD9-FC5229EC2754}\MpKsl59b03a8c.sys not found.
    Error: No service named MpKsl26104004 was found to stop!
    Service\Driver key MpKsl26104004 not found.
    File c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{562D2451-767D-4105-9A56-686ECF6F8211}\MpKsl26104004.sys not found.
    Registry value HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1FCA4DF8-9ACD-4DFB-89CC-DDD0082FC588} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1FCA4DF8-9ACD-4DFB-89CC-DDD0082FC588}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}\ not found.
    Registry value HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{A69A551A-1AAE-4B67-8C2E-52F8B8A19504}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A69A551A-1AAE-4B67-8C2E-52F8B8A19504}\ not found.
    Registry key HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ttlc\ not found.
    Registry key HKEY_USERS\S-1-5-21-3033927999-2936934246-3914811308-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\turbotax.com\ not found.
    Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Unable to delete ADS C:\ProgramData\TEMP:679ABA25 .
    Unable to delete ADS C:\ProgramData\TEMP:D1B5B4F1 .
    Unable to delete ADS C:\ProgramData\TEMP:DFC5A2B2 .
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: IUSR_NMPR
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: Ralph
    ->Temp folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Ralph K
    ->Temp folder emptied: 647013 bytes
    ->Temporary Internet Files folder emptied: 3483645 bytes
    ->Java cache emptied: 0 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 3960 bytes

    User: Ralph.D4996T
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 9007 bytes
    RecycleBin emptied: 896 bytes

    Total Files Cleaned = 4.00 mb


    [EMPTYJAVA]

    User: All Users

    User: Default

    User: Default User

    User: IUSR_NMPR

    User: Public

    User: Ralph

    User: Ralph K
    ->Java cache emptied: 0 bytes

    User: Ralph.D4996T

    Total Java Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: IUSR_NMPR

    User: Public

    User: Ralph
    ->Flash cache emptied: 0 bytes

    User: Ralph K
    ->Flash cache emptied: 0 bytes

    User: Ralph.D4996T

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.46.0 log created on 06072012_124258

    Files\Folders moved on Reboot...
    File\Folder C:\Users\Ralph K\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{091F0317-E88D-4D17-A2FB-14BCBB19E866}.tmp not found!
    File\Folder C:\Users\Ralph K\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2C872159-01E9-4FBD-9EFE-8D13AD9B526B}.tmp not found!
    File\Folder C:\Users\Ralph K\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{62E08242-E1DD-48A8-AD48-55F05381415D}.tmp not found!
    File\Folder C:\Users\Ralph K\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{75EC18DA-0AE5-4509-AEC0-1BCEB7CAFCD7}.tmp not found!
    File\Folder C:\Users\Ralph K\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8F6CA480-9731-410C-A3E7-ED09BA44BA3C}.tmp not found!
    File\Folder C:\Users\Ralph K\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C296AE1E-C135-4440-805C-74C5B14A98ED}.tmp not found!

    Registry entries deleted on Reboot...

    Task bar color in now white, was dark blue, some windows now have different color scheme.
    R.
     
    AirHead,
    #37
  19. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    Also, when I open Task Scheduler, 5 windows pop up one at a time, 4 are the same as I posted at the beginning of this post. The 5th "mcpupdate" is new.
     
    AirHead,
    #38
  20. 2012/06/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Did you follow other steps from my reply #26?

    What about TFC and Eset?
     
    broni,
    #39
  21. 2012/06/07
    AirHead

    AirHead Well-Known Member Thread Starter

    Joined:
    2011/07/09
    Messages:
    105
    Likes Received:
    0
    I believe I followed your instructions and posted them as asked.
     
    AirHead,
    #40
Page 2 of 5

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...