Author Topic: System restore not working. (Read 17390 times)

evilfantasy · « **Reply #15 on:** February 16, 2009, 03:50:12 PM »

Try renaming it to Combo-Fix and then run it.

srtony1946 · « **Reply #16 on:** February 16, 2009, 04:49:47 PM »

I disabled all virus protection and spyware that I could find, as well as Windows Firewall. I thought I had deleted Comodo Pro Firewall...did a search and got rid of all files, but it stills shows in Security that I have it and that it is enabled.

I downloaded ComboFix and renamed it to Combo-Fix, then ran it and I get the following message:

"Some files could not be created.
Please close all applications, reboot Windows and restart this installation".

After rebooting, tried running ComboFix again and I get the same message above. What am I doing wrong?

evilfantasy · « **Reply #17 on:** February 16, 2009, 04:54:44 PM »

Quote

I thought I had deleted Comodo Pro Firewall...did a search and got rid of all files, but it stills shows in Security that I have it and that it is enabled.

Comodo is notorious for that. It's gone but the Security Center still says it's there.

Delete ComboFix and also the C:\combofix folder, if it's there.

Download Lop S&D by Eric_71 and save it to your Desktop. Lop S&D will only run on Windows XP and Windows Vista

Disable your antivirus and antimalware programs so they do not interfere with the running of Lop S&D. If needed see: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

If you are using Windows Vista, right-click on LopSD.exe icon and select 'Run as administrator' to perform this scan.

Double-click Lop S&D.exe
Choose the language by typing of the corresponding letter and press Enter
Click OK at the informative window
Type 1, to choose Option 1 (Search) then press Enter
Wait until the end of the scan
A report will be generated, post the contents of it in your next reply.

A copy of the report can be found at this location: %systemdrive%\lopR.txt, in most cases C:\lopR.txt

srtony1946 · « **Reply #18 on:** February 16, 2009, 06:01:24 PM »

Before I post the lop report, I wanted to let you know that the trojan is in my boot files:

Trojan.Agent \boot.ini Malware bytes quarantined the file.

Here is the lop report:'

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel Pentium III processor )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Tony ( Administrator )
BOOT : Normal boot
Antivirus : ThreatFire 4.0.0.10 (Not Activated)
Firewall : COMODO Firewall Pro 3.0 (Activated)
C:\ (Local Disk) - NTFS - Total:465 Go (Free:430 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( Mon 02/16/2009|18:54 )

--------------------\\ Listing folders in APPLIC~1

[02/15/2009|03:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe
[08/04/2008|06:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Avira
[09/01/2008|08:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> AVS4YOU
[09/30/2008|07:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> BigFishGamesCache
[10/20/2008|03:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Citrix
[09/29/2008|06:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Enkord
[06/06/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Hewlett-Packard
[06/05/2008|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> HPSSUPPLY
[10/01/2008|01:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> MAGIX
[07/18/2008|12:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes
[01/07/2009|10:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> McAfee
[06/02/2008|06:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
[09/29/2008|06:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> n7-89-o9-3r-4t-r9
[02/15/2009|11:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> NOS
[09/16/2008|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> nView_Profiles
[07/03/2008|04:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PC Tools
[08/18/2008|11:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PCPitstop
[08/06/2008|05:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SiteAdvisor
[01/31/2009|01:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SpeedBit
[09/29/2008|07:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SUPERAntiSpyware.com
[11/09/2008|01:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Sync App Settings
[06/10/2008|09:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage
[06/14/2008|06:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Yahoo!
[01/01/2009|12:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Zylom

[05/27/2008|04:17] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[01/01/2009|09:00] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> GameTracker
[05/27/2008|04:17] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft
[02/15/2009|04:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> SACore
[12/02/2008|01:17] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Yahoo!

[05/31/2008|10:59] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

[02/15/2009|09:33] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Adobe
[07/15/2008|02:34] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Ahead
[09/01/2008|08:14] C:\DOCUME~1\Tony\APPLIC~1\<DIR> AVS4YOU
[12/31/2008|04:59] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Chessmaster Challenge
[08/17/2008|10:37] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Codessentials
[09/01/2008|08:14] C:\DOCUME~1\Tony\APPLIC~1\<DIR> DivX
[01/01/2009|08:37] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Gaijin Ent
[09/29/2008|06:35] C:\DOCUME~1\Tony\APPLIC~1\<DIR> GameHouse
[08/12/2008|07:44] C:\DOCUME~1\Tony\APPLIC~1\<DIR> GlarySoft
[01/01/2009|12:46] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Identities
[01/21/2009|05:45] C:\DOCUME~1\Tony\APPLIC~1\<DIR> IObit
[08/30/2008|10:58] C:\DOCUME~1\Tony\APPLIC~1\<DIR> IrfanView
[08/06/2008|08:41] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Leadertech
[10/25/2008|12:55] C:\DOCUME~1\Tony\APPLIC~1\<DIR> LimeWire
[12/20/2008|02:13] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Macromedia
[07/18/2008|12:36] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Malwarebytes
[11/02/2008|11:36] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Map Maker
[10/20/2008|03:10] C:\DOCUME~1\Tony\APPLIC~1\<DIR> McAfee
[07/06/2008|07:45] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Microsoft
[11/01/2008|02:44] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Move Networks
[09/30/2008|05:36] C:\DOCUME~1\Tony\APPLIC~1\<DIR> NetMedia Providers
[07/13/2008|10:29] C:\DOCUME~1\Tony\APPLIC~1\<DIR> OpenOffice.org2
[01/01/2009|10:50] C:\DOCUME~1\Tony\APPLIC~1\<DIR> PlayFirst
[09/30/2008|04:43] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Publish Providers
[07/13/2008|09:54] C:\DOCUME~1\Tony\APPLIC~1\<DIR> RapidBackup 2
[05/29/2008|02:28] C:\DOCUME~1\Tony\APPLIC~1\<DIR> SecuROM
[09/30/2008|04:43] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Sony
[12/31/2008|04:58] C:\DOCUME~1\Tony\APPLIC~1\<DIR> SpinTop
[06/11/2008|09:42] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Sun
[09/29/2008|07:39] C:\DOCUME~1\Tony\APPLIC~1\<DIR> SUPERAntiSpyware.com
[10/19/2008|11:16] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Thinking Minds Budiling Bytes
[01/25/2009|03:19] C:\DOCUME~1\Tony\APPLIC~1\<DIR> U3
[12/14/2008|05:00] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Yahoo!
[01/01/2009|12:46] C:\DOCUME~1\Tony\APPLIC~1\<DIR> Zylom

--------------------\\ Scheduled Tasks located in C:\windows\Tasks

[02/08/2009 10:13 PM][--a------] C:\windows\tasks\SmartDefrag.job
[02/16/2009 05:52 PM][--ah-c---] C:\windows\tasks\SA.DAT
[02/28/2006 06:00 AM][-r-h-c---] C:\windows\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[11/14/2008|05:49] C:\Program Files\<DIR> Activision
[02/15/2009|04:38] C:\Program Files\<DIR> ACW
[02/16/2009|03:48] C:\Program Files\<DIR> Adobe
[12/13/2008|04:06] C:\Program Files\<DIR> AGEIA Technologies
[06/05/2008|09:43] C:\Program Files\<DIR> Avago-HP
[08/04/2008|04:56] C:\Program Files\<DIR> Avira
[07/06/2008|07:30] C:\Program Files\<DIR> CachemanXP
[12/27/2008|12:21] C:\Program Files\<DIR> CCleaner
[07/19/2008|12:09] C:\Program Files\<DIR> Chess
[11/22/2008|11:38] C:\Program Files\<DIR> Codemasters
[08/17/2008|10:37] C:\Program Files\<DIR> Codessentials
[02/15/2009|04:38] C:\Program Files\<DIR> Common Files
[01/31/2009|01:14] C:\Program Files\<DIR> DAP
[09/23/2008|04:41] C:\Program Files\<DIR> Free Hide Folder
[08/17/2008|08:34] C:\Program Files\<DIR> GameGain
[09/29/2008|06:35] C:\Program Files\<DIR> GameHouse
[06/05/2008|09:46] C:\Program Files\<DIR> HP
[01/22/2009|07:46] C:\Program Files\<DIR> InstallShield Installation Information
[02/15/2009|09:43] C:\Program Files\<DIR> Internet Explorer
[01/21/2009|05:45] C:\Program Files\<DIR> IObit
[08/25/2008|01:41] C:\Program Files\<DIR> IrfanView
[12/13/2008|04:21] C:\Program Files\<DIR> Java
[10/01/2008|02:01] C:\Program Files\<DIR> MAGIX
[02/15/2009|07:13] C:\Program Files\<DIR> Malwarebytes' Anti-Malware
[11/02/2008|11:36] C:\Program Files\<DIR> Map Maker
[01/07/2009|01:07] C:\Program Files\<DIR> McAfee
[08/14/2008|07:15] C:\Program Files\<DIR> Messenger
[07/06/2008|07:57] C:\Program Files\<DIR> Microsoft Bootvis
[10/19/2008|07:01] C:\Program Files\<DIR> Microsoft CAPICOM 2.1.0.2
[05/27/2008|04:18] C:\Program Files\<DIR> microsoft frontpage
[10/21/2008|09:49] C:\Program Files\<DIR> Microsoft Silverlight
[11/23/2008|05:06] C:\Program Files\<DIR> Microsoft Xbox 360 Accessories
[07/14/2008|12:03] C:\Program Files\<DIR> Moffsoft FreeCalc
[06/10/2008|10:32] C:\Program Files\<DIR> Movie Maker
[05/26/2008|10:28] C:\Program Files\<DIR> MSN
[09/30/2008|07:23] C:\Program Files\<DIR> MSN Games
[05/27/2008|04:14] C:\Program Files\<DIR> MSN Gaming Zone
[11/12/2008|04:22] C:\Program Files\<DIR> MSXML 4.0
[07/19/2008|10:29] C:\Program Files\<DIR> Nero
[06/10/2008|10:31] C:\Program Files\<DIR> NetMeeting
[02/15/2009|04:38] C:\Program Files\<DIR> NOS
[10/08/2008|04:50] C:\Program Files\<DIR> NVIDIA Corporation
[05/27/2008|04:14] C:\Program Files\<DIR> Online Services
[08/17/2008|10:49] C:\Program Files\<DIR> OpenOffice.org 2.4
[06/10/2008|10:30] C:\Program Files\<DIR> Outlook Express
[11/09/2008|04:16] C:\Program Files\<DIR> Paint.NET
[01/01/2009|10:49] C:\Program Files\<DIR> PlayFirst
[05/26/2008|10:07] C:\Program Files\<DIR> Realtek
[07/13/2008|09:05] C:\Program Files\<DIR> ReflexiveArcade
[12/21/2008|11:12] C:\Program Files\<DIR> Ricochet Infinity
[11/02/2008|12:10] C:\Program Files\<DIR> ScrollWall
[12/13/2008|04:25] C:\Program Files\<DIR> Secunia
[11/22/2008|10:24] C:\Program Files\<DIR> SEGA
[09/30/2008|05:50] C:\Program Files\<DIR> Sony
[09/30/2008|04:40] C:\Program Files\<DIR> Sony Setup
[01/11/2009|05:52] C:\Program Files\<DIR> SpeedBit Video Accelerator
[09/10/2008|10:07] C:\Program Files\<DIR> SpeedFan
[02/15/2009|07:13] C:\Program Files\<DIR> SpywareBlaster
[01/21/2009|05:46] C:\Program Files\<DIR> SUPERAntiSpyware
[05/28/2008|10:15] C:\Program Files\<DIR> SystemRequirementsLab
[11/26/2008|01:15] C:\Program Files\<DIR> ThreatFire
[05/30/2008|04:20] C:\Program Files\<DIR> Trend Micro
[01/01/2009|12:32] C:\Program Files\<DIR> Tropico Jong
[08/20/2008|01:16] C:\Program Files\<DIR> Tweak-XP Pro 4
[01/23/2009|11:13] C:\Program Files\<DIR> VideoLAN
[08/12/2008|07:50] C:\Program Files\<DIR> Windows Media Player
[06/10/2008|10:30] C:\Program Files\<DIR> Windows NT
[11/23/2008|03:08] C:\Program Files\<DIR> XBox 360 Controller for Windows Software
[05/27/2008|04:18] C:\Program Files\<DIR> xerox
[10/19/2008|06:54] C:\Program Files\<DIR> Yamicsoft

--------------------\\ Listing Folders in C:\Program Files\Common Files

[02/16/2009|03:48] C:\Program Files\Common Files\<DIR> Adobe
[02/15/2009|04:38] C:\Program Files\Common Files\<DIR> Adobe AIR
[07/19/2008|10:29] C:\Program Files\Common Files\<DIR> Ahead
[09/01/2008|08:17] C:\Program Files\Common Files\<DIR> AVSMedia
[05/27/2008|06:30] C:\Program Files\Common Files\<DIR> Cisco Systems
[08/10/2008|10:14] C:\Program Files\Common Files\<DIR> InstallShield
[07/27/2008|04:20] C:\Program Files\Common Files\<DIR> Java
[01/07/2009|10:15] C:\Program Files\Common Files\<DIR> McAfee
[08/17/2008|10:35] C:\Program Files\Common Files\<DIR> Microsoft Shared
[05/27/2008|04:16] C:\Program Files\Common Files\<DIR> MSSoap
[01/01/2009|08:36] C:\Program Files\Common Files\<DIR> Oberon Media
[05/26/2008|11:07] C:\Program Files\Common Files\<DIR> ODBC
[05/27/2008|04:16] C:\Program Files\Common Files\<DIR> Services
[05/26/2008|11:07] C:\Program Files\Common Files\<DIR> SpeechEngines
[06/10/2008|10:30] C:\Program Files\Common Files\<DIR> System
[12/13/2008|04:06] C:\Program Files\Common Files\<DIR> Wise Installation Wizard

--------------------\\ Process

( 40 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-16 18:56:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

No other infections found !

[F:108][D:3]-> C:\DOCUME~1\Tony\LOCALS~1\Temp
[F:24][D:0]-> C:\DOCUME~1\Tony\Cookies
[F:261][D:4]-> C:\DOCUME~1\Tony\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 02/16/2009|18:56 - Option : [1]

--------------------\\ Scan completed at 18:56:46

srtony1946 · « **Reply #19 on:** February 16, 2009, 06:21:35 PM »

PS: When booting the computer while in bios it says:

invalid boot.ini

evilfantasy · « **Reply #20 on:** February 16, 2009, 07:32:45 PM »

Yes that's very useful information

Download the MBR Rootkit Detector to your desktop.

Doubleclick mbr.exe and follow prompts.
A black DOS window will quickly appear then disappear.
When mbr.exe is finished it will create a log on your desktop.
Copy and paste contents of that log file to your next reply.

srtony1946 · « **Reply #21 on:** February 16, 2009, 07:40:53 PM »

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

evilfantasy · « **Reply #22 on:** February 16, 2009, 07:43:13 PM »

Not a rootkit.

Have you looked at the solution portion on this page? http://support.microsoft.com/kb/330184

Also this http://support.microsoft.com/kb/289022

srtony1946 · « **Reply #23 on:** February 16, 2009, 07:51:41 PM »

ok, My girlfriend suggested that I may have to do just that, Boot from the windows cd. So I will have to try it tomorrow as I have to go into work tonight. Will keep you updated, thanks for your help.

evilfantasy · « **Reply #24 on:** February 16, 2009, 07:56:58 PM »

I would like to see the MBAM entry that was reported. The logs save under the Logs tab in MBAM.

srtony1946 · « **Reply #25 on:** February 16, 2009, 08:45:52 PM »

It will not let me copy and paste, so I took a screenshot of the logg but it fills the whole message page, any ideas?

evilfantasy · « **Reply #26 on:** February 16, 2009, 08:50:06 PM »

Upload the file to File Dropper

Click Upload
Locate the file and double click it.
Copy the download link and post it back here.

srtony1946 · « **Reply #27 on:** February 17, 2009, 06:24:42 AM »

http://www.filedropper.com/malwarebyteslogs....<a href=http://www.filedropper.com/malwarebyteslogs.... not sure which one you needed so I pasted both. Man your the coolest dude on here, lol.

evilfantasy · « **Reply #28 on:** February 17, 2009, 10:50:22 AM »

I need the log itself. Double click on the log that has the infection and post it.

srtony1946 · « **Reply #29 on:** February 17, 2009, 12:23:22 PM »

The Infection was quarantined 2-16-09, there where several logs that day but this was the full scan log...Malwarebytes' Anti-Malware 1.34
Database version: 1766
Windows 5.1.2600 Service Pack 3

2/16/2009 3:44:49 PM
mbam-log-2009-02-16 (15-44-49).txt

Scan type: Full Scan (C:\|)
Objects scanned: 105780
Time elapsed: 18 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected) The quarantine tab has a reference number do you need that?(46658). none off the logs show an infection, I do not understand that. But this one did, on quick scan......Malwarebytes' Anti-Malware 1.34
Database version: 1766
Windows 5.1.2600 Service Pack 3

2/16/2009 3:02:20 PM
mbam-log-2009-02-16 (15-02-20).txt

Scan type: Quick Scan
Objects scanned: 44030
Time elapsed: 1 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
\boot.ini (Trojan.Agent) -> Quarantined and deleted successfully.

Computer Hope Forum

News:

Author Topic: System restore not working. (Read 17390 times)

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.

srtony1946

Re: System restore not working.

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.

evilfantasy

Re: System restore not working.

srtony1946

Re: System restore not working.