Welcome to GeekPolice Forums! I'm
Crush but, you can call me Chris too 
and I will be helping you with your Malware issues.
A few things to keep in mind as we progress:1. We are all volunteer staff here so we log in and assess threads when real life, work, family, and other obligations permit. Additionally, we are located all over the world. There may be a bit of a time delay due to this.
2. Malware Removal threads are
very time intensive. Each entry must be researched until it can be said with 100% certainty whether or not it can stay or needs to be removed. Sometimes additional work is needed to weed out suspect entries
3. This may turn into a long ordeal but, rest assured we
will stay with you until you are completely disinfected.
4. Only
Tech Officers,
Global Moderators,
Administrators, and
Malware Advisors are allowed to give advice on removing malware from your computer. Do not run any tools unless specifically asked to by a member of one of these usergroups
5. If you are not the original poster of this thread
DO NOT run any fixes given to the poster in this thread. They are all custom tailored specifically to
this user. It could prove to be disastrous.
6. Please keep responding until I give you the
"All Clear".
Absence of symptoms does not mean that everything is clear. 7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
8. If you have any questions or issues
please stop and ask! We are all here to help.
IMPORTANT: Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.Because of this, I advise you to backup any personal files and folders before you start.
If you follow these instructions, everything should go smoothly
.
Please
subscribe to this thread to get immediate notification of replies as soon as they are posted.
To do this click
, then click
Preferences. Make sure
Always notify me of replies is set to
Yes
With that out of the way:
Please download and run
RKill.
Download mirror 1 -
Download mirror 2 -
Download mirror 3- Save it to your Desktop.
- Double click the RKill desktop icon.
- It will quickly run and launch a log. If it does not launch a log, try another download link until it does.
- Please post its log in your next reply.
- After it has run successfully, delete RKill.
Note: This tool only kills the active infection, the actual infection will not be gone. Once you reboot the infection will be active again! Please do not reboot until instructed further to do so.=========
Download
OTL to your Desktop
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Under the Custom Scan box paste this in
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
c:\$recycle.bin\*.* /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
nvstor32.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
explorer.exe
svchost.exe
userinit.exe
qmgr.dll
ws2_32.dll
proquota.exe
imm32.dll
kernel32.dll
ndis.sys
autochk.exe
spoolsv.exe
xmlprov.dll
ntmssvc.dll
mswsock.dll
Beep.SYS
ntfs.sys
termsrv.dll
sfcfiles.dll
st3shark.sys
ahcix86.sys
srsvc.dll
nvrd32.sys
/md5stop
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
