Member Panel

Chicagoboy · SUPERAntiSpyware Scan Log - 03-08-2008 - 19-09-47.log (2.6 KB, 2 views)

Hi all,

Well here is my first official post to ask for help. I've been experiencing blue screens of late. I was directed to use sdfix to resolve the problems. That worked, but today it has started up again. I have done the PreWork recommended by LadyGreenwitch. So I am attaching my AVG log, my two SUPERAntiSpyware logs and my Hijack this log.

I hope someone out there will be able to give me a clue as to what is going on.

BTW I had to fix the date so the logs appear as "March 3rd" but it's really today, March 8th.

here is a copy of my log from the system (event observer)

Type de l'événement : Erreur
Source de l'événement : DCOM
Catégorie de l'événement : Aucun
ID de l'événement : 10010
Date : 03/03/2008
Heure : 15:17:24
Utilisateur : AUTORITE NT\SYSTEM
Ordinateur : JOHN
Description :
Le serveur {1BE1F766-5536-11D1-B726-00C04FB926AF} ne s'est pas enregistré sur DCOM avant la fin du temps imparti.

it says

Type of event : error
Source: DCOM
Categorie: none
ID of the event: 10010
Date 03/03/2008
Time: 3:17:24 pm
User: Authority NT/System
Computer: JOHN
Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not save on DCOM before the expiration of the allotted time.

Ok, thanks

Pancake

Please download SDFix from here and save it to your desktop
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Post that log in your next reply.
=================================

Ok.We also need to download ComboFix.exe.
Please visit this webpage for download links, and instructions for running the tool

When the tool is finished, it will produce a report for you. Please post the "C:\ComboFix.txt" along with a new HijackThis log so that we can continue to do any further cleaning that your system may require.
Caution: Never run and remove files with Combofix unless supervised by a security analyst.

Chicagoboy

Ok here is the information. Let me know if you need any help understanding the French. When I ran SDFix the following error messasge was shown "impossible to import assosfix.reg"

during ComboFix it said "the size of your registry is not big enough. In order for Windows to function correctly you must increase the maximum size of your registry. For more information consult Help"

Thank you for your time

Pancake

Before we continue with the cleanup.....

We need to install your Recovery Console first.
Go to Microsoft's website => How to obtain Windows XP Setup boot disks
Select the download that's appropriate for your Operating System

Download the file & save it as its originally named, next to ComboFix.exe.

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.
Please do not reboot your machine until we have reviewed the log.

Chicagoboy

Euhh, one small problem. My server is Windows 2000 service pack 3

Pancake

When you get chance I suugest you install the recovery console from your startup/installation/repair disc.
========================
Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.

O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINNT\system32\ms.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINNT\system32\ms.exe (file missing)
O23 - Service: HV - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HV.exe (file missing)
Reboot...
==================

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the text in the quotebox below into it:

Killall::
File::
C:\WINNT\system32\4.tmp
C:\WINNT\system32\3.tmp
C:\WINNT\Internet Logs\xDB242.tmp
C:\WINNT\Internet Logs\xDB240.tmp
C:\WINNT\Internet Logs\xDB23F.tmp
C:\WINNT\Internet Logs\xDB241.tmp
C:\WINNT\Internet Logs\xDB23E.tmp
C:\WINNT\Internet Logs\xDB23C.tmp
C:\WINNT\Internet Logs\xDB23B.tmp
C:\WINNT\Internet Logs\xDB247.tmp
C:\WINNT\Internet Logs\xDB23D.tmp
C:\WINNT\Internet Logs\xDB2D0.tmp
C:\WINNT\Internet Logs\xDB2CE.tmp
C:\WINNT\Internet Logs\xDB281.tmp
C:\WINNT\Internet Logs\xDB23A.tmp
C:\WINNT\Internet Logs\xDB233.tmp
C:\WINNT\Internet Logs\xDB2C5.tmp
C:\WINNT\Internet Logs\xDB2C4.tmp
C:\WINNT\Internet Logs\xDB2BC.tmp
C:\WINNT\Internet Logs\xDB2B5.tmp
C:\WINNT\Internet Logs\xDB2A5.tmp
C:\WINNT\Internet Logs\xDB2A4.tmp
C:\WINNT\Internet Logs\xDB239.tmp
C:\WINNT\Internet Logs\xDB2A0.tmp
C:\WINNT\Internet Logs\xDB236.tmp
C:\WINNT\Internet Logs\xDB29D.tmp
C:\WINNT\Internet Logs\xDB238.tmp
C:\WINNT\Internet Logs\xDB237.tmp
C:\WINNT\Internet Logs\xDB298.tmp
C:\WINNT\Internet Logs\xDB296.tmp
C:\WINNT\Internet Logs\xDB28C.tmp
C:\WINNT\Internet Logs\xDB286.tmp
C:\WINNT\Internet Logs\xDB234.tmp
C:\WINNT\Internet Logs\xDB235.tmp
C:\WINNT\Internet Logs\xDB250.tmp
C:\WINNT\Internet Logs\xDB244.tmp
C:\WINNT\Internet Logs\xDB230.tmp
C:\WINNT\Internet Logs\xDB231.tmp
C:\WINNT\Internet Logs\xDB232.tmp
C:\WINNT\Internet Logs\xDB22F.tmp
C:\WINNT\Internet Logs\xDB22E.tmp
C:\WINNT\Internet Logs\xDB22C.tmp
C:\WINNT\Internet Logs\xDB22B.tmp
C:\WINNT\Internet Logs\xDB22D.tmp
C:\WINNT\Internet Logs\xDB22A.tmp
C:\WINNT\Internet Logs\xDB229.tmp
C:\WINNT\Internet Logs\xDB228.tmp
C:\WINNT\Internet Logs\xDB227.tmp
C:\WINNT\Internet Logs\xDB226.tmp
C:\WINNT\Internet Logs\xDB225.tmp
C:\WINNT\Internet Logs\xDB224.tmp
C:\WINNT\Internet Logs\xDB223.tmp
C:\WINNT\Internet Logs\xDB222.tmp
C:\WINNT\Internet Logs\xDB221.tmp
C:\WINNT\Internet Logs\xDB220.tmp
C:\WINNT\Internet Logs\xDB21F.tmp
C:\WINNT\Internet Logs\xDB21E.tmp
C:\WINNT\Internet Logs\xDB21D.tmp
C:\WINNT\Internet Logs\xDB21C.tmp
C:\WINNT\Internet Logs\xDB21A.tmp
C:\WINNT\Internet Logs\xDB21B.tmp
C:\WINNT\Internet Logs\xDB219.tmp
C:\WINNT\Internet Logs\xDB218.tmp

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*

Member Panel

Sponsors and Ads

Live Tag Cloud