Unable to Delete ALL Specified Values (2)

[So2L]

I'm sorry for the Delay but My PC wont let me Reply to http://forum.avast.com/index.php?topic=111078.0
BUT I did manage to get 3 Log Files, except for aswMBR as it kept getting Hung-up all the time.
Thank You for your Help & Patience.

[mikaelrask]

hqy and welcome to the forum. a amlware expert will guide you from here when one is online.

about the aswmbr have you tried to run it in safemode?

[essexboy]

OK lets kill those bits first and then see if there is a reason that aswMBR hung

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
O4 - HKU\S-1-5-21-2601973988-1143446372-3340486091-1001..\Run: [] C:\Users\So2L\Local Settings\Application Data\vghd.exe File not found
F3:64bit: - HKU\S-1-5-21-2601973988-1143446372-3340486091-1001 WinNT: Load - (C:\Users\So2L\LOCALS~1\Temp\msjemt.cmd) - File not found
F3 - HKU\S-1-5-21-2601973988-1143446372-3340486091-1001 WinNT: Load - (C:\Users\So2L\LOCALS~1\Temp\msjemt.cmd) - File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 6484 = C:\PROGRA~3\LOCALS~1\Temp\msicrtz.com
@Alternate Data Stream - 5632 bytes -> C:\ProgramData:gs5sys
@Alternate Data Stream - 4096 bytes -> C:\Users\So2L\Documents\desktop.ini:gs5sys
@Alternate Data Stream - 4096 bytes -> C:\Users\So2L\Desktop\desktop.ini:gs5sys
@Alternate Data Stream - 4096 bytes -> C:\Users\Public\Documents\desktop.ini:gs5sys

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download the latest version of TDSSKiller from here and save it to your Desktop.
 
 

• Doubleclick on TDSSKiller.exe to run the application
  
  
  
• Then click on Change parameters.
   
  
   
  
• Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
   
  
• Click the Start Scan button.
   
   
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
   
  
   
  
• If malicious objects are found, they will show in the Scan results and offer three (3) options.
• Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
  
  
• Get the report by selecting Reports

 

• Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  

Please copy and paste its contents on your next reply.

[So2L]

Ok, I did all you asked. I really hope you can find the problem & have a solution.

[DavidR]

There may be some delay due to differing time zones and essexboy's availability

It is now after midnight in the UK so essexboy is likely to be in bed now and will be back later today.

[So2L]

Oh Ok. I'm not going to use My PC untill I can get this resolved. Thank You very much.

[DavidR]

You're welcome.

[So2L]

Should I run aswMBR in Safemode right now as stated by mikaelrask or should I just wait?

[Pondus]

Should I run aswMBR in Safemode right now as stated by mikaelrask or should I just wait?

you may....it will not do any harm as long as you only save the log....dont click any fix buttons 

[So2L]

Ok, I tried but when I rebooted into Safemode I couldn't find aswMBR on My Desktop. I typed it in The Search Box in The Startmenu in Safemode but couldn't locate it. Edit: Well I just tried to run aswMBR not in Safemode and after 3 min it crashed into a Windows BlueScreen Error.

[essexboy]

Not a problem on aswMBR that does occur on some systems

The run and F3 keys should now be gone could you confirm that with a fresh MBAM run please

[So2L]

Sure Thanks, &, I have one other Problem I hope you can help me with. Since I got that FBI MoneyPak Virus My PC has been rebooting on its own every 15-30 min or so especially when I'm not at My PC. Is there anyway you can show me a program or something so you can diagnose why its doing that? I'm really Thankful for your Help & everybody that helps me.

[essexboy]

Sounds like it may be a temperature problem

Download Speedfan and install it. 
Once it's installed, run the program and post here the information it shows. 
The information I want you to post is the stuff that is circled in the example picture I have attached.
If you are running on a vista machine, please go to where you installed the program and run the program as administrator.


(this is a screenshot from a vista machine)

[So2L]

I took a Screenshot. There was a Fireball next to Temp2 I believe but it went away. Edit: Crud, Im so sorry, was I supposed to get SpeedFan v4.38?

[essexboy]

No its is just that I have not updated my screenshots 

Do you have any dump files in C:\windows\minidumps ?