incorrect function

[REDACTED]

hi,

when i asked avast to do a full system scan, it returned that some files could not be scanned,
i added the image in the attachments, how can i solve this ?

[Pondus]

This is asked a million times....search forum

also read this.  https://blog.avast.com/2014/02/28/how-do-i-handle-files-that-avast-cant-scan/

[igor]

Actually, I believe this is a different case... those are special reparse points that some malware has created to block access to those files. (Now the malware may be gone already, but those blocked file were left there.)
Malware removal experts may have more information

[Pondus]

To me the files seems to belong to windows update and windows defender?

but we can always notify essexboy to confirm. 

[REDACTED]

i do have problems with windows update, i keep getting error 80073712 (see attachments)

[essexboy]

Hi there, I would tend to agree with Igor a partially removed zero access infection

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Select  additions at the bottom
• Press Scan button.
  
  
• It will produce a log called FRST.txt in the same directory the tool is run from. 
  
• Please attach both logs generated.

[REDACTED]

here are both the files.

[essexboy]

I see you have been doing a lot of torrents... They have brought multiple friends down, I am surprised that the system still runs. 

This will take several runs to fix as I cannot be sure that I got them all first time round

Download the attached fixlist.txt to the same location as FRST
Run FRST and press fix
After the reboot a log will be generated please post that

Then

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
  
• Click on Scan.
  
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.
  

Finally

Could you run one further FRST scan including additions

[REDACTED]

here are the files you asked for

[essexboy]

OK I will now hit the ones I missed and then do a final check and repair the system

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

HKU\.DEFAULT\...\RunOnce: [SpUninstallDeleteDir] - rmdir /s /q "\SearchProtect"
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
CHR Plugin: (DealPlyLive Update) - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
CHR Plugin: (FileLab plugin) - C:\ProgramData\FileLab\Plugin\Framework\npFlPluginS.dll No File
C:\$Recycle.Bin\S-1-5-21-4024043669-412896207-1546364751-1001\$060dda8e7e74abf773ef1fd32dfa0af1
Task: {17136D76-45A0-41C1-A203-C74BACACF4AD} - \{17B14B7E-5B0D-43F4-997B-69DCFF99F3A9} No Task File <==== ATTENTION
Task: {39594B0F-A111-41BC-9FEA-86C96F12984A} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-1 No Task File <==== ATTENTION
Task: {3FEB1E15-ADF8-4CAB-8B96-F61ACB318C89} - \{F4B87A5A-D115-4E17-AE94-992F1999C16B} No Task File <==== ATTENTION
Task: {4286860F-4994-4DDD-80CE-A96BFAE961C8} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {4D8E8305-55B7-4B4A-962F-BFF95D583457} - \{73E031BC-014B-49AC-A96E-E8E461322E89} No Task File <==== ATTENTION
Task: {576B7A76-30EF-4466-AB69-49B83334A598} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-6 No Task File <==== ATTENTION
Task: {969A8415-7776-4719-8D07-9A0BF4F6D268} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-5 No Task File <==== ATTENTION
Task: {9750DD8D-2B81-492D-BD88-9B900231791D} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-7 No Task File <==== ATTENTION
Task: {9CAB6974-9BD4-4FB8-868F-5C13613E7A25} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-11 No Task File <==== ATTENTION
Task: {9D5AE510-9145-4679-8CDE-52BCF29BA0D3} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-4 No Task File <==== ATTENTION
Task: {B166DE71-A60C-4B83-BDDE-16931342700A} - \{CA20FB3C-FA3D-4CE9-B5BC-5995AEE6A171} No Task File <==== ATTENTION
Task: {DE72770E-0480-4A5D-BC19-C19B4F3006B3} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-3 No Task File <==== ATTENTION
ask: {EBBAEA50-C808-494A-9B39-0197E6AFC3C0} - \97a60ff5-1ff3-48f3-bd6a-5f9bd925bcb7-2 No Task File <==== ATTENTION
Task: {F136FC68-AAB4-44C6-B0F8-19160605AFE2} - \G2MUpdateTask-S-1-5-21-4024043669-412896207-1546364751-1001 No Task File <==== ATTENTION
CMD: bitsadmin /reset /allusers
CMD: DEL %TEMP%\*.* /F /S /Q
CMD: RD /S /Q %TEMP%
REBOOT:

 
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[REDACTED]

combofix didn't produce a log

[Pondus]

So you dont find it at C:\ComboFix.txt  ?

How is your computer running now ...... any problems ?

[essexboy]

See if you can find the log at c:\combofix.txt

Download and run farbar service scanner



Tick "All" options.
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

[REDACTED]

cant find the log at the c drive

Farbar Service Scanner Version: 10-06-2014
Ran by jonas (administrator) on 17-07-2014 at 22:35:13
Running from "C:\Users\jonas\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============
Checking FirewallRules of SharedAccess: ATTENTION!=====> Unable to open "SharedAccess\Defaults\FirewallPolicy\FirewallRules" registry key. The key does not exist.


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

[essexboy]

Download the registry file at this link  https://dl.dropboxusercontent.com/u/73555776/SharedAccess.reg to your desktop
Right click the reg file and select Merge
OK the warning
Reboot the computer and then run FSS one more time please.   

How is the computer behaving now, what problems remain