Avast free scan shows virus- can't Repair or Move to chest

[bookend]

Hi bookend,

Thank you for your post.  I think the screenshot should be enough.  We'll wait for Essexboy to respond.  He should be back on the forum late UK time zone.  So wait for further instruction.  Thank you.

I answered his message but asked him a couple of things before I can give him information he needs. I am on North America EST, and Essex is 5 hours ahead of where I am. I am not very familiar with how to get around the board yet. When I come here, I can go to "see new posts to me" or whatever it says, but when I answer someones post or lose my first post with all replies on it, I can't find it again and need to go down all messges from yesterday or day before. It takes me a while. There is probably an easier way. 

[essexboy]

Could you attach the main OTL log initially, if it is to large then upload to an online site like mediafire and post the sharing link 

[bookend]

Could you attach the main OTL log initially, if it is to large then upload to an online site like mediafire and post the sharing link

I am attaching otl.txt and extras.txt. What I was asking you in my last message when I said the .txt files are large, was did you want the .txt files of both otl and extras which were created as .txt files and appeared on my Desktop, or if you wanted the text files opened and pasted on a  post to you which might take too much space on the board. I am uploading the two .txt files and hope that's what you want. I hope so as I know nothing about Media fire site and many other things you mention on the board.

 

[essexboy]

What are your current problems ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  [2011/10/30 02:21:07 | 000,000,344 | ---- | C] () -- D:\Documents and Settings\All Users.WINDOWS\Application Data\6DSS92c31Apgjk
  
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[bookend]

What are your current problems ?

After I deleted MBR -1MB "bad" partition of the C drive, when I ran Avast, there is no error about it now. I haven't had a chance to check if any other problems regarding the MBR problem. But I have different problems when I run Malwarebytes. I was going to mention them to you once I got the MBR problem solved. When I run Malwarebytes it comes up with 6 errors which say:

PUM.Disabled 28/03/12
PUM.   "           26/3/12
(another 3 PUM.disabled errors the same as above but different dates.
Trojan Dropper - 26/03/12

Should I ignore the Malwarebytes result and see if I can follow your instructions in this message you are sending me? I am not sure what to do next. Thanks.
 

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  [2011/10/30 02:21:07 | 000,000,344 | ---- | C] () -- D:\Documents and Settings\All Users.WINDOWS\Application Data\6DSS92c31Apgjk
  
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[essexboy]

Yes run the OTL fix and then do a quick scan with MBAM after updating it, then post that log

[bookend]

Hi Essex, things didn't go well this time. I hope its OK to quote some things from your last message to me. If I do "Reply", I will forget some things you said.Please scroll down.

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

I disabled.

I copied and pasted your instructions (which I left here at the end of this message)  in the space at the bottom of OTL and clicked "Run Fix" at the top of OTL and it said at the bottom Status area "Killing processes -Do not interrupt. I let the computer run and came back after 20 minutes - scan still running. Came back after an hour, same. Left again.  I figured its taking too long.Came back after 2 hours and an hourglass was on the screen (not good), and in blue area at the top of the screen  said "Not responding". My computer had hung. Had to turn off computer and restart. I was glad my desktop icons came back.

I wonder if I copied and pasted the contents you gave me to run OTL are all at the right places? I started copying your instructions before I pasted (but can't remember if I put :OTL or just OTL and how much does it matter? I copied your message and left spaces in the same places between lines. The last word at the end which I included in my copy and paste was "reboot" - but not sure if the word "reboot" part was for me or part of the copy and paste instructions.

I checked my C:\ drive sometime after I deleted the 1MB "bad" partition as you had instructed and notice now in my C:\ drive files under "Documents and Settings" in Windows Explorer, when I click on that line it says "Documents and settings is not accessible - access denied".  On my D:\ drive I can access Documents and settings OK. I may be completely off.  I'm sure you will know.

I also wonder if it didn't work because the "bad" partition was in C:\ drive and I boot from D:\ drive and maybe the OTL was running on the D:\ drive? or maybe nothing to do with that.  Much of it is over my head, but I try to learn what I can, but never had many viruses to need to learn these things I am glad to say Thanks.


Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  [2011/10/30 02:21:07 | 000,000,344 | ---- | C] () -- D:\Documents and Settings\All Users.WINDOWS\Application Data\6DSS92c31Apgjk
  
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[/quote]
[/quote]

[essexboy]

OK that is MBAM being a total pain in the posterior now

If you boot from the D drive and try to access a different user on the C drive then windows will assume you are a different user and deny access

Re-run OTL with this modified script please


:OTL
[2011/10/30 02:21:07 | 000,000,344 | ---- | C] () -- D:\Documents and Settings\All Users.WINDOWS\Application Data\6DSS92c31Apgjk


:Files
ipconfig /flushdns /c

:Commands
[CREATERESTOREPOINT]
[Reboot]

[bookend]

OK that is MBAM being a total pain in the posterior now .

I disabled MBAM before running OTL.

If you boot from the D drive and try to access a different user on the C drive then windows will assume you are a different user and deny access.

I boot from the D drive but only access the C drive by using Windows Explorer to get to it.  I don't sign on as a different user to get to C drive. I don't have a dual boot. I am the only administrator and don't use any passwords.

Re-run OTL with this modified script please

I used your script below and it ran for about 3 seconds the a window came up with "OTL-The system requires a reboot to finish removing files, click OK to Reboot". I clicked ok and it rebooted. I ran OTL again and clicked on "Quick scan which said at the bottom status line "Looking for newly created files" then after a minute changed to "looking for modified files". took a few minutes.

I checked C:\documents and settings in Windows explorer again, and it still says "Documents and settings not accessible, access denied." I am uploading OTL2.txt (renamed) so as not to mix it up with otl.txt of a few days ago. I see you put (b) for that purpose below. I didn't notice the (b) till right now. Was I supposed to include the (b) in the script below? Does the  OTL log I just created and I am attaching solve anything?


:OTL
[2011/10/30 02:21:07 | 000,000,344 | ---- | C] () -- D:\Documents and Settings\All Users.WINDOWS\Application Data\6DSS92c31Apgjk


:Files
ipconfig /flushdns /c

:Commands
[CREATERESTOREPOINT]
[Reboot]

[essexboy]

Just one left to remove now

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  O4 - Startup: D:\Documents and Settings\MMary.MARY\Start Menu\Programs\Startup\_uninst_88490121.lnk = File not found
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [CREATERESTOREPOINT]
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Can you take ownership of the errant documents and settings http://www.winxptutor.com/ownership.htm

How is the computer running now ?

[bookend]

Just one left to remove now

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  O4 - Startup: D:\Documents and Settings\MMary.MARY\Start Menu\Programs\Startup\_uninst_88490121.lnk = File not found
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [CREATERESTOREPOINT]
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

OTL3.txt attached.

Can you take ownership of the errant documents and settings http://www.winxptutor.com/ownership.htm

Not quite yet. I had a problem with take ownership. I think you mean for me to take ownership of "C:\Documents and Settings." I accessed winxptutor.com and followed along about "To take ownership of a folder, follow these steps:"

Under Security tab, I have 3 lines, the first one is "Adminstrator (and my name), below that is "Everyone", below that is "System". I clicked on "Advanced at bottom for "Special permissions or for "Advanced Settings click Advanced".
Next page - click on "owner",next page "Administrator (my name), next line My name by itself. Check at bottom "Replace owner or subcontainers and objects", click OK.

Then "if you do not have permissions to read contents of directory\??\C:\Documents and Settings", do you want to replace the directory permissions with permissions granting Full Control?- All permissions will be replaced if yes"
I am not sure if I should say Yes.

Under the window where it says about permissions, there is a smaller window says "unable to set new owner on Documents and Settings" but if I click on Yes to get full control which I haven't done till I hear back from you, maybe that window will disappear.
 
Sorry to put all the above in, but I don't want to do this part wrong. I've never checked permissions or administrator stuff except when installing an OS, as I have always been administrator and there was no need to check. 

How is the computer running now ?

It seems to be running OK except I haven't yet completed "documents and settings in C:\" - I don't know why the files which were there before disappeared and there is still PUM- disabled which can be deleted or restored, but will leave for now..
I think we are getting there. It's been quite complicated and challenging.

[essexboy]

Well the good news is that there is no apparent malmare remaining 

If you are still trouble free tomorrow let me know and I will remove my tools and tidy up

[bookend]

Well the good news is that there is no apparent malmare remaining 

If you are still trouble free tomorrow let me know and I will remove my tools and tidy up

Hi Essex:

Seems to be ok today. But would like to ask 2 questions about things still to do.

1. In Quarantine tab in Malwarebytes can I safely delete 6 items -5 PUM-disabled registry data and one trojan dropper file. Choices are Delete or Restore. I ran Malwarebytes today and it said I had 3 - PUM.disabled registry data in Quarantine. I dont know if they are new or part of the group already there. Anyway, Can I delete the Quarantine list  and other 3 listed today?

2. After running Winxptutor.com link you gave me, can I take the last step to take ownership of C:\documents and settings as full administrator so I can access the C:\documents and settings folder?. I have always been the only administrator. I don't know how I lost access.
Thank you.
 
 

[essexboy]

Yes take the last step, the way windows sees it is, as it is from a different operating system (i.e. on the C and not D drive) it does not belong to you.  However, taking the final step will give you ownership

Yes you can delete the MBAM quarantine 

[bookend]

Yes take the last step, the way windows sees it is, as it is from a different operating system (i.e. on the C and not D drive) it does not belong to you.  However, taking the final step will give you ownership

Yes you can delete the MBAM quarantine

Hi Essex:
I deleted all stuff in Quarantine MBAM and did quick scan and seems to be all clear. So thats done.

Only one more thing:
I changed "Documents and settings" to being the only owner,  but now there are about 15 folders under C:\documents and settings (even with me as only administrator) that say either "access denied" or the folder is empty. Also, some new folders have appeared under C:\documents and settings I've never seen before such as "Migwiz" and "ACE" which has some programming language in it. Are they part of your changes or nothing to do with that? Should I delete them? Also should I delete folders which say Access denied or are empty folders in C:\Documents and settings. I guess they are old folders before I changed to one owner.     
Thank you.