Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

pls help me .vbs virus


  • Please log in to reply
1 reply to this topic

#1 asoberde1

asoberde1

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:15 AM

Posted 18 September 2013 - 07:26 PM

hello. i have this problem with my laptop that everytime a flashdisk is inserted in it, the files on the flashdisk are turned all into shortcuts but i still can access the files. i am afraid that my laptop is infected.

this is the ComboFix log.

thanks in advance.

 

ComboFix 13-09-17.01 - VinRa 09/18/2013  22:19:43.3.4 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.63.1033.18.8089.6259 [GMT 8:00]
Running from: c:\users\VinRa\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2013-08-18 to 2013-09-18  )))))))))))))))))))))))))))))))
.
.
2013-09-18 14:24 . 2013-09-18 14:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-18 05:32 . 2013-08-10 00:25 19744 --sha-w- c:\users\VinRa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ztorsftdgh.vbs
2013-09-17 19:15 . 2013-09-17 19:15 -------- d-----w- c:\users\VinRa\dwhelper
2013-09-14 02:38 . 2013-09-14 23:26 -------- d-----w- c:\users\VinRa\AppData\Local\cache
2013-09-14 02:33 . 2013-09-14 23:22 -------- d-----w- c:\programdata\FLEXnet
2013-09-14 02:32 . 2013-09-14 02:32 -------- d-----w- c:\programdata\FARO
2013-09-14 02:28 . 2013-09-14 02:28 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2013-09-14 02:28 . 2013-09-14 23:27 -------- d-----w- c:\users\VinRa\AppData\Local\Autodesk
2013-09-14 02:24 . 2013-09-15 00:02 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2013-09-14 02:24 . 2013-09-14 23:33 -------- d-----w- c:\program files\Autodesk
2013-09-14 02:23 . 2013-09-14 23:37 -------- d-----w- c:\program files (x86)\Autodesk
2013-09-14 02:19 . 2013-09-14 11:38 -------- d-----w- c:\program files\7-Zip
2013-09-14 02:17 . 2013-09-14 23:43 -------- d-----w- c:\program files (x86)\Common Files\Autodesk Shared
2013-09-14 02:13 . 2013-09-14 23:26 -------- d-----w- c:\users\VinRa\AppData\Roaming\Autodesk
2013-09-14 02:13 . 2013-09-14 23:07 -------- d-----w- c:\programdata\Autodesk
2013-08-28 13:43 . 2013-08-28 13:43 -------- d-----w- c:\programdata\RELOADED
2013-08-28 13:42 . 2013-08-28 13:42 -------- d-----w- c:\users\VinRa\My Games
2013-08-28 13:38 . 2013-08-28 13:38 -------- d-----w- c:\users\VinRa\AppData\Roaming\Media Player Classic
2013-08-28 13:09 . 2013-08-28 13:59 -------- d-----w- c:\program files (x86)\Torchlight II
2013-08-28 02:00 . 2013-08-28 02:12 -------- d-----w- c:\users\VinRa\AppData\Roaming\DVDVideoSoft
2013-08-28 02:00 . 2013-08-28 02:00 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2013-08-28 02:00 . 2013-08-28 02:00 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2013-08-28 01:59 . 2013-08-28 01:59 -------- d-----w- c:\users\VinRa\AppData\Local\Programs
2013-08-26 13:31 . 2013-08-26 13:31 -------- d-----w- c:\windows\SysWow64\Launchpad.libs
2013-08-26 13:30 . 2013-08-26 13:30 -------- d-----w- c:\users\VinRa\AppData\Local\SCE
2013-08-26 13:30 . 2013-08-26 13:30 -------- d-----w- C:\Crash
2013-08-21 03:00 . 2013-08-21 03:00 -------- d-----w- c:\users\VinRa\AppData\Local\Macromedia
2013-08-21 03:00 . 2013-08-21 03:00 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-21 03:00 . 2013-08-21 03:00 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-21 03:00 . 2013-08-21 03:00 -------- d-----w- c:\windows\SysWow64\Macromed
2013-08-21 03:00 . 2013-08-21 03:00 -------- d-----w- c:\windows\system32\Macromed
2013-08-21 02:42 . 2013-08-21 02:42 -------- d-----w- c:\users\VinRa\AppData\Local\Mozilla
2013-08-21 02:27 . 2013-08-21 02:27 -------- d-----w- c:\windows\Sun
2013-08-21 02:26 . 2013-08-21 02:39 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-08-21 02:26 . 2013-08-21 02:39 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-08-21 01:14 . 2008-02-05 07:36 798208 ----a-w- c:\windows\SysWow64\NextControls.ocx
2013-08-21 01:14 . 2000-05-22 09:58 608448 ----a-w- c:\windows\SysWow64\comctl32.ocx
2013-08-21 01:03 . 1997-07-19 08:55 1347344 ----a-w- c:\windows\SysWow64\msvbvm50.dll
2013-08-21 01:03 . 2013-08-21 02:05 -------- d-----w- c:\program files (x86)\Winstep
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-05 23:54 . 2013-08-05 03:53 81112 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-09-05 23:54 . 2013-08-05 03:49 132088 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-05 23:54 . 2013-08-05 03:49 105344 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"NetLimiter"="c:\program files\NetLimiter 3\NLClientApp.exe" [2011-03-21 2910208]
"NeXuS-Ultimate"="c:\program files (x86)\Winstep\Nexus-Ultimate.exe" [2011-10-10 14558848]
"ztorsftdgh"="wscript.exe" [2009-07-14 141824]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-03-29 636032]
"USB3MON"="c:\program files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-26 291608]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-09-05 347192]
"USB Antivirus"="c:\program files (x86)\USB Disk Security\USBGuard.exe" [2008-08-16 798720]
"S-Bar"="c:\program files (x86)\S-Bar\S-Bar.exe" [2012-04-13 5498880]
.
c:\users\VinRa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ztorsftdgh.vbs [2013-8-10 19744]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 <NtDriverName>;<NtDriverName>;c:\windows\System32\Drivers\<NtDriverName>.sys;c:\windows\SYSNATIVE\Drivers\<NtDriverName>.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R4 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\DRIVERS\amdkmpfd.sys;c:\windows\SYSNATIVE\DRIVERS\amdkmpfd.sys [x]
S0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 nltdi;nltdi;c:\program files\NetLimiter 3\nltdi.sys;c:\program files\NetLimiter 3\nltdi.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files (x86)\S-Bar\MSIService.exe;c:\program files (x86)\S-Bar\MSIService.exe [x]
S2 s7oiehsx64;SIMATIC IEPG Help Service;c:\program files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe;c:\program files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [x]
S2 s7ousbu64x;SIMATIC USB Service;c:\windows\system32\DRIVERS\s7ousbu64x.sys;c:\windows\SYSNATIVE\DRIVERS\s7ousbu64x.sys [x]
S2 s7sn2srtx;PROFINET IO RT-Protocol V2.0;c:\windows\system32\DRIVERS\s7sn2srtx.sys;c:\windows\SYSNATIVE\DRIVERS\s7sn2srtx.sys [x]
S2 S7TraceServiceX;S7TraceServiceX;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S3 dpmconv;SIMATIC NET DP Driver;c:\windows\system32\DRIVERS\dpmconv.sys;c:\windows\SYSNATIVE\DRIVERS\dpmconv.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 iusb3hub;Intel® USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys;c:\windows\SYSNATIVE\Drivers\RTSUVSTOR.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 s7odpx2x64;SIMATIC Knotentaufe;c:\windows\system32\DRIVERS\s7odpx2x64.sys;c:\windows\SYSNATIVE\DRIVERS\s7odpx2x64.sys [x]
S3 s7oppinx64;SIMATIC PPI Transport;c:\windows\system32\DRIVERS\s7oppinx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7oppinx64.sys [x]
S3 s7oserix64;Siemens PC Serial Cable;c:\windows\system32\Drivers\s7oserix64.sys;c:\windows\SYSNATIVE\Drivers\s7oserix64.sys [x]
S3 s7osmcax64;SIMATIC PC Adapter RS232;c:\windows\system32\DRIVERS\s7osmcax64.sys;c:\windows\SYSNATIVE\DRIVERS\s7osmcax64.sys [x]
S3 s7osobux64;SIMATIC SoftBus;c:\windows\system32\DRIVERS\s7osobux64.sys;c:\windows\SYSNATIVE\DRIVERS\s7osobux64.sys [x]
S3 s7otmcd64x;SIMATIC Memory Cards;c:\windows\system32\Drivers\s7otmcd64x.sys;c:\windows\SYSNATIVE\Drivers\s7otmcd64x.sys [x]
S3 s7otranx64;SIMATIC Transport;c:\windows\system32\DRIVERS\s7otranx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7otranx64.sys [x]
S3 s7otsadx64;SIMATIC TS Adapter RS232;c:\windows\system32\DRIVERS\s7otsadx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7otsadx64.sys [x]
S3 vsnl2ada;SIMATIC NET FDL Driver;c:\windows\system32\DRIVERS\vsnl2ada.sys;c:\windows\SYSNATIVE\DRIVERS\vsnl2ada.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-06 00:11 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-05 02:05]
.
2013-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-08-05 02:05]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-27 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-27 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-27 439064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-04-25 12481128]
"ETDCtrl"="c:\program files (x86)\Elantech\ETDCtrl.exe" [BU]
"ztorsftdgh"="wscript.exe" [2009-07-14 168960]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.254.254
FF - ProfilePath - c:\users\VinRa\AppData\Roaming\Mozilla\Firefox\Profiles\7az8wxdz.default\
FF - ExtSQL: 2013-08-21 10:53; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:\users\VinRa\AppData\Roaming\Mozilla\Firefox\Profiles\7az8wxdz.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Rainbow Sentinel Driver - c:\windows\SYSTEM32\RNBOSENT\SETUPX86.EXE
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-09-18  22:26:32
ComboFix-quarantined-files.txt  2013-09-18 14:26
ComboFix2.txt  2013-09-18 14:13
ComboFix3.txt  2013-09-18 14:06
.
Pre-Run: 375,195,226,112 bytes free
Post-Run: 375,121,600,512 bytes free
.
- - End Of File - - EBEDC34F91CD9B5CA71D00986ADF20B3
 

 



BC AdBot (Login to Remove)

 


#2 Aaflac

Aaflac

    Doin' Dis 'n Dat...


  • Malware Response Team
  • 2,307 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:USA
  • Local time:10:15 PM

Posted 21 September 2013 - 07:37 PM

asoberde1,

 

:welcome: to BC forums!

 

Please do the following...

 

:step1:  To stop the Autorun feature, download and run the following:
Microsoft Fix It 50471:
http://support.microsoft.com/kb/967715

Scroll down to: How to disable or enable all Autorun features in Windows 7 and other operating systems
Click Run in the File Download dialog box, and follow the steps of the wizard.

 

Note: There is an option to enable Autorun automatically. You can do so later, if you wish.

 

Reboot the system after applying the Microsoft FixIt.

 

:step2:  Please click on the Windows 7 Start button and then on Control Panel
In Control Panel, select the Folder Options link.
Click on the View tab in the Folder Options window.

 

In the Advanced settings: area, locate the Hidden files and folders category.

Check: Show hidden files, folders, and drives
Uncheck: Hide protected operating system files (Recommended)
Click Apply and OK at the bottom of the Folder Options window.

 
:step3:  Next, download UsbFix:
http://www.infospyware.com/utiles/usbfix/

It is a Spanish language website, but the program is in English.
To download. press the button that says: Descagar  (It means: Download)
Save to the Desktop. 
 

:step4:   Next, right-click the downloaded USBFix file and select: Run as Administrator

Connect any problem USB drive!

Press: Research

When done, the program closes on its own, and a report appears.
(The report file is also found at C:\UsbFix.txt)

 

>> Please post the UsbFix.txt (Research Mode) report in your reply.

 

:step5:  Once again, run USBFix as Administrator, but, this time, press: Listing

>> Also post the UsbFix.txt (Listing Mode) report in your reply. 

 

Note 1: If USBFix does not run in normal Windows, please run in Safe Mode:

Restart your computer.
 When the computer starts, tap the F8 key on the keyboard repeatedly until presented with the Advanced Boot Options menu
 Using the arrow keys, select: Safe Mode
 Press the Enter key on your keyboard to boot into the selected mode.

 

Note 2: If your AntiVirus program detects USB as malware, either let the AV program allow USBFix to run, or, temporarily disable your AntiVirus program:

Info - http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

When done with USBFix, re-enable your AV!

 

:step6:  Last, please download the Farbar Recovery Scan Tool
Download: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Select the version that applies to your system.
Save it to your Desktop.

 

Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.

 

Press the Scan button.

 

The tool makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

>> Please provide the FRST.txt in your reply.

 

The first time the tool is run, it also makes another log: Addition.txt

>> Also post the Addition.txt in your reply.


Edited by Aaflac, 21 September 2013 - 07:38 PM.

Old duck...





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users