Go Back   Cyber Tech Help Support Forums > Software > Malware Removal Forum

Notices

Reply
 
Topic Tools
  #106  
Old April 24th, 2012, 01:25 AM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Well did the System Engineer and it said the system repair engineer core module failed. Saying something like it was broken down into separate modules and couldn't work.
Reply With Quote


  #107  
Old April 24th, 2012, 01:51 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
Go to Start Search, type cmd.exe in the Start Search box. Cmd.exe will appear at the top of the Menu. Rightclick on it and choose "Run as administrator". At the prompt copy/paste the following, pressing Enter after each:

net user administrator /active:yes

You should get a confirmation that succeeded. Then type exit and press Enter to close that Window.

Reboot to Safe Mode. At startup tap the F8 key about once per half-second, then select Safe Mode with Networking from the menu that will appear.

You should now see the icon to log in to the Administrator account. Do that, then right click Computer, left click Explore/Open, and navigate to the Users folder - your normal user account, locate and try to run Gmer's normal scan then (Desktop, Downloads or wherever you have been running it from).
Reply With Quote
  #108  
Old April 24th, 2012, 02:24 AM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Nope. It ran for a little while then a problem arose. This is one bad malware if that is the problem. Smh
Reply With Quote
  #109  
Old April 24th, 2012, 02:28 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
Earlier you said "Windows" said the file was "corrupt"? Can you provide exact details on what just occurred please?
Reply With Quote
  #110  
Old April 24th, 2012, 02:34 AM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Whenever I do a GMER scan a window will come up and say Windows has to close the scan because a problem has occurred. Then it says a solution is being looked for. I press okay, the scan is closed. Sometimes that happens, other times in normal mode, an icon in the bottom right hand corner will come up and say the file GMER is a corrupt file.
Reply With Quote
  #111  
Old April 24th, 2012, 02:43 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
Let's check if active unseen malware is calling out there. Have active Internet access to do the following.

Go here and download TCPView, unzip that downloaded file and click the Tcpview.exe from that to run TCPView. Before doing that close all browsers.

Once TCPView opens, click Options - Always On Top. The open whatever browser you use, and watch the TCPView display. What you are looking for is multiple obvious connections to various websites. Not yming (Yahoo) or just IP addresses (example - 257.09.223.187), but a bunch of activity that seems to be hitting many web sites all at once.
Reply With Quote
  #112  
Old April 24th, 2012, 03:02 AM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
If I am understanding this right. Nothing is coming up like that. I might be wrong. I am confused. Sorry. Are mcciservicehost.exe and hnm_svc.exe good things to have running?
Reply With Quote
  #113  
Old April 24th, 2012, 03:25 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
I sense you are understanding it right. It's busy list, but when TDL4/ZAcess is active there, the activity would jump out like a neon sign. So it's at least neutralized.

Try SRENg2 from Admin Safe Mode. Also run Gmer, by this time before clicking Scan, uncheck Services.
Reply With Quote
  #114  
Old April 24th, 2012, 04:19 AM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Tried to run both in safe mode, same messages cam up. Says Since System Engineer Repair 2.6, System Engineer Repair has broken down into SREngLdr module and SREngCore module. SREngCore Module will automatically generated by SREngLdr module when System Repair Engineer running.

GMER Scan still same message as well.
Reply With Quote
  #115  
Old April 24th, 2012, 04:23 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
Late where I am, but one other thing to check please. Run SREng2 again. Where the actual SREngLdr.exe is located, running it should then create a second .exe file in the same location. Once you see it, click on that and see if SREng runs then.
Reply With Quote
  #116  
Old April 24th, 2012, 04:38 AM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Did that and it says the version I have is out of date and I need a product key or something like that. Sorry for keeping you up so late.
Reply With Quote
  #117  
Old April 25th, 2012, 12:13 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
So Check Disk won't run, and Windows says Gmer is corrupted.

Delete your existing copies of Gmer and SREng2, download fresh copies and try some of those procedures again please.
Reply With Quote
  #118  
Old April 25th, 2012, 10:56 PM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Redid the SREng2 scan, and nothing came up in the right corner that was detected. Did a scan and everything looked alright. It was a lot to read. Haven't done the GMER scan yet.
Reply With Quote
  #119  
Old April 25th, 2012, 11:01 PM
mac1981 mac1981 is offline
Senior Member
 
Join Date: Mar 2012
O/S: Windows Vista 32-bit
Posts: 228
Redownloaded the GMER scan and Windows said a problem was encountered while the program was running and had to shut it down. Same message.
Reply With Quote
  #120  
Old April 26th, 2012, 01:21 AM
Jintan Jintan is offline
Malware Removal Team Advisor
 
Join Date: Dec 2004
Posts: 50,396
I believe we did it already, but do need to locate this one hold-out.

Open Gmer again. Once it has completed it's opening scan, this time just right click in the white space in the display and select Options - Only non MS files. Then click Scan and allow Gmer to run a different scan. Once that completes click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.
Reply With Quote
Reply

Bookmarks

Topic Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump




All times are GMT +1. The time now is 10:37 AM.