Problems return after reboot

[jpraymond]

I have run Rogue Killer Premium 3 times, yet the same errors reappear after reboot.

Rather than posting more info than you need, I have attached 4 .txt files, and 3 or 4
.jpg files for a better view of what I see.

Please advise? (No, I can't afford to update beyond Win XP Home, as I'm on SSDI)

Thank you very much. (If I've posted in the wrong area, please move to such), and if possible,
please undo my dumb-ass move of "Show all as read" or some command, as there are many I
am unable to view...

MË₮ẮĻĦËẮÐ

[Curson]

Hi jpraymond,

Your computer is infected with a variant of trojan Gootkit, a Trojan horse that steals confidential information.
Please consider that all your online accounts may have been compromised and be especially warry of unauthorized transactions if you use online banking.

Please download Farbar Recovery Scan Tool (x86) and save it to your Desktop.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will produce a log called FRST.txt in the same directory the tool is run from.
  
• Please attach log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe). Please also attach that along with the FRST.txt into your reply.
  

Thank you very much. (If I've posted in the wrong area, please move to such), and if possible,
please undo my dumb-ass move of "Show all as read" or some command, as there are many I
am unable to view...

I'm sorry but I'm unable to reverse this operation.
This command marks all threads as read but you should be able to access them without problems.

Regards.

[jpraymond]

Thank you Curson.

 Have done as instructed, and will post the 2 files now. I really appreciate the help, especially knowing the ramifications it could cause.

 Prior to reading your reply, I had run Malwarebytes, and it found the same problem as before. I did not reboot, and then ran RogueKiller, supposedly cleaning the system, then logged onto the Adlice forum. If you wanted the FRST.exe run prior to removing the virus(s), please send me an email and I'll reboot and not run virus /  malwarebytes software before running the two programs to rid this system of the problems.

 Thank you once again,

 JP

[Curson]

Hi jpraymond,

It's OK.
Uninstall the following softwares using Add/Remove programs (if present) :

Adobe Flash Player 20 ActiveX
Amazon Assistant
MySecurityCenter License Service

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system !

Run FRST and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please attach it to your reply.

How is the computer running now ?

Regards.

[jpraymond]

About to run program... sorry, had to run out and get a suit, for a legal suit going on in Salem, Ma., as not one of my old suits fixed. 

When deleting the 3 programs you gave, I had to go into boot mode to remove the Amazon Assistant... it was probably in process with other Amazon programs.

Will respond again and post file you requested...

Again, thank you very much for the help... 

--------------------------------------------------------------------------

Did as you said, and result at this time

When it first came up with an error, it shut down mail account, and mspaint.

Can't attach anything in edit mode...

[jpraymond]

 txt file and jpg files attached. should I reboot into safe mode, then try it?

 Thanks again for you efforts!!!

[Curson]

Hi jpraymond,

Yes, please try in Safe Mode.

Regards.

[jpraymond]

In safe mode, after running program in safe mode, reboot into regular mode, things would not work, and eventually forced me into another reboot, into safe mode...

Prior to forced reboot, tried to open adobe .pdf, and it seems the Amazon Assistance was needed.

In trying to copy/paste info as I've always been able to, only the "hand" for up/down mouse use was usable, and no "arrow" was visible. that seemed odd to me.

[Curson]

Hi jpraymond,

Please attach the following file in your next reply.

C:\Documents and Settings\Jeff\Desktop\Fixlog.txt

Regards.

[jpraymond]

Sorry, thought I had attached it first...

What I meant by nothing worked, I was referring to NSS, and other functions. System crashed after a few minutes, then I rebooted into safe mode to reply. Only left half was viewable,
as right half was all adds... and although viewable is color red underlined, it is correctly spelled.

Thanks... forgot to mention, the SONAR.Kotver!gen1 virus warning did NOT reappear after running scan/fix. System seems to be more stable, it was running slower before this... Directory I was working on with MANY .pdf files are now under /FRST/ Quarantine/C/Temp/ (vertically like)
2011
2012
2013
2014
2015
contained 49 .pdf files that I was working on for the court hearing tomorrow. That Is a big problem! I will add to next reply, which may help you see my new dilemma...

[Curson]

Hi jpraymond,

The infection has been removed.
What do you means by "NSS" ? Is booting into Normal Mode still possible ?
I have trouble understanding your explanations.

Regards.

[jpraymond]

Ok will do, with my "current view" as well...

NSS = Norton Security System, yes, booting into normal mode is ok, and stabilized.
 
I'm sorry, describing the best I can... this English language
is quite a pain to learn...

[Curson]

Hi jpraymond,

OK, I'm glad the system is now working great.
You will need to download a PDF reader, since "Amazon Assistant" was removed.
I suggest PDF-XChange Viewer.

Directory I was working on with MANY .pdf files are now under /FRST/ Quarantine/C/Temp/ (vertically like)

I wrote a script to restore this directory.
Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please attach it to your reply.

Are you able to access your files ?

Regards.

[jpraymond]

After running the PDF-Viewer then install, opened .jpg file, still have... was checking with the drop down menus in PDF-Viewer, went to Tools-Basic Tools - Select Tool allowed the pointer to return.

You're an amazing master of the codes! After working at DEC for !4 years, then PC repair business after the BIG "downsizing" of DEC.  Never have been able to find anything close to what I was doing at DEC, or come close to what I was making, I (barely) get by.

Thanks for the assistance (FAR beyond my expectations!!!) I'll run Rogue Killer to ensure that is clear, and get back to the files, which hopefully will allow me "Grandparent Rights" to see my 2 grandsons I've never seen, and hopefully get to know them, and continue on with the relationship. Also hope to reconcile things with my daughter, who for reasons beyond my imagination, hasn't seen me since 2008 (all her choices, not mine)

Should anything new show up after the running of the RK SW, I'll let you know... otherwise, thanks doesn't seem to be enough for all the support! It's been an amazing experience!!!

Best regards, and God bless you and those you love and care for in ways only He can!

JP 

[Curson]

Hi jpraymond,

I'm glad the issue has been resolved.
You can now delete FRST and the files linked to it, except the C:\FRST folder.
I will be very grateful if you could zip it and attach it in your next reply so I would be able to analyze the malware more deeply.

I strongly advice you to change your passwords since they may have been stolen.

Thanks for the kind words, this is very appreciated.
I wish you all the best, especially with the family issues.

Regards.