Can only work in Safe Mode

To disable UAC via Command Prompt:

• Try this:
• Go to start > type in cmd
• Click on cmd.exe > and paste in the following:

After you enable or disable UAC, you will have to reboot your computer for the changes to take effect.

You should receive a success message saying: "The operation completed successfully"

 

Explain what happened with MGTools please?

Download OTL to your desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Attach both of these logs into your next reply.

 

Don't bump, it only hurts! Getting to your logs now.

 

We need to run an OTL Fix

• Right-click OTL.exe And select " Run as administrator " to run it. If Windows UAC prompts you, please allow it.
• Copy and Paste the following code into the textbox. Do not include the word Code

Code:

:otl
[2012/09/04 07:45:38 | 000,278,581 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.013
[2012/09/04 07:45:37 | 001,388,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.011
[2012/09/04 07:45:37 | 000,326,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.012
[2012/09/04 07:45:37 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.010
[2012/09/04 07:45:36 | 000,598,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00D
[2012/09/04 07:45:36 | 000,164,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00E
[2012/09/04 07:45:36 | 000,147,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00F
[2012/09/01 23:19:15 | 000,278,581 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00C
[2012/09/01 23:19:14 | 000,326,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00B
[2012/09/01 23:19:13 | 001,388,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.00A
[2012/09/01 23:19:13 | 000,164,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.007
[2012/09/01 23:19:13 | 000,147,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.008
[2012/09/01 23:19:13 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.009
[2012/09/01 23:19:12 | 000,598,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\temp.006
[2011/06/18 02:04:15 | 000,000,216 | ---- | C] () -- C:\ProgramData\~25943824
[2011/06/18 02:04:15 | 000,000,152 | ---- | C] () -- C:\ProgramData\~25943824r
[2011/06/18 02:03:50 | 000,000,344 | ---- | C] () -- C:\ProgramData\25943824
[2011/06/07 19:22:45 | 000,000,344 | ---- | C] () -- C:\ProgramData\30857564
[2011/05/31 14:11:17 | 000,010,956 | -HS- | C] () -- C:\ProgramData\q357f5hcb74jf314d8844uge3716675j3
[2011/05/26 21:55:05 | 000,010,020 | -HS- | C] () -- C:\ProgramData\4256o56y1a8o6x33021iv38cljbeoo2456lvgt
@Alternate Data Stream - 1854 bytes -> C:\ProgramData\rkfree:cfg
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:C8B8CEBD
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:6B9940D5
  
:commands
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click Image.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. ATTACH that report in your next reply.

Rerun OTL normally, just a scan and attach the log.

 

Then replace the OTL step with avenger. Don't forget to run OTL normally afterwards and attach log.


Download The Avenger by Swandog469, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

 

I don't understand why you cannot just attach the logs when you get to work. If you really need to paste the avenger log and then the OTL log you can but I'll edit them asap to get into attachment form again.

 

I am not seeing any malware now in that latest OTL log. I feel you should post in the software forum at this point. Then when you are done perhaps you could return here and run tools again once you are back up and running in normal mode in case any more malware is revealed.

Mention this when you post in software too:

 

You're welcome. But don't forget it's wise to come back here and run the scans once you can run in normal mode.