Skip to main content
To Customer Support To Customer Support
I am so very frustrated. I work full time, and I go to school full time, so I have a very limited amount of time, but I spent the whole day trying to get rid of this Win.Useradded trojan. Webroot did not even discover that I had it until I ran rkill, malware bytes, then ad-aware and then hijackthis. Now my computer is not responding (I do not have permission to reinstall internet explorer 10). I am locked out of doing so many things. Files are missing. I am at my wits end! I have a Windows 7 system, so I am guessing I have whatever Microsoft was trying to prevent everyone from getting. Well, too late. PLEASE HELP ME! Anyone! Soon for both my computer's sake, my 2 online classes sake, my calculus class, and my physics course (which I have to complete homework online) and finally for my own sake (seriously, everything is falling apart in my life and this is just one more thing).

 

It has disabled Microsoft Security Essentials. 

 

Any time I run Webroot and Webroot finds anything I go to remove the files and I get the blue screen of death. HELP ME PLEASE!

 

 

Here is the webroot log..   

 

 

 

 

SecureAnywhere Scan Log (Version v8.0.2.155)

Log saved at Wed 2013-08-28 08:03:51

v8.0.2.155

Windows 7 Service Pack 1 (Build 7601) 64bit (Hostname: JASON-PC - Local IP: 192.168.2.6)

Scan Started: Wed 2013-08-28 01:15:04

Files Scanned: 41607

Malicious Files: 0

Duration: 8m 35s

Some legitimate files are not included in this log

[g] c:windowsassemblyativeimages_v4.0.30319_64system.web.applicat#cd49820016c51b7c529057e10a58c285system.web.applicationservices.ni.dll [MD5: 0B88593111C74518E64333BF75AF6CEC] [Flags: 00010000.8776]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.serviceproce#272907b22e0c307f612fe4d2e990530dsystem.serviceprocess.ni.dll [MD5: 5D2DCC6E7C82DC2B7B958FBC1A4D4F16] [Flags: 00010000.8749]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.drawing.desi#cd83efca1514b2cb17b56521c83b039bsystem.drawing.design.ni.dll [MD5: FB13EC15CC4B0B4285FAD31F044DA8DC] [Flags: 00010000.8766]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.activities.d#3054dade466711e4b2c13de4a6baaa40system.activities.durableinstancing.ni.dll [MD5: 0339795434F7AA5F4A1DBCBF75EEF318] [Flags: 00010000.8715]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.configuratio#a2a262c0b7514de686f4f2d7e14d5f5fsystem.configuration.install.ni.dll [MD5: B414DDD14FAE108E7C9B08685465E4C4] [Flags: 00010000.8740]

[g] c:windowsassemblyativeimages_v4.0.30319_32uiautomationprovider9ab6c813d69cd2ccd1998f22e5b4b132uiautomationprovider.ni.dll [MD5: 33555414E42A61FAED101318E6B75405] [Flags: 00000000.8984]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.configuration1a48f2470bb7a115c9cd06955f6d6330system.configuration.ni.dll [MD5: EE2DFCFFF8C412486E9F52BFC6703949] [Flags: 00010000.8760]

[g] c:windowsassemblyativeimages_v4.0.30319_32system.drawing2154273cb2d7a8b1a47d672b6d0808bfsystem.drawing.ni.dll [MD5: 48593A07948A0350ABFEE1FA1EF69ADD] [Flags: 00000000.8972]

[g] c:windowsassemblyativeimages_v2.0.50727_64microsoft.visualstu#4b87a5b9b351225bf70c12fa12458541microsoft.visualstudio.tools.applications.serverdocument.v9.0.ni.dll [MD5: 107D11CF8B8899D4B8C8CBA168BFACCE] [Flags: 00010000.8689]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.directoryser#66f6c409fa733f257d4bbf3409573382system.directoryservices.protocols.ni.dll [MD5: 65184A3C32A6070490DE70D5A733A462] [Flags: 00010000.8771]

[g] c:windowsassemblyativeimages_v4.0.30319_32system.xml.linq2e4f35dee487a97ad26fe59fa56fd90esystem.xml.linq.ni.dll [MD5: 1747ADCFCD27FDF4E3309A92C7416724] [Flags: 00000000.8953]

[g] c:windowsassemblyativeimages_v4.0.30319_32system.dynamic19a93d5e87b19373d15d4a16356dcef7system.dynamic.ni.dll [MD5: 4E3C2076382ACDEE509DB0252E4548E6] [Flags: 00000000.8982]

[g] c:windowsassemblyativeimages_v4.0.30319_32microsoft.csharp974cd65e2cbb060c4024d06cccd0cf3emicrosoft.csharp.ni.dll [MD5: AD6068F031DE0EAD24620507349B07C4] [Flags: 00000000.8694]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.data.service#2137bc848054e4bfc451687d1848d905system.data.services.design.ni.dll [MD5: 4D1D22CADC98E50E1122013550161E6A] [Flags: 00010000.8777]

[g] c:windowsassemblyativeimages_v4.0.30319_64microsoft.build.uti#e24ec2492d8c55583d636059f0a00e69microsoft.build.utilities.v4.0.ni.dll [MD5: 9453EE1B17436C2E60F7E77371C375B6] [Flags: 00010000.8780]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.web.extensio#63299c84d767689faccdf6b810538a67system.web.extensions.ni.dll [MD5: BF33F8448F0EEE8596D2F2C838DEAB86] [Flags: 00010000.8732]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.xml.linqc4744d7317907c5a4367d2f96b62b4ffsystem.xml.linq.ni.dll [MD5: 7AB116F010080C525242EFF483564648] [Flags: 00010000.8738]

[g] c:windowssyswow64wpcap.dll [MD5: 4633B298D57014627831CCAC89A2C50B] [Flags: 40001000.167]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.web.dynamicd#7185d1ecce9a4d7c4e41a9cc40db6e9dsystem.web.dynamicdata.ni.dll [MD5: DC505953795C68DEB21BF51A33D704FA] [Flags: 00010000.8754]

[g] c:windowsassemblyativeimages_v4.0.30319_32presentationframewo#fd153e15372eeccda79ab49101238146presentationframework.classic.ni.dll [MD5: EBB4F4D28EBAC046AC8DDC6A8CF3A088] [Flags: 00000000.9003]

[g] c:windowsassemblyativeimages_v4.0.30319_64smdiagnostics98eed9a440a25293fe6631107f463e06smdiagnostics.ni.dll [MD5: 8EAE0F1605BCECB4BDE941BB7DC6619F] [Flags: 00010000.8783]

[g] c:windowsassemblyativeimages_v4.0.30319_32system.windows.inpu#17dd01cc2e07b97121db39d09a299e1asystem.windows.input.manipulations.ni.dll [MD5: ACCD75CF3DE644A1C7799396A9ABD93E] [Flags: 00000000.8985]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.componentmod#48293751b60416eec20b51fc3cbffcabsystem.componentmodel.dataannotations.ni.dll [MD5: 423E96FC3ED112184675B6DAF13D99CA] [Flags: 00010000.8703]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.servicemodel#d1b35c8bbec3f1c7beecc593b0b473csystem.servicemodel.activation.ni.dll [MD5: 2775936AD5EFC6B67B05FF69BC963481] [Flags: 00010000.8709]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.identitymodel189e31855aa2fdb1206d6a4b9b0352b3system.identitymodel.ni.dll [MD5: 9674D3D9D4582F702E93CB7B12CA66AB] [Flags: 00010000.8692]

[g] c:windowsassemblyativeimages_v2.0.50727_32windowsbase1f6f220f9efe936d1158c79b9d4b451fwindowsbase.ni.dll [MD5: 69313294C5FF9A2B3FA4151EE1075376] [Flags: 00000000.8959]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.data.linq20e3068c40ef936a66e03b74bd226345system.data.linq.ni.dll [MD5: 7EF03EC4DCD5E65EAA1F568A838E7210] [Flags: 00010000.8750]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.datac05c9bd519678f9a09d3d6baa2d0c25dsystem.data.ni.dll [MD5: 0F61B5F7AFE512E55E1873FDE3530AD4] [Flags: 00010000.8718]

[g] c:windowsassemblyativeimages_v4.0.30319_32windowsbased2382128944d16da8adf76c58fb8e6f1windowsbase.ni.dll [MD5: C610A503A78145D415D5BF585AC89B81] [Flags: 00000000.8725]

[g] c:windowsassemblyativeimages_v4.0.30319_64microsoft.build.fra#aa120ba5952d9cdc7cf50f4e4c90c43microsoft.build.framework.ni.dll [MD5: DE28E1865EB66803E4D24EE4A371E92C] [Flags: 00010000.8773]

[g] c:windowsassemblyativeimages_v4.0.30319_32system.datacacd0d32f75db65027f745842172855asystem.data.ni.dll [MD5: BA5825935DCD2B829AE8E5BE8CE70804] [Flags: 00000000.8958]

[g] c:windowsassemblyativeimages_v2.0.50727_32system.xml9db78d6068543df01862a023aca785asystem.xml.ni.dll [MD5: 4FD693D4B9AA64EE32BAA9B8D9956ACF] [Flags: 00000000.7950]

[g] c:windowsassemblyativeimages_v2.0.50727_32system.printing79fad14e3994552238179d60fe7d7cbsystem.printing.ni.dll [MD5: 4D76CD44AF6DEFDB9DF6D508A2501403] [Flags: 00000000.8996]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.identitymode#60b642dd39e7ea5b0a1be004f70e43csystem.identitymodel.selectors.ni.dll [MD5: 3FE7DE02865642F330A52E6476B19C82] [Flags: 00010000.8756]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.activitiesceefd3130775c76dc99f005e90724396system.activities.ni.dll [MD5: A4F118281034EBD884E592F7BE11D8CC] [Flags: 00010000.8743]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.security2b9867bb77f4083b0da1c09085f3300asystem.security.ni.dll [MD5: 4E0BC39B8657D25FA8F4B7F5A10A39DF] [Flags: 00010000.8759]

[g] c:windowsassemblyativeimages_v4.0.30319_64microsoft.build.tas#64c7418a71e29a921d9176f73684e344microsoft.build.tasks.v4.0.ni.dll [MD5: A55EF174CEF67878A560233EC446127E] [Flags: 00010000.8678]

[g] c:windowsassemblyativeimages_v2.0.50727_64system.directoryser#c53e24a4b319ed8e0abe6b4a8ffaf871system.directoryservices.ni.dll [MD5: E4E0BF346E151E238DFD9306B4B1E8DE] [Flags: 00010000.7945]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.runtime.cach#cd9eb67c610f532d947aaf279c26eca2system.runtime.caching.ni.dll [MD5: 05ED6EFA035352B8A615E2426BF3E0E5] [Flags: 00010000.8729]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.core11bd23095969f506924ed4b4aac6a219system.core.ni.dll [MD5: AE387670A2CCC08D1E9823ECBE3356AC] [Flags: 00010000.8690]

[g] c:windowssysnativesbbd.exe [MD5: D95CD9B1BB27B748864DC4914B1ACF05] [Flags: 40011000.1268]

[g] c:windowsassemblyativeimages_v4.0.30319_64system.transactions673bc03e7a64344e7a7049d882b3e9bsystem.transactions.ni.dll [MD5: 8B8B417C4B405833C5B6F61C5B102321] [Flags: 00010000.8739]

[g] c:usersjasondesktopmbarmbar.exe [MD5: 60CEFABAC2C573B266B567534CE7567E] [Flags: 10001000.8919]

[g] c:windowssystem32wlanutil.dll [MD5: 7F1B4C6FF3B85F9ADF74055187B8A22C] [Flags: 00010000.5267]

[g] c:windowssyswow64rowseui.dll [MD5: F977BE7B8C5462087374364EAFB3C15B] [Flags: 00000000.8765]

[g] c:windowssystem32sisvc.dll [MD5: D54BFDF3E0C953F823B3D0BFE4732528] [Flags: 40010000.69]

[g] c:program filesmicrosoft silverlight5.1.20513.0agcp.exe [MD5: 955AC84C750226D85C1A3FC554D32136] [Flags: 00011000.8098]

[g] c:windowssystem32driversswenum.sys [MD5: D01EC09B6711A5F8E7E6564A4D0FBC90] [Flags: 40011000.152]

[g] c:windowssystem32sspisrv.dll [MD5: 3A0CE5FE781708CD6ABD55313607EC8B] [Flags: 00010000.7901]

[g] c:windowssystem32cscapi.dll [MD5: 1BF0CB861A48FEB1638228760750F3CB] [Flags: 40010000.98]

[g] c:windowssyswow64cryptbase.dll [MD5: F08F6FCD09F9BE94C37ACC1B344685FF] [Flags: 40000000.105]

[g] c:windowssystem32driverswdcsam64.sys [MD5: A3D04EBF5227886029B4532F20D026F7] [Flags: 40010000.205]

[g] c:windowssyswow64drprov.dll [MD5: D6692338B985D4A0CA52B828314D897D] [Flags: 00000000.4689]

[g] c:windowssyswow64api-ms-win-downlevel-shlwapi-l2-1-0.dll [MD5: 007863E45F25AA47A4C30D0930BBFD85] [Flags: 40000000.157]

[g] c:windowssystem32api-ms-win-downlevel-ole32-l1-1-0.dll [MD5: 0E6FBF19D9DFBB77316C23DF91F8A101] [Flags: 40010000.225]

[g] c:windowssystem32api-ms-win-downlevel-normaliz-l1-1-0.dll [MD5: 64A4AB126E24FD3F58EBE64852773DB5] [Flags: 40010000.27]

[g] c:windowssystem32drivershecix64.sys [MD5: B6AC71AAA2B10848F57FC49D55A651AF] [Flags: 40011000.153]

[g] c:windowssystem32samcli.dll [MD5: FC51229C7D4AFA0D6F186133728B95AB] [Flags: 40010000.257]

[g] c:program files (x86)ad-aware antivirussbamsvcps.dll [MD5: E92F9A1CAF8369D541DA870B683A33D6] [Flags: 00001000.8604]

[g] c:windowssyswow64secur32.dll [MD5: A113AFEED3159A1ED52D78CB0226006D] [Flags: 40000000.96]

[g] c:windowssyswow64dhcpcsvc6.dll [MD5: 81F6C1AE23B1C493D9E996C3103915D7] [Flags: 40000000.156]

[g] c:windowssystem32wwapi.dll [MD5: 62C7AACC746C9723468A8F2169ED3E85] [Flags: 00010000.5590]

[g] c:program filesmicrosoft silverlight5.1.20513.0microsoft.xna.framework.graphics.shaders.ni.dll [MD5: 50DE141AD5811118ECF215F23E5AEFFD] [Flags: 00010000.8458]

[g] c:windowssyswow64imgutil.dll [MD5: B96C13B5C85AC4240FE95DE115945D59] [Flags: 40000000.524]

[g] c:windowssystem32

dpgrouppolicyextension.dll [MD5: E9A0777DCA9148157E0EF9B71D7DE353] [Flags: 40010000.522]

[g] c:windowssystem32dhcpcsvc.dll [MD5: F568F7C08458D69E4FCD8675BBB107E4] [Flags: 40010000.293]

[g] c:windowssystem32shacct.dll [MD5: 4E9C2DB10F7E6AE91BF761139D4B745B] [Flags: 40010000.419]

[g] c:program files (x86)common filesadobearm1.0armsvc.exe [MD5: ADDA5E1951B90D3D23C56D3CF0622ADC] [Flags: 40001000.365]

[g] c:windowssystem32smartcardcredentialprovider.dll [MD5: CA2985996BB49924B677113DF95CFEA7] [Flags: 40010000.376]

[g] c:windowssyswow64imagehlp.dll [MD5: B2DB6ABA2E292235749B80A9C3DFA867] [Flags: 40000000.318]

[g] c:windowssystem32hhsetup.dll [MD5: 818BD0499A21CD095D13318598B214DE] [Flags: 00010000.5327]

[g] c:program files (x86)

ealnetworks

ealdownloadercodecsavcm.dll [MD5: 2958F78F2AF54F085F17E7898207E3E3] [Flags: 00000000.4766]

[g] c:windowssystem32 absvc.dll [MD5: E3C61FD7B7C2557E1F1B0B4CEC713585] [Flags: 40010000.362]

[g] c:windowssystem32iphlpapi.dll [MD5: 2B81776DA02017A37FE26C662827470E] [Flags: 40010000.395]

[g] c:windowssystem32msvcp100.dll [MD5: BC83108B18756547013ED443B8CDB31B] [Flags: 40001000.320]

[g] c:windowssystem32httpapi.dll [MD5: BCEA9AB347E53BC03B2E36BE0B8BA0EF] [Flags: 00010000.4710]

[g] c:windowssyswow64cfgmgr32.dll [MD5: F436E847FA799ECD75AD8C313673F450] [Flags: 40000000.476]

[g] c:windowssyswow64msiexec.exe [MD5: EEE470F2A771FC0B543BDEEF74FCECA0] [Flags: 40100000.466]

[g] c:windowssyswow64xmllite.dll [MD5: EDF2A5E96BEC469DA3F64E9BDD386111] [Flags: 40000000.407]

[g] c:windowssystem32igfxsrvc.dll [MD5: C8598917640A816C9C5C3E30FE8A8204] [Flags: 40010000.437]

[g] c:windowssyswow64wldap32.dll [MD5: A8BB45F9ECAD993461E0FEF8E2A99152] [Flags: 40000000.404]

[g] c:windowssystem32dfscli.dll [MD5: 1369DF1AA12A11876B41627099923EDB] [Flags: 00010400.4975]

[g] c:windowssystem32cdd.dll [MD5: 943F527DF79E6B400104341AA7023C75] [Flags: 00010000.7935]

[g] c:windowsmicrosoft.netframeworkv4.0.30319lssorting.dll [MD5: A8F8A187BCA7C1DEE5638AD2997595EE] [Flags: 00001000.7868]

[g] c:windowssystem32lodctr.exe [MD5: EB003E38CC60BB0BA70A1CAD0259C4A3] [Flags: 00110000.4701]

[g] c:windowssystem32es.dll [MD5: 4166F82BE4D24938977DD1746BE9B8A0] [Flags: 40010000.284]

[g] c:windowssystem32scardsvr.dll [MD5: 9B7395789E3791A3B6D000FE6F8B131E] [Flags: 40010000.473]

[g] c:windowssyswow64wevtapi.dll [MD5: 82C089EA2A3EEFADF3588EA71E8BDADA] [Flags: 40000000.451]

[g] c:windowssystem32slwga.dll [MD5: B6D6886149573278CBA6ABD44C4317F5] [Flags: 00010000.4837]

[g] c:usersjasonappdata

oamingdropboxindropboxext.19.dll [MD5: 8106983F4D5C609A6211A28F70AD2946] [Flags: 00001000.5600]

[g] c:windowssystem32profsvc.dll [MD5: 53E83F1F6CF9D62F32801CF66D8352A8] [Flags: 40010000.377]

[g] c:windowssystem32etsh.exe [MD5: 637982A421D0133DCEAA0D1490D1DC9C] [Flags: 00010000.8476]

[g] c:windowssystem32spfileq.dll [MD5: 198803E5E93E29967DFB0BCFD0186151] [Flags: 00010000.4688]

[g] c:windowsassemblyativeimages_v4.0.30319_32microsoft.visualc7db9c324205788cb5bf2c7ba6165f0c3microsoft.visualc.ni.dll [MD5: 5CD7A9A5AFBC0D41EA538009C3D7BE2B] [Flags: 00000000.8966]

[g] c:windowsmicrosoft.netframework64v4.0.30319gen.exe [MD5: 1ABC37A6E61C143903F409359C3E61EE] [Flags: 00111000.4698]

[g] c:windowssystem32kernelbase.dll [MD5: 1F56F209585F350A5666E3CC7931FD67] [Flags: 40010000.458]

[g] c:program files (x86)internet explorerieshims.dll [MD5: AC96DF89129E17B80D79193CEF831BA8] [Flags: 00000400.5016]

[g] c:windowssystem32ci.dll [MD5: FEB91B4DA0D540865260A33838654FA3] [Flags: 00010000.8487]

[g] c:windowssyswow64mmdevapi.dll [MD5: 243974EC02F7AE49E4179C54624143AB] [Flags: 40000000.663]

[g] c:program files (x86)ad-aware antivirussbhips.dll [MD5: 414F0C81BC69D2BF7216B0A5432DBA7F] [Flags: 40001000.435]

[g] c:windowsassemblyativeimages_v4.0.30319_32accessibility81ca6a6e48c49ac175f64484a56865caaccessibility.ni.dll [MD5: 7C028EF825E27A979CDB4EEC122F750D] [Flags: 00000000.8989]

[g] c:windowssyswow64wbemcomn.dll [MD5: 704314FD398C81D5F342CAA5DF7B7F21] [Flags: 40000000.607]

[g] c:windowssyswow64davclnt.dll [MD5: 284B59D7B56FC76C80E622AB856B1FAB] [Flags: 40000000.721]

[g] c:windowswinsxsx86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9amsvcr80.dll [MD5: C9564CF4976E7E96B4052737AA2492B4] [Flags: 40001000.622]

[g] c:windowssystem32shdocvw.dll [MD5: 22A0AE97360C1B146FDD9AA55AC0E989] [Flags: 40010000.735]

[g] c:windowssystem32 askcomp.dll [MD5: 6DC4A7242F565C9E9C9CCC7BB0FA75C7] [Flags: 00010000.5578]

[g] c:windowsassemblyativeimages_v2.0.50727_32presentationcffrast#3ea679e79eda32e3465d8cf36e838a00presentationcffrasterizer.ni.dll [MD5: B5BD343C6C93459F75E5E6CBD9DBD657] [Flags: 00000000.8981]

[g] c:windowssyswow64msxml6.dll [MD5: EAADD6E47ED2A7003ACE1793B98CF63F] [Flags: 40000000.745]

[g] c:windowssystem32dnsapi.dll [MD5: 492D07D79E7024CA310867B526D9636D] [Flags: 40010000.776]

[g] c:windowsassemblyativeimages_v2.0.50727_64accessibilityac8fcb25480f6a106783ce1c3fe92e3eaccessibility.ni.dll [MD5: 0F297EBC24F481296D26F07D4E1744CC] [Flags: 00010000.8700]

[g] c:windowssyswow64msxml3.dll [MD5: 21D3A18769EC2C4E56756D04E989A221] [Flags: 40000000.627]

[g] c:windowssystem32wlanapi.dll [MD5: 357BE883C5236BFC7341CB9E82308908] [Flags: 00010000.5266]

[g] c:windowssystem32igdumdx32.dll [MD5: C679F9E548ECB2E75A2879A3AACB6104] [Flags: 40000000.569]

[g] c:windowssystem32schannel.dll [MD5: B7D42CB36C08FA017E73FF2433CD7287] [Flags: 40010000.660]

[g] c:windowssystem32wlanhlp.dll [MD5: E4FCA0F99A41E460C84016DEFD31E6EF] [Flags: 00010000.5583]

[g] c:program files (x86)

ealnetworks

ealdownloader

caplugins

pbgrecorderapp.dll [MD5: D01BE97235CDF477551050A5B003FFA5] [Flags: 00000000.4756]

[g] c:windowsmicrosoft.netframework64v4.0.30319lssorting.dll [MD5: 4E2F590AE5FA7A767170BF8C2A0DB0FB] [Flags: 00011000.4707]

[g] c:program files (x86)

ealnetworks

ealdownloaderpluginszipf3260.dll [MD5: 021AF660B114E8463490FFB97564485B] [Flags: 40000000.602]

[
The 52 infected files are actually good files, these werent removed as they were mostly system files. If you want my advise I would re-enable whatever was disabled, uninstall all security products and reinstall WSA. We would be happy to connect to your PC to have a look. My shift has finished but one of my US based colleagues would be happy to help out.
I cannot even do a system restore. 
windows live was installed on my computer. probably when I installed microsoft office. that does not mean I have an account or ever used it. I appreciate the help guys, but obviously I messed things up here and you guys seem to think I am crazy. I will take it from here and try and fix it myself. Thank you anyway.
that would be great. if someone could connect to my computer and help, I would be elated. 
Jason, I updated your support case to note that you'd like a remote session.  One of the threat researchers should see that, or worst case, Rakanisheu will be back tomorrow.

 

On the MS Live thing, I'm not alone in my understanding of that credential:

http://www.sevenforums.com/software/197862-what-virtualapp-didlogical-credential.html

http://social.technet.microsoft.com/Forums/windows/en-US/6c6923c1-7852-48ed-b491-fd83c6e5d721/generic-credentials-virtualappdidlogical

http://answers.microsoft.com/en-us/windows/forum/windows_7-security/unknown-credential-virtualappdidlogical/40467173-a75a-44b2-8617-5aa7a0479925

http://techrena.net/remove-virtualapp-didlogical-credentials-windows-7/

http://www.howtogeek.com/forum/topic/generic-credentials
I restored those system files and ad-aware caught the threat: Optimum Installer (fs) as soon as I did. file name:setup.exe.
Just FYI, Optimum Installer is low-grade general adware, it doesn't mess with core functionality. It will perform stuff that is extremely annoying, but will generally not limit any legitimate function. Still made by terrible people, though.

Webroot's core protection is for files attempting to execute, so if it's just sitting on your disk then it's normal it would not be detected.

 
Cool. 

So one of the other ways that I know that I have a virus, it has reinstalled 4 additional usb "virtual" drives on my computer. Whenever I go into my device manager I am able to disable these or uninstall them, but they eventually come back if I have not gotten them with a malware program. I am telling you and everyone who has helped me today, whatever is on my computer is not gone. Webroot is not finding it. Internet explorer 10 won't reinstall. I cannot uninstall Webroot to reinstall it. Etc.

J 
Could you post a screenshot? I'm not sure what you're referring to as a "virtual drive," but things like the USB controllers are going to reinstall themselves to keep your USB ports functional. You might have a lot of entries for "USB Root Hub" or "USB Composite Device." Knowing the name of what you're referencing would be helpful in explaining what it is and what it does.
These virutal drives you speak of - those are empty USB-based media card readers. One of your anti-virus tools probably edited the "Folder Options" in Windows, which unchecked "Hide empty drives in the Computer folder."

 

"Uninstalling" the drives from Device Manager just removes them until PnP picks them up again and reinstall them for you.

 

This is native Windows functionality on all computers, though most users are never aware of this option. Windows XP had a problem where media card readers would introduce 5 or more "Drives" in My Computer that were always empty when not in use. Microsoft developed the option to hide them to clean up the Computer view.

 

These days malware has financial motivations rather than the academic/childish viruses in the past. They are either extremely quiet, in order to steal your data, or attempt to lock you out of everything in order to extort money out of you. There are exceptions, but if something was messing with you, there would be an address to wire money to in order to "Fix" it.

 

Extremely aggressive actions against infections on computers can often cause more damage than the infection themselves unless you are working with experts like those at BleepingComputers. Removing a virus manually is always surgery - you're always operating a few pixels away from damaging core functionality. This is why I encourage people to wait for Webroot personnel to attend to their problem. Removing things manually also means that Webroot's journaling feature and rollback won't be activated, which would probably leave users with a cleaner machine than purely manual interventions. And I'm saying this as someone who was, for reasons I won't get into, forced to fight and remove these kinds of infections daily for an hour or more. But even so, I now rely on Webroot's rollback functionality before I ever do anything else to a machine. Luckily it's extremely rare I have to do so now.
I am in the office now and will be for the next 5-6 hours or so if you need a connection.

Reply


Terms & Conditions