[tisla]

So I think I may have downloaded a .exe file which has tampered with my internal system files. Because every time I start my laptop, the task bar loads and everything like the windows icon, search bar and the system tray but I can always see the taskbar icons take like 2 minutes to load and if I click them it takes like 10 seconds for it to open, especially windows explorer. After a while I cant even open up the start menu or type in the search bar. Hope this can be resolved quickly. Thanks!

MiniToolBox Link- http://pastebin.com/cMpLmiAL
SecurityCheck Link- http://pastebin.com/seHajj1x
-tisla

[Knautschtabak]

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Ensure you read through my instructions thoroughly, and carry out each step in the order specified.
  


• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in providing the best set of instructions for you.
  


• Please backup important files before proceeding with my instructions. Malware removal can be unpredictable at times.
  


• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
  


• I will notify you when I believe your computer is free of malware. Please bear in mind, absence of symptoms does not necessarily correlate to absence of malware, so please wait until the "All Clean".
  

------

Step 1: Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
  


• Right-Click FRST64.exe and select Run as Administrator
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.

Step 2: aswMBR

• Please download aswMBR and save the file to your Desktop.
  


• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  


• Right-Click aswMBR.exe and select Run as administrator to run the program.
  


• Click Yes when prompted to download avast! virus definitions. Wait until AVAST engine defs: ### appears.
  


• If you are prompted to enable the use of "Virtualization Technology", click Yes.
  


• Click the AV Scan: drop down box and click C:\.
  


• Click Scan.
  


• Upon completion, you will see Scan finished successfully. Click Save log. Save the log to your Desktop.
  


• Re-enable your anti-virus software.
  


• Copy the contents of the log to pastebin.com and paste the link in your next reply.
  

Note: Do NOT click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your Desktop. Do NOT click or delete it.

[tisla]

Farbar Recovery Tool (FRST+addition): http://pastebin.com/GK8H3cei
For aswmbr it says it cant find a version for your PC.

EDIT: It is working now. it just didnt download properly. Waiting until it is done scanning...

ASWMBR:

---

aswMBR: http://pastebin.com/La28rVRY

[Knautschtabak]

I see that you used it to msconfig disable startup entries. msconfig allows malware-related items to hide in your registry which may not become apparent until switched back to normal startup mode - this could result in reinfection. So please enable all entries in the next step and do not disable them again until we are done.

For the future I recommend using Winpatrol as startup manager, as msconfig should only be used for troubleshooting

Enable Services and Startup Entries

• Press the Windows Key + r on your keyboard at the same time. Type msconfig and click OK.
  


• If prompted for an administrator password or for confirmation, type the password, or provide confirmation.
  


• In the Startup tab, click Enable All.
  


• In the Services tab, click Enable All, followed by OK.
  


• If prompted, click Restart.
  

I need fresh FRST scans to see the changes in effect.

Farbar Recovery Scan Tool (FRST) Scan

• Double-Click FRST64.exe to run the programme
  


• Click Yes to the disclaimer.
  


• Ensure the Addition.txt box is checked.
  


• Click the Scan button and let the program run.
  


• Upon completion, click OK, then OK on the Addition.txt pop up screen.
  


• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste them to pastebin.com. Post the link here.
  

[tisla]

NEW FRST AND ADDITION: http://pastebin.com/S7AVxBuy

[Knautschtabak]

1. All of the msconfig services and autorun entries are still disabled in the FRST logs. Did you enable them in the last step or did you have any problems executing the instructions?

2. This seems to be a VMWare workstation. Is this correct? You can make use of snapshots to revert back the state once you get problems on it. But of course you must have created a snapshot beforehand.

[tisla]

No I went to msconfig and pressed enable all for both the tabs. I will also delete VMWare Workstation because dont need it anymore.

---

Also this isnt a VMware Workstation.

---

So I went to msconfig and re-enabled them all and rescan my PC. Here it is. http://pastebin.com/54Gq0J5N

[Knautschtabak]

DISM /RestoreHealth

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
  


• Copy the four lines below (without 'Code:') and paste into the Notepad document:
  
  
  Code

  dism /online /cleanup-image /restorehealth
timeout /t 120 /nobreak
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\CBS.txt"
del %0
  
  


• Click Format. Ensure Wordwrap is unchecked.
  


• Click File, Save As and name the file dism.bat.
  


• Select All Files as the Save as type. Save the file to your Desktop.
  


• Locate dism.bat on your Desktop. Right-click the file and click Run as administrator.
  


• Upon completion, a file (CBS.txt) will be created on your Desktop. Submit the contents to pastebin.com and post the link in your next reply.
  


• Note: If the file is too large, upload to a service such as Dropbox, One Drive or SendSpace and provide a direct download link in your next reply.
  

[tisla]

While the dism.bat is loading, can you tell me if you found anything that may be causing my problem?

---

Umm I have left DSIM to run from 9:15AM-1:22PM and it is still stuck at 20.0% and hasnt moved yet. Is it frozen or just still loading?

---

So DISM.log came with an error 0x800f081f and so i cant get the CBS.log. So i think i ran a restore-health a few days ago and this is the old log. Hopefully you can find out what happened. If you need a new version i can let the dism.bat run overnight but i think it will be the same error.

Dism.log: http://www.mediafire.com/download/gbahev...t/dism.log
CBS.log: http://www.mediafire.com/download/ov25um...51/CBS.log