Log File Scan Copy

Viruses and worms
1

How do I copy and paste a log file. I’m trying to get malware help and they need a copy of a scan to know the viruses I had. They gave me directions on how to copy and paste it, but it’s not working for me. Any help weill be appreciated. Thank you. Sheryl

2
They gave me directions on how to copy and paste it,
who are they ?

you can attach logs here…
lower left corner > additional options > attach…

3

It is a group that used to be under MSN in MSN Groups until they closed down groups. Now they are on their own and they help people with Malware problems. The link is http://www.community-feedback.com/index.php?s=2912b4e1d189a5b7bcde85ea06998ad6&

I’m guessing I have to somehow save the files. I’ll have to see if I can figure out how to do that. Thanks.

4

if you have a malware problem then follow the guide here http://forum.avast.com/index.php?topic=86818.0

attach the logs in your next reply and Essexboy will fix it…

5

My original complaint at the group I was talking about is that when I open a window I get this message that pops up…This webpage wants to run the following add-on:‘npctrl.dll’ from Microsoft Corporation’. It gives me the option to allow or no allow. I’ve just been X-ing out, not knowing what to do. I also ran a full scan with Avast last week and had a bunch of malware and two trojans. I put them in some kind of chest. I’ms assuming they’re like quarantined.

I had Malware bytes installed and I tried to run it, but I kept getting this message…An error has accurred. Please report this error code to our support team. MBAM_ERROR_ESPANDING_VARIABLES (0,453) I uninstalled and reinstalled it and got it to run. My log is below. I appreciate the help. Thank you. Oh, and should I run another full scan with Avast or no necessary? Thanks.

Malwarebytes’ Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7967

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

10/17/2011 2:33:30 PM
mbam-log-2011-10-17 (14-33-30).txt

Scan type: Quick scan
Objects scanned: 223731
Time elapsed: 8 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

6

Hi could you run OTL and attach the resultant logs please… Additional options > Attach

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U*.* /s
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs

7

Here are the logs.

8

‘npctrl.dll’ is part of silverlight ;D

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL [2010/12/02 13:56:28 | 000,010,017 | ---- | M] () -- C:\Users\Sheryl Martinez\AppData\Roaming\Mozilla\Firefox\Profiles\42xcqd67.default\searchplugins\mywebsearch.xml O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0C8413C1-FAD1-446C-8584-BE50576F863E} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. @Alternate Data Stream - 85 bytes -> C:\ProgramData\Namco Networks:$ES_DESCRIPTOR_PBVUV1VK9V89KMRVCL9YERB3CKNVYNK9DBGB4WKX8JVX6RVDBFNTBV3CHBPB2PY6VVV4VVVVVVFJVX

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

9

Here’s that log. Is silverlight something bad? Just for my future knowledge?

10

I don’t think that worked. Let me retry. Sorry.

11

Silverlight is MS’s replacement for flash player http://www.microsoft.com/silverlight/features/

Your log looks OK - what are your current problems ?

12

I don’t think anything now. :smiley: It’s just when I click on that last log link that I posted for you all I see is a bunch of symbols, so I didn’t know if you could see the log or not. Before I was getting that thing with silverlight. When I was reinstalling malwarebytes it said it fixed a couple of things, so hopefully stuff is back to normal again. I really appreciate all of your help. Thank you so much. :slight_smile:

13
I don't think anything now. It's just when I click on that last log link that I posted for you all I see is a bunch of symbols
bc you did not save the log in ANSI format...then it looks like chinese gibbely gobbel...

see the picture here how to http://forum.avast.com/index.php?topic=53253.0

14

chinese gibbely gobbel…is this a technical word? ;D I got it now and got it attached right. Not that you need it now. Just for practice for me I suppose.

Everything seems to be running better now and that silverlight thing isn’t popping up.I got it now. Thank you again for your help.

Oh lord! I guess I did it again. I will practice for next time I need help. I’m leaving now. lol

Oh yeah! I got it! :smiley:

15

well Essexboy is in bed now (and so will i) and wont be back untill tomorrow…so you have all night to practise ;D

obs you can edit the post and remove / upload new file…you dont have to do a new post

16

I used notepad++ to translate it and it looked good

Run OTL and press the cleanup button to remove it and the associated files ;D

17

Okay…Thanks so much.

18

My pleasure keep safe ;D