That is not s full rootrepeal log, it's drivers only
when starting Rootrepeal, then click the "Report" tab then select all the boxes, and then scan.
Quads
ok thanks quads youre right im sorry and im running norton antivirus 2008 version (guessing thats symantec antivirus) which was fully updated till i tried to reinstall it where now i cant update it live update completes itself but after restart nothings changed. If that isnt the full log please tell me as im not sure how to save all the tabs at once
Message Edited by freeten on 07-13-2009 05:45 PM
ok im not sure if this is it but norton (now that redownloading it lets me scan) just removed a high level risk (first time i let it scan fully) called Trojan.Fakeavalert
not re-downloading but re-installing
Message Edited by freeten on 07-13-2009 06:30 PM
Hi
Now (read carefully) If you have Spybot S&D uninstall it.
Also during the restarts with Avenger if Your PC has a Startup repair center like with HP and Toshiba tell it to start Normally if it kicks in.
1. Download Avenger to your desktop,
Unzipped version http://homepages.slingshot.co.nz/~crutches/Avenger/
Creators website http://swandog46.geekstogo.com/avenger2/avenger2.html with zipped version to the unzip to desktop
2. Click to run "Avenger.exe" (right click "Run as Administrator" if using Vista)
3. In the "Input script here:" copy and paste the script between the lines
Drivers to disable:
MSIVXserv.sys
Drivers to delete:
MSIVXserv.sys
Files to delete:
C:\Autorun.inf
D:\Autorun.inf
C:\Windows\System32\drivers\MSIVXlvdbbownsrpdqvsbwwyrdlxgbivxturr.sys
C:\Windows\System32\MSIVXttkkmhjqjoowiwfwakltlcbodexengip.dll
C:\Windows\System32\MSIVXwxyxgalvqpmyueapuxfmqhymjbantjia.dll
C:\WINDOWS\System32\MSIVXcount
Registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet010\Services\MSIVXserv.sys
HKEY_LOCAL_MACHINE\SOFTWARE\MSIVX
Here is a screenshot (script updated since shot)
Make sure the "Automatically disable any rootkits found" is NOT selected
4. Click "Execute"
You will be asked to restart the PC click "Yes", when the PC restarts the load screen will takes slightly longer, then when it looks as though windows is loading the PC will restart again.
Then when Windows fully loads the Avenger log will be loaded, showing files it could or could not find.
5. Restart the PC again, then see if you can install Update and run Malwarebytes
Quads
ok not good i got an error message right after welcome where all i could see was the screensaver (no icons or start or rest of the bar etc) and the message said that it couldnt find something in the c: hard drive and i pushed enter before i read it all but it said make sure you typed the file name correctly then everything came on and microsoft had a log prepared saying windows has recovered from a serious crash or w/e and i went ahead and sent it but i was just wondering if thats cause norton removed the high level risk trojan (and this happened after the restart)
ok so do i download both of those?
oh btw it says i dont have a risk factor anymore (norton) maybe it updated itself?
like its saying everything is secure
If your PC has startup recovery software it can jump in thing that Norton has not loaded properly etc.
That fact Norton is now running correctly, is there an Avenger.txt??
when you say do I download both of those, what are you meaning to download??
Also can you use Malwarebytes
Quads
Message Edited by Quads on 07-14-2009 02:15 PM
ok ill check malwarebytes tomorrow then after tomorrow i wont be on for a few days but what i mean by downloading both is do i use both links and install/download the product from both? or just use one link
p.s. i havent downloaded avenger yet thats what im asking about with the links (whether i download product off of both or just use one)
Message Edited by freeten on 07-13-2009 08:56 PM
Use one or the other. If one doesn’t want to download, use the other.
ok gtg to bed in a min but norton just updated itself to 2009 version (had to find a certain file took me 10 mins) but its able to scan now to 
just cant get malwarebytes to work
tomorrow we can mess with avenger as i might need to do another log… but for now i gtg to bed im tired and its 11 pm
going to bed after this post but i just need to mention norton is at risk cause of advanced protection not being quite right and when i push fix now it doesnt work
Nothing is going to work properly until you run the Avenger and script to get the rootkit out, Freeten
im sorry to say that when i tried to get on the next day and all the rest of the days it wouldnt let me access the internet so i will probably have to get it serviced unless i download it onto my flashdrive and copy the commands onto a text pad onto the flashdrive also.
using a friends laptop (it will connect to my highspeed wireless but my comp says it is connected although it blocks access i guess that the norton scan messed with something)
Freeten:
It is the rootkit that is preventing you from doing anything. Quads may be able to find another way to get you onto the net. He will be online later. Rootkits prevent anti malware from working properly or at all, and often block access.
ok well also when i scan norton it scans a total of 25k files on full scan where before the rootkit it scanned 400k
Freeten:
Until you perform the actions that Quads told you to do with Avenger and the script, there is nothing we can do for you. That is what you must get accomplished before you can proceed further.