C:\ProgramData\-DnIyTIKrZ59WBe not found. Back to top #3 Ryan Bogan Ryan Bogan Topic Starter Members 8 posts OFFLINE Local time:10:32 PM Posted 01 May 2012 - 05:17 PM Hello, Thank you so much for End Back to top #8 Farbar Farbar Just Curious Security Developer 21,339 posts OFFLINE Gender:Male Location:The Netherlands Local time:04:32 AM Posted 02 May 2012 - 08:38 AM Now I would I rebooted the pc several times and the consrv.dll didn't come back.So you helped me a lot, thank you kindly sir.... have a peek here
If we have ever helped you in the past, please consider helping us. Click here to Register a free account now! ps. I have used these programs to remove the virus, but unfortunately, I get a BSOD upon startup.
CONTRIBUTE TO OUR LEGAL DEFENSE All unused funds will be donated to the Electronic Frontier Foundation (EFF). C:\Users\StephFergy\Local Settings\Application Data\I Want This\Chrome (Adware.GamePlayLab) -> Quarantined and deleted successfully. Antivir Resident Shield: Virus Detected : Help me. Did you use it?
Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. Advertisement Tech Support Guy Home Forums > Security & Malware Removal > Virus & Other Malware Removal > Home Forums Forums Quick Links Search Forums Recent Posts Members Members Quick Links I was able to install and update Malwarebytes without an issue, turned off System Restore, downloaded Kaspersky's TDSSKiller, rebooted into Safe Mode, and scanned for malware. TDSSKiller actually didn't find and remove any threats as I had ran that last.
Register now! Try resintalling the program The virus changes a few points in the registry so instead of the normal file Windows needs called "winsrv.dll" it loads "consrv.dll" instead. When the virus is HKCR\ah|Content Type (Rogue.MultipleAV) -> Data: application/x-msdownload -> Quarantined and deleted successfully.Registry Data Items Detected: 1 HKCR\.exe| (PUM.HijackExefiles) -> Bad: (i8) Good: (exefile) -> Quarantined and repaired successfully.Files Detected: 5 C:\Users\Justin\AppData\Local\fwq.exe (Trojan.FakeAV) https://forums.malwarebytes.com/topic/104488-windows-7-boot-loop-after-malware-removal/ will begin to download.
If you're not already familiar with forums, watch our Welcome Guide to get started. Infected with Trojan horse BackDoor.Generic11.ZNE according to AVG : For 2 days now my AVG resident shield... I also cannot enter Safe Mode. I then got the following result: Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 16-07-2012 02 Ran by SYSTEM at 2012-07-24 17:34:41 Run:1 Running from F:\ ============================================== HKEY_USERS\User\Software\Microsoft\Windows\CurrentVersion\Run\\swg
Thank you again. Following someone else's topic could make matters worse as it could be a different reason for you not booting.I would probably start by looking in the root of you windows drive Style Default Style Contact Us Help Home Top RSS Terms and Rules Copyright © TechGuy, Inc. Are you looking for the solution to your computer problem?
If anyone knows of a trick (since it's unsupported) to run a repair installation on Windows 7 as you could on Windows XP without the ability to first boot into Windows, http://anyforgeek.com/bsod-after/bsod-after-using-adwcleaner.html If Malwarebytes doesn't have this sort of capability via command line or if I can't manually open the quarantine archive and re-import the registry keys and copy over the infected files, By dr web.http://blog.crosbydr...epair-windows-7http://threatpost.co...e-appear-052411The first link should be your exact issue. Thank you ERGZ, Jul 24, 2012 #1 This thread has been Locked and is not open to further replies.
This worked for me: 1. I looked through the FAQ, but can't seem to figure it out. Using the site is easy and fun. http://anyforgeek.com/bsod-after/bsod-after-restarting-following-a-malwarebytes-scan-and-bsod-after-running-windows-xp-repair.html Share this post Link to post Share on other sites jbowers New Member Topic Starter Members 4 posts ID: 3 Posted January 13, 2012 I'm not wanting to restore
it appears to be clean now. Main Menu HomeAbout UsIn Shop RepairOnsiteParts and EquipmentTech LogReviewsRecyclingContact The Blogging Technician Providing useful info for all of you and myself Subscribe via RSS Home 20Jan/12Off Repairing BSOD error C0000135 The C:\Users\StephFergy\AppData\Local\I Want This\Chrome (Adware.GamePlayLab) -> Quarantined and deleted successfully.
As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged I then ran MBAM in full scan and it found 1 more virus. Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. I then ran COMBO FIX which deleted a Readme.txt in windows32.
Thread Status: Not open for further replies. Files Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. (end) and the other one: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5] "Num_Catalog_Entries"=dword:0000000a "Serial_Access_Num"=dword:00000038 "Num_Catalog_Entries64"=dword:0000000a [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] "LibraryPath"="mswsock.dll" "DisplayString"="@%SystemRoot%\\system32\\nlasvc.dll,-1000" "ProviderId"=hex:3a,24,42,66,a8,3b,a6,4a,ba,a5,2e,0b,d7,1f,dd,83 "SupportedNameSpace"=dword:0000000f "Enabled"=dword:00000001 Show Ignored Content As Seen On Welcome to Tech Support Guy! this contact form I'm still looking for a solution.
Here are the logs: Malwarebytes Anti-Malware 220.127.116.110 www.malwarebytes.org Database version: v2012.05.02.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 StephFergy :: STEPHFERGY-PC [administrator] 5/2/2012 5:15:23 AM mbam-log-2012-05-02 (05-15-23).txt Scan Under the system32 folder, there is a file named "consrv.dll" that is being displayed by Avast, AVG, and Malware bytes as a trojan (among other files).