Jump to content
computertooter

System.BrokenFileAssociation. False Positive?

Recommended Posts

An optical drive is a CD or CD/DVD drive.

Given that the laptop has no recovery partition, or an optical drive, then your only practical options are to bring it in to a shop, or continue with Rise's instructions. If you do the latter, I suggest you disable System Restore before proceeding.

oh ...no to doesn't have cd/dvd drive ...since I cannot access system restore don't know if it is disabled or not ..just know I have no access it says to contact domain administrator ..well I guess see what Rise thinks ty Seth

Share this post


Link to post
Share on other sites

Hi,

Boot in normal mode, and make sure to update Malwarebytes' and SUPERAntiSpyware, and run a quick scan with both and copy logs

Next uninstall AVG and download avast! free http://www.avast.com/en-eu/free-antivirus-download update avast and run a boot scan

See here how to run a boot scan: http://www.schmahl.net/avastbootscan.php

edit:

And also Run scan with OTL in normal mode

  • Open OTL
  • Under the Extra Registry select Use SafeList
  • Now click Run Scan
  • When scan is finished copy OTL.txt and Extras.txt

Share this post


Link to post
Share on other sites

Hi,

Boot in normal mode, and make sure to update Malwarebytes' and SUPERAntiSpyware, and run a quick scan with both and copy logs

Next uninstall AVG and download avast! free http://www.avast.com/en-eu/free-antivirus-download update avast and run a boot scan

See here how to run a boot scan: http://www.schmahl.net/avastbootscan.php

edit:

And also Run scan with OTL in normal mode

  • Open OTL
  • Under the Extra Registry select Use SafeList
  • Now click Run Scan
  • When scan is finished copy OTL.txt and Extras.txt

ran mbam and sas scans I didnt take any action just ran scans cause I didnt know if you wanted me to do anything but run scan please advise if you want me to take any action will proceed with other steps:logs attached

mbam-log-2011-06-21 (11-37-06a).txt

SUPERAntiSpyware Scan Log - 06-21-2011 - 12-23-37.zip

Share this post


Link to post
Share on other sites

Hi I have edited my post so please firs run SASFixEXE: https://www.superantispyware.com/downloads/SAS_FixEXEfile.com

then rescan and remove those

ran the sasfixexe. then ran scans again enclosed are first scans after sasfix.exe then I ran scans again on both mbam and sas neither of them found any threats..so for after fix I can again assess program files instead of going through what I was before...ok which step do you want me to take next remove Avg or run OTL first and the installing of avast ..just not sure which one to do first..

mbam-log-2011-06-21 (13-33-17)b.txt

SUPERAntiSpyware Scan Log - 06-21-2011 - 14-11-16b.zip

Share this post


Link to post
Share on other sites

Hi, first uninstall AVG and install avast! free

Next, to speed a boot scan we will remove some junk, temporary files with TFC

Download TFC to your Desktop

  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished if necessary it will reboot your machine,

Then run a boot scan with avast

Next run a OTL scan

Thanks.

Share this post


Link to post
Share on other sites

Hi, first uninstall AVG and install avast! free

Next, to speed a boot scan we will remove some junk, temporary files with TFC

Download TFC to your Desktop

  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished if necessary it will reboot your machine,

Then run a boot scan with avast

Next run a OTL scan

Thanks.

boot scan with avast attached

Otl scan attached

aswBoot(avastboot).txt

Extras1.zip

OTL1.zip

Share this post


Link to post
Share on other sites

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-21-867624957-1142715932-3990699764-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-867624957-1142715932-3990699764-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -  File not found
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -  File not found
[2011/05/23 19:24:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\cO28281EhPhI28281
[2011/06/21 08:22:47 | 000,011,142 | -HS- | M] () -- C:\Documents and Settings\freedie\Local Settings\Application Data\58buw8x567u4lj0h5muh1i27tls0vo45a5
[2011/06/21 08:22:47 | 000,011,142 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\58buw8x567u4lj0h5muh1i27tls0vo45a5

:Files
ipconfig /flushdns /c

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 0

:Commands
[Purity]
[EmptyFlash]
[EmptyTemp]
[CreateRestorePoint]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Copy log you get

How is the machine running? Any issues?

Share this post


Link to post
Share on other sites

How is the machine running? Any issues?

its a little slow to finish booting up on start up...windows firewall is off you can turn it on though windows update is off as well ..but we can talk about firewalls and what do to do about them and their proper setting later ..will run fix first....did I do the right thing when running the boot scan...by choosing it to put infections found in chest?

Share this post


Link to post
Share on other sites

its a little slow to finish booting up on start up...windows firewall is off you can turn it on though windows update is off as well ..but we can talk about firewalls and what do to do about them and their proper setting later ..will run fix first....did I do the right thing when running the boot scan...by choosing it to put infections found in chest?

Otl log after fix attached sorry I didn't read again I think you wanted a copy and paste instead So Editing post

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoViewContextMenu deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFind deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HideClock deleted successfully.

Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoViewContextMenu not found.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFind not found.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop not found.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HideClock not found.

Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun not found.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoViewContextMenu deleted successfully.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFind deleted successfully.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HideClock deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoViewContextMenu deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFind deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.

Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HideClock deleted successfully.

Registry value HKEY_USERS\S-1-5-21-867624957-1142715932-3990699764-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-867624957-1142715932-3990699764-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2e2dd38-d088-4134-82b7-f2ba38496583}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\avgsecuritytoolbar\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2DDE6B2-9684-4A55-86D4-E255E237B77C}\ deleted successfully.

File {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - File not found not found.

Folder C:\Documents and Settings\All Users\Application Data\cO28281EhPhI28281\ not found.

C:\Documents and Settings\freedie\Local Settings\Application Data\58buw8x567u4lj0h5muh1i27tls0vo45a5 moved successfully.

C:\Documents and Settings\All Users\Application Data\58buw8x567u4lj0h5muh1i27tls0vo45a5 moved successfully.

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\freedie\My Documents\Downloads\cmd.bat deleted successfully.

C:\Documents and Settings\freedie\My Documents\Downloads\cmd.txt deleted successfully.

========== REGISTRY ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"AntiVirusOverride" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"FirewallOverride" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\\"DisableSR" | 0 /E : value set successfully!

========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

->Flash cache emptied: 0 bytes

User: All Users

User: Default User

->Flash cache emptied: 0 bytes

User: freedie

->Flash cache emptied: 0 bytes

User: LocalService

->Flash cache emptied: 0 bytes

User: NetworkService

->Flash cache emptied: 0 bytes

User: ricardo

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: freedie

->Temp folder emptied: 3595985 bytes

->Temporary Internet Files folder emptied: 359581 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 45087948 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: ricardo

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 47.00 mb

Error starting restore point: System Restore is disabled.

Error closing restore point: System Restore is disabled.

OTL by OldTimer - Version 3.2.24.1 log created on 06222011_074448

Files\Folders moved on Reboot...

File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!

Registry entries deleted on Reboot...

OTLFIXLOG.zip

Share this post


Link to post
Share on other sites

did I do the right thing when running the boot scan...by choosing it to put infections found in chest?

Yes

Do you/did you have anything installed from PC tools? I see some leftovers from it

After running the last fix are you able to turn firewall and win. updates?

Share this post


Link to post
Share on other sites

Yes

Do you/did you have anything installed from PC tools? I see some leftovers from it

After running the last fix are you able to turn firewall and win. updates?

not that I was aware of ran that remover you asked me to the last time and taught the was all removed..? What PC tools are you seeing that is leftover? I can turn on the firewall but not the windows update it will not turn on.. i ran you another otl scan to look at if it will help attached

Extras2.zip

OTL2.zip

Share this post


Link to post
Share on other sites

Please uninstall this: Registry Mechanic

Next download & run DDS when finished it will produce 2 logs attach them

Next, download Security Check from here to your Desktop

  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Share this post


Link to post
Share on other sites

not that I was aware of ran that remover you asked me to the last time and taught the was all removed..? What PC tools are you seeing that is leftover? I can turn on the firewall but not the windows update it will not turn on.. i ran you another otl scan to look at if it will help attached

ran a file and folder search for pc tools and yes there are files looks like they were created 4/15/2010 ...there are program files ...i cant copy and paste what is there ..but PCTools C:\Program Files\Common file size 1.85MB folders:sMonitor and when you go to that folder there are other files including dll files PCTLNty.dll 58kb PCTLogon.dll 518KB PCTProcess 5KB SMSvc 601KB SSDMonitor 102 KB StartManSvc 618 KB all of which are in C:\Program Files\Common Files\PC Tools\sMonitor in C:\Program Files\Registry Mechanic\Data\Resources there is PM-PCTools and PM-PCToolsLab both are 13.3 KB both bit map images I DONT KNOW if that help any ....

Share this post


Link to post
Share on other sites

Please uninstall this: Registry Mechanic

Next download & run DDS when finished it will produce 2 logs attach them

Next, download Security Check from here to your Desktop

  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

ok will do...

Share this post


Link to post
Share on other sites

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following

:Services
nwid
:Files
c:\windows\system32\drivers\putaxb.sys
:Commands
[Purity]
[EmptyFlash]
[EmptyTemp]
[CreateRestorePoint]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Copy log you get

How it's running now?

Share this post


Link to post
Share on other sites

How it's running now?

Your Java and Flash player are outdated remove them and download new versions

Share this post


Link to post
Share on other sites

do you have save download location for me? and how do I uninstall what I have...still can not turn on win auto updates have not tried system restore for any access so I dont know about that but the notebook seems to running aright..

Share this post


Link to post
Share on other sites

Go to Start > Run and type cmd now copy/paste this in black box

%SYSTEMROOT%\SYSTEM32\REGSVR32.EXE %SYSTEMROOT%\SYSTEM32\WUAUENG.DLL

Are you now able to turn updates?

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

×
×
  • Create New...