Hello folks,
I have a problem that I have seen mentioned in the forum, but have not been able to fix using the steps suggested. When I attempt to remove some critical objects from my scan log, Adaware switches off to reboot the computer. I was able to succesfully remove tracking cookies, but trying to remove critical modules or processes (I have nine!)results in either a total or partial reboot. I am updated and have run a Hijack This log. I attempted to remove a wuaboot.exe that had been mentioned as a critical object, but got an error 52 message.

Any suggestions?

Hi

Do you see a window similiar to the attached displayed just before the system reboots?

If so try this:

Press start, select run and in the window that opens enter the text:

shutdown -a

Note the space between shutdown and the -a

Leave this window open, and now run a scan with Ad-Aware as before, when the shutdown window appears quickly go back to the run window and click on the OK button to abort the shutdown. Let Ad-Aware SE now complete its scan and remove items found.

Post back if this helps.

During An Ad-aware Scan, My Computer Restarts... What Is Wrong?
http://www.lavasoftsupport.com/index.php?showtopic=203

During an Ad-Aware scan, I get a bluescreen and my computer restarts, what is wrong?, bluescreen, blue screen, bsod
http://www.lavasoftsupport.com/index.php?showtopic=346

Computer shuts down with Message: System shutdown initiated by NT Authority/system System must restart because DCOM server process launcher terminated
http://www.lavasoftsupport.com/index.php?showtopic=345

Might be something in one of those to help you on your way..

Post back if this helps.

Hi,
I'm a little time delayed moving back and forth between computers. No, I don't get the screen you mention. My critical objects are Purity Scan Virtumond, Winlogfile and arpa.dll. When I try to remove these, the computer shuts off and I get a blue creen error message, Sometimes restarting requires restoring my active desktop. I'm fairly frustrated about this.

Hi

Can you try this process please. It would be worth printing this out as there are several steps to follow.

Download VundoFix from

http://www.atribune.org/ccount/click.php?id=4

Then download and install the Lavasoft VX2 cleaner (the production version rather than the beta version)

http://lavasoft.com/software/addons/vx2cleaner.shtml

Please close all running applications including all Internet Explorer or alternate browser sessions and then disconnect from the Internet, either unplug the LAN cable or power off the modem as some malware try to reinstall themselves over the net when they are removed. Please run these steps in the sequence below.

1) Run the VundoFix.exe downloaded above. Click on the "Scan for Vundo" button and if anything is found click on the "Remove Vundo" and follow the prompts.

2) Run the Lavasoft VX2 cleaner plug-in: Start Ad-Aware SE, click the Add-ons button, select the VX2 Cleaner plug-in and click “Run Tool�, click OK to confirm.

If your computer isn’t infected, click “Close�. (please note that the VX2 cleaner only targets specific variants so if it reports clean it means that none of these variants are present rather than there are no VX2 items at all).

If the VX2 cleaner reports that your computer is infected, select “Clean System� then immediately Shutdown/restart your computer (do NOT connect to the Internet on re-boot).

3) Next we need to scan with Ad-Aware SE to finish off the cleaning, it should hopefully not crash after running the above items.

Click "Start" select "Run" and type the text shown in bold below (including the quotation marks and spaces, quickest way would be to cut and paste the text in bold, pick the one relevant to your version of Ad-Aware)

For personal:

"C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" +procnuke

For Plus

"C:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Aware.exe" +procnuke

For Professional

"C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe" +procnuke


When Ad-Aware starts click start and then make sure you select "Perform full system scan" and uncheck "Search for negligible risk entries". Click next to start the scan.

When the scan has completed please remove all target families identified and reboot your PC.

Reconnect to the Internet and run a fresh scan with Ad-Aware SE, post back how you got on and include a copy of the log file from the Ad-Aware SE scan.

[1) Run the VundoFix.exe downloaded above. Click on the "Scan for Vundo" button and if anything is found click on the "Remove Vundo" and follow the prompts.


Downloaded and run. No reported Vundo viruses

2If the VX2 cleaner reports that your computer is infected, select “Clean System�? then immediately Shutdown/restart your computer (do NOT connect to the Internet on re-boot).

Reported finding a varisant of VX2.Shutdown and Restart succesful

Click "Start" select "Run" and type the text shown in bold below (including the quotation marks and spaces, quickest way would be to cut and paste the text in bold, pick the one relevant to your version of Ad-Aware)

Restarted succesfully. The same critical objects reported as before scan. This time when I tried to remove the critical objects, the program reported quarantining succefully, then hung up when trying to remove.

include a copy of the log file from the Ad-Aware SE scan.
[/quote]

Click to view attachment

Ok, There are some difficult to remove items in your log.

First lets see if there are any "easy" removals. In Control Panel select "Add or Remove Programs" then in the list of installed programs look for WinFixer or Winantivirus. If any are found then remove them.

Next as some version of the items in your log hide themselves please post this log to see if any are present.

If you do not have a copy of HijackThis download it (see

http://www.lavasoftsupport.com/index.php?showtopic=216 )

and unzip to a folder (not your desktop or a temp folder). E.g. c:\program files\hijackthis. Then rename Hijackthis.exe to hjt.exe (there are variants of the items in your log that detect Hijackthis.exe running so renaming it fools this).

Boot into safe mode. See this Microsoft article on how to do this:

http://support.microsoft.com/default.aspx?...kb;EN-US;315222

Log on as a user with Admin privilage and run HijackThis (hjt.exe). In the main window click on the Config button, then select Misc Tools, then check "List also minor sections (full)" and click on "Generate StartupList Log" clcik yes to continue, this will start Notepad with the output, save the file to disk for later.

Now start Ad-Aware SE, run the VX2 cleaner as before, if you have reboot please do so but boot back into safe mode.

Now start Adware with the more command line options than before:

"C:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Aware.exe" +procnuke +immortal

Press start select run and cut and paste the above text in bold into the run box and click on Ok to start Ad-Aware SE.

Run a full scan as before and try to remove the objects found. Does Ad-Aware SE now complete the removal?

With this command line option you will not be able to close the Ad-Aware SE window so once finished with Ad-Aware SE please reboot and start Windows as normal. Post back your findings and a copy of the HijackThis startup log created earlier.

Many thanks