Help - trying to remove BraveSentry etc

[jholland1964]

Well the .dat file is still showing in the HJT log?
Darn!
Try fixing again with HJT...
O20 - AppInit_DLLs: C:\WINDOWS\system32\perfc000.dat
see if it will let you place the checkmark and click the fix button.
Reboot.

Have been in touch with PhilliePhan. He asked that you do the program linked below.

Need you to download WPFind3U
to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

Then Safe Mode;
Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
In the Processes group click Non-Microsoft
In the Win32 Services group click Non-Microsoft
In the Driver Services group click Non-Microsoft
In the Registry group click Non-Microsoft
In the Files Created Within group click 30 days Make sure Non-Microsoft only is CHECKED
In the Files Modified Within group select 30 days Make sure Non-Microsoft only is CHECKED
In the File String Search group select Non-Microsoft
in the Additional scans sections please press select all and uncheck microsoft only
Now click the Run Scan button on the toolbar.
The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file

Reboot normally

[StckFigure]

Okay, I'm going to do all this now. Update that AVG Fast Scan found nothing! Surely this is good! That WPFind thing will probably not be up until late tonight at the best, then, it sounds like. Thanks!

[StckFigure]

Update: HJT gives me the same error message trying to fix the entry. On to WPFind

[StckFigure]

Update update: (Sorry for clogging up with all these quick consecutive posts!) I rebooted and extracted WPFind, and as Windows loaded I got the yellow "Updates available" bubble again. I ignored it and this time I did *not* go through the "downloading updates" deal, but perhaps because I did a reboot, not a shut down.

[StckFigure]

(Ack, another post!)

WPFind is running. At least, I clicked Run Scan - it doesn't look as if anything is happening.. should I get a progress bar or something? I did not see a File String Search group, so I skipped that step. In Additional Scans, I only saw a "Non-Microsoft Only" box, default checked... no "Microsoft Only" box. I left it checked because you didn't say anything about unchecking non-MS.

[StckFigure]

Nope, it hung. Twice. I'll keep trying, but should I do it in Normal Mode?

[jholland1964]

Look at those instructions......
You mean it will not run in Safe Mode?

[jholland1964]

Try the older version then, WPFind
Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

[PhilliePhan]

Hi Guys,

I'm not sure if you used Killbox's Delete on Reboot option. That should get it.

This ought to help as well:
-- Download ComboFix.exe and save it to your DeskTop.
-- DoubleClick combofix.exe & follow the prompts.
When it's finished, it will produce a log of what it found. Please post that log for us.
Do not mouseclick combofix's window whilst it's running as it may cause it to stall...

This tool ought to do the trick.
I'll try to check back as time permits - Awfully busy these days.
If need be, we can try to put together a manual removal procedure.

Best Luck
PP

[StckFigure]

I did do Delete on Reboot, but I can always try again. First I'll do the combofix, though. Hopefully that'll take care of it! Thanks so much!!

P.S. Is there any way that I - or you, as an admin - can delete or otherwise hide the massive log posted before? Since it has personal info embedded in it, I'd rather it not be posted to the Internet where Google can find it.