Topic: Alureon.F Google Redirection problem.

[oD323]

My anti-virus identified Alureon.F and since then I have had google redirects and multiple trojans pop up.  When I try to run DDS, GMER, or Hijack from C:/ I get a warning stating that I "may not have the appropriate permissions".  My windows firewall has also been disabled as so; 

 It won't let me turn it on at all..
Thank you for your help!


DDS (Ver_09-12-01.01) - NTFSx86 
Run by Sunndropp at 18:15:38.75 on Fri 12/11/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.1918.830 [GMT -8:00]

AV: Spy Sweeper with AntiVirus *On-access scanning enabled* (Updated)   {B3891867-7230-459B-9987-E7CCFA7A7D1D}
AV: Windows Live OneCare *On-access scanning enabled* (Updated)   {427ADFC3-B354-4A51-BE34-A9D4218E45C4}
FW: Windows Live OneCare Firewall *enabled*   {A3899D22-27E6-4A7E-AE4E-2C106646DAAB}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
G:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.lanecc.edu/
uSearch Page = hxxp://www.google.com
uWindow Title = Windows Internet Explorer provided by Qwest
uDefault_Page_URL = hxxp://qwest.live.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uURLSearchHooks: N/A: {0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: Ask Search Assistant BHO: {0579b4b1-0293-4d73-b02d-5ebb0ba0f0a2} - c:\program files\asksbar\srchastt\1.bin\A2SRCHAS.DLL
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Ask Toolbar BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
TB: Ask Toolbar: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] "nwiz.exe" /install
mRun: [NvMediaCenter] "RUNDLL32.EXE" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SkyTel] SkyTel.EXE
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
mRun: [AppleSyncNotifier] "c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe"
mRun: [OneCareUI] "c:\program files\microsoft windows onecare live\winssnotify.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2
mRun: [<NO NAME>]
mRun: [Ad-Watch] "c:\program files\lavasoft\ad-aware\AAWTray.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [net] "c:\windows\system32\net.net"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [SpySweeper] "c:\program files\webroot\spy sweeper\SpySweeperUI.exe" /startintray
StartupFolder: c:\docume~1\sunndr~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
Trusted Zone: microsoft.com\office
Trusted Zone: revagency.net
Trusted Zone: teamavc.com
Trusted Zone: teamavc.com\im
Trusted Zone: teamavc.com\mail
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -

hxxp://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217042209526&h=d76334b7dab1596d6d19e037749fa2ff/&filename=jinstall-6u7-windows-i586-jc.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9DBAFCCF-592F-101B-85CE-00608CEC297B} - hxxp://im.teamavc.com/jwchat/circ.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: WRNotifier - WRLogonNTF.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sunndr~1\applic~1\mozilla\firefox\profiles\pr3e48uz.default\
FF - prefs.js: browser.startup.homepage - http:/www.blingo.com
FF - component: c:\documents and settings\sunndropp\application data\mozilla\firefox\profiles\pr3e48uz.default\extensions\{463f6ca5-ee3c-4be1-b7e6-7fee11953374}\platform\winnt\components\FoxyTunes.dll
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\documents and settings\sunndropp\application data\mozilla\firefox\profiles\pr3e48uz.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-26 64160]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-2-29 13696]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\microsoft windows onecare live\OcHealthMon.exe [2009-7-9 26104]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\spy sweeper\SpySweeper.exe [2008-3-1 3572592]
R3 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2008-10-31 53168]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-11 133104]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2008-12-23 50704]
S3 root_repeal00001;root_repeal00001;\??\c:\windows\system32\drivers\root_repeal00001.sys --> c:\windows\system32\drivers\root_repeal00001.sys [?]
S3 rootrepeal;rootrepeal;\??\c:\windows\system32\drivers\rootrepeal.sys --> c:\windows\system32\drivers\rootrepeal.sys [?]
S3 XDva302;XDva302;\??\c:\windows\system32\xdva302.sys --> c:\windows\system32\XDva302.sys [?]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-12-11 21:53:01   0   d-----w-   c:\program files\Trend Micro
2009-12-11 20:43:24   30784   ----a-w-   c:\windows\system32\drivers\szcmkwnl.sys
2009-12-11 20:43:24   105472   ------w-   c:\windows\system32\drivers\nvata.sys3C446617
2009-12-11 20:35:45   30784   ----a-w-   c:\windows\system32\drivers\rdtxriwk.sys
2009-12-11 20:35:45   105472   ------w-   c:\windows\system32\drivers\nvata.sys4F44496A
2009-12-11 20:33:15   30784   ----a-w-   c:\windows\system32\drivers\jtoxrgtv.sys
2009-12-11 20:33:15   105472   ------w-   c:\windows\system32\drivers\nvata.sysB3DEBCB3
2009-12-11 20:31:51   30784   ----a-w-   c:\windows\system32\drivers\wwzxrojm.sys
2009-12-11 20:31:51   105472   ----a-w-   c:\windows\system32\drivers\nvata.sys5FE83AF9
2009-12-11 20:29:55   30784   ----a-w-   c:\windows\system32\drivers\nygbrmdw.sys
2009-12-11 20:29:19   30784   ----a-w-   c:\windows\system32\drivers\vckyweiv.sys
2009-12-11 20:28:31   30784   ----a-w-   c:\windows\system32\drivers\gixqxrqf.sys
2009-12-11 20:28:31   105472   ------w-   c:\windows\system32\drivers\nvata.sysE98F7886
2009-12-11 20:28:15   30784   ----a-w-   c:\windows\system32\drivers\mtbwqdxy.sys
2009-12-11 20:28:14   105472   ----a-w-   c:\windows\system32\drivers\nvata.sys74349127
2009-12-11 08:03:51   0   d-----w-   c:\program files\Subagames
2009-12-11 06:13:51   36312   ----a-w-   c:\windows\system32\net.net
2009-12-10 12:37:10   0   d-----w-   c:\program files\OGPlanet
2009-12-10 12:36:20   0   d-----w-   c:\program files\ElastoMania111
2009-12-10 01:44:20   39669   ----a-w-   c:\documents and settings\sunndropp\.recently-used.xbel
2009-11-30 19:33:46   41872   ----a-w-   c:\windows\system32\xfcodec.dll
2009-11-14 21:24:49   0   d-----w-   c:\program files\iPod
2009-11-14 21:24:45   0   d-----w-   c:\program files\iTunes
2009-11-14 21:24:45   0   d-----w-   c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}

==================== Find3M  ====================

2009-12-11 20:11:24   105472   ------w-   c:\windows\system32\drivers\nvata.sys
2009-12-10 01:20:50   147606   ----a-w-   c:\windows\hpoins21.dat
2009-10-29 07:45:38   916480   ----a-w-   c:\windows\system32\wininet.dll
2009-10-21 05:38:36   75776   ----a-w-   c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36   25088   ----a-w-   c:\windows\system32\httpapi.dll
2009-10-20 16:20:16   265728   ----a-w-   c:\windows\system32\drivers\http.sys
2009-10-13 10:30:16   270336   ----a-w-   c:\windows\system32\oakley.dll
2009-10-12 13:38:19   149504   ----a-w-   c:\windows\system32\rastls.dll
2009-10-12 13:38:18   79872   ----a-w-   c:\windows\system32\raschap.dll
2008-11-19 07:29:57   32768   --sha-w-   c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008111820081119\index.dat
2009-01-03 20:59:02   16384   --sha-w-   c:\windows\temp\cookies\index.dat
2009-01-03 20:59:02   16384   --sha-w-   c:\windows\temp\history\history.ie5\index.dat
2009-01-03 20:59:02   32768   --sha-w-   c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 18:17:23.31 ===============


[attachment deleted by admin]

[Derek]

Delete any existing version of ComboFix you have sitting on your desktop

Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note:  It is important that it is saved directly to your desktop  and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and  anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
  
• Remember to re enable the protection again after combofix has finished
  

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you. 
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version. 

[oD323]

Thank You for the quick response, I did all as instructed but when I go to run ComboFix from the desktop I receive this:



I tried running Safe Mode and Safe Mode with Networking, but it would just restart any time I tried to boot it.
[Earlier, I was able to run the other diagnostics from an external drive (they would receive the same error when executed on C:]

[Derek]

we need to try something here, which might or might not work

first you need to disable onecare which is interfering with any fixes, you might have to uninstall it to let us do any fixes

do you have your windows cd

go to C:\WINDOWS\system32\drivers\nvata.sys  & right click it & select copy

then go to C:\  and right click a blank spot & select paste

that makes a copy of the file & palces it where we ned to use it

then download avenger from  http://swandog46.geekstogo.com/avenger2/avenger2.html

unzip it & place it on desktop

double click it run & in teh box paste the contents of the quote box

Files to move:
C:\nvata.sys | C:\WINDOWS\system32\drivers\nvata.sys

press execute & the computer will reboot

after booting copy the log it makes and post that back here then try combofix which should run

[oD323]

I did as instructed,(disabled onecare through CMD) and upon restart the avenger log said that it "could not locate nvata.sys.  I then tried to run combofix, but was still restricted.  I saw that the file I copied to C:\ was named "nvata" nvata.sys, so I renamed it ( and the original),  then tried running avenger again ( which said that it had completed successfully and could reboot.    Upon starting, I'm greeted by a screen that says " a system file [nvata.sys] is missing or corrupt."   It then asks for a windows CD to enter the recovery console, I have my CD now and am logged onto C:\WINDOWS.
What should I do from here? (sorry for messing up that bad, it was late).
Thank you

[Derek]

if you are in recovery console

type cd c:\windows\system32\drivers  press ok

then look for nvata.sys and make sure it is called nvata.sys & not any other name with spaces or any additional bits to it

let me know if it is called anything else

you should see several nvata.sys there with names like this
c:\windows\system32\drivers\nvata.sys3C446617

if there is NO nvata.sys on its own without teh extra letters then carefully write down the exact name of 1 of the files if thre letters etc after nvata.sys are different to what I have written, then change it to the one you find

then type ren c:\windows\system32\drivers\nvata.sys3C446617 nvata.sys  ( ppress ok/enter)

make sure there is a space between ren & C and between 3C446617   and nvata.sys

you should get a message file renamed successfully

once you get that type exit & press enter to get out of recovery console

reboot & see if it will boot normally