After run Malwarebytes, restart and logon, explorer.exe don

[elgg]

I

[GT500]

The registry entry for userinit.exe may not have been repaired after removal. Can you post a copy of the log from the scan?

[AdvancedSetup]

Hello and Welcome to Malwarebytes.org

If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
   
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
   

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review
  

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.
  

[elgg]

Before any thing, thankful for your aid. It follows the requested archive.

Malwarebytes' Anti-Malware 1.33

Database version: 1698

Windows 5.1.2600 Service Pack 3

27/1/2009 11:56:17

mbam-log-2009-01-27 (11-56-17).txt

Scan type: Full Scan (C:\|)

Objects scanned: 94116

Time elapsed: 41 minute(s), 41 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 3

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

C:\WINDOWS\system32\SnAgOS.EXE (Trojan.Agent) -> Failed to unload process.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\TypeLib\{d3073845-c655-42e7-b723-191ccfc41f0a} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/abn.gpc (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplorer (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\Abn.gpc (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplorers (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\SnEngine.EXE (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\SnAgOS.EXE (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\Downloaded Program Files\Abn.gpc (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\svhost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

C:\WINDOWS\shell.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Roberto Ferreira\results.txt (Malware.Trace) -> Quarantined and deleted successfully.

[GT500]

Deleting C:\WINDOWS\shell.exe may have caused the problem.

[GT500]

I've attached a ZIP file with a fix in it. Save the ZIP file on your desktop, extract it, and double click on the "Registry Entries" file that was extracted. It should ask you if you want to add the contents to the registry, tell it 'Yes'. Once it's done, restart your computer, and let me know if it worked.

If that fixes it, then you may want to follow Advanced Setup's instructions for getting help from a malware removal expert to make sure that your system really is cleaned up.

fix_explorer.zip

fix_explorer.zip

[elgg]

The behavior continues without changes. Unfortunately I cannot wait more time for the solution. I need to place the computer in production and to return it the user to it. I will go to format it and will reinstall the system. I immensely thank the given support. I am generating an image of this installation to be able to continue the research future. Thanks.

[GT500]

It's a bit odd that the fix I gave you didn't work, but there could have still been a trojan preventing the registry entries from being changed, or the registry permissions could have been damaged.

[ohmniscient]

Hi fellows,

I go the same problem. After removing the infected files and restarting the computer, the explorer.exe does not load automatically. I tried to reset the old system configuration with windows tools, but it caused more problems so that I gave up about this.

This happened in 2 different computers, in a Windows XP profession SP2 interface.

Take a look to the log (it is in portuguese, but I translated what was necessary):

Malwarebytes' Anti-Malware 1.44

Vers