DDS and attach.zip OK help me now pleeeaze

[Threadgill]

Mr. LDTate,

Well this is difficult.

MSC removal error I am working through.

"missing filter manager roll up package" error code 0x8004ff56" with link to download.

no response clicking link, so I tried searching "error" with MS internet explorer google tool bar. MS internet explorer popped up"not in active directory" error when I clicked search. I then typed in go - www.google.com and same error popped up. I closed MS internet explorer and opened chrome. with chrome I was able to search and downloaded kb914882 and installed.

ALSO whenever I try to open MS file explorer from the start menu ADOBE acrobat begins installing. I have cancelled each time and MS file explorer freezes.

Threadgill

[Threadgill]

Uninstalling now

[LDTate]

Nothing is easy, is it?

[Threadgill]

How boring, life would be, otherwise.

[Threadgill]

Having EVERYTHING deleted under "My Documents" really makes you feel ALIVE! Course there are better ways...

[LDTate]

So what happened?

You installed MSE and now everything in your My Documents are gone?

You sure that aren't just hidden?

[LDTate]

If your programs are also hidden it could be an infection causing that.

Give Unhide a run

Download http://download.bleepingcomputer.com/grinler/unhide.exe"] unhide.exe & save it to your windows folder:

Right click on unhide.exe and select Run as administrator (In case you have Vista or Win7)

Reboot

This will unhide folders/files that were set to be hidden by the infection you had.

Let me know if that solved your problem.

[Threadgill]

What happened...early morning on the 15th (my 2nd day into eliminating malware,hacker...) ...I had been signed in as "admin" on the "computer" and not the "domain admin" - and deleted 2 "ANONYMOUS?" users that showed up in the "user account" window accessed from control panel. On the 16th found out the accounts were not so anonymous, but my domain accounts. I recovered like a zillion files and put them in a single folder.

MSE is about 80% complete @ 1.4Million files. I'll run unhide when complete

[LDTate]

OK.

[Threadgill]

Mr. LDTate,

I ran unhide, but cannot use file explorer to poke around...because Adobe starts some type of INSTALL every time I right click or try to open from start menu. OK, I am under the belief this is bad....

what do I do...let install? What kind of problem do I look for...?

[Threadgill]

Mr. LDTate,

Please read the post above this^^^^^. The post below is....additional commentary.

[LDTate]

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
• Double click on ComboFix.exe & follow the prompts.
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  Note: If you have XP SP3, use the XP SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

[Threadgill]

Do I let the Adobe INSTALLER install before running Combo Fix?

I'll post commentary later....

[LDTate]

It shouldn't make any difference.

[Threadgill]

C:\ComboFix.txt

ComboFix 12-01-26.03 - Administrator 01/26/2012 15:59:13.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2060 [GMT -6:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\default_user_class.dat.LOG

.

.

[LDTate]

Lets run a temp file cleaner

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

[Threadgill]

Posted Today, 06:30 AM

Posted Today, 06:13 PM

unbelievable. I am crazy cause no way this is happening...and my Little Lady must be crazier cause she has stuck by me 23yrs...today. I am guessing you cannot comment on the ComboFix...cause if my theory is correct, its really SCARY. Yeah, I am crazy, and, from the looks of the postings, I still owe you a commentary. You are a good guy Mr. LDTate and I am blessed with you help... but I gotta shut down now and do some living with my crazy Little Lady.

We'll file clean tomorrow morning, may your evening be as good as mine.

[LDTate]

The only thing I saw in the Combofix scan that needed attention was the temporary files.

After you run the cleaner, we'll uninstall Combofix and then I'll ask how it's running.

[Threadgill]

good morning

ATF done, run combof /uninstall now?

[Threadgill]

I proceeded and uninstalled combofix

[Threadgill]

Before ATF ran, I let windows install 68 updates, 1 security update for .net did not install. rebooted then ran ATF

rebooted then uninstalled ComboFix

rebooted then installed 5+ windows updates , reported again .net security did not install

[Threadgill]

Status:

cpu fan on, lot of processing in backgound

Last 4 boots desktop had a file explorer window open showing C:\Program Files\Chrome\Application...not open when shut down

when combofix uninstalled MSE popup alert with suspicious file "explorer.exe" requested to be sent to Microsoft. I declined and also shut down MSE requested by Combofix to finish.

When I rebooted after ComboFix uninstal I had to reboot 2x. The 1st time alert pop up asking to install "drive letter access component" by sonic Solution...no option to decline and could not end process through task manager....so I held down power for restart.

just checked and I can see my CD drive. Well I clicked on it...up pops the alert. I'll post and then check out before computer freezes

[LDTate]

 
The 1st time alert pop up asking to install "drive letter access component" by sonic Solution...no option to decline and could not end process through task manager....so I held down power for restart

That should be ok to let it install the CD driver.

[Threadgill]

tried and failed

located the file on CD and installed the .msi file...This file letter access thing is for dragging and dropping songs to record...I did not check the option after "program window " popped up after install. I ejected the disk started explorer...alert to install again. this time the .msi file was not acceptable. I figure go to web and find, or find on my drive...but your running the show here...thinking I might of corrupted the file when I stopped it from installing the 1st time.

whats next?

[LDTate]

I'm out of ideas.

Are the orignal issues solved?