Infected Dell Dimension 8200

[Maniac]

http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

[TomW]

Here are the two reports.

 

RogueKiller V8.6.5 [Aug  5 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Dell [Admin rights]
Mode : Scan -- Date : 08/17/2013 10:16:33
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤
[HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1       localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST340016A +++++
--- User ---
[MBR] 5512ec6cd3addea38f44f1e4b3683781
[bSP] 6a485f659bdaa1fb04c52d495460461e : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38154 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_08172013_101633.txt >>

 

 

Farbar Service Scanner Version: 17-08-2013
Ran by Dell (administrator) on 17-08-2013 at 10:21:53
Running from "C:\Documents and Settings\Dell\Desktop"
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x0700000005000000010000000200000003000000040000000600000007000000
IpSec Tag value is correct.

**** End of log ****

[Maniac]

Please download on the Desktop the following application: Windows Repair

Next, extract and launch the Repair_Windows.exe

Click on Start repairs tab and then click on Start

Check mark following options alone

Reset Registry Permissions

Reset File Permissions

Register System Files

Checkmark Restart System When Finished option

click the Start button

System should restart after repaired.

[TomW]

Maniac-

I appreciate your help and courtesy but must tell you I "violated the rules" when I did not hear from you yesterday.  Specifically, I downloaded and tried to run Spybot but got an error saying "this application has failed to start because wtsapi32.dll was not found". So I retrieved a copy of wtsapi32.dll from c:\windows\servicepackfiles\i386 and put it in c:\windows\system32. Spybot then ran fine and found 82 "low threat" tracking items (which I did not delete). I then tried Chameleon and was suprised that it also ran and found 3 items which I did delete then rebooted and noticed the computer seemed "faster".  I then tried Windows Update and was again surprised that Windows Update worked and presented 47 updates (which I have not yet done). So, if an apology is in order for what I did, then I apologize. Should we continue with our effots and run Repair_Windows.exe or just do the 47 Windows Updates and, if no further issues appear, consider the mission "accomplished"?

Tom

[Maniac]

Probably you should explain that to me earlier. Nevermind, please update your Windows, reboot and let em know how are things then.

[TomW]

Installed 41 updates in Windows Update, rebooted, updated / ran Malwarebytes and got a "no malware found" dialog. My neighbor should be very pleased with our efforts to repair his computer. Thank you for helping and I hope this thread may be useful to someone else.

(I was able to uninstall combofix with start/run/combofix /uninstall; how do I uninstall farbar, roguekiller, & wus_Fix.exe?)

[Maniac]

There is no specific instructions for them. Just manually delete them.

Also, here some malware preventions:

users.telenet.be/bluepatchy/miekiemoes/prevention.html

Safe surfing!

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!