Jump to content

Missing themed32.dll file ruining my laptop


Recommended Posts

Yesterday I was attempting to rid my laptop of the google redirect virus which is going round. I've been trying to get rid of it for a while but nothing was working. Another problem was that whenever i tried to run Firefox, I would get the error message saying Windows cannot find C:\Program files\...\firefox.exe. I reinstalled it several times but with no luck. I tried scanning my computer using Mbam, SAS, and my antivirus software, Bitdefender. Several viruses/trojans/spyware were deleted, including the firefox error. But the feckin google redirect problem is still there!

After rebooting after the final scan, i get several error messages saying "This application has failed to start because themed32.dll was not found. Re-installing the application may fix this problem.". This message would be in reference to several different processes, saying "Unable to locate component", with the message itself is the same. As a result, my desktop and start menu/bar do not appear, just my wallpaper. Even when I try to access the Task Menu using Ctrl, Alt, Delete, I get the error message(the message referring to taskmgr.exe in this case). Task manager runs eventually but again when I try to run any program, i get the error message, normally several times, before it runs.

I've tried looking online for how to reinstall themed32.dll but can't find a website where i can get it from. My guess is that either I still have a virus which is causing this error, or that the dll file was in fact changed somehow when the virus scans where performed.

That was a bit of a effort so thanks for reading. Any help/suggestions on how to get the themed32.dll back would be really appreciated. Here's the HT log:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:10:51, on 19/06/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\GEARSec.exe

C:\Program Files\Dell Network Assistant\hnm_svc.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\Program Files\Norton Ghost\Agent\VProSvc.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytalktalk.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,C:\WINDOWS\system32\sdra73.exe,

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe

O23 - Service: Peer Networking p2psvcDhcp (p2psvcDhcp) - Unknown owner - C:\WINDOWS\system32\algo.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: MS Software Shadow Copy Provider SwPrvNtmsSvc (SwPrvNtmsSvc) - Unknown owner - C:\WINDOWS\system32\advpack.dlln.exe (file missing)

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

O23 - Service: WLANKEEPER - Intel

Edited by Maurice Naggar
Emphasis added
Link to post
Share on other sites

Hello cowdenbeath.

I want you to locate your Windows XP o.s. CD and tell me what the label reads on it. We may need to use this CD at some point, maybe very soon.

One of the things I need to know is: if this is a retail Microsoft CD, or if it is from an OEM factory (like Dell or HP, etc) OR it is just a "Recovery CD" or a "Restore CD".

You will want to print out or copy these instructions to Notepad for offline reference!

eusa_hand.gif

If you are a casual viewer, do NOT try this on your system!

If you are not cowdenbeath and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

icon_arrow.gif Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

DO as much as possible of the following. Provide all details, as appropos, in case something does not work.

If in these processes you cannot download on this system, then use a clean pc to do downloads and save & burn to CD/DVD or copy to a Clean (unused) thumb-flash-USB drive, and copy the tools to the Desktop.

Disable the options "Automatically detect settings" and "Use automatic configuration script."

To do this:

1. Open Internet Explorer.

2. Click "Tools," and then click "Internet Options."

3. Click "Connections," and then click "LAN Settings."

4. Make sure the check boxes for "Automatically detect settings" and "Use automatic configuration script" are not selected.

5. Apply changes & OK

Start HijackThis. Look for these lines and place a checkmark against each of the following, if still present

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,C:\WINDOWS\system32\sdra73.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe

Click on Fix Checked when finished and exit HijackThis.

Make sure your Internet Explorer (& or any other window) is closed when you click Fix Checked!

Step 2

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 3

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 4

Download & SAVE OTL by OldTimer to your desktop from one of the following links: Link1 or

Link2

  • Close all open windows on the Task Bar. Double-click OTL.com (for Vista, right click the icon and Run as Administrator) to start the program.
  • In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
  • Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
  • It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
  • Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
  • Exit OTL by clicking the X at top right.

Download Security Check by screen317 and save it to your Desktop: here or here

  • Run Security Check
  • Follow the onscreen instructions inside of the command window.
  • A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

eusa_hand.gifIf one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Then copy/paste the following into your post (in order):

  • the contents of OTL.txt;
  • the contents of Extras.txt ; and
  • the contents of checkup.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

P.S. This system has BitDefender as your active antivirus but also shows remnants of Norton Symantec. Can you tell me why the Symantec is leftover?

Did your Norton Symantec expire, or was it the trial edition?

Is the BitDefender a free edition or do you have a current license?

Having 2 active AVs leads to definite deadlock conflicts, which aggravates an already complicated infection case.

Link to post
Share on other sites

Thanks for the speedy reply!

I'm using my home PC to access this page. My laptop is fairly old so it may take me a while to find the CD that came with it(if any), i'll get on that ASAP.

Right now I'm stuck at Step 3. My laptop won't display any desktop items so I can't access the My Computer menu options. I'm executing everything using Task Manager at the moment. Is there another way to change these options?

Thanks

Link to post
Share on other sites

Preview keeps returning an Internet Explorer "Page cannot be displayed" message, so I'll post the reports one at a time.

Right, I tried running explorer.exe but it gave the same "Unable to locate component" error message for explorer.exe and explorer didn't show up. So I continued with the rest of the steps and got the documents. The "Unable to locate component" error message came up frequently, as it has been doing, bu when running Security Check it came up about 100 times. Dunno if that might have interefered with it or something.

Bitdefender is a free version. The Norton Symantec, I think must have been a trial version that came with the laptop since I've never purchased it before and can't remember ever using it even. So that must need removing as well I guess.

Here are the reports

OTL.txt report:

OTL logfile created on: 19/06/2010 19:26:47 - Run 1

OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Mandeep\Desktop\Malware Removers

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,015.00 Mb Total Physical Memory | 623.00 Mb Available Physical Memory | 61.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 52.68 Gb Total Space | 2.66 Gb Free Space | 5.05% Space Free | Partition Type: NTFS

Drive D: | 18.61 Gb Total Space | 3.72 Gb Free Space | 20.01% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: MANDEEP

Current User Name: Mandeep

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/19 19:26:35 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mandeep\Desktop\Malware Removers\OTL.com

PRC - [2009/11/12 17:30:59 | 001,638,240 | ---- | M] (BitDefender S. R. L.) -- C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

PRC - [2009/10/08 15:47:09 | 000,413,696 | ---- | M] (BitDefender SRL) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

PRC - [2008/04/14 01:12:36 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\snmp.exe

PRC - [2007/02/19 19:58:30 | 000,083,504 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe

PRC - [2006/09/15 11:03:40 | 000,822,424 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

PRC - [2006/06/29 12:12:34 | 000,376,832 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe

PRC - [2005/12/07 16:05:34 | 002,066,072 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe

PRC - [2005/12/07 16:05:12 | 000,053,248 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe

PRC - [2004/12/13 15:30:10 | 000,165,488 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PRC - [2004/12/13 15:30:04 | 000,198,256 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PRC - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel

Link to post
Share on other sites

Kudos / congratulations on a good job getting this.

Download and SAVE FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

  • Double-click FixPolicies.exe.
  • Click the "Install" button on the bottom toolbar of the box that will open.
  • The program will create a new Folder called FixPolicies.
  • Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
  • A black box will briefly appear and then close.
  • This may or may not help, but is worth trying. You can safely run the utility again, if we need to.

Take a break for a while. I'll need to review this log and formulate our next steps. Stay tuned. :P

Link to post
Share on other sites

Download The Avenger by Swandog46 from here.

  • Unzip/extract it to a folder on your desktop.
  • Double click on avenger.exe to run The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Files to delete:
    C:\WINDOWS\System32\12520850m.sys
    c:\windows\system32\sdra64.exe
    c:\windows\system32\sdra73.exe
    C:\WINDOWS\System32\2387118637.dat
    C:\Documents and Settings\Mandeep\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini


  • In the avenger window, click the Paste Script from Clipboard icon, pastets4.png button.
  • ! Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.

If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.

and then reboot the system again.

Reply with copy of C:\Avenger.txt

and tell me, How is the system now?

are you seeing a Taskbar ? a Start button? start menus? Give details, as you have done before.

If needed, we will continue using Task Manager. :P

Link to post
Share on other sites

Ok, I've downloaded both FixPolicies and The Avenger and followed the instructions for both and got a log for the Avenger. There was just one restart when using the Avenger. The laptop is still running as it was before unfortunately. The "Unable to locate component" messages are still appearing at startup and whenever I try do run anything, taskbar/start menu/start button haven't appeared yet. I still have the other two log files, Extras.txt and checkup.txt, should I post those next? I can see from the Avenger report that one of those five problems have been deleted.

avenger.txt report:

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: file "C:\WINDOWS\System32\12520850m.sys" not found!

Deletion of file "C:\WINDOWS\System32\12520850m.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\sdra64.exe" not found!

Deletion of file "c:\windows\system32\sdra64.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "c:\windows\system32\sdra73.exe" not found!

Deletion of file "c:\windows\system32\sdra73.exe" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

File "C:\WINDOWS\System32\2387118637.dat" deleted successfully.

Error: file "C:\Documents and Settings\Mandeep\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" not found!

Deletion of file "C:\Documents and Settings\Mandeep\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

I'm off to catch some sleep for the night so I'll catch your reply tomorow!

Thanks

Link to post
Share on other sites

Good run of Avenger actually. The other 4 files are gone already.

Please close any of your open windows/programs and exit; saving any open work you have.

I'd like to have you do a special run of OTL to generate some searches & a new log-report.

  • Please double-click OTL.exe otlDesktopIcon.png to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy all the lines in between the **** stars lines **** below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
    *****************************************************************
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %SYSTEMDRIVE%\*.exe
    /md5start
    themeui.dll
    userinit.exe
    ssmdrv.sys
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    /md5stop
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    CREATERESTOREPOINT
    *****************************************************************
  • Return to OTL. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
  • Close any browser(s) windows that may be open.
  • Using your mouse, click on Run Scan.
  • The scan won't take long.
    When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of just OTL.txt

Link to post
Share on other sites

OTL.txt report:

OTL logfile created on: 20/06/2010 14:40:16 - Run 2

OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Mandeep\Desktop\Malware Removers

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,015.00 Mb Total Physical Memory | 629.00 Mb Available Physical Memory | 62.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 52.68 Gb Total Space | 2.25 Gb Free Space | 4.27% Space Free | Partition Type: NTFS

Drive D: | 18.61 Gb Total Space | 3.72 Gb Free Space | 20.01% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: MANDEEP

Current User Name: Mandeep

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/19 19:26:35 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mandeep\Desktop\Malware Removers\OTL.com

PRC - [2009/11/12 17:30:59 | 001,638,240 | ---- | M] (BitDefender S. R. L.) -- C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

PRC - [2009/10/08 15:47:09 | 000,413,696 | ---- | M] (BitDefender SRL) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

PRC - [2008/04/14 01:12:36 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\snmp.exe

PRC - [2007/02/19 19:58:30 | 000,083,504 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe

PRC - [2006/09/15 11:03:40 | 000,822,424 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

PRC - [2006/06/29 12:12:34 | 000,376,832 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe

PRC - [2006/05/16 23:15:10 | 000,071,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

PRC - [2005/12/07 16:05:34 | 002,066,072 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe

PRC - [2005/12/07 16:05:12 | 000,053,248 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe

PRC - [2004/12/13 15:30:10 | 000,165,488 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PRC - [2004/12/13 15:30:04 | 000,198,256 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PRC - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel

Link to post
Share on other sites

OTL.txt

OTL logfile created on: 20/06/2010 14:40:16 - Run 2

OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Mandeep\Desktop\Malware Removers

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,015.00 Mb Total Physical Memory | 629.00 Mb Available Physical Memory | 62.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 52.68 Gb Total Space | 2.25 Gb Free Space | 4.27% Space Free | Partition Type: NTFS

Drive D: | 18.61 Gb Total Space | 3.72 Gb Free Space | 20.01% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: MANDEEP

Current User Name: Mandeep

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/19 19:26:35 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mandeep\Desktop\Malware Removers\OTL.com

PRC - [2009/11/12 17:30:59 | 001,638,240 | ---- | M] (BitDefender S. R. L.) -- C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

PRC - [2009/10/08 15:47:09 | 000,413,696 | ---- | M] (BitDefender SRL) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

PRC - [2008/04/14 01:12:36 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\snmp.exe

PRC - [2007/02/19 19:58:30 | 000,083,504 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe

PRC - [2006/09/15 11:03:40 | 000,822,424 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

PRC - [2006/06/29 12:12:34 | 000,376,832 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe

PRC - [2006/05/16 23:15:10 | 000,071,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

PRC - [2005/12/07 16:05:34 | 002,066,072 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe

PRC - [2005/12/07 16:05:12 | 000,053,248 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe

PRC - [2004/12/13 15:30:10 | 000,165,488 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PRC - [2004/12/13 15:30:04 | 000,198,256 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PRC - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel

Edited by Maurice Naggar
OTL log placed In-line
Link to post
Share on other sites

You will want to print out or copy these instructions to Notepad for offline reference!

eusa_hand.gifIf you are a casual viewer, do NOT try this on your system!

If you are not cowdenbeath and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

icon_arrow.gif Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

FYI I attempted to place your log (OTL.txt) in-line, but for some reason it does not post completely.

I have it back where you had it attached.

Please see if you can do the following, as much as possible:

Step 1

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

Double-click gmer.exe. The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

  • Click Yes.
  • Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  • Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

  • Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  • Save it where you can easily find it, such as your desktop.

Step 2

Download this file & extract TDSSKiller.exe onto your Desktop

Then create this batch file to be placed next to TDSSKiller:

----

Start NOTEPAD and copy/paste the text in the quotebox below into it:

@ECHO OFF
START /WAIT TDSSKILLER.exe -l Logit.txt -v
START Logit.txt
del %0

Save this as fix.bat Choose to "Save type as - All Files"

It should look like this: batchfileimage.jpg

Double click on fix.bat & allow it to run.

Step 3

Start NOTEPAD and then copy and paste the codebox lines below into it.

Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop.

@echo off
copy C:\WINDOWS\ServicePackFiles\i386\themeui.dll C:\themed32.dll

Double-click on fixes.bat file to run it.

Next, You already have Avenger.exe from before.

  • Double click on avenger.exe to run The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Drivers to disable:
    cleanup

    Drivers to delete:
    cleanup

    Files to move:
    C:\themed32.dll | C:\WINDOWS\system32\themed32.dll

    Files to delete:
    C:\zip.exe
    C:\cleanup.exe
    C:\cleanup.bat

    Registry values to delete:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce | cleanup


  • In the avenger window, click the Paste Script from Clipboard icon, pastets4.png button.
  • ! Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Please post back with the result: Gmer log & Logit.txt

Also, please keep me advised on whether or not you have a Taskbar, Start button, able to start Windows Explorer (explorer.exe)

added note on running SFC

Hopefully you'll now have a Start button functionality. If not, use Task Manager > Run New Task

Start > RUN

SFC /scannow

You'll see a very brief command-prompt-window flash. no panic.

Followed by a "Windows File Protection" window. Leave it be. Let System File Checker run un-interrupted, for whoever it takes.

It will show

Please wait while Windows verifies that all protected Windows files are intact and in their original versions.

Have infinite patience. Let it finish.

Now, advise if subsequently, you have a Taskbar & Desktop.

If you already have DDS, then skip the download.

Download DDS and save it to your desktop from http://www.techsupportforum.com/sectools/sUBs/dds here or http://download.bleepingcomputer.com/sUBs/dds.scr or

http://www.forospyware.com/sUBs/dds

Disable any script blocker if your antivirus/antimalware has it.

Then double click dds.scr to run the tool.

DDS will run in a command prompt window and will take 3 to 4 minutes or so.

  • When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt
  • Save both reports to your desktop.

Please include the following logs in your next reply:

DDS.txt

Attach.txt

Be sure to also place the contents of DDS.txt and Attach.txt in a reply.

Edited by Maurice Naggar
added SFC & DDS
Link to post
Share on other sites

It worked! My desktop is back and I have the start bar and menu working as it was before. There seem to be no more "Unable to locate component" error messages, although I've not used my laptop very much since the scans. The imporvements came after I did the SFC and DDS scan and then rebooted. The laptop is still fairly unresponsive however. And Bitdefender seems to be blocking alot of viruses and trojans, 3 already and I've only had it on for about 10 minutes. Think there is still a problem?

I have all the logs here apart from logit.txt. I can't find it or know which scan it would have come from?

gmer.txt report:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-06-22 14:12:15

Windows 5.1.2600 Service Pack 3

Running: gmer.exe; Driver: C:\DOCUME~1\Mandeep\LOCALS~1\Temp\uwddypob.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

AttachedDevice \Driver\Tcpip \Device\Ip bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

AttachedDevice \Driver\Tcpip \Device\Tcp bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

AttachedDevice \Driver\Tcpip \Device\Udp bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

AttachedDevice \Driver\Tcpip \Device\RawIp bdftdif.sys (BitDefender Firewall TDI Filter Driver/BitDefender LLC)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device -> \Driver\atapi \Device\Harddisk0\DR0 87124EE4

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

avenger.txt report:

Logfile of The Avenger Version 2.0,

Edited by Maurice Naggar
emphasis added
Link to post
Share on other sites

Here's Attach.txt again, it doesn't seem to have posted fully last post.

Attach.txt report:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 24/09/2006 03:10:58

System Uptime: 23/06/2010 13:25:43 (1 hours ago)

Motherboard: Dell Inc. | | 0RJ272

Processor: Intel® Pentium® M processor 1.70GHz | Microprocessor | 1695/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 53 GiB total, 1.972 GiB free.

D: is FIXED (NTFS) - 19 GiB total, 3.724 GiB free.

E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP4: 20/06/2010 14:42:03 - OTL Restore Point

RP5: 22/06/2010 06:22:39 - System Checkpoint

==== Installed Programs ======================

AC3Filter (remove only)

Adobe Flash Player 10 Plugin

Adobe Flash Player 9 ActiveX

Adobe Reader 7.0.9

Adobe Shockwave Player

Adobe

Link to post
Share on other sites

Argh, same problem as with OTL.txt before. Here's the attchment.

Attach.txt report:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 24/09/2006 03:10:58

System Uptime: 23/06/2010 13:25:43 (1 hours ago)

Motherboard: Dell Inc. | | 0RJ272

Processor: Intel

Attach.txt

Edited by Maurice Naggar
placed Attach txt log In-Line
Link to post
Share on other sites

Good going on your end !! :P I believe that System File Checker (SFC) has done the trick, likely replacing some dlls. Thus getting you back the Desktop.

You must understand we still have lots to do and follow-up on.

While we continue & while this case is ongoing, do NO web surfing of any kind.

Just only this forum and the websites I guide you to.

Start with the following soonest.

Step 1

1. YOU already have ERUNT on your system (the Desktop). Skip the download. I do need for you to RUN it.

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

3. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

4. Make sure that at least the first two check boxes are ticked

5. Press OK

6. Press YES to create the folder.

Step 2

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 3

Take out the trash (temporary files & temporary internet files)

Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.

Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:

Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

ATF-Cleaner should be run per the above in every user-login account {User Profile}

Step 4

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Delete the old copy of Combofix.exe (red-lion icon) !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1

Link 2

Link 3

CF_download_FF.gif

CF_download_rename.gif

* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop

If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Double click on Combo-Fix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RcAuto1.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

whatnext.png

Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

-------------------------------------------------------

A caution - Do not run Combofix more than once.

Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.

If this occurs, please reboot to restore the desktop.

RE-Enable your AntiVirus and AntiSpyware applications.

Reply with copy of the latest C:\Combofix.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Link to post
Share on other sites

Right, I managed to compete all four steps exactly, without any problem. The system feels more responsive after having used ATF cleaner. Here's the log file produced from combofix:

ComboFix 10-06-23.05 - Mandeep 24/06/2010 16:13:44.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.555 [GMT 1:00]

Running from: c:\documents and settings\Mandeep\Desktop\Combo-Fix.exe

AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\default.temp

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\firmware.inf

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\ip3picfile.temp

c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\ip3Wmapic.temp

c:\documents and settings\Mandeep\Application Data\B35B96C3ACD64E6EB5F551E6A34571AD

c:\documents and settings\Mandeep\Application Data\B35B96C3ACD64E6EB5F551E6A34571AD\enemies-names.txt

c:\documents and settings\Mandeep\Start Menu\Programs\Antimalware Doctor

c:\documents and settings\Mandeep\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk

c:\documents and settings\Mandeep\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk

c:\program files\WinPCap

c:\program files\WinPCap\daemon_mgm.exe

c:\program files\WinPCap\INSTALL.LOG

c:\program files\WinPCap\npf_mgm.exe

c:\program files\WinPCap\rpcapd.exe

c:\program files\WinPCap\Uninstall.exe

C:\test.txt

c:\windows\system32\2387118637.dat

c:\windows\system32\algo.exe

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\wpcap.dll

c:\windows\xpsp1hfm.log

Infected copy of c:\windows\system32\drivers\mouclass.sys was found and disinfected

Restored copy from - Kitty had a snack :P

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_IPRIP

-------\Legacy_NPF

-------\Legacy_P2PSVCDHCP

-------\Legacy_SWPRVNTMSSVC

-------\Service_Iprip

-------\Service_NPF

-------\Service_p2psvcDhcp

-------\Service_SwPrvNtmsSvc

((((((((((((((((((((((((( Files Created from 2010-05-24 to 2010-06-24 )))))))))))))))))))))))))))))))

.

2010-06-23 13:16 . 2008-04-14 00:12 116224 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll

2010-06-23 13:16 . 2001-08-17 21:36 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll

2010-06-23 13:16 . 2008-04-14 00:12 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll

2010-06-23 13:16 . 2001-08-17 21:37 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe

2010-06-23 13:16 . 2001-08-17 21:37 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe

2010-06-23 13:16 . 2001-08-17 21:37 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe

2010-06-23 13:16 . 2001-08-17 11:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys

2010-06-23 13:16 . 2004-08-03 21:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys

2010-06-23 13:16 . 2004-08-03 21:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys

2010-06-23 13:16 . 2008-04-14 00:12 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll

2010-06-23 13:15 . 2008-04-13 18:36 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys

2010-06-23 13:15 . 2004-08-03 21:31 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys

2010-06-23 13:15 . 2001-08-17 11:12 34890 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys

2010-06-23 13:15 . 2001-08-17 12:28 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys

2010-06-23 13:13 . 2001-08-17 12:28 64605 ----a-w- c:\windows\system32\dllcache\vvoice.sys

2010-06-23 13:13 . 2001-08-17 12:28 397502 ----a-w- c:\windows\system32\dllcache\vpctcom.sys

2010-06-23 13:13 . 2001-08-17 12:28 604253 ----a-w- c:\windows\system32\dllcache\vmodem.sys

2010-06-23 13:13 . 2001-08-17 11:14 249402 ----a-w- c:\windows\system32\dllcache\vinwm.sys

2010-06-23 13:13 . 2001-08-17 12:49 24576 ----a-w- c:\windows\system32\dllcache\viairda.sys

2010-06-23 13:13 . 2001-08-17 12:28 687999 ----a-w- c:\windows\system32\dllcache\usrwdxjs.sys

2010-06-23 13:13 . 2001-08-17 12:28 765884 ----a-w- c:\windows\system32\dllcache\usrti.sys

2010-06-23 13:13 . 2001-08-17 12:28 113762 ----a-w- c:\windows\system32\dllcache\usrpda.sys

2010-06-23 13:13 . 2001-08-17 12:28 7556 ----a-w- c:\windows\system32\dllcache\usroslba.sys

2010-06-23 13:13 . 2001-08-17 12:28 224802 ----a-w- c:\windows\system32\dllcache\usr1807a.sys

2010-06-23 13:11 . 2001-08-17 21:36 47616 ----a-w- c:\windows\system32\dllcache\umaxcam.dll

2010-06-23 13:11 . 2001-08-17 21:36 211968 ----a-w- c:\windows\system32\dllcache\um54scan.dll

2010-06-23 13:11 . 2001-08-17 21:36 216064 ----a-w- c:\windows\system32\dllcache\um34scan.dll

2010-06-23 13:11 . 2001-08-17 12:48 11520 ----a-w- c:\windows\system32\dllcache\twotrack.sys

2010-06-23 13:11 . 2004-08-04 04:00 14336 ----a-w- c:\windows\system32\dllcache\tsprof.exe

2010-06-23 13:11 . 2001-08-17 11:51 166784 ----a-w- c:\windows\system32\dllcache\tridxpm.sys

2010-06-23 13:11 . 2001-08-17 21:36 525568 ----a-w- c:\windows\system32\dllcache\tridxp.dll

2010-06-23 13:11 . 2001-08-17 11:51 159232 ----a-w- c:\windows\system32\dllcache\tridkbm.sys

2010-06-23 13:11 . 2001-08-17 13:56 440576 ----a-w- c:\windows\system32\dllcache\tridkb.dll

2010-06-23 13:11 . 2001-08-17 11:51 222336 ----a-w- c:\windows\system32\dllcache\trid3dm.sys

2010-06-23 13:11 . 2001-08-17 13:56 315520 ----a-w- c:\windows\system32\dllcache\trid3d.dll

2010-06-23 13:11 . 2001-08-17 11:12 34375 ----a-w- c:\windows\system32\dllcache\tpro4.sys

2010-06-23 13:11 . 2001-08-17 21:35 42496 ----a-w- c:\windows\system32\dllcache\tp4res.dll

2010-06-23 13:10 . 2008-04-14 00:12 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe

2010-06-23 13:10 . 2001-08-17 21:36 31744 ----a-w- c:\windows\system32\dllcache\tp4.dll

2010-06-23 13:10 . 2001-08-17 13:02 230912 ----a-w- c:\windows\system32\dllcache\tosdvd03.sys

2010-06-23 13:10 . 2001-08-17 13:01 241664 ----a-w- c:\windows\system32\dllcache\tosdvd02.sys

2010-06-23 13:10 . 2001-08-17 11:10 28232 ----a-w- c:\windows\system32\dllcache\tos4mo.sys

2010-06-23 13:09 . 2001-08-17 11:14 123995 ----a-w- c:\windows\system32\dllcache\tjisdn.sys

2010-06-23 13:09 . 2004-08-04 04:00 185344 ----a-w- c:\windows\system32\dllcache\thawbrkr.dll

2010-06-23 13:09 . 2001-08-17 11:51 138528 ----a-w- c:\windows\system32\dllcache\tgiulnt5.sys

2010-06-23 13:09 . 2001-08-17 13:56 81408 ----a-w- c:\windows\system32\dllcache\tgiul50.dll

2010-06-23 13:09 . 2008-04-13 18:40 149376 ----a-w- c:\windows\system32\dllcache\tffsport.sys

2010-06-23 13:09 . 2004-08-04 04:00 19464 ----a-w- c:\windows\system32\dllcache\tdspx.sys

2010-06-23 13:09 . 2001-08-17 11:13 17129 ----a-w- c:\windows\system32\dllcache\tdkcd31.sys

2010-06-23 13:09 . 2001-08-17 11:13 37961 ----a-w- c:\windows\system32\dllcache\tdk100b.sys

2010-06-23 13:09 . 2004-08-04 04:00 21896 ----a-w- c:\windows\system32\dllcache\tdipx.sys

2010-06-23 13:09 . 2004-08-04 04:00 13192 ----a-w- c:\windows\system32\dllcache\tdasync.sys

2010-06-23 13:08 . 2001-08-17 12:49 30464 ----a-w- c:\windows\system32\dllcache\tbatm155.sys

2010-06-23 13:08 . 2001-08-17 12:52 7040 ----a-w- c:\windows\system32\dllcache\tandqic.sys

2010-06-23 13:08 . 2001-08-17 11:50 36640 ----a-w- c:\windows\system32\dllcache\t2r4mini.sys

2010-06-23 13:08 . 2001-08-17 13:56 172768 ----a-w- c:\windows\system32\dllcache\t2r4disp.dll

2010-06-23 13:08 . 2001-08-17 21:36 94293 ----a-w- c:\windows\system32\dllcache\sxports.dll

2010-06-23 13:08 . 2001-08-17 12:50 103936 ----a-w- c:\windows\system32\dllcache\sx.sys

2010-06-23 13:08 . 2001-08-17 13:02 3968 ----a-w- c:\windows\system32\dllcache\swusbflt.sys

2010-06-23 13:07 . 2001-08-17 21:36 10240 ----a-w- c:\windows\system32\dllcache\swpidflt.dll

2010-06-23 13:07 . 2001-08-17 21:36 10240 ----a-w- c:\windows\system32\dllcache\swpdflt2.dll

2010-06-23 13:07 . 2001-08-17 21:36 53760 ----a-w- c:\windows\system32\dllcache\sw_wheel.dll

2010-06-23 13:07 . 2001-08-17 21:36 41472 ----a-w- c:\windows\system32\dllcache\sw_effct.dll

2010-06-23 13:07 . 2001-08-17 21:36 155648 ----a-w- c:\windows\system32\dllcache\stlnprop.dll

2010-06-23 13:07 . 2001-08-17 21:36 53248 ----a-w- c:\windows\system32\dllcache\stlncoin.dll

2010-06-23 13:07 . 2001-08-17 11:18 285760 ----a-w- c:\windows\system32\dllcache\stlnata.sys

2010-06-23 13:07 . 2001-08-17 12:51 16896 ----a-w- c:\windows\system32\dllcache\stcusb.sys

2010-06-23 13:06 . 2001-08-17 11:11 48736 ----a-w- c:\windows\system32\dllcache\srwlnd5.sys

2010-06-23 13:06 . 2001-08-17 21:36 99328 ----a-w- c:\windows\system32\dllcache\srusd.dll

2010-06-23 13:06 . 2004-08-04 04:00 101376 ----a-w- c:\windows\system32\dllcache\srusbusd.dll

2010-06-23 13:06 . 2001-08-17 21:36 24660 ----a-w- c:\windows\system32\dllcache\spxupchk.dll

2010-06-23 13:06 . 2001-08-17 12:51 61824 ----a-w- c:\windows\system32\dllcache\speed.sys

2010-06-23 13:06 . 2001-08-17 21:36 106584 ----a-w- c:\windows\system32\dllcache\spdports.dll

2010-06-23 13:06 . 2001-08-17 12:56 7552 ----a-w- c:\windows\system32\dllcache\sonypvu1.sys

2010-06-23 13:05 . 2001-08-17 11:51 37040 ----a-w- c:\windows\system32\dllcache\sonypi.sys

2010-06-23 13:05 . 2001-08-17 21:36 114688 ----a-w- c:\windows\system32\dllcache\sonypi.dll

2010-06-23 13:05 . 2001-08-17 11:51 20752 ----a-w- c:\windows\system32\dllcache\sonync.sys

2010-06-23 13:05 . 2001-08-17 12:53 9600 ----a-w- c:\windows\system32\dllcache\sonymc.sys

2010-06-23 13:05 . 2008-04-13 18:40 7552 ----a-w- c:\windows\system32\dllcache\sonyait.sys

2010-06-23 13:05 . 2004-08-04 04:00 143422 ----a-w- c:\windows\system32\dllcache\softkey.dll

2010-06-23 13:05 . 2001-08-17 12:53 7040 ----a-w- c:\windows\system32\dllcache\snyaitmc.sys

2010-06-23 13:05 . 2001-08-17 21:36 7168 ----a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll

2010-06-23 13:05 . 2001-08-17 21:36 12288 ----a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll

2010-06-23 13:05 . 2001-08-17 11:51 58368 ----a-w- c:\windows\system32\dllcache\smiminib.sys

2010-06-23 13:04 . 2001-08-17 13:56 147200 ----a-w- c:\windows\system32\dllcache\smidispb.dll

2010-06-23 13:04 . 2001-08-17 11:12 25034 ----a-w- c:\windows\system32\dllcache\smcpwr2n.sys

2010-06-23 13:04 . 2001-08-17 11:10 35913 ----a-w- c:\windows\system32\dllcache\smcirda.sys

2010-06-23 13:04 . 2001-08-17 11:12 24576 ----a-w- c:\windows\system32\dllcache\smc8000n.sys

2010-06-23 13:04 . 2001-08-17 12:57 6784 ----a-w- c:\windows\system32\dllcache\smbhc.sys

2010-06-23 13:04 . 2008-04-13 18:36 6912 ----a-w- c:\windows\system32\dllcache\smbclass.sys

2010-06-23 13:04 . 2008-04-13 18:36 16000 ----a-w- c:\windows\system32\dllcache\smbbatt.sys

2010-06-23 13:04 . 2004-08-04 04:00 31744 ----a-w- c:\windows\system32\dllcache\smb6w.dll

2010-06-23 13:04 . 2001-08-17 21:36 45568 ----a-w- c:\windows\system32\dllcache\smb3w.dll

2010-06-23 13:04 . 2004-08-04 04:00 31744 ----a-w- c:\windows\system32\dllcache\sma3w.dll

2010-06-23 13:04 . 2001-08-17 21:36 33792 ----a-w- c:\windows\system32\dllcache\smb0w.dll

2010-06-23 13:02 . 2001-08-17 11:50 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys

2010-06-23 13:02 . 2004-08-03 21:31 32768 ----a-w- c:\windows\system32\dllcache\sisnic.sys

2010-06-23 13:02 . 2001-08-17 21:36 238592 ----a-w- c:\windows\system32\dllcache\sisgrv.dll

2010-06-23 13:02 . 2001-08-17 11:50 104064 ----a-w- c:\windows\system32\dllcache\sisgrp.sys

2010-06-23 13:02 . 2001-08-17 13:56 150144 ----a-w- c:\windows\system32\dllcache\sis6306v.dll

2010-06-23 13:02 . 2001-08-17 11:50 68608 ----a-w- c:\windows\system32\dllcache\sis6306p.sys

2010-06-23 13:02 . 2001-08-17 13:56 252032 ----a-w- c:\windows\system32\dllcache\sis300iv.dll

2010-06-23 13:02 . 2001-08-17 11:50 101760 ----a-w- c:\windows\system32\dllcache\sis300ip.sys

2010-06-23 13:01 . 2001-07-21 13:29 161568 ----a-w- c:\windows\system32\dllcache\sgsmusb.sys

2010-06-23 13:01 . 2001-07-21 13:29 18400 ----a-w- c:\windows\system32\dllcache\sgsmld.sys

2010-06-23 13:01 . 2001-08-17 11:51 98080 ----a-w- c:\windows\system32\dllcache\sgiulnt5.sys

2010-06-23 13:01 . 2001-08-17 21:36 386560 ----a-w- c:\windows\system32\dllcache\sgiul50.dll

2010-06-23 13:01 . 2001-08-17 11:19 36480 ----a-w- c:\windows\system32\dllcache\sfmanm.sys

2010-06-23 12:59 . 2001-08-17 13:56 245632 ----a-w- c:\windows\system32\dllcache\s3savmx.dll

2010-06-23 12:58 . 2004-08-03 21:31 20992 ----a-w- c:\windows\system32\dllcache\rtl8139.sys

2010-06-23 12:58 . 2001-08-17 11:12 19017 ----a-w- c:\windows\system32\dllcache\rtl8029.sys

2010-06-23 12:58 . 2001-08-17 11:19 30720 ----a-w- c:\windows\system32\dllcache\rthwcls.sys

2010-06-23 12:58 . 2001-08-17 21:36 9216 ----a-w- c:\windows\system32\dllcache\rsmgrstr.dll

2010-06-23 12:58 . 2001-08-17 11:19 3840 ----a-w- c:\windows\system32\dllcache\rpfun.sys

2010-06-23 12:58 . 2008-04-13 18:40 79104 ----a-w- c:\windows\system32\dllcache\rocket.sys

2010-06-23 12:58 . 2001-08-17 11:12 37563 ----a-w- c:\windows\system32\dllcache\rlnet5.sys

2010-06-23 12:58 . 2001-08-17 21:36 86097 ----a-w- c:\windows\system32\dllcache\reslog32.dll

2010-06-23 12:58 . 2001-08-17 21:36 23040 ----a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe

2010-06-23 12:58 . 2004-08-04 04:00 14848 ----a-w- c:\windows\system32\dllcache\register.exe

2010-06-23 12:58 . 2001-08-17 12:51 19584 ----a-w- c:\windows\system32\dllcache\rasirda.sys

2010-06-23 12:58 . 2001-08-17 12:28 714762 ----a-w- c:\windows\system32\dllcache\r2mdmkxx.sys

2010-06-23 12:56 . 2001-08-17 12:53 17792 ----a-w- c:\windows\system32\dllcache\ppa.sys

2010-06-23 12:56 . 2008-04-13 18:40 8832 ----a-w- c:\windows\system32\dllcache\powerfil.sys

2010-06-23 12:56 . 2001-08-17 12:53 7168 ----a-w- c:\windows\system32\dllcache\pnrmc.sys

2010-06-23 12:56 . 2004-08-04 04:00 131584 ----a-w- c:\windows\system32\dllcache\pmxviceo.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-06-24 15:08 . 2009-06-04 21:31 81984 ----a-w- c:\windows\system32\bdod.bin

2010-06-19 15:05 . 2009-03-14 11:31 -------- d-----w- c:\documents and settings\Mandeep\Application Data\WinEdt

2010-06-19 00:46 . 2007-08-24 00:15 -------- d-----w- c:\program files\Full Tilt Poker

2010-06-19 00:46 . 2006-09-15 10:12 -------- d-----w- c:\program files\Google

2010-06-19 00:46 . 2006-09-15 10:00 -------- d-----w- c:\program files\Dell

2010-06-19 00:45 . 2006-09-15 10:06 -------- d-----w- c:\program files\Common Files\aolshare

2010-06-19 00:45 . 2006-09-15 10:06 -------- d-----w- c:\program files\Common Files\AOL

2010-06-19 00:45 . 2009-01-26 21:25 -------- d-----w- c:\program files\BitLord

2010-06-19 00:45 . 2006-10-02 15:42 -------- d-----w- c:\program files\BitTorrent

2010-06-19 00:45 . 2006-09-27 23:49 -------- d-----w- c:\program files\Apple Software Update

2010-06-19 00:45 . 2006-09-15 10:06 -------- d-----w- c:\program files\AOL 9.0

2010-06-19 00:45 . 2006-09-24 02:11 -------- d-----w- c:\documents and settings\Mandeep\Application Data\AOL

2010-06-19 00:45 . 2006-09-15 10:06 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL

2010-06-19 00:29 . 2010-06-19 00:29 69 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_C4D3ABC415F806D42BE76F6B145C177E.dll

2010-06-19 00:28 . 2010-06-19 00:28 74 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_8A0F842331866D117AB7000B0D610003.dll

2010-06-19 00:28 . 2010-06-19 00:28 42 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_8A0F842331866D117AB7000B0D510006.dll

2010-06-19 00:28 . 2010-06-19 00:28 154 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_7E577B2224C65CF4E801A9E52375DB49.dll

2010-06-19 00:28 . 2010-06-19 00:28 1152 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_7D52C05A9E261154DA07E8D25A7EB9D7.dll

2010-06-19 00:28 . 2010-06-19 00:28 229 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_788E47A8F0F87104FA35BC4A2211AA5A.dll

2010-06-19 00:28 . 2010-06-19 00:28 255 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_745EB6B52E12AC942B2EA6F57450391B.dll

2010-06-19 00:28 . 2010-06-19 00:28 299 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_7208564961F99054BB7D5AF95EC70332.dll

2010-06-19 00:28 . 2010-06-19 00:28 282 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_71A0906F7690A8A43B3C24A2B115D494.dll

2010-06-19 00:28 . 2010-06-19 00:28 137 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_70B83354632A0724A977BE4B1155715B.dll

2010-06-19 00:28 . 2010-06-19 00:28 152 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_6E8A266FCD4F2A1409E1C8110F44DBCE.dll

2010-06-19 00:28 . 2010-06-19 00:28 10 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_69A5CA7BCB8CC1346B16720A7918FD8A.dll

2010-06-19 00:28 . 2010-06-19 00:28 682 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_68AB67CA7DA73301B7447A9000000020.dll

2010-06-19 00:28 . 2010-06-19 00:27 88 ----a-w- c:\documents and settings\All Users\Application Data\SecTaskMan\icn_65598CC98753DD844880406EE6EB4F10.dll

2010-06-14 18:46 . 2006-10-02 15:43 -------- d-----w- c:\documents and settings\Mandeep\Application Data\BitTorrent

2010-06-08 01:52 . 2009-07-19 01:10 -------- d-----w- c:\program files\Common Files\DivX Shared

2010-06-08 01:52 . 2006-12-09 17:05 -------- d-----w- c:\program files\DivX

2010-05-28 17:35 . 2008-12-04 12:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Sports Interactive

2010-05-27 23:59 . 2006-12-09 17:48 -------- d-----w- c:\documents and settings\Mandeep\Application Data\DivX

2010-05-27 22:39 . 2007-06-01 12:38 -------- d-----w- c:\documents and settings\Mandeep\Application Data\Sports Interactive

2010-05-27 22:25 . 2007-06-01 12:25 -------- d-----w- c:\program files\Sports Interactive

2010-05-27 13:40 . 2009-04-01 15:20 -------- d-----w- c:\program files\TalkTalk

2010-05-26 21:20 . 2006-09-24 11:12 58136 -c--a-w- c:\documents and settings\Mandeep\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-05-26 17:40 . 2009-07-23 15:32 -------- d-----w- c:\documents and settings\Mandeep\Application Data\Spotify

2010-05-22 13:06 . 2007-12-07 00:19 -------- d-----w- c:\program files\Graboid

2010-05-22 12:52 . 2007-05-26 19:53 -------- d-----w- c:\program files\LimeWire

2010-05-05 19:13 . 2010-05-05 19:13 -------- d-----w- c:\program files\SopCast

2010-05-05 00:33 . 2010-05-05 00:33 -------- d-----w- c:\documents and settings\Mandeep\Application Data\Malwarebytes

2010-05-05 00:33 . 2010-05-05 00:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-05 00:33 . 2010-05-05 00:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-29 14:39 . 2010-05-05 00:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 14:39 . 2010-05-05 00:33 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-31 01:58 . 2009-07-19 01:12 133616 ------w- c:\windows\system32\pxafs.dll

2010-03-31 01:58 . 2006-12-09 17:05 125424 -c----w- c:\windows\system32\pxinsi64.exe

2010-03-31 01:58 . 2006-12-09 17:05 123888 -c----w- c:\windows\system32\pxcpyi64.exe

2010-03-31 01:58 . 2005-04-25 01:03 44944 ----a-w- c:\windows\system32\drivers\pxhelp20.sys

2009-11-12 16:31 . 2008-10-30 16:34 65536 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll

2009-01-19 16:12 . 2006-09-24 22:13 56 --sh--r- c:\windows\system32\5F2BD593F5.sys

2008-03-01 00:13 . 2006-09-24 22:15 88 --sh--r- c:\windows\system32\F593D52B5F.sys

2009-01-19 16:12 . 2006-09-24 22:12 6580 --sha-w- c:\windows\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-12 782336]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-06-04 69632]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2004-09-07 15:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL 9.0 Tray Icon.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL 9.0 Tray Icon.lnk

backup=c:\windows\pss\AOL 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk

backup=c:\windows\pss\AOL Companion.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Dell Network Assistant.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk

backup=c:\windows\pss\Dell Network Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Scroll-In-Mouse V2.0.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Scroll-In-Mouse V2.0.lnk

backup=c:\windows\pss\Scroll-In-Mouse V2.0.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

2005-06-06 22:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]

2007-07-02 10:27 219520 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]

2004-03-19 13:17 78960 -c--a-w- c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]

2006-09-30 02:00 43520 ----a-w- c:\program files\BitTorrent\bittorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

2004-12-13 14:30 58992 -c--a-w- c:\program files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

2007-04-03 22:29 165784 ----a-w- c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]

2006-07-16 20:29 389120 ----a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2005-09-08 04:20 122940 -c--a-w- c:\windows\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]

2005-11-01 02:12 94208 -c--a-w- c:\program files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]

2005-10-14 19:46 77824 -c--a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]

2005-10-14 19:50 114688 -c--a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]

2005-10-14 19:49 94208 -c--a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]

2004-10-30 13:59 385024 ----a-w- c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]

2006-03-20 17:34 213936 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2006-03-20 17:34 213936 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2006-03-20 17:34 86960 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2006-10-30 09:36 256576 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]

2003-09-10 01:24 20480 -c----w- c:\program files\NetWaiting\netwaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]

2005-07-12 18:05 1117184 -c--a-w- c:\program files\McAfee\SpamKiller\MSKDetct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2009-07-26 16:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\none]

2010-02-19 00:29 57 ----a-w- c:\AUTOEXEC.BAT

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Norton Ghost 10.0]

2005-12-07 15:05 1537696 -c--a-w- c:\program files\Norton Ghost\Agent\GhostTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2006-10-25 18:58 282624 -c--a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

2007-02-15 19:49 208941 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2006-03-24 22:30 282624 -c--a-w- c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]

2004-01-26 11:38 866816 ----a-w- c:\program files\Thomson\SpeedTouch USB\dragdiag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2007-09-25 01:11 132496 -c--a-w- c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2006-03-08 17:48 761947 -c--a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2007-02-15 19:49 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UltraMon]

2006-10-12 20:27 304640 ----a-w- c:\program files\UltraMon\UltraMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

2006-03-30 15:45 313472 ----a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"matlabserver"=2 (0x2)

"iPod Service"=3 (0x3)

"SBAMSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Spotify\\spotify.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Sports Interactive\\Football Manager 2010\\fm.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"7329:TCP"= 7329:TCP:ppLive

"8615:UDP"= 8615:UDP:ppLive

"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping

"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 19:25 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 19:41 67656]

R2 UltraMonUtility;UltraMon Utility Driver;c:\program files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [24/09/2006 21:22 11776]

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [18/09/2008 11:09 111112]

R3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\UltraMonMirror.sys [24/09/2006 21:23 3584]

S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 12:06 118784]

S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [02/10/2006 16:23 685816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx REG_MULTI_SZ scan

p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.

Contents of the 'Scheduled Tasks' folder

2010-05-27 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13]

2010-06-09 c:\windows\Tasks\Install_NSS.job

- c:\program files\DivX\Symantec\scstubinstaller.exe [2010-03-08 18:00]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uStart Page = hxxp://forums.malwarebytes.org/index.php?showtopic=54605

uInternet Connection Wizard,ShellNext = iexplore

FF - ProfilePath - c:\documents and settings\Mandeep\Application Data\Mozilla\Firefox\Profiles\0g3bkiue.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.bbc.co.uk/

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\documents and settings\Mandeep\Application Data\Mozilla\Firefox\Profiles\0g3bkiue.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Veetle\Player\npvlc.dll

FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-4oD - c:\program files\Kontiki\KHost.exe

MSConfigStartUp-AOLDialer - c:\program files\Common Files\AOL\ACS\AOLDial.exe

MSConfigStartUp-Corel Photo Downloader - c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe

MSConfigStartUp-DownloadAccelerator - c:\program files\DAP\DAP.EXE

MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

MSConfigStartUp-gotnewupdate000 - c:\documents and settings\Mandeep\Application Data\B35B96C3ACD64E6EB5F551E6A34571AD\gotnewupdate000.exe

MSConfigStartUp-kdx - c:\program files\Kontiki\KHost.exe

MSConfigStartUp-McAfeeUpdaterUI - c:\program files\Network Associates\Common Framework\UpdaterUI.exe

MSConfigStartUp-Monitor - c:\windows\PixArt\PAC207\Monitor.exe

MSConfigStartUp-MSKAGENTEXE - c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe

MSConfigStartUp-Network Associates Error Reporting Service - c:\program files\Common Files\Network Associates\TalkBack\tbmon.exe

MSConfigStartUp-nonep - c:\windows\TEMP\5E.tmp

MSConfigStartUp-PAC207_Monitor - c:\windows\PixArt\PAC207\Monitor.exe

MSConfigStartUp-SBAMTray - c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe

MSConfigStartUp-ShStatEXE - c:\program files\Network Associates\VirusScan\SHSTAT.EXE

MSConfigStartUp-Steam - c:\program files\Steam\Steam.exe

MSConfigStartUp-TalkTalk - c:\program files\TalkTalk\bin\sprtcmd.exe

MSConfigStartUp-Veoh - c:\program files\Veoh Networks\Veoh\VeohClient.exe

AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb

AddRemove-WinPcapInst - c:\program files\WinPcap\Uninstall.exe

AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-06-24 16:36

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{60778762-8BE2-5BE8-74B1F534DECE7DD7}\{033814D8-F5F0-69C3-B63A6822FA3F97AC}\{BB1878CD-9C66-F7AC-793F8981AF2E0354}*]

"RA4KGUJC6T6LBNJRIDQ63C2L6C1"=hex:01,00,01,00,00,00,00,00,f7,8a,3d,85,55,45,07,

82,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{6394A16B-F803-48C7-678A5F5C0D5AF33B}\{084FA269-25E9-EAF9-79282C5961DBAAF7}\{1F365BB6-4338-38B7-EE9F8ECE49C04569}*]

"RA4KGUJC6T6LBNJRIDQ63C2L6C1"=hex:01,00,01,00,00,00,00,00,f7,8a,3d,85,55,45,07,

82,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1180)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

c:\program files\Intel\Wireless\Bin\LgNotify.dll

- - - - - - - > 'explorer.exe'(3836)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe

c:\program files\Intel\Wireless\Bin\WLKeeper.exe

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\windows\System32\GEARSec.exe

c:\program files\Dell Network Assistant\hnm_svc.exe

c:\program files\Dell\QuickSet\NICCONFIGSVC.exe

c:\program files\Norton Ghost\Agent\VProSvc.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\tcpsvcs.exe

c:\windows\System32\snmp.exe

c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

c:\progra~1\Intel\Wireless\Bin\1XConfig.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-06-24 16:51:40 - machine was rebooted

ComboFix-quarantined-files.txt 2010-06-24 15:51

Pre-Run: 2,278,608,896 bytes free

Post-Run: 2,190,667,776 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=7 Default=7 Failed=6 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8

- - End Of File - - 5E669A80D5E3EBEEC1C2E83C6B9D933A

Link to post
Share on other sites

Here's what to do next.

Step 1

De-install BitTorrent and Limewire, and any other peer-to-peer program. Such filesharing/downloading from unknown sources is one of the leading causes of transmission of malware.

File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

P2P file sharing: Know the risks

Step 2

javaicon.gif

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

  • Download the latest version of Windows 7/XP/Vista/2000/2003/2008 Offline and save it to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, select Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586-s.exe to install the newest version.

  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup) javaicon.gif
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
        Trace and Log Files

      [*]Click OK on Delete Temporary Files Window

      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

      [*]Click OK to leave the Temporary Files Window

Small tweaks for Java runtime, since most all users do not need to load Java at each Windows startup:

Click Advanced Tab. Expand the Miscellaneous item.

UN-check the line Java quick starter

If you want to also un-check the "Check for updates automatically" you may:

Click the Update tab. un-check the line if it is checked.

Press Apply then OK. Close the applet when done.

To test your Java Run-time, you may go to this page http://www.java.com/en/download/help/testvm.xml

When all is well, you should see Java Version: Java 6 Update 20 from Sun Microsystems Inc.

Step 3

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Scan the system with the Kaspersky Online Scanner

http://www.kaspersky.com/kos/eng/partner/d...kavwebscan.html

icon_arrow.gifAttention: Kaspersky Online Scanner 7.0 may not run successfully while another antivirus program is running. If you have Anti-Virus software installed, please temporarily disable your AV protection before running the Kaspersky Online Scanner. Reenable it after the scan is finished.

During this run, make sure your browser does not block popup windows. Have patience while some screens populate.

Read the Information block presented on the screen, and then press the Accept button.

1) Accept the agreement

2) The necessary files will be downloaded and installed. Please have plenty of patience.

3) After Kaspersky AntiVirus Database is updated, look at the Scan box.

4) Click the My Computer line

5 ) Be infinetely patient, the scan is comprehensive and, unlike other online antivirus scanners, will detect all malwares

6) When the scan is completed there will be an option to Save report as a .txt file. Click that button. Copy and paste the report into your reply.

( To see an animated tutorial-how-to on the scan, see >>this link<<)

Re-enable your antivirus program after Kaspersky has finished.

Kapersky Online Scanner can be uninstalled later on from Add or Remove Programs in the Control Panel, if desired.

Do not be alarmed if Kaspersky tags items that are already in quarantine by MBAM, or ComboFix's Qoobox & quarantine.

Kaspersky is a report only and does not remove files.

Step 4

Next, a new run of OTL

Locate the OTL.exe on your Destop

Double-click OTL.exe otlDesktopIcon.png to start it.

Look at the upper left of window. Press the pink color Quick Scan button.

Have patience while it runs.

It will produce a new log. Save it.

Post back with copies of the Kaspersky.txt report and

the new OTL.txt

There will be more to do after this.

Edited by Maurice Naggar
Link to post
Share on other sites

Sorry for the late reply, the Kaspersky scan took FOREVER! All the steps were completed without any problem. Here's the two reports

Kaspersky report:

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Sunday, June 27, 2010

Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Saturday, June 26, 2010 11:16:51

Records in database: 4292034

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

C:\

D:\

E:\

Scan statistics:

Objects scanned: 245747

Threats found: 4

Infected objects found: 56

Suspicious objects found: 0

Scan duration: 09:15:41

File name / Threat / Threats count

C:\Documents and Settings\Mandeep\Desktop\daemon409-x86.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\mouclass.sys.vir Infected: Rootkit.Win32.TDSS.ap 1

C:\WINDOWS\system32\1025c.sys Infected: Packed.Win32.Krap.ao 29

C:\WINDOWS\system32\1025c.sys Infected: Trojan-Spy.Win32.Zbot.akle 25

Selected area has been scanned.

OTL.txt report:

OTL logfile created on: 27/06/2010 02:33:34 - Run 3

OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Mandeep\Desktop\Malware Removers

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,015.00 Mb Total Physical Memory | 523.00 Mb Available Physical Memory | 52.00% Memory free

2.00 Gb Paging File | 1.00 Gb Available in Paging File | 62.00% Paging File free

Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 52.68 Gb Total Space | 0.88 Gb Free Space | 1.67% Space Free | Partition Type: NTFS

Drive D: | 18.61 Gb Total Space | 3.72 Gb Free Space | 20.01% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: MANDEEP

Current User Name: Mandeep

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/06/26 16:27:43 | 000,139,264 | ---- | M] (Kaspersky Lab.) -- C:\Documents and Settings\Mandeep\Local Settings\temp\jkos-Mandeep\binaries\ScanningProcess.exe

PRC - [2010/06/26 02:28:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\java.exe

PRC - [2010/06/19 19:26:35 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Mandeep\Desktop\Malware Removers\OTL.com

PRC - [2010/06/03 01:50:58 | 001,144,104 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe

PRC - [2009/11/12 17:31:00 | 000,782,336 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe

PRC - [2009/11/12 17:30:59 | 001,638,240 | ---- | M] (BitDefender S. R. L.) -- C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

PRC - [2009/10/08 15:47:09 | 000,413,696 | ---- | M] (BitDefender SRL) -- C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

PRC - [2008/04/14 01:12:36 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\snmp.exe

PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/02/19 19:58:30 | 000,083,504 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe

PRC - [2006/09/15 11:03:40 | 000,822,424 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

PRC - [2006/06/29 12:12:34 | 000,376,832 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe

PRC - [2005/12/07 16:05:34 | 002,066,072 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe

PRC - [2005/12/07 16:05:12 | 000,053,248 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe

PRC - [2004/12/13 15:30:10 | 000,165,488 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PRC - [2004/12/13 15:30:04 | 000,198,256 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PRC - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel

Link to post
Share on other sites

You will want to print out or copy these instructions to Notepad for offline reference!

eusa_hand.gifIf you are a casual viewer, do NOT try this on your system!

If you are not cowdenbeath and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

icon_arrow.gif Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Step 1

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

A new run of The Avenger to remove one driver noted by Kaspersky and also to delete the BitTorrent folder

  • Double click on avenger.exe to start The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Drivers to disable:
    1025c

    Drivers to delete:
    1025c

    Files to delete:
    C:\WINDOWS\system32\1025c.sys

    Folders to delete:
    C:\Documents and Settings\Mandeep\Application Data\BitTorrent

    Registry keys to delete:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}

    Folders to delete:
    C:\recycler
    D:\recycler
    e:\recycler
    f:\recycler
    g:\recycler
    h:\recycler


  • In the avenger window, click the Paste Script from Clipboard icon, pastets4.png button.
  • ! Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.

If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.

and then reboot the system again.

Step 2

Download TFC by OldTimer to your desktop

  • Please double-click TFC.exe to run it. (Note: If you are running on Vista or Windows 7, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  • IF prompted to Reboot, reply "Yes".

Step 3

Start your MBAM MalwareBytes' Anti-Malware.

Click the Settings Tab and then the General Settings sub-tab. Make sure all option lines have a checkmark.

Then click the Scanner sub-tab. Make sure all option lines have a checkmark.

Next, Click the Update tab. Press the "Check for Updates" button.

When done, click the Scanner tab.

Do a FULL Scan.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Step 4

Use your browser to go here at Virustotal website

Click the Browse button and then navigate to C:\Documents and Settings\Mandeep\Desktop\daemon409-x86.exe, then click the Submit button.

The various virus scanners will identify the file and if it is not identified, the AV vendors will then have a copy of it for analysis. Save the results, and post back here in a reply.

Step 5

RE-Enable your AntiVirus and AntiSpyware applications.

Reply with copy of C:\Avenger.txt

MBAM scan log

the VirusTotal report

and tell me, How is your system now ?

Link to post
Share on other sites

I ran avenger twice, the first time I couldn't find the log file at it's location. Here's the link to the Virus Total report:

http://www.virustotal.com/analisis/3131764...7b3a-1273558760

The system is running smoothly I guess. I have very little free Hard drive space so its kinda hard to judge if it's responsive or not, but it's at least as responsive as it was before I had the problems.

avenger.txt report:

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

Error: could not open driver "1025c"

Disablement of driver "1025c" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\1025c" not found!

Deletion of driver "1025c" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: file "C:\WINDOWS\system32\1025c.sys" not found!

Deletion of file "C:\WINDOWS\system32\1025c.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: folder "C:\Documents and Settings\Mandeep\Application Data\BitTorrent" not found!

Deletion of folder "C:\Documents and Settings\Mandeep\Application Data\BitTorrent" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Folder "C:\recycler" deleted successfully.

Folder "D:\recycler" deleted successfully.

Error: could not open folder "e:\recycler"

Deletion of folder "e:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "f:\recycler"

Deletion of folder "f:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "g:\recycler"

Deletion of folder "g:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "h:\recycler"

Deletion of folder "h:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

mbam log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4247

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

28/06/2010 13:22:33

mbam-log-2010-06-28 (13-22-33).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 362282

Time elapsed: 2 hour(s), 56 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Qoobox\Quarantine\C\WINDOWS\system32\algo.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP11\A0012212.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5\A0006907.exe (Trojan.Zapchast) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5\A0006910.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5\A0008673.dll (Patched.UxTheme) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP5\A0008800.dll (Patched.UxTheme) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP6\A0009996.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP6\A0010020.exe (Trojan.Zapchast) -> Quarantined and deleted successfully.

Link to post
Share on other sites

Hello cowedenbeath,

My regrets for not getting back to you sooner. We need to apply one tweak into the registry to insure a standard (clean) userinit setting, and then you are good to go after the cleanups.

registry tweak

Using your mouse, Highlight all contents of the Quote box below, including all blank lines. Then press Ctrl+C to copy it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Shell"="Explorer.exe"

"Userinit"="C:\\WINDOWS\\system32\\userinit.exe, "

Next, start Notepad, and click Format. Uncheck Word Wrap (if checked).

Press Ctrl+V to paste the contents of the code box into Notepad.

Click File=>Save as.... Type (including quotation marks): "Winlogon.reg", and save to your desktop.

Exit Notepad.

On your desktop, RIGHT-click Winlogon.reg and select Merge. Agree to the registry merge as prompted.

Cleanups & tools removal

If you have a problem with these steps, or something does not quite work here, do let me know.

Using Control Panel's Add-Remove programs:

De-install Kaspersky Online if present

HijackThis

Exit Control Panel.

The following few steps will remove tools we used; followed by advice on staying safer.

We have to remove Combofix and all its associated folders.

The "/uninstall" in the Run line below is to start Combofix for it's cleanup & removal function.

Note the space before the slash mark.

The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.

  • Click Start, then click Run.
    In the command box that opens, type or copy/paste
    combo-fix /uninstall
    and then click OK.

In any event, proceed forward with the OTL step below, even if Combo-fix does not uninstall. OTL Cleanup will remove the remainders of it and the other tools used as well.

  • Please double-click OTL.com otlDesktopIcon.png to run it.
  • Click on the CleanUp! button at upper Right corner. If you're be asked if you want to Begin cleanup process? Select Yes.
  • This step removes the files, folders, and shortcuts created by the tools I had you download and run.

We are finished here. Best regards.

Link to post
Share on other sites

  • 3 weeks later...
  • Staff

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.