Frustrated

Dadcanfixit · April 12, 2011

Hello

The limits of my knowledge have been reached, time to ask an expert. I've spent several days searching online forums for identical symptoms to no avail. Have tried 2 or 3 spyware/malware removers (other than Malwarebytes,the best) twice a registry restore and an EXE fix and still have the same dysfunctions.

This is my daughters computer, about Christmas time it was infected with the security alert virus. I thought at the time the issue was resolved, everything appeared to be working normally after Malwarebytes and Avast scan and removal.

My current issues are:

Cannot open any EXE files in normal mode, first got a rundll.32 application not found error, then all files give me an open with option.

Am running in safe mode at the moment the only way she will work.

Have downloaded current version of Avast but am not able to get it to turn on it will not respond to any action.

Here is the latest Malwarebytes scan and the last one showing infections.

defogger is enabled.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6337

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

4/11/2011 7:48:55 PM

mbam-log-2011-04-11 (19-48-55).txt

Scan type: Full scan (C:\|)

Objects scanned: 211341

Time elapsed: 11 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6226

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

4/6/2011 12:41:15 PM

mbam-log-2011-04-06 (12-41-15).txt

Scan type: Full scan (C:\|)

Objects scanned: 218639

Time elapsed: 17 minute(s), 24 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 6

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jasmine\Local Settings\Application Data\pej.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jasmine\Local Settings\Application Data\pej.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jasmine\Local Settings\Application Data\pej.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\Jasmine\local settings\Temp\0.31644966148573095.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6226

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

4/6/2011 12:41:15 PM

mbam-log-2011-04-06 (12-41-15).txt

Scan type: Full scan (C:\|)

Objects scanned: 218639

Time elapsed: 17 minute(s), 24 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 6

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jasmine\Local Settings\Application Data\pej.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jasmine\Local Settings\Application Data\pej.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jasmine\Local Settings\Application Data\pej.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\Jasmine\local settings\Temp\0.31644966148573095.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

ark.zip

Attach.zip

DDS.zip

screen317 · April 13, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log. Then run DDS again and post DDS.txt directly into your reply instead of attaching it.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Dadcanfixit · April 13, 2011

screen317,

Here are the logs you requested.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6354

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

4/13/2011 5:28:22 PM

mbam-log-2011-04-13 (17-28-22).txt

Scan type: Quick scan

Objects scanned: 168726

Time elapsed: 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_11-03-05.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 7/31/2009 5:28:26 PM

System Uptime: 4/10/2011 9:43:05 AM (80 hours ago)

.

Motherboard: Dell Inc. | | 0G848F

Processor: Intel Pentium III Xeon processor | Microprocessor | 2194/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 59 GiB total, 24.922 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller

Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_02AA1028&REV_13\4&243EA0D2&0&00E2

Manufacturer: Marvell

Name: Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller

PNP Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_02AA1028&REV_13\4&243EA0D2&0&00E2

Service: yukonwxp

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.4.1

Advanced Audio FX Engine

Advanced Video FX Engine

Apple Application Support

Apple Mobile Device Support

Apple Software Update

avast! Free Antivirus

BitTorrent

Bonjour

CA Yahoo! Anti-Spy (remove only)

CCleaner

Compatibility Pack for the 2007 Office system

Critical Update for Windows Media Player 11 (KB959772)

Dell Webcam Central

Dell Wireless WLAN Card Utility

Diskeeper Professional Premier Edition

HiJackThis

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB945060-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

HP Memories Disc

IDT Audio

Integrated Webcam Driver (1.02.01.0320)

Intel® Graphics Media Accelerator Driver

InterActual Player

iTunes

IZArc 3.81

Java Auto Updater

Java 6 Update 23

KODAK Share Button App

Lexmark 2600 Series

Live! Cam Avatar Creator

Malwarebytes' Anti-Malware

Marvell Miniport Driver

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2416447)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox (3.6.16)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 7 Ultra Edition

QuickTime

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972260)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974455)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB976325)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Skype Toolbars

Skype

screen317 · April 15, 2011

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

Dadcanfixit · April 15, 2011

Hello again,

Ran both scans(below), am still getting an open with box for all programs in a normal mode. Still running in safe mode.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6425

# api_version=3.0.2

# EOSSerial=4ec77412a540c34bac381a269cbac565

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-04-15 02:02:11

# local_time=2011-04-14 10:02:11 (-0500, Eastern Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=770 16774142 0 2 0 0 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=47698

# found=6

# cleaned=6

# scan_time=1540

C:\Documents and Settings\Administrator.JASMINEPC\My Documents\Downloads\registrybooster.exe Win32/RegistryBooster application (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Jasmine\Application Data\Sun\Java\Deployment\cache\6.0\37\3e85f8e5-307720e5 a variant of Java/TrojanDownloader.OpenStream.NBF trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\Jasmine\Application Data\Sun\Java\Deployment\cache\6.0\39\bc0fce7-6979253f a variant of Java/TrojanDownloader.OpenStream.NBF trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Program Files\TrendMicro\HiJackThis\backups\backup-20100326-131641-792.dll Win32/Adware.Gamevance application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{9BFB266D-3C7E-4EB3-BF9A-895EDB45256E}\RP1\A0000016.dll Win32/Adware.Gamevance application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Results of screen317's Security Check version 0.99.10

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Enabled!

ESET Online Scanner v3

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 23

Out of date Java installed!

Adobe Flash Player 10.2.152.32

Adobe Reader 9.4.1

Out of date Adobe Reader installed!

Mozilla Firefox (3.6.16) Firefox Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

ESET ESET Online Scanner OnlineCmdLineScanner.exe

``````````End of Log````````````

screen317 · April 16, 2011

Hi,

Is it only with .exe files? If you rename them to .com, does the Open With box still appear?

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
sfcfiles.dll
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Dadcanfixit · April 16, 2011

Hello again,

I was in the middle of responding to your post last night and lost power due to a wicked wind. All is good we are back in business this morning.

Back to your post, I am pretty sure that only .exe files are affected, however I do not know how to change one to .com in order to answer your question. Computer programing from 30+ years ago helps to understand some of the logic involved but it has been a long time and I have forgotten a lot.

Here is the latest log requested, Thanks

SystemLook 04.09.10 by jpshortstuff

Log created at 07:35 on 16/04/2011 by Administrator

Administrator - Elevation successful

========== filefind ==========

Searching for "sfcfiles.dll"

C:\WINDOWS\system32\sfcfiles.dll --a---- 1614848 bytes [20:46 08/05/2008] [20:46 08/05/2008] 9F42478360E9B053A6703DEF39B4CE33

-= EOF =-

Dadcanfixit · April 18, 2011

HI,

I found a tutorial on changing file extensions and was able to change an .exe to a .com and it worked without an open with option. After we have finished removing all the virus', could we resolve this issue as well?

Also, while trying to figure out why I can't get my avast to turn on, I discovered an antivirus.evt in the system. Is this a possible issue that needs to be resolved as well?

I need to get this thing up an running soon, my daughter needs this thing for school work.

Thanks

screen317 · April 20, 2011

Hi,

My apologies for the delay.

Run this .reg file; it should restore .exe functionality:

http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip

After running it, restart your computer and see if .exe files will run.

I discovered an antivirus.evt in the system. Is this a possible issue that needs to be resolved as well?

Where did you find it?

Dadcanfixit · April 20, 2011

Hello Chris(I hope thats ok i'm Art)

It may be time to fire your assistant at this end. Stupid mistakes create more problems.

I downloaded xp_exe_fix.zip and applied, however stupid me did not close Firefox browser and recieved Registry Editor error "cannot import c:\windows\temp\arc39\xp_exe_fix.reg not all data was successfuly written to the regestry. Some keys are open by system or other process".I closed the browser and ran it again, switched over to normal mode to check if repair was successful. It was not. I still recieve an "open with" window.

Now I have created another problem for you to help me repair. Firefox was the .exe file that I renamed to .com and changed back. After applying the exe fix this morning I now recieve the following:

16BIT MS-DOS Subsystem

C:\DOCUME~1\ALLUSE~1\Desktop\MOZILL~1.PIF

Invalid programe file name. Please check your pif file. Chose 'close' to terminate application.

I did a system search for the above file and came up with no result.(could be a hidden file?)

Had to search out internet explorer to reply to you, it is never used, dosen't have a shortcut and isn't even listed in the programs in the start menu.

As for the EVT, I did a search for antivirus in the system and found

Antivirus.evt

C:\WINDOWS\system32\config

modified 7\10\2010 size 128kb

Also found a 1kb dat file in C:\Qoobox\quarantine\Registry_backups, is this anything to be concerned about?

Thanks Art

screen317 · April 22, 2011

Hi Art.

Click Start --> Programs --> Accessories --> Windows Explorer

From there, click Tools --> Folder Options --> File Types

Create a new file type EXE; set its associated file type with Application.

Restart your computer and see if executables will run.

I recommend uninstalling Firefox, grabbing a fresh copy from Mozilla and reinstalling it; see if that solves the issue.

Zip up this file and attach it to your post:

C:\WINDOWS\system32\config\Antivirus.evt

Also found a 1kb dat file in C:\Qoobox\quarantine\Registry_backups, is this anything to be concerned about?

Don't worry about that-- Qoobox is ComboFix's quarantine.

Dadcanfixit · April 22, 2011

Hi Chris,

So here is where we are at.

Twice tried to create EXE (application) file, after generating a new file I assumed the apply tab would engage it didn't. As you can tell from the "twice tried" this procedure was unsuccessful.

New version of Firefox will take some time to get used to, have been resisting the upgrade for a while.

I haven't zipped a file for a long time I hope this is correct.

Thanks Art

Antivirus.zip

screen317 · April 24, 2011

Hi,

Please open Notepad. Copy and paste the following text (starting with @echo off) into the Notepad document.

Navigate to File --> Save As..., and save the file as RegExport.bat (make sure the Save As Type is set to All Files).

Save it to your Desktop.

@echo off
copy C:\Windows\REGEDIT.exe C:\Windows\REGEDIT.com
REGEDIT.com /E "%userprofile%\DESKTOP\EXE.reg" "HKEY_CLASSES_ROOT\exefile"
EXIT

Now navigate to your Desktop, and double click RegExport.bat

A black window will open and close quickly. This is normal.

Now, open Notepad, navigate to your Desktop, and open EXE.reg.

Dadcanfixit · April 24, 2011

OK my friend,

Windows registry editor 5.00 is open in notepad. What is the next step? Do I need to import the text somewhere?

I opened regedit and compared all the text, they were identical.

Awaiting your next set of instructions.

screen317 · April 25, 2011

Copy and paste the contents here so I can look at it please.

Dadcanfixit · April 25, 2011

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile]

@="Application"

"EditFlags"=hex:38,07,00,00

"TileInfo"="prop:FileDescription;Company;FileVersion"

"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]

@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]

"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]

@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]

@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]

@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]

@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]

@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]

@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"

screen317 · April 27, 2011

Hi,

Your case is a new type of infection. Please bear with us as we work on a fix.

With that said, please grab a fresh copy of ComboFix, run it, and post its log.

Dadcanfixit · April 27, 2011

Hello Chris,

After preforming all the prep work to run Combofix, it informed me that Avast was still running. Apparently whatever bugger has taken over this machine had corrupted the fresh download. The user interface showed that nothing was enabled and I had disabled it from the systray, Combofix showed it running so I removed it from the system before continuing. Here is the fresh log you requested.

Thanks Art

ComboFix 11-04-26.03 - Administrator 04/27/2011 8:38.2.1 - x86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3034.2744 [GMT -4:00]

Running from: c:\documents and settings\Administrator.JASMINEPC\My Documents\Downloads\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\regedit.com

.

((((((((((((((((((((((((( Files Created from 2011-03-27 to 2011-04-27 )))))))))))))))))))))))))))))))

.

2011-04-22 00:45 . 2011-03-18 17:53 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-04-22 00:45 . 2011-03-18 17:53 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-04-22 00:45 . 2011-03-18 17:53 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll

2011-04-22 00:45 . 2011-03-18 17:53 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll

2011-04-22 00:45 . 2011-03-18 17:53 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll

2011-04-22 00:45 . 2011-03-18 17:53 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll

2011-04-22 00:45 . 2011-03-18 17:53 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-04-22 00:45 . 2011-03-18 17:53 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll

2011-04-15 01:28 . 2011-04-15 01:28 -------- d-----w- c:\program files\ESET

2011-04-12 18:27 . 2011-04-12 18:27 -------- d-----w- c:\documents and settings\Administrator.JASMINEPC\Local Settings\Application Data\Adobe

2011-04-09 00:51 . 2011-04-09 00:51 -------- d-----w- c:\documents and settings\Administrator.JASMINEPC\Local Settings\Application Data\PackageAware

2011-04-08 15:08 . 2011-04-08 15:08 -------- d-----w- c:\documents and settings\Administrator.JASMINEPC\Application Data\QuickScan

2011-04-08 01:05 . 2011-04-08 01:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2011-04-07 02:46 . 2011-04-27 12:15 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-04-07 02:46 . 2011-04-07 23:52 -------- d-----w- c:\program files\AVAST Software

2011-04-07 02:07 . 2011-04-07 02:07 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2011-04-07 00:38 . 2011-04-07 02:54 -------- d-----w- c:\program files\Free Window Registry Repair

2011-04-07 00:11 . 2011-04-07 00:11 -------- d-sh--w- c:\documents and settings\Administrator.JASMINEPC\PrivacIE

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:53 . 2008-04-14 09:42 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2008-04-14 09:41 186880 ----a-w- c:\windows\system32\encdec.dll

2011-02-06 01:42 . 2011-02-06 01:42 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-02-06 01:42 . 2011-02-06 01:42 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-02-02 07:58 . 2009-07-31 21:23 2067456 ----a-w- c:\windows\system32\mstscax.dll

2008-10-28 17:41 . 2009-12-11 06:39 238896 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll

2008-10-28 17:41 . 2009-12-11 06:39 210320 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll

2008-10-28 17:41 . 2009-12-11 06:39 83248 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll

2008-10-28 17:41 . 2009-12-11 06:39 431512 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll

2008-10-28 17:41 . 2009-12-11 06:39 464176 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll

2008-10-28 17:41 . 2009-12-11 06:39 144688 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll

2008-10-28 17:41 . 2009-12-11 06:39 210224 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll

2008-10-28 17:41 . 2009-12-11 06:39 111920 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll

2008-10-28 17:41 . 2009-12-11 06:39 218416 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll

2008-10-28 17:41 . 2009-12-11 06:39 173360 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll

2011-03-18 17:53 . 2011-04-22 00:45 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

.

[-] 2008-05-08 . 9F42478360E9B053A6703DEF39B4CE33 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((( SnapShot@2011-04-13_22.34.02 )))))))))))))))))))))))))))))))))))))))))

.

- 2006-02-28 12:00 . 2011-04-13 22:31 71462 c:\windows\system32\perfc009.dat

+ 2006-02-28 12:00 . 2011-04-27 12:25 71462 c:\windows\system32\perfc009.dat

+ 2006-02-28 12:00 . 2011-04-27 12:25 441692 c:\windows\system32\perfh009.dat

- 2006-02-28 12:00 . 2011-04-13 22:31 441692 c:\windows\system32\perfh009.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2010-12-20 18:09 191488 ------w- c:\program files\Yontoo Layers Client\YontooIEClient.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-16 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-16 178712]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-16 150040]

"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-18 737280]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

"lxdnmon.exe"="c:\program files\Lexmark 2600 Series\lxdnmon.exe" [2009-05-20 660136]

"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-01-09 405639]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"KodakShareButtonApp"="c:\program files\Kodak\KODAK Share Button App\Listener.exe" [2011-03-07 107008]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"DiskeeperSystray"="c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-06-07 319488]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\WINDOWS\\system32\\lxdncoms.exe"=

"c:\\Program Files\\Lexmark 2600 Series\\lxdnmon.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnpswx.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnjswx.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdntime.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdnwbgw.exe"=

"c:\\Program Files\\Lexmark 2600 Series\\lxdnlscn.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]

S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [11/10/2009 1:00 PM 98984]

S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc --> RUNDLL32.EXE ykx32coinst,serviceStartProc [?]

S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [7/31/2009 5:56 PM 20160]

S3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [7/31/2009 7:07 PM 113024]

S3 AMBFilt;Creative AMB Service;c:\windows\system32\drivers\AMBFilt.sys [7/31/2009 7:07 PM 1656960]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [12/11/2009 3:31 AM 144128]

S3 OA009Afx;Provides a software interface to control audio effects of OA009 camera.;c:\windows\system32\drivers\OA009Afx.sys [6/7/2007 5:00 PM 148056]

S3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\drivers\OA009Ufd.sys [3/6/2009 7:30 AM 133632]

S3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\drivers\OA009Vid.sys [3/19/2009 5:02 PM 271552]

S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys --> c:\windows\system32\Drivers\RTS5121.sys [?]

S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

.

Contents of the 'Scheduled Tasks' folder

.

2011-04-23 c:\windows\Tasks\User_Feed_Synchronization-{668F4B5E-1BF3-4D04-9D35-8596016AA21C}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 09:31]

.

------- Supplementary Scan -------

.

uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe" //mailurl:mailto:no-reply@malwarebytes.org?subject=Error%20on%20the%20forums

FF - ProfilePath - c:\documents and settings\Administrator.JASMINEPC\Application Data\Mozilla\Firefox\Profiles\8o1chhqk.default\

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-04-27 08:41

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1659004503-1284227242-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fa,98,b3,27,88,2e,ae,48,80,9b,a3,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fa,98,b3,27,88,2e,ae,48,80,9b,a3,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(564)

c:\windows\System32\BCMLogon.dll

.

Completion time: 2011-04-27 08:42:18

ComboFix-quarantined-files.txt 2011-04-27 12:42

ComboFix2.txt 2011-04-13 22:35

.

Pre-Run: 29,007,245,312 bytes free

Post-Run: 29,033,926,656 bytes free

.

- - End Of File - - 73BC54C9409F079A8AD1BA716377BD22

screen317 · April 28, 2011

Hi,

Can you boot into Normal Mode? In detail, describe the symptoms you are currently experiencing.

Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.

Next, please open Notepad - don't use any other text editor than notepad or the script will fail.

Copy/paste the text in the box below into Notepad:

MIA::
c:\windows\system32\sfcfiles.dll

Save this as CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new DDS log.

-screen317

Dadcanfixit · April 28, 2011

Hi,

Yes, am able to boot in normal mode, however still having issue with .exe files. Here is what I attempted today.

Opened My Computer>C Drive>view system information and received the following error,

Control Panel

C:\WINDOWS\system32\rundll32.exe

Application not found

Windows security alerts shield is red. Receive an open with window, file: rundll32.exe.

Tried to open Adobe reader with Adobe reader(open with) and got "Adobe reader can't open AcroRd32.exe not a supported file type or a damaged file."

I also tried again to create a new EXE Application file without success. As I'm sure you know, the drop down window allows me 6 options other than straight application.

Have yet to download fresh copy of antivirus, until we resolve the exe issue I can't get it to work anyway.

And finally, having read through several forums, I do not have CD for the XP operating software. I do have access to an old desktop with XP operating system should I need to snatch something off it with a zip drive.

Here are your logs.

ComboFix 11-04-27.03 - Administrator 04/28/2011 7:09.3.1 - x86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3034.2755 [GMT -4:00]

Running from: c:\documents and settings\Administrator.JASMINEPC\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator.JASMINEPC\Desktop\CFScript.txt

.

((((((((((((((((((((((((( Files Created from 2011-03-28 to 2011-04-28 )))))))))))))))))))))))))))))))