209 replies to this topic

[Gator]

Yes have second computer. Can use flashdrive that is attached to infected unit if you think that is wise. No floppy drive on the infected laptop.

[LDTate]

Yes have second computer. Can use flashdrive that is attached to infected unit if you think that is wise. No floppy drive on the infected laptop.

That should be fine. I feel the infection is gone.

[Gator]

Ok placed flashdrive in non infected computer and ran scan with norton internet security. It found W32.Sality.AE virus. cleaned drive. Copied Shdocvw.dll and tried to copy into the Windows\System32 folder on the infected computer but got the following error. Cannot copy it is being used by another person or program. Tried to run the command given. But got the Windows File Protection dialog box stating that I needed to insert the Windows XP Proffessional Service Pack 3 CD. I do not have such a cd. Service pack 3 was downloaded online. What next ?? Seems we are stopped at every turn.

[LDTate]

Do you have a Windows XP cd. Try that.

[Gator]

All I have is the dell reinstallation cd for windows xp home edition including service pk 2 that came with the desktop unit I have.

[LDTate]

go to the Windows\System32 folder and right click on Shdocvw.dll check to make sure it's not read only, then rename it to Shdocvw.old Now see if you can copy the one you transfered.

[Gator]

Found both a Shdocvw.bak and Shdocvw.dll in the folder. Changed the .dll to .old and then was able to copy the Shdocvw.dll from the flashdrive to the folder

[LDTate]

And please follow these steps:
1. Quit all programs that are running.
2. Click Start, and then click Run.
3. Type regsvr32 Shdocvw.dll (note the space), and then click OK.
4. When you receive the "DllRegisterServer in urlmon.dll succeeded" message, click OK.

Please try opening a page that previously didn't open.

[Gator]

Typed in regsvr32 Shdocvw.dll and clicked ok and got the same file error as before. Went back to the Windows\System32 folder and found the Shdocvw.dll and renamed it againg. Then clicked on refresh at the top and the Shdocvw.dll was regenerated without copying it from the flashdrive. It is being regenerated by whatever junk is on this unit.

[LDTate]

Have you tried Windows updates?

[Gator]

Not since was prompted when setting prompted me that there were updates available.

[LDTate]

Get the updates and see if that helps. I'm about out of ideas.

[Gator]

Ok got 2 updates that were made available since the last update done. Exe files still being generated in the Windows\temp folder. Shdocvw.dll still being replicated in the Windows/System32 folder. Know how you feel I was out of ideas long ago. If I could get this machine to go into safe mode, would try again to restore to an earlier date but don's know if all the programs we have run wiped the earlier restore points out.

[LDTate]

Combofix creates a new restore point when it's run. I'm going to go through what we've done and see if I missed anything.

[LDTate]

I find it interesting that the temp files are listed here under the firewall policy:
Is your firewall working?

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Common Files\\WRAL DESKTOP WEATHER\\TrueWeather.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe"=
"c:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe"=
"c:\\WINDOWS\\system32\\Ati2evxx.exe"=
"c:\\WINDOWS\\system32\\WLTRAY.exe"=
"c:\\Program Files\\Outlook Express\\msimn.exe"=
"c:\\Program Files\\Dell\\QuickSet\\quickset.exe"=
"c:\\Program Files\\Dell Support\\DSAgnt.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe"=
"c:\\Program Files\\Dell Support Center\\bin\\sprtcmd.exe"=
"c:\\WINDOWS\\stsystra.exe"=
"c:\\Program Files\\Trend Micro\\Internet Security 14\\TMAS_OE\\TMAS_OEMon.exe"=
"c:\\WINDOWS\\TEMP\\winveus.exe"=
"c:\\WINDOWS\\TEMP\\winlrgjh.exe"=