[Resolved] Hijack and Mbam logs attached

That would be fantastic! The path is simply "E:\Random Stuff".

OK then,

please do this

Please download OTMoveIt3 by OldTimer.

• Save it to your desktop.
• Please click OTMoveIt3 and then click >> run.
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
E:\Random Stuff

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Let me know if that removes it for you..

OTMoveIt was unable to remove the folder. Here is the log. ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== Folder move failed. E:\Random Stuff scheduled to be moved on reboot. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Max\LOCALS~1\Temp\etilqs_de501gOyAVxuLHHMJOLm scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Max\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\051b6c2c-7dca-46c7-aa0b-3a6b521f610c.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\235dcc97-a036-4295-bd61-8f637c663c6d.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\3ef1f7b8-6c18-496e-a88e-8f230e09d761.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\7760b246-dc54-4004-bf9c-4a22e005e7fd.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\82380291-0f43-4c30-b9f4-ae6f52646d4b.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\894f6cb3-3619-4b44-b164-8dba673400ee.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\89e7575d-7df4-4ccf-8314-0b1459d91fed.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\949788f9-4b14-4d74-9d13-ce7761a4ccb0.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\97557927-3960-4b1b-a8f5-60a0cb352503.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\995310cb-b7cb-4a58-acd8-8db16fe9ced3.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\aa737bea-f6fa-45eb-b72f-606e50b9c57a.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\acf0996d-f30d-4120-b09c-72d56c11cfc0.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\afa38128-215c-429c-bed7-3c6d6bb43ce8.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\dbc63d1d-e2d8-433e-98a6-57254c9335df.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\ede6dd3f-752c-4e26-b555-792fd9ea38bf.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_368.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04192009_203417 Files moved on Reboot… Folder move failed. E:\Random Stuff scheduled to be moved on reboot. File C:\DOCUME~1\Max\LOCALS~1\Temp\etilqs_de501gOyAVxuLHHMJOLm not found! DllUnregisterServer procedure not found in C:\WINDOWS\temp\logishrd\LVPrcInj01.dll C:\WINDOWS\temp\logishrd\LVPrcInj01.dll NOT unregistered. File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. C:\WINDOWS\temp\051b6c2c-7dca-46c7-aa0b-3a6b521f610c.tmp moved successfully. C:\WINDOWS\temp\235dcc97-a036-4295-bd61-8f637c663c6d.tmp moved successfully. C:\WINDOWS\temp\3ef1f7b8-6c18-496e-a88e-8f230e09d761.tmp moved successfully. C:\WINDOWS\temp\7760b246-dc54-4004-bf9c-4a22e005e7fd.tmp moved successfully. C:\WINDOWS\temp\82380291-0f43-4c30-b9f4-ae6f52646d4b.tmp moved successfully. C:\WINDOWS\temp\894f6cb3-3619-4b44-b164-8dba673400ee.tmp moved successfully. C:\WINDOWS\temp\89e7575d-7df4-4ccf-8314-0b1459d91fed.tmp moved successfully. C:\WINDOWS\temp\949788f9-4b14-4d74-9d13-ce7761a4ccb0.tmp moved successfully. C:\WINDOWS\temp\97557927-3960-4b1b-a8f5-60a0cb352503.tmp moved successfully. C:\WINDOWS\temp\995310cb-b7cb-4a58-acd8-8db16fe9ced3.tmp moved successfully. C:\WINDOWS\temp\aa737bea-f6fa-45eb-b72f-606e50b9c57a.tmp moved successfully. C:\WINDOWS\temp\acf0996d-f30d-4120-b09c-72d56c11cfc0.tmp moved successfully. C:\WINDOWS\temp\afa38128-215c-429c-bed7-3c6d6bb43ce8.tmp moved successfully. C:\WINDOWS\temp\dbc63d1d-e2d8-433e-98a6-57254c9335df.tmp moved successfully. C:\WINDOWS\temp\ede6dd3f-752c-4e26-b555-792fd9ea38bf.tmp moved successfully. File C:\WINDOWS\temp\Perflib_Perfdata_368.dat not found! C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\urlclassifier3.sqlite moved successfully. C:\Documents and Settings\Max\Local Settings\Application Data\Mozilla\Firefox\Profiles\2zzobral.default\XUL.mfl moved successfully. I got the same message from Windows to use the Chkdsk utility after the reboot.

Hmmm

I'm curious about that now…

lets see if we can get a look at it ….

please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :Dir
   E:\Random Stuff  /s

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (14.04.09) Log created at 21:31 on 19/04/2009 by Max (Administrator - Elevation successful) ========== Dir ========== E:\Random Stuff - Parameters: "/s" —Files— None found. No folders found. -=End Of File=- It seemed strange to me that it couldn't even find the folder I'm referring to; I went back for a closer inspection. This folder used to have at least 6 GB of material in it, but now when I look at the folder properties, it says the folder is completely empty. But as I said before, everything else on that hard drive is functioning normally.

Try to delete that folder in safemode?

Attempting to delete it using normal methods didn't work…should I try and use OTMove it in safe mode?

No…lets bring out the big gun:

1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All…"
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained inside the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:

Folders to delete:
E:\Random Stuff

Note: the above code was created specifically for this user.  If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions.  This log file will be located at  C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not open folder "E:\Random Stuff"
Deletion of folder "E:\Random Stuff" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
–> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.

As the scan suggests, the folder is still there. Should I consider getting a new external hard drive and transferring my "good" files to that?

Something must be 'off' with that external hard drive for sure. I have never heard of Avenger not being able to delete a folder.

I am not 'techie' enough (I just stick with malware removal) to be able to test it for you to know what is wrong with it, but we have some excellent expert tech gurus in our tech forums. you may with to start a new topic, link back to this one to see what has taken place, just to see what is going on with that external drive.

post in this forum HERE

Run this tools cleaner program again to clean up Avenger - it's not desirable to have on your system


Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

• Click the Pt. Restauration button and press OK to the prompts.
• Click the Corbeille button and press OK to the prompt.
• Click the Fichiers temp button and press OK to the prompt.
• Click the Recherche button and let it run ( it may look like it freezes but let it continue )
• Once it is done click the Suppression button and let it remove anything it finds.
• Close the program

Will do - thanks again for all the help!

You are more than welcome stay safe CB

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.