What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] what happened? (failtechie)

51 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,
my sister (failtechie) had previously started a topic (http://forums.whatthetech.com/Computer_s_mega_virused_t104199.html&hl;=mega+viruses) and I was told to fix the computer. After following the instructions given everything went well. The computer loaded at a moderate speed and there were no more popups, however after turning the computer off I was unable to get back on. The computer had created an account and a password of some sort without me knowing (There were no accounts on the computer previously) If I try logging in without a password it says "unable to log you on because of an account restriction". Please help

I had ran Combofix a few hours before turning the computer off. Did I do something wrong so that it created an account? Here is log I had from Combofix.
ComboFix 09-06-22.0E - HP_Owner 23/06/2009 17:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.511.262 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: COMODO Firewall Pro *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Norton Internet Worm Protection *enabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\twain32
C:\Autorun.inf
c:\windows\azukatikun.dll
c:\windows\Hquhofajah.dll
c:\windows\ld01.exe
c:\windows\svcho.exe
c:\windows\syssvc.exe
c:\windows\system32\aereajfm.dll
c:\windows\system32\amlskyoc.dll
c:\windows\system32\avljxegh.dll
c:\windows\system32\bckwfukc.dll
c:\windows\system32\bnaiqtjn.dll
c:\windows\system32\brwbmvdq.dll
c:\windows\system32\buxfsliw.dll
c:\windows\system32\chveyevy.dll
c:\windows\system32\cimdja.dll
c:\windows\system32\coykslma.ini
c:\windows\system32\ctevhrtm.dll
c:\windows\system32\cwkrhdee.ini
c:\windows\system32\dmrfsevm.dll
c:\windows\system32\dpcybytt.ini
c:\windows\system32\dqgwzt.dll
c:\windows\system32\drivers\UACd.sys
c:\windows\system32\eedhrkwc.dll
c:\windows\system32\enctrhry.dll
c:\windows\system32\enydnfai.dll
c:\windows\system32\eqavjbvo.dll
c:\windows\system32\espbjsvx.ini
c:\windows\system32\fbeaqofy.ini
c:\windows\system32\fgibtnqp.dll
c:\windows\system32\flpjekga.dll
c:\windows\system32\fsivjyyb.dll
c:\windows\system32\ftansiup.ini
c:\windows\system32\fugnsxim.ini
c:\windows\system32\fysfmkxp.dll
c:\windows\system32\gdkbupgs.dll
c:\windows\system32\gkknjfgm.ini
c:\windows\system32\grebla.dll
c:\windows\system32\hgexjlva.ini
c:\windows\system32\hs3i7jdgfd.dll
c:\windows\system32\htcxqdot.dll
c:\windows\system32\hufmhz.dll
c:\windows\system32\hulgamtp.dll
c:\windows\system32\huwsepqx.dll
c:\windows\system32\iaplqqer.ini
c:\windows\system32\iguhfh.dll
c:\windows\system32\imprdqux.dll
c:\windows\system32\itnhjeoy.dll
c:\windows\system32\iuwcfx.dll
c:\windows\System32\jjagcy.dll
c:\windows\system32\jrftennt.dll
c:\windows\system32\kccmff.dll
c:\windows\system32\krbqtigm.ini
c:\windows\system32\kyfekvol.dll
c:\windows\system32\ldxyjvfo.ini
c:\windows\system32\ltuniflr.ini
c:\windows\system32\lvfwkvsb.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\meamhhho.dll
c:\windows\system32\mfjaerea.ini
c:\windows\system32\mgfjnkkg.dll
c:\windows\system32\mgitqbrk.dll
c:\windows\system32\mixsnguf.dll
c:\windows\system32\mqvdtmds.ini
c:\windows\system32\mrgvmlgr.dll
c:\windows\system32\mstssbvp.ini
c:\windows\system32\mtrhvetc.ini
c:\windows\system32\mukruhwu.dll
c:\windows\system32\muwcepgn.dll
c:\windows\system32\nfr.assembly
c:\windows\system32\nfr.gpref
c:\windows\system32\ngpecwum.ini
c:\windows\system32\njtqianb.ini
c:\windows\system32\nsluwkod.dll
c:\windows\system32\nykeegcx.ini
c:\windows\system32\oaxborre.dll
c:\windows\system32\ofvjyxdl.dll
c:\windows\system32\orjelleg.dll
c:\windows\system32\ovbjvaqe.ini
c:\windows\system32\pjynqswq.dll
c:\windows\system32\puisnatf.dll
c:\windows\system32\pvbsstsm.dll
c:\windows\system32\qdvmbwrb.ini
c:\windows\system32\qifzhn.dll
c:\windows\system32\qrfhylkt.dll
c:\windows\system32\qtssvmts.ini
c:\windows\system32\qwsqnyjp.ini
c:\windows\system32\qxyudf.dll
c:\windows\system32\reqqlpai.dll
c:\windows\system32\rfkxuo.dll
c:\windows\system32\rglmvgrm.ini
c:\windows\system32\rlfinutl.dll
c:\windows\system32\rtqllumv.ini
c:\windows\system32\sdmtdvqm.dll
c:\windows\system32\seneka.dat
c:\windows\system32\senekadf.dat
c:\windows\system32\senekalog.dat
c:\windows\system32\stmvsstq.dll
c:\windows\system32\svoicvxm.dll
c:\windows\system32\tmhtkxhw.ini
c:\windows\system32\tnnetfrj.ini
c:\windows\system32\todqxcth.ini
c:\windows\system32\tphjhj.dll
c:\windows\system32\ttybycpd.dll
c:\windows\system32\uksudlvj.dll
c:\windows\system32\usmrgdej.dll
c:\windows\system32\vadumz.dll
c:\windows\system32\vgkiwisr.dll
c:\windows\system32\vmullqtr.dll
c:\windows\system32\whxkthmt.dll
c:\windows\system32\wtaydcpl.dll
c:\windows\system32\wukuraqx.ini
c:\windows\system32\xcgeekyn.dll
c:\windows\system32\xqarukuw.dll
c:\windows\system32\xvsjbpse.dll
c:\windows\system32\yaycseuv.dll
c:\windows\system32\yfoqaebf.dll
c:\windows\system32\yoejhnti.ini
c:\windows\system32\yrhrtcne.ini
c:\windows\system32\yzussd.dll
c:\windows\ubokojot.dll
D:\Autorun.inf
D:\Desktop.ini

—– BITS: Possible infected sites —–

hxxp://b9n.org
c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\userinit.exe . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_IPRIP


((((((((((((((((((((((((( Files Created from 2009-05-23 to 2009-06-23 )))))))))))))))))))))))))))))))
.

2009-05-30 14:20 . 2009-05-30 14:20 ——– d—–w- c:\windows\WinRAR
2009-05-30 12:25 . 2009-05-30 12:25 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-21 16:58 . 2008-12-20 10:47 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\AdobeUM
2009-06-05 21:39 . 2008-12-20 09:11 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\.ABC
2009-05-19 18:35 . 2009-05-19 18:35 ——– d—–w- c:\program files\Trend Micro
2009-04-09 20:32 . 2009-04-09 20:32 87056 —-a-w- c:\windows\system32\drivers\cmdguard.sys
2009-04-09 20:32 . 2009-04-09 20:32 79760 —-a-w- c:\windows\system32\drivers\inspect.sys
2009-04-09 20:32 . 2009-04-09 20:32 24208 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2009-04-09 20:32 . 2009-04-09 20:32 143104 —-a-w- c:\windows\system32\guard32.dll
.

——- Sigcheck ——-

[-] 2009-03-05 07:45 8704 EAB8C03DC9A5396FC30A3C848B3B6126 c:\windows\system32\userinit.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2005-01-01 32881]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2008-12-18 26112]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HostManager"="c:\program files\Common Files\AOL\1229762181\ee\AOLSoftware.exe" [2006-09-26 50736]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-04-09 1655552]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-09 344064]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2007-12-07 71008]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-07-29 77824]
"SiSPower"="SiSPower.dll" - c:\windows\system32\SiSPower.dll [2004-09-24 49152]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-07-29 2551808]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]

c:\documents and settings\HP_Owner\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AOL 9.0 Tray Icon.lnk - c:\program files\AOL 9.0\aoltray.exe [2008-12-19 156784]
AOL Companion.lnk - c:\program files\AOL Companion\companion.exe [2008-12-19 250992]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-29 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"userinit"="c:\windows\explorer.exe,"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\1229762181\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ABC\\abc.exe"=
"c:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"7070:TCP"= 7070:TCP:nfr

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [09/04/2009 21:32 87056]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [09/04/2009 21:32 24208]
R3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [01/01/2005 10:48 24544]
S0 pggrkatg;pggrkatg;c:\windows\system32\drivers\rrwpczyg.sys []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
- - - - ORPHANS REMOVED - - - -

BHO-{001B00AE-7860-4251-AB09-F5084B6016EC} - (no file)
BHO-{051C4D78-98FA-4B6D-ADF3-79904CC8B7AF} - (no file)
BHO-{09EABA3C-397E-4F2C-8840-5AD3D8BDDFDB} - (no file)
BHO-{0C8A0741-B54F-4CFA-85F8-494662FE8E41} - (no file)
BHO-{0EDF10DE-12F8-44B7-83F4-E2AFEEDC0183} - (no file)
BHO-{1CE272AD-E408-451E-A08B-B0048D907B33} - (no file)
BHO-{1E1949F7-B16A-47EA-85B2-A89939417F61} - (no file)
BHO-{1EF042BE-1F1F-44AC-B301-E6E794691394} - (no file)
BHO-{1F0DB968-B499-4C0F-84A7-A5D30660E822} - (no file)
BHO-{216187C0-423C-4123-908E-7246D86886A0} - (no file)
BHO-{216D8D75-DEE0-499F-8F87-DDE12FE03DF8} - (no file)
BHO-{27BD3C51-BC2E-49E0-9C6B-F0D0D010CE80} - (no file)
BHO-{2FC7A6B7-EFAA-4AFC-989D-02310398F83A} - (no file)
BHO-{303B270C-AA0A-4DE6-91A7-FD452C9631DC} - (no file)
BHO-{3081BC85-2BB3-4238-BB8E-0D5F930892C3} - (no file)
BHO-{33A4125A-0E9E-4959-B46E-A34689E8DD73} - (no file)
BHO-{340DA371-C36E-4C98-85B4-3A29C3A5A0F9} - (no file)
BHO-{350A958B-8897-4FA6-BA8E-C0202CD3F30E} - (no file)
BHO-{35A71AF0-50BA-4074-93E6-6F097384689F} - (no file)
BHO-{36B0CE3B-2389-48E4-92E4-00ED8579DC74} - (no file)
BHO-{3B31C0ED-586A-408E-9CF3-D12DCD23376E} - (no file)
BHO-{40167E6E-9DF0-423B-9094-9578D043C432} - (no file)
BHO-{444B7843-A646-4525-A5E7-6F4CD7CE0628} - (no file)
BHO-{46AAF4BD-32DD-4E49-91B8-33B70119D9AC} - (no file)
BHO-{46CB60B7-610C-4A58-9E1A-32B16F37B211} - (no file)
BHO-{511512CB-CFAC-49E0-BD1D-F5DF656A1C8A} - (no file)
BHO-{538DF27D-F49D-40B1-9644-A696C2071B78} - (no file)
BHO-{5817FDBD-3462-4B7B-9E8A-7842189010BE} - (no file)
BHO-{633808CA-C1BE-4EA7-9279-1C8282BF07FF} - (no file)
BHO-{67520427-1A9C-44CE-A679-BAC8122D8746} - (no file)
BHO-{690E9E38-8FDB-48C7-8CD1-534E73F2666B} - (no file)
BHO-{69432058-704F-4E6E-B1A4-493C1F3723F3} - c:\windows\system32\mlJArsRK.dll
BHO-{6EF9FD7C-C8B9-4F63-9271-26015961B294} - (no file)
BHO-{74ED29C2-3B04-491F-B00E-3B1383159E91} - (no file)
BHO-{75E0D66C-5620-4BCF-9962-AA78188164EC} - (no file)
BHO-{765402F7-A14D-4279-88A8-EE51096F18D3} - (no file)
BHO-{7A1F6839-AA47-4EF9-A879-E83E6AABB99A} - (no file)
BHO-{7A4C7266-E6EF-4361-8A86-696BD89C7239} - (no file)
BHO-{81125015-08af-4a04-9512-f21ec33a1f93} - c:\windows\system32\yzussd.dll
BHO-{841FDACB-8EC2-4512-A9A7-51E090448A11} - (no file)
BHO-{882F2FE5-61B3-4765-845A-485582732E33} - (no file)
BHO-{887A2277-9875-4300-90B0-E56D56791EC3} - (no file)
BHO-{8EDC0272-3960-41BC-91BF-1E3B32615FF0} - (no file)
BHO-{90BE6A4A-895D-46D4-9051-6EE6465390DC} - (no file)
BHO-{9731BF4D-69EA-46F8-9F1E-8AAEA2EDB36E} - (no file)
BHO-{979C9B28-D9DD-45D2-A910-642990B3DACD} - (no file)
BHO-{9C2F459E-AA22-4CD2-B56D-E3D8878117A5} - (no file)
BHO-{9DA61E8E-66C6-4576-8B9D-DCB3EAAF13C2} - (no file)
BHO-{A0584506-0BC5-4623-8702-83E1EB3934D9} - (no file)
BHO-{A0A17DFB-BD47-4618-B187-1A0E1B799EA9} - (no file)
BHO-{A19120DB-8D7D-4BF2-A126-6C58DEEB04AD} - (no file)
BHO-{A230C57E-46FE-4278-88DC-FFC3F296F16C} - (no file)
BHO-{A3081139-B6D2-4DF3-B460-7DC729729457} - (no file)
BHO-{A377CB11-8F15-4DAE-BB3E-ABBD65B1002D} - (no file)
BHO-{A5C775ED-DFA0-417F-A84D-1850A3484F9E} - (no file)
BHO-{A7788911-F6E2-42A1-BEEC-739001DDC8FD} - (no file)
BHO-{A9F1B5BD-99CB-4280-AD15-F59808DE8FAF} - (no file)
BHO-{AC10C684-C169-469F-8F8E-D057CD5FD0B9} - (no file)
BHO-{AF912E8A-CA9E-4A9F-AA86-190C6AE9CFDE} - (no file)
BHO-{B1387124-3580-4FC6-B866-3090489DEE59} - (no file)
BHO-{B23E8909-C3F4-43F7-833A-9403598D6066} - (no file)
BHO-{B309E0DF-A0FB-4391-8DD4-AF1F901AB0C3} - (no file)
BHO-{B324C745-5811-40DF-962D-4BBCE6031155} - (no file)
BHO-{B4672FFB-E4C6-40E2-9013-F8EDAB6F3B89} - (no file)
BHO-{B4AA5C1C-31B4-472C-8B69-1415FC0F9AA4} - (no file)
BHO-{B7F1CA51-A658-4824-8034-538C96E86BE8} - (no file)
BHO-{BB4531ED-E666-4F13-B0D1-BFFAB935B300} - (no file)
BHO-{C85B854A-A280-4B4C-8D36-2D8E3B83F591} - (no file)
BHO-{CF2038DD-3204-4FD1-9AD1-C2B532E42779} - (no file)
BHO-{D1AAECDA-9484-4226-B7E3-B2D718B3D076} - (no file)
BHO-{D32943BD-A447-45DC-9F0A-27FF4E826B30} - (no file)
BHO-{D701BC89-4050-49FC-A78B-933E976411BC} - (no file)
BHO-{D9C33BF9-5318-4B94-9DBC-B6F1F3BB585E} - (no file)
BHO-{DAB439E3-70F7-492A-9E1A-D3612E066DB5} - (no file)
BHO-{DB135C85-892F-44FF-B5BC-25F3CE421C85} - (no file)
BHO-{DBD21D7E-DCD3-477B-B6A7-06123403BC48} - (no file)
BHO-{DDAF548A-4E81-4FF6-A5C7-BF5CA6721465} - (no file)
BHO-{DFA0C81E-4192-4B00-8541-01D024C20998} - (no file)
BHO-{E0E5477E-5B2E-4566-A967-52A27FF39768} - (no file)
BHO-{E21D36C8-AC9B-4A98-8084-8E71BB61B123} - (no file)
BHO-{E5DC1D5C-BC91-459A-85B3-97F481B05B5A} - (no file)
BHO-{EAFAFB62-C6FF-4B95-A0C0-756A17327F48} - (no file)
BHO-{F1A449AC-5AC7-4B4D-BD32-DCCB6BE57F89} - (no file)
BHO-{FF715C15-D67C-4CC2-A66D-69426256129F} - (no file)
HKLM-Run-Ddoga - c:\windows\azukatikun.dll
HKLM-Run-a0fa9d1c - c:\windows\system32\smooroaa.dll
HKLM-Run-VTTimer - VTTimer.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_GB&c;=Q105&bd;=pavilion&pf;=desktop
uInternet Connection Wizard,ShellNext = hxxp://www.bt.net/digitaldemo
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-23 18:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\windows\system32\drivers\rrwpczyg.sys 25088 bytes executable
c:\docume~1\HP_Owner\LOCALS~1\Temp\RGI9.tmp 7075 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2508)
c:\program files\Common Files\AOL\ACS\WLHook.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\COMODO\Firewall\cmdagent.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\wscntfy.exe
c:\program files\AOL 9.0\waol.exe
c:\program files\Common Files\AOL\1229762181\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe
c:\program files\AOL 9.0\shellmon.exe
c:\program files\Common Files\AOL\aoltpspd.exe
.
**************************************************************************
.
Completion time: 2009-06-23 18:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-23 17:08

Pre-Run: 135,492,616,192 bytes free
Post-Run: 135,430,344,704 bytes free

368
Please help,
Jun
Post #3
Hi, I'm really sorry about this making another topic, but my sister hasnt told me the password for her account and I couldnt post in the thread made previously. (She hasnt told me the password to her email, so I cant ask what the tech to send it to her email address) I got Windows into safe mode but I still cant get in, although there is another account called "Administrator" (the other one is called "HP_Owner") however, I doubt if this information is of any use. I dont think I have an XP CD, would I need to purchase this to fix the computer? thank you for your help, Jun
Post #4
Hi Jun23, Ok, we will continue in this thread. In safe mode, are both accounts asking for a password? Don't do anything to computer.
Post #6
Hi Jun23, Thanks, there goes that idea. Let me check with some other folks to see if there is another way. I'll be back asap. Thanks
Post #8
Hi Jun23,

We have a couple of options to try. We'll try this one first and if you are able to get into windows do not change anything, just post back.

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the option, Last Known Good Configuration , then press "Enter".
  • The computer should start to load Windows
Did you get in?

Let me know how you made out.
Post #9
Hi Jun23,

If the previous solution didnt work, try this.

Unless you are able to access the infected computer and view these instructions on the computer you are currently using, please print out these instructions for reference.

Please read through the instructions before proceding. Don't hesitate to askany questions if you are not clear on something.

1. Restart your computer
2. Before Windows loads, you will be prompted to choose which Operating System to start
3. Use the up and down arrow key to select Microsoft Windows Recovery Console
4. You must enter which Windows installation to log onto. Type 1 and press enter.
5. At the C:\Windows prompt, type the following bolded text, and press Enter:

cd erdnt\subs

6. At the next prompt, type the following bolded text, and press Enter:

batch erdnt.con

7. The erunt backups will begin copying.
8. At the next prompt, type the following bolded text, and press Enter:

exit

Windows will now begin loading.

extra notes: please note that when typing in the commands, there are spaces in the commands, these need to be there.

They are between cd and erunt
and between batch and erunt

If you have a questions or problems, let me know.

We will need to make a copy of a file from your computer to transfer to the infected one. Do you have a CD burner or a flash drive we can use?

Thanks
Post #10
Hi, sorry I havent replied, I didnt have the internet for a while.. but I got in with the first option! Thank you for your help!! Thank you! :notworthy:
Post #11
Hi Jun21,

Good.

We will need to make a copy of a file from your computer to transfer to the infected one. Do you have a CD burner or a flash drive we can use?

Please answer the question.

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post

Please post both logs.

Thanks
Post #13
Hi Jun23,

We will need to copy a file from your computer to the infected one. I'll get you to make the copy then we'll look at a registry key on the infected computer.

On the good machine you will be copying from, put in a Cd

Click your start button and double click on "MY Computer"
  • Double click on Local disk (C:)
  • Scroll down to the Windows folder and double click it
  • Scroll down to the System32 folder and click on it
  • Locate userinit.exe and click on it
  • In the left hand panel in the Files and Folders Task section, click Copy this file
  • The Copy Items box will pop up, click on the drive where you want to copy the file to and click the copy button

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield
  • Do not copy the word CODE , please note the script starts with the :
    :reg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


Please post back with SystemLook log and let me know if you where able to make the copy.

Thanks
Post #14
Hi, I've made the copy. SystemLook v1.0 by jpshortstuff (22.05.09) Log created at 20:47 on 27/06/2009 by Gwendarlin (Administrator - Elevation successful) ========== reg ========== [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "AutoRestartShell"= 0x0000000001 (1) "Background"="0 0 0" "cachedlogonscount"="10" "DebugServerCommand"="no" "DisableCAD"= 0x0000000001 (1) "forceunlocklogon"= 0000000000 (0) "LegalNoticeCaption"="" "LegalNoticeText"="" "passwordexpirywarning"= 0x000000000e (14) "PowerdownAfterShutdown"="0" "ReportBootOk"="1" "scremoveoption"="0" "Shell"="explorer.exe" "ShutdownFlags"= 0x000000002b (43) "ShutdownWithoutLogon"="0" "Userinit"="C:\Windows\system32\userinit.exe," "VmApplet"="rundll32 shell32,Control_RunDLL "sysdm.cpl"" "WinStationsDisabled"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\AutoLogonChecked] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\GPExtensions] -=End Of File=-
Post #15 last edited
Hi Jun23,

Good job. We will transfer that file over and if you encounter no problems we will use combofix again.

Please read these instructions through before starting so you are familar with what to expect.

Transfer the CD or to the infected computer.

Click your start button and double click on "MY Computer"
  • Double click on Local disk (C:)
  • Scroll down to the Windows folder and double click it
  • Scroll down to the System32 folder and click on it
  • Locate userinit.exe and click on it
  • In the left hand panel in the Files and Folders Task section, click Rename this file
  • The filename will now be highlighted
  • On your keyboard, type userinit.old
  • Left click near the name and ensure that the rename took place
If all went well, please continue with the rest of these instruction.

If you were unable to rename the file , STOP and post back for further instructions.

Use the Back button to go back to the page that lists the drives.
  • Double click on the drive that contains the file you copied
  • Locate userinit.exe and click on it
  • In the left hand panel in the Files and Folders Task section, click Copy this file
  • The Copy Items box will pop up,
  • Navigate to the System32 folder by clicking the + sign beside Local Disk (C:) and Windows
  • Scroll down to the System32 folder, click on it and click the copy button

Confirm userinit.exe is in the system32 folder
  • Click the Back button
  • Double click on Local disk (C:)
  • Scroll down to the Windows folder and double click it
  • Scroll down to the System32 folder and click on it
Locate the file and if it is present, you can close that window and please continue. If not let me know.



Please disable this program and leave it disabled unil we are done.

SPYBOT TEATIMER
  • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
  • On the left hand side, click on Tools, then click on the Resident Icon in the list.
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • Click on the "System Startup" icon in the List
  • Uncheck the "TeaTimer" box and "OK" any prompts.
  • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
  • Exit Spybot S&D when done.
  • (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

Next

Open hijackthis, do a system scan only and checkmark these lines, if present

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7070
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;


Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.

Next

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Locate combofix.exe on your desktop, it has a icon that looks like a cat.
  • Double click on ComboFix.exe & follow the prompts. Close all other windows/browser first.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do Not run combofix more than once. If you have problems please post back for further instructions.
3.CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with
  • combofix log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI