What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] your system is infected wallpaper

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I get the message "your system is infected" on the wallpaper. My computer runs slowly. System Restore won't work. I have run a virus scan by AV antivirus-elite 5.0 but it doesn't help. I click on a google link and it mis-directs me. When my computer first starts, it says I have a worm Win32 sky. Any suggestions?
Post #2
[external image: Posted Image]


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
[external image: Posted Image]
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • [external image: Posted Image]
  • Then click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste". .
Post #5
My computer seems to run much better and the wallpaper is back to normal. Thanks for the help!! I did notice that a screen from my ISP pops up when I click on a saved favorite. Malwarebytes' Anti-Malware 1.42 Database version: 3439 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 12/27/2009 11:11:50 AM mbam-log-2009-12-27 (11-11-50).txt Scan type: Quick Scan Objects scanned: 145047 Time elapsed: 26 minute(s), 49 second(s) Memory Processes Infected: 6 Memory Modules Infected: 4 Registry Keys Infected: 15 Registry Values Infected: 23 Registry Data Items Infected: 13 Folders Infected: 5 Files Infected: 80 Memory Processes Infected: C:\WINDOWS\system32\FastNetSrv.exe (Backdoor.Bot) -> Unloaded process successfully. C:\Documents and Settings\Owner\Local Settings\Temp\csrss.exe (Trojan.Downloader) -> Unloaded process successfully. C:\Documents and Settings\Owner\Local Settings\Temp\spoolsv.exe (Trojan.Downloader) -> Unloaded process successfully. C:\WINDOWS\system32\winupdate86.exe (Trojan.Downloader) -> Unloaded process successfully. C:\Documents and Settings\Owner\Local Settings\Temp\user.exe (Trojan.Downloader) -> Unloaded process successfully. C:\Documents and Settings\Owner\Local Settings\Temp\csrss.exe (Trojan.Downloader) -> Unloaded process successfully. Memory Modules Infected: C:\WINDOWS\system32\msaouahn.dll (Spyware.OnlineGames) -> Delete on reboot. c:\WINDOWS\system32\BtwSrv.dll (Backdoor.Bot) -> Delete on reboot. C:\WINDOWS\system32\ju8b8q5oe.dll (Trojan.Downloader) -> Delete on reboot. C:\WINDOWS\system32\kbdsock.dll (Spyware.Passwords) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{a5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Zlob.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsrv (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fastnetsrv (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Downloader) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Virus Elite 5.0_is1 (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Anti-Virus Elite (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_BTWSRV (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_FASTNETSRV (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a5bf49a2-94f1-42bd-f434-3604812c807d} (Trojan.Zlob.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tqammy (Spyware.OnlineGames) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate86.exe (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asg984jgkfmgasi8ug98jgkfgfb (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ygua8e7yhuiesfha876yfauy8fe (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\buildw (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\firstinstallflag (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ulrn (Malware.Trace) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\update (Malware.Trace) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\updatenew (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mbt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udfa (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mfa (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asg984jgkfmgasi8ug98jgkfgfb (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: catetr32.dll -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Downloader) -> Data: c:\windows\system32\winlogon86.exe -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Downloader) -> Data: system32\winlogon86.exe -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\winlogon86.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus Elite (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\logs (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\NoAdwareBackup (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\catetr32.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ju8b8q5oe.dll (Trojan.Zlob.H) -> Delete on reboot. C:\WINDOWS\system32\msaouahn.dll (Spyware.OnlineGames) -> Delete on reboot. c:\WINDOWS\system32\BtwSrv.dll (Backdoor.Bot) -> Delete on reboot. C:\WINDOWS\system32\FastNetSrv.exe (Backdoor.Bot) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\csrss.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\spoolsv.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winupdate86.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\user.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\win16.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\mtn5c3z4a.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\haypsixd.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Startup\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kbdsock.dll (Spyware.Passwords) -> Delete on reboot. C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\AVR10.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mshlps.dll (Spyware.Passwords) -> Quarantined and deleted successfully. C:\WINDOWS\system32\notepad.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\opeia.exe (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\w1j5r522k1.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winhelper86.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winlogon86.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\config\SystemProfile\ntload.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\config\Systemprofile\Start Menu\Programs\Startup\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\smss.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\spoolsv.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\drweb.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\install.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\login.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\system.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\tmp0_24192544001.bk.old (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\ntload.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\nvsvc32.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\vpkq0yfe.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Laura\Local Settings\Temp\user.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Laura\Local Settings\Temp\nvsvc32.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Laura\Local Settings\Temp\notepad.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\services.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\debug.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\lsass.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\mdm.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\notepad.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\nvsvc32.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\system.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\win.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\winamp.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\winlogon.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\avp.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\NoadwareBkupTemp\Services.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\ntload.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus Elite\Anti-Virus Elite .lnk (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\Anti-Virus Elite\Uninstall Anti-Virus Elite .lnk (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\adgutils.dll (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\Anti-Virus Elite.exe (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\noadware4_122609.na (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\unins000.dat (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\unins000.exe (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\UninstlDll.dll (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\logs\Date(26-12-2009) Time(18-16-14).txt (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\NoAdwareBackup\12,26,2009_18,15,16.zip (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Program Files\Anti-Virus Elite\NoAdwareBackup\12,26,2009_19,45,57.zip (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\ogstiuu.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\waxfhosk.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Desktop\Anti-Virus Elite.lnk (Rogue.AntiVirusElite) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Startup\scandisk.lnk (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Program Files\Common\helper.sig (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\critical_warning.html (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Local Settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\ntldrs (Pwned.Zbot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\flags.ini (Malware.Trace) -> Delete on reboot. C:\WINDOWS\system32\uses32.dat (Malware.Trace) -> Quarantined and deleted successfully.
Post #6
That's not a good sign.


Memory Modules Infected:
C:\WINDOWS\system32\msaouahn.dll (Spyware.OnlineGames) -> Delete on reboot.
c:\WINDOWS\system32\BtwSrv.dll (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\ju8b8q5oe.dll (Trojan.Downloader) -> Delete on reboot.
C:\WINDOWS\system32\kbdsock.dll (Spyware.Passwords) -> Delete on reboot.


you should be aware that you may have been infected by a backdoor trojan. This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.
Post #7
I am still having problems using system restore. My computer will not open in safe mode. I keep getting a message that it was closed by group policy. When I click on a link in google, it wants to re-direct me. I am thinking about a reformat. I have an hp pavillion a320n. I reformatted it last year. My system allows for two different types of reformatting. I was wondering if the less invasive one is the better choice. I downloaded windows office using Microsoft's special offer to businesses ($20) for a one time download and would like to save it. Any way I can do this. Any tips on reformatting. I still have my recovery discs.
Post #9
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI