What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

System Scan virus -- says harddrive, ram failed [Solved]

70 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Here's the Avast log: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-03-20 22:05:08 —————————– 22:05:08.796 OS Version: Windows 5.1.2600 Service Pack 3 22:05:08.796 Number of processors: 2 586 0x1C02 22:05:08.796 ComputerName: ACER-330BB84976 UserName: Administrator 22:05:09.625 Initialize success 22:13:27.578 AVAST engine defs: 12032000 22:14:03.937 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 22:14:03.953 Disk 0 Vendor: Hitachi_ FB2O Size: 152627MB BusType: 3 22:14:03.984 Disk 0 MBR read successfully 22:14:03.984 Disk 0 MBR scan 22:14:04.015 Disk 0 Windows VISTA default MBR code 22:14:04.031 Disk 0 Partition 1 00 12 Compaq diag NTFS 7169 MB offset 63 22:14:04.062 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 145456 MB offset 14684160 22:14:04.078 Disk 0 scanning sectors +312578048 22:14:04.171 Disk 0 scanning C:\WINDOWS\system32\drivers 22:14:16.984 Service scanning 22:14:50.000 Modules scanning 22:14:56.437 Disk 0 trace - called modules: 22:14:56.468 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys 22:14:56.484 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f6e6c8] 22:14:56.500 3 CLASSPNP.SYS[f78bdfd7] -> nt!IofCallDriver -> \Device\00000067[0x86f672c0] 22:14:56.531 5 ACPI.sys[f7834620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x86f49030] 22:14:57.375 AVAST engine scan C:\WINDOWS 22:15:10.281 AVAST engine scan C:\WINDOWS\system32 22:18:51.078 AVAST engine scan C:\WINDOWS\system32\drivers 22:19:11.453 AVAST engine scan C:\Documents and Settings\Administrator 22:20:01.750 AVAST engine scan C:\Documents and Settings\All Users 22:20:07.093 File: C:\Documents and Settings\All Users\Application Data\B83hsSGvoEd1o1.exe **INFECTED** Win32:FraudTool-UJ [Trj] 22:20:16.484 File: C:\Documents and Settings\All Users\Application Data\qvPKttoujdWOABX.exe **INFECTED** Win32:FraudTool-UJ [Trj] 22:20:23.109 Scan finished successfully 22:20:48.218 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 22:20:48.234 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"
Post #17
Hi shannonhills. I'm pleased that we finally got something to work with.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
O4 - HKLM..\Run: [qvPKttoujdWOABX.exe] C:\Documents and Settings\All Users\Application Data\qvPKttoujdWOABX.exe
[2012/03/16 21:28:29 | 000,441,344 | —- | C] () – C:\Documents and Settings\All Users\Application Data\qvPKttoujdWOABX.exe
 [2012/03/16 23:27:05 | 000,000,456 | —- | M] () – C:\Documents and Settings\All Users\Application Data\B83hsSGvoEd1o1
[2012/03/16 23:13:34 | 000,346,624 | —- | M] () – C:\Documents and Settings\All Users\Application Data\B83hsSGvoEd1o1.exe
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:93C494CA
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AB689DEA
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9AB56A06
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:798A3728

:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

====================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
  • start Malwarebytes-Anti-Malware and update it, (“Update” tab}
  • once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

====================================================

Please re-run aswMBR: if asked, don’t bother with the AVAST virus definition download

Logs to include in the next post:

OTL fix log
New OTL log
Mbam.txt
aswMBR log

Can you tell me if there is any difference.

Thanks

Satchfan
Post #18
OK, I'll do these tonight. I'm still running in Safe Networking mode, right? If Malwarebytes asks me to reboot, do I boot back up in Safe Networking?
Post #20
As this computer was still in Safe Networking, I ran OTL fix and allowed it to reboot in normal mode. The desktop was completely black, no icons, nothing. The Start menu had Programs, but no Internet Explorer. I tried logging off and relogging on as Administrator, but there was no Administrator option. There was just the "shannon" user and it said two programs were running. I restarted again in Safe Networking mode so that i could get back to this forum and post the results. I can't post the OTL fix log because it is on the desktop of the user "Shannon."
Post #21
Please try all the steps in the previous post in Safe mode with networking and if Malwarebytes asks to renoot, do the same. If Malwarebytes ran previously, can you locate that log and post it. Satchfan
Post #22
Here's today's OTL log:

OTL logfile created on: 3/22/2012 9:58:37 AM - Run 3
OTL by OldTimer - Version 3.2.39.1 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.88 Mb Total Physical Memory | 784.18 Mb Available Physical Memory | 77.34% Memory free
2.38 Gb Paging File | 2.29 Gb Available in Paging File | 96.20% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.05 Gb Total Space | 124.00 Gb Free Space | 87.29% Space Free | Partition Type: NTFS

Computer Name: ACER-330BB84976 | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (USBCCID) – system32\DRIVERS\Rts5161ccid.sys File not found
DRV - (Rts516xIR) – system32\DRIVERS\Rts516xIR.sys File not found
DRV - (RSUSBSTOR) – System32\Drivers\RTS5121.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (int15.sys) – c:\acernb\int15.sys File not found
DRV - (Changer) – File not found
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (L1c) – C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (M3000Srv) – C:\WINDOWS\system32\drivers\M3000KNT.sys ()
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (btwhid) – C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (DritekPortIO) – C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ACAW

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.2.72: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.2.72: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/05/17 15:07:36 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/10 19:39:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/12 22:59:15 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/03/12 22:59:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/02/16 07:40:42 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 03:42:53 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 03:42:53 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2008/04/14 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7865F192-851C-4580-8579-DB71F758AE05}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Acer.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/11 22:07:49 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2012/03/21 20:57:53 | 000,000,000 | —D | C] – C:\_OTL
[2012/03/21 20:56:55 | 009,502,424 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Administrator\Desktop\mbam–setup-1.60.1.1000.exe
[2012/03/20 21:29:49 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/03/20 21:26:32 | 000,594,432 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/03/18 20:46:09 | 000,389,024 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Administrator\Desktop\unhide.exe
[2012/03/17 22:28:06 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2012/03/16 21:33:41 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2012/03/12 23:15:41 | 000,000,000 | —D | C] – C:\WINDOWS\ie8
[2012/03/12 22:59:12 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox

========== Files - Modified Within 30 Days ==========

[2012/03/22 09:50:20 | 000,434,126 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/03/22 09:50:20 | 000,068,412 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/03/22 09:46:10 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/03/21 21:09:05 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/03/21 20:57:06 | 009,502,424 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Administrator\Desktop\mbam–setup-1.60.1.1000.exe
[2012/03/20 22:20:48 | 000,000,512 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/03/20 21:36:14 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.scr
[2012/03/20 21:35:44 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.com
[2012/03/20 21:35:15 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.exe
[2012/03/20 21:34:37 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill 2.com
[2012/03/20 21:33:52 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill 1.exe
[2012/03/20 21:29:49 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/03/20 21:26:35 | 000,594,432 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/03/18 20:46:23 | 000,389,024 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Administrator\Desktop\unhide.exe
[2012/03/18 20:41:27 | 000,294,400 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\exeHelper.com
[2012/03/17 22:33:01 | 000,068,194 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\RogueKiller.exe
[2012/03/16 20:40:25 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/03/12 23:18:51 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/02/22 02:20:24 | 000,183,424 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/22 02:16:29 | 000,000,290 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1602489464-951796526-1614765859-1006.job
[2012/02/22 02:16:19 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1602489464-951796526-1614765859-1006.job
[2012/02/22 02:16:09 | 000,000,986 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1602489464-951796526-1614765859-1006UA.job
[2012/02/22 02:15:56 | 000,000,934 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1602489464-951796526-1614765859-1006Core.job

========== Files Created - No Company Name ==========

[2012/03/20 22:20:48 | 000,000,512 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\MBR.dat
[2012/03/20 21:36:09 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill.scr
[2012/03/20 21:35:40 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill.com
[2012/03/20 21:35:11 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill.exe
[2012/03/20 21:34:32 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill 2.com
[2012/03/20 21:33:47 | 001,008,141 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\rkill 1.exe
[2012/03/18 20:41:05 | 000,294,400 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\exeHelper.com
[2012/03/17 22:32:50 | 000,068,194 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\RogueKiller.exe
[2012/02/21 22:02:38 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/21 22:02:38 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\dllcache\iacenc.dll
[2011/01/03 15:06:20 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/10/07 01:02:38 | 000,000,008 | RHS- | C] () – C:\WINDOWS\System32\Desktop_.ini

========== LOP Check ==========

[2009/03/11 23:32:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Acer
[2009/03/11 23:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Acer GameZone Console
[2009/03/11 23:27:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Super-Cow
[2009/12/26 09:14:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2DBoy
[2009/03/11 23:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Acer GameZone Console
[2010/10/07 01:01:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broadcom
[2011/05/12 09:50:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2012/02/10 20:01:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/09/09 00:09:13 | 000,000,110 | —- | M] () – C:\WINDOWS\Tasks\Critical Battery Alarm Program.job

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/03/11 22:07:49 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/10/06 23:22:58 | 000,000,212 | RHS- | M] () – C:\boot.ini
[2009/03/11 22:07:49 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/03/11 22:07:49 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/05/05 20:04:24 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2009/02/18 02:26:30 | 000,002,016 | —- | M] () – C:\MOD01SET0J00P2000K.enc
[2008/08/06 18:16:21 | 000,002,488 | —- | M] () – C:\MOD01WOS02ENP20001.enc
[2009/03/11 22:07:49 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 05:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/03/22 09:46:03 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2009/03/11 22:57:01 | 000,001,883 | —- | M] () – C:\RHDSetup.log
[2012/03/20 21:45:21 | 000,000,359 | —- | M] () – C:\rkill.log
[2009/05/11 09:40:59 | 000,000,190 | —- | M] () – C:\Setup.log

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 03:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/03/11 14:02:31 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2009/03/11 14:02:31 | 001,064,960 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2009/03/11 14:02:31 | 000,901,120 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2008/04/30 00:35:58 | 000,773,120 | —- | M] () – C:\WINDOWS\system32\NEROINSTAEC43759.DB

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/03/11 22:10:31 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/03/11 22:10:30 | 000,000,079 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/03/20 21:29:49 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/03/21 20:57:06 | 009,502,424 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Administrator\Desktop\mbam–setup-1.60.1.1000.exe
[2012/03/20 21:26:35 | 000,594,432 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/03/20 21:33:52 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill 1.exe
[2012/03/20 21:35:15 | 001,008,141 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\rkill.exe
[2012/03/17 22:33:01 | 000,068,194 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\RogueKiller.exe
[2012/03/18 20:46:23 | 000,389,024 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Administrator\Desktop\unhide.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2003/09/22 14:36:46 | 000,013,448 | —- | M] () – C:\WINDOWS\M3000Twn.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-02-22 05:18:44

< %appdata%\Microsoft\Windows\Start Menu\*.* /s >
Invalid Environment Variable: programdata

< End of report >
Post #23
OTLdid not post an Extras log on my desktop. So here's the Malwarebytes log: Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.22.04 Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking) Internet Explorer 8.0.6001.18702 Administrator :: ACER-330BB84976 [administrator] 3/22/2012 11:09:37 AM mbam-log-2012-03-22 (11-09-37).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 265415 Time elapsed: 23 minute(s), 49 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\_OTL\MovedFiles\03212012_205753\C_Documents and Settings\All Users\Application Data\B83hsSGvoEd1o1.exe (Backdoor.Agent.Gen) -> Quarantined and deleted successfully. C:\_OTL\MovedFiles\03212012_205753\C_Documents and Settings\All Users\Application Data\qvPKttoujdWOABX.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully. (end)
Post #24
Here's the aswMBR log: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-03-22 11:40:07 —————————– 11:40:07.562 OS Version: Windows 5.1.2600 Service Pack 3 11:40:07.562 Number of processors: 2 586 0x1C02 11:40:07.562 ComputerName: ACER-330BB84976 UserName: Administrator 11:40:08.312 Initialize success 11:40:32.468 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 11:40:32.468 Disk 0 Vendor: Hitachi_ FB2O Size: 152627MB BusType: 3 11:40:32.500 Disk 0 MBR read successfully 11:40:32.515 Disk 0 MBR scan 11:40:32.515 Disk 0 Windows VISTA default MBR code 11:40:32.531 Disk 0 Partition 1 00 12 Compaq diag NTFS 7169 MB offset 63 11:40:32.546 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 145456 MB offset 14684160 11:40:32.562 Disk 0 scanning sectors +312578048 11:40:32.656 Disk 0 scanning C:\WINDOWS\system32\drivers 11:40:40.031 Service scanning 11:41:00.359 Modules scanning 11:41:06.843 Disk 0 trace - called modules: 11:41:06.875 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys 11:41:06.890 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f796a0] 11:41:06.906 3 CLASSPNP.SYS[f78bdfd7] -> nt!IofCallDriver -> \Device\00000067[0x86f7a808] 11:41:06.921 5 ACPI.sys[f7834620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x869fa030] 11:41:06.953 Scan finished successfully 11:41:44.593 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 11:41:44.609 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR march 22 .txt"
Post #25
OK, so now I booted up in normal mode and the desktop is still all black, no icons, and the start menu is very minimal, no internet explorer. Also, the programs in my list are gone. Should I run those unhide programs again?
Post #27
OK I tried to download the exehelper and unhide to my desktop while running in normal mode, logged in as "shannon" (logged in normally) and Avira antivirus stopped the downloads. I can't get to Avira to change the settings since I can't see my programs. Should I go back to Safe Networking mode and run those programs from Administrator? Or should I try logging on to "shannon" in safe networking and download them?
Post #28
I tried downloading those programs while in Safe Networking but logged in as Shannon and it says they are already installed on the desktop, but I can't see anything on the desktop. So I'm going back to Safe Networking as Administrator.
Post #30
Here's the exehelper log. I also ran unhide. I'm going to reboot now and try normal mode. exeHelper by Raktor Build 20100414 Run at 20:41:28 on 03/18/12 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished– exeHelper by Raktor Build 20100414 Run at 16:18:17 on 03/22/12 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished–

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI