System Scan virus -- says harddrive, ram failed [Solved]

Thanks, Satchfan. Here's the SystemLook log: SystemLook 30.07.11 by jpshortstuff Log created at 13:30 on 03/04/2012 by Administrator Administrator - Elevation successful ========== reg ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "AutoRestartShell"= 0x0000000001 (1) "DefaultDomainName"="ACER-330BB84976" "DefaultUserName"="Administrator" "LegalNoticeCaption"="" "LegalNoticeText"="" "PowerdownAfterShutdown"="0" "ReportBootOk"="1" "Shell"="Explorer.exe" "ShutdownWithoutLogon"="0" "System"="" "Userinit"="C:\WINDOWS\system32\userinit.exe," "VmApplet"="rundll32 shell32,Control_RunDLL "sysdm.cpl"" "SfcQuota"= 0x00ffffffff (-1) "allocatecdroms"="0" "allocatedasd"="0" "allocatefloppies"="0" "cachedlogonscount"="10" "forceunlocklogon"= 0x0000000000 (0) "passwordexpirywarning"= 0x000000000e (14) "scremoveoption"="0" "AllowMultipleTSSessions"= 0x0000000001 (1) "UIHost"="logonui.exe" "LogonType"= 0x0000000001 (1) "Background"="0 0 0" "DebugServerCommand"="no" "SFCDisable"= 0x0000000000 (0) "WinStationsDisabled"="0" "HibernationPreviouslyEnabled"= 0x0000000001 (1) "ShowLogonOptions"= 0x0000000000 (0) "AltDefaultUserName"="Administrator" "AltDefaultDomainName"="ACER-330BB84976" "LegalNotice Text"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SCLogon] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Credentials] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell] (Unable to open key - key not found) -= EOF =-

That looks OK. Have you tried creating a new user with admin permissions and then logging as the new user? Let me know how that goes.

I created a new user with administrative rights (called it Shannon2), and it's the same as the other Shannon. Everything seems to be working normally except there are no programs in the shortcuts on the Start/Programs menu. The new programs installed since we started this, Malwarebytes, is there with functioning links. But none of the programs that were there before the virus. Also, on Shannon2 user, the start menu is simple again.

You can run the start menu reg fix again for Shannon 2 if you want to keep it.

Log in as Shannon 2.

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted REGEDIT below to it. Don't forget to include REGEDIT4:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
“NoSimpleStartMenu”=dword:00000000

• "Save in": Desktop
• "File Name": fixme.reg
• "Save as Type": All files
• click: Save

On the desktop, double-click fixme.reg and allow it to run. Let it merge

Reboot.

I don’t think there is an easy way for the start menu to be restored but I’m going to check further and see what the options are.

Am I to understand that you can also now log in normally as Administrator?

Satchfan

Hi Shannon

I consultef with some colleages and have a couple of suggestions but this is probably worth trying first.

Download and run this.

Let me know how you get on.

Am I to understand that you can also now log in normally as Administrator?

Satchfan

Well, in normal mode, there is no choice to log in as Administrator. I forget where I read it, but maybe in User Accounts in Control Panel it told me that it will not show "Administrator" as one of the users in normal mode unless there is no other user. So it only allows me to log in as "Administrator" in Safe mode. But Shannon has administrator rights.

There are different ways of logging in to XP depending on the configuration. I believe there is a way to get Administrator as an option but it appears that this is not a problem as you have admin rights.

With regard to the start menu, I’m afraid your only option may be to recreate it. Please let me know if you need help with this.

Meanwhile, I’d like you to run a couple more scans followed by an online scan.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

================================================

Run Malwarebytes’ Anti-Malware

If you no longer have it, you can download it from here:

• start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
• when the scan is complete, click OK, then Show Results to view the results.
• be sure that everything is checked, and click Remove Selected.
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Logs to include in your next post:

checkup.txt
Mbam.txt
Eset log if any infections were found

Satchfan

There are different ways of logging in to XP depending on the configuration. I believe there is a way to get Administrator as an option but it appears that this is not a problem as you have admin rights.

With regard to the start menu, I’m afraid your only option may be to recreate it. Please let me know if you need help with this.

Yes, I'm afraid I need help with this. Do I just go into the c:/programs and reclick "setup.exe" in each program?

I'll run those scans today.

Here's the checkup log:

Results of screen317's Security Check version 0.99.32
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Avira AntiVir Personal - Free Antivirus
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
HijackThis 2.0.2
Java™ 6 Update 20
Java version out of date!
Adobe Reader 9 Adobe Reader out of date!
Mozilla Firefox 10.0.2 Firefox out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
``````````End of Log````````````


It said it updated Avira. I tried to update Avira last night and it wouldn't work. Strange.

I also ran a full scan in Malwarebytes (since Avira wouldn't update, I got worried( and it found nothing. But I'll run a quick scan now and post the log.

Here's the mbam-log: Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.04.04.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Shannon :: ACER-330BB84976 [administrator] 4/5/2012 2:16:05 PM mbam-log-2012-04-05 (14-16-05).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 237966 Time elapsed: 7 minute(s), 3 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Hi Shannon The Malwarebytes scan seems OK How about the Eset scan?

ESETScan found a threat: C:\System Volume Information\_restore{D943BACC-C405-4AD7-B9AF-994E097D0C0F}\RP361\A0065498.exe probably a variant of Win32/InstallCore.A application

That Eset entry is in System Restore which we will be emptying shortly.

As far as I know there's no direct way to replace programs other than to re-install them but this is another option that one of my colleagues suggested and is probably easier..

To manually recreate "All Programs" entries, follow these steps:

• download App Paths
• double click on AppPaths.exe to run the program.
• keep the program open

.
In this example I'll recreate an entry for Avast antivirus program (replace it with the program of your choice).

• go Start>All Programs.
• right click on the Avast entry and choose Properties

🖼Click to load external image (Posted Image)

NOTE. Make sure, you right click on the Avast program, NOT on the Avast folder. You'll see this window:

🖼Click to load external image (Posted Image)

Due to the damage caused by the infection, you'll find "Target" box empty.

• go back to AppPaths window and find Avast entry.
• right-click on the Avast line and choose Edit
• a pop-up window will open:

🖼Click to load external image (Posted Image)

• highlight everything in "Path" box, right click on it, click "Copy"
• go back to Avast "Properties" window, right click inside "Target" box, click "Paste".
• IMPORTANT!: add quotation marks at the beginning of the path and at the end
• click OK and you're done.

🖼Click to load external image (Posted Image)

In case, program's link shows as (empty):

🖼Click to load external image (Posted Image)

• open Windows Explorer, navigate to Avast folder in Program Files
• right click on Avast’s ".exe" file, click Create shortcut

:

🖼Click to load external image (Posted Image)

• copy that shortcut, go back to Start menu.
• right click on avast!Free Antivirus, click Paste.
• you'll see Avast shortcut recreated replacing (empty) entry.

Alternatively

Paste that shortcut in C:\Documents and Settings\All Users\Start Menu\Programs\Avast

Let me know how it goes.

Satchfan

NOTE. Make sure, you right click on the Avast program, NOT on the Avast folder. You'll see this window:

🖼Click to load external image (Posted Image)

Due to the damage caused by the infection, you'll find "Target" box empty.

I'm having trouble with this. Since the target box is empty, I can only right-click on the folder, not the program itself. The program has disappeared and the box says "empty" in light gray letters.

So when I right-click and choose properties, there is no "Target" box or place to insert a new path.

You know what, Sachfan, most of the programs on the little Netbook are downloaded, so I can just re-download them. That's what I should do, right?

Alternatively

Paste that shortcut in C:\Documents and Settings\All Users\Start Menu\Programs\Avast

Oh wait, let me try this alternate.