What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I'm infected with Win32/Doklin!generic

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello, I posted awhile back in the HijackThis part of your forum but that was for a different PC of mine.

I'm not sure if this is the correct forum for me to post in, or if I should psot in the Hijackthis part, because I don't know if you're going to ask me to run a hijack log or not. Let me know if I'm posting in the wrong subforum.

In the other situation (my other PC) you (The TomCoyoto folks) nicely fixed my computer and got rid of my virus. You also recommended I prevent future infections by installing antivirus, antispyware, and firewall software. I've done everything you asked, and that computer is running very nicely now, and I certainly thank you for the assistance you gave me.

Now, I have a second PC in my house, which is infected with a different virus than the other one had before, and I'd like to take similar action. As I recall, you told me not to install all the above software until after I remove the viruses from my computer.

Let me tell you my symptoms, and what I've done so far.

Symptoms: I get a message when I boot, generated from yahoo online protection (which is anti virus software my DSL provider gave me) which says I'm infected with Win32/Doklin!generic

The file that's infected is: C:\WINDOWS\CTFMON32.DLL

I'm also being told that the virus was detected and cleaned. But I don't think so, because everytime I reboot, the virus is still there. My ISP provider has admitted that Yahoo online Protection is not really very good, and that I should install better software. The software you guys pointed me to, which I installed on my other PC seems to be working nicely. But before installing, I infer from previous posts by you guys that I should clean this virus off first.

Another symptom I have is that my computer processes veeerrrry sloooowwwwly. Especially when I click on a website URL… if it needs to open a new instance of Internet Explorer, it takes a very long time for it to process that. Also, occasionally it loses contact with my home network. Also, I get this strange application trying to dial out on my modem. But I don't have a dialup modem, so fortunately this attempt to dial out never works. :) I wonder if it's a trojan horse or something.

Now, in my other thread here, you guys suggested I first scan my computer using this site:

http://support.f-secure.com/enu/home/ols.shtml

That worked fine on my other PC, but that site will not scan this PC. When I try to scan, it installs to the softare, but right when it gets to the step of scanning my PC, I get the message:

An error has occured! Please close the scanner and your browser, then try again. (Id: 24)

I've tried what it says, and even tried rebooting my PC. I've done this many times, but every time, the above error message occurs, and so I'm not able to scan or clean my PC.

I've run out of ideas, and hope to get some assistance here. By the way, I felt kind of guilty that I'm using so much of your resources, seeing as this is my second PC with a problem, so I just donated money to your site earlier today. :)
Post #2
Hi Thromble,

Thank you on behalf of everyone at Tom Coyote for the donation :)

Please post a HijackThis log for the infected computer and I'll take a look at it for you.
Also, please include an uninstall list, here are instructions if needed:

Download HijackThis from this link if you don't have it already.
Double-click on the HJTsetup.exe icon to start installation
By default it will install to C:\Program Files\HijackThis
Continue to click Next in the setup dialog boxes until you are asked which additional icons you would like
Put a check by Create a desktop icon then click Next again.
Press Install and then Finish and it will automatically launch HijackThis

Select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your deskop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.
Post #3
Thank you for the instructons. Here's the uninstall list:

2Wire Wireless Client
Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
AI RoboForm (All Users)
AT&T Yahoo! Applications
Avance AC'97 Audio
Citrix ICA Web Client
Conexant SoftK56 Modem(M)
Hijackthis 1.99.1
HijackThis 1.99.1
ICQ
Intel® Extreme Graphics Driver Software
Java 2 Runtime Environment Standard Edition v1.3.1_02
Microsoft Office Professional Edition 2003
PhotoStudio Suite & IBM Scanner
Quicken 2006
RealPlayer Basic
TextBridge Classic 2.0
Viewpoint Media Player (Remove Only)
Winamp (remove only)
Windows Backup Utility
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833407
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB842773
Windows XP Hotfix (SP1) [See Q306676 for more information]
Windows XP Hotfix (SP1) [See Q308387 for more information]
Windows XP Hotfix (SP1) [See Q308402 for more information]
Windows XP Hotfix (SP1) [See Q308677 for more information]
Windows XP Hotfix (SP1) [See Q311889 for more information]
Windows XP Hotfix (SP1) [See Q312368 for more information]
Windows XP Hotfix (SP1) [See Q312370 for more information]
Windows XP Hotfix (SP1) [See Q315000 for more information]
Windows XP Hotfix (SP1) [See Q315403 for more information]
Windows XP Hotfix (SP1) [See Q316134 for more information]
Windows XP Hotfix (SP1) [See Q329048 for more information]
Windows XP Hotfix (SP1) [See Q329390 for more information]
Windows XP Hotfix (SP1) [See Q329441 for more information]
Windows XP Hotfix (SP1) [See Q329834 for more information]
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q815021
Windows XP Hotfix (SP1) Q817606
Windows XP Hotfix (SP2) [See Q329115 for more information]


By the way, I'm wary about the above item that says: Conexant SoftK56 Modem(M) This is exactly the application that's been trying to dial out without my permission. But I have broadband internet, so this dialing out doesn't make sense to me.

Here is the hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 8:47:31 AM, on 3/28/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\service32.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162781728515
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
Post #4
Hi Thromble,

I can understand your concerns about the attempted dial-outs, this however is a fairly common symptom of infection. For example - some malware tries to dial up very expensive premium-rate telephone numbers which are set up by the people behind the malware - it's easy to see how this would be effective where a victim uses a dial-up connection. We can sort this problem out for you, however:

The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here to get WinXP SP1a: http://www.microsoft.com/windowsxp/downloa…p1/default.mspx

Apply the update, reboot, then go to Windows Update and install all the Critical Updates (Note: Except for WinXP SP2)
Click here for Windows Update: http://www.windowsupdate.com/
Be sure to reboot your machine after this process.

Once complete, please post a new HijackThis log and we'll get on with removing the malware on your machine.
Post #5
Hi Thromble, How are you getting on? If the instructions are unclear or something isn't working, please let me know before proceeding.
Post #6

Hi Thromble,

How are you getting on?

If the instructions are unclear or something isn't working, please let me know before proceeding.


To tell the truth, it's taking a loooong time for me to apply the Windows updates. For some reason, whenever I reboot, the computer takes forever, and then when I click on internet links, the computer gets stuck doing a bunch of paging, and sometimes the virtual memory gets low. Sometimes when I reboot, the paging isn't so bad though. Also, I followed your links to try to patch SP1A, like you said, but I don't see it. It applied SP1, I think, and after many attempts, I simply told it to apply all Windows patches it thinks I need. (I hope that doesn't goof things up.) I let it do that overnight last night, so when I get home this evening, I can see if that worked. I'm sure I'll probably also want to go back and have it check to see if there are more Windows updates to do, because if I recall correctly, Windows applies the updates in waves, and it's possible that once last night's updates are done, it might see more updates it wants to do.

Also, by the way, it spends some time during reboot to detect my virus, which it finds everytime and supposedly cleans everytime, and also, I hear this strange clicking that after a long while quits, and when the clicking quits, that's when I see the phantom application trying to dial out on my nonexistent modem.

Anyway, I'm hoping that by this evening, I'll have a new update. Also, maybe when all this is done, maybe my computer won't be so slow. It used to be fast when it was a new computer, so something must be wrong. Another thing I'm considering is buying more RAM for it, because as I recall, it has a pretty small amount of it, and I think this could help improve the speed of the computer.
Post #7
Hi Thromble,

Yes I understand that it can take a very long time to update your machine, but I hope you understand that it is simply essential in order to get your machine clean and to keep it that way. An unpatched version of XP is vulnerable to just about anything, and no sooner would we remove one bit of malware, than something else would take it's place.

You should follow the link I provided, choose Express Install and follow the on-screen instructions. Make sure you don't choose SP2 yet as it may not work. If you have problems with Windows Update you can download SP1a to install offline by choosing the Network Install, this is over 100Mb so is best downloaded using a download manager like wxDownloadFast so you can stop the download and resume it later.

If you want to check whether the installation was successful, right-click My Computer on the Desktop or start menu, select Properties and under the word System your OS version and service pack level should appear.

RAM is the best performance boost for the money for most people, if you have less than 1Gb you almost certainly will notice a big improvement. Removing malware also often speeds things up dramatically :)

Good luck and I'm confident we can resolve your problems.
Post #8

Hi Thromble,

Yes I understand that it can take a very long time to update your machine, but I hope you understand that it is simply essential in order to get your machine clean and to keep it that way. An unpatched version of XP is vulnerable to just about anything, and no sooner would we remove one bit of malware, than something else would take it's place.

You should follow the link I provided, choose Express Install and follow the on-screen instructions. Make sure you don't choose SP2 yet as it may not work. If you have problems with Windows Update you can download SP1a to install offline by choosing the Network Install, this is over 100Mb so is best downloaded using a download manager like wxDownloadFast so you can stop the download and resume it later.

If you want to check whether the installation was successful, right-click My Computer on the Desktop or start menu, select Properties and under the word System your OS version and service pack level should appear.

RAM is the best performance boost for the money for most people, if you have less than 1Gb you almost certainly will notice a big improvement. Removing malware also often speeds things up dramatically :)

Good luck and I'm confident we can resolve your problems.


Well last night, I successfully applied something like 35 updates to the computer. I went back in afterwards to see if it recommended more updates, and it recommended SP2. At the time, I assumed this was okay, since it applied the other updates already, so I allowed it to apply SP2. Hopefully I didn't goof anything up by that. I fell asleep in the middle of the update, so it'll be this evening before I can check on the status of the computer again. But thanks for all the assistance you're giving.
Post #9
Well when I went back I saw SP2 wasn't applied.

By the way, I should mention that I've been having trouble using windowsupdate.com. When it looks for updates, it takes a really long time to decide if I need any, and then it gives me an error screen. I stored a screen print of that screen at

http://www.geocities.com/timckelley/windowsupdateerror.JPG

You'll probably need to go to full screen view to be able to read the small font on that screen print.

Anway, I already had windows update installed on my computer, and there was a tray icon recommending updates. So I clicked on that. It still said I needed about 30 or so updates, even though I thought I had just applied about 30 updates. So I told it to go ahead, but it errored out with a similar message as above, if I remember correctly. I rebooted several times, and that didn't help, so I went into custom install instead of express install, and only selected a few of the updates. That worked. Over the course of many days I applied a few updates per day, until they were all applied.

I no longer have the tray icon telling me I need to apply updates. To be extra sure, I went back to windowsupdate.com, but I get that same error message, so that website isn't helping.

Also while I'm at it, I should mention other symptoms. Usually when I reboot, it has trouble closing at least one task. For example, it could be my Roboform program. It ends it, but it forces it to end abnomally and then it reboots.

Also, sometimes when I reboot I have no access to my home network, and sometimes I do. Just now, I no longer have access to the network, but I don't have access to internet either, so I'm posting this from another computer on that network. Fortunately I can access the bad computer from this one, just not vice versa. Also, every new task I want to launch takes minutes to launch. When my screen saver activates, and I move the mouse, it takes a long time to go away, and when it does, I see I'm logged out. To log back in takes minutes. Also, there is a huge amount disk drive activity most of the time, and sometimes I get virtual memory/paging messages. And everytime I reboot, the same virus is detected and supposedly cleaned.

Also this didn't used to be so, so I'm hoping to get my computer back to how it used to be.

Anyway, I'm hoping I got all the windows updates installed that I was supposed to, but maybe you can tell by looking at my latest Hijack log. (I don't know if you can glean that from logs or not.) Here is my latest HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 10:19:01 PM, on 4/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\service32.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162781728515
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175397217324
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
Post #10
Hi Thromble,

It sounds like you have a world of trouble with this machine, and I'm glad you have persevered long enough to get some updates installed. The problems you describe probably have multiple causes, malware being one of them, we'll get the machine clean and then I'll do my best to get it running as best we can.

As we can see from the HijackThis log, Service Pack 2 (SP2) has been installed, so we're OK for updates for now - we'll come back to this after cleaning, try to get Windows Update working and get your machine fully up to date.

Next, I have some bad news, one program installed on your system may be a backdoor trojan, I'm can't be 100% sure but you need to be aware of the implications if it is - this is my standard warning for victims of this type of malware:

This program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use a another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

I will continue with instructions for cleaning now, if you wish to reformat then let me know in your next response.

I know that every step may take a long time because of the problems with the machine, so if you run into trouble with a step, stop and tell me rather than continuing so I can advise you :)

First we need to make hidden/system files and folders visible:
Click Start -> My Computer
Select the Tools menu, click Folder Options and select the View tab
Under the Hidden files and folders heading SELECT Show hidden files and folders
UNCHECK the Hide protected operating system files (recommended) option
Click Yes to confirm and press OK

Please close all open programs as this will require a reboot

Open HijackThis, choose Open the Misc Tools section
Click Generate StartupList log button, OK the prompt and save a copy of startuplist.txt to your Desktop - include a copy in your next response.
Then, click the Delete a file on reboot button and navigate to:

C:\WINDOWS\service32.exe

Press Open and then when asked to reboot, say Yes and allow your computer to reboot.

Next we need to run a couple of scans, both programs can be downloaded to a good machine and transferred to the bad machine if required:

Download Dr.WEB CureIt to your desktop from here:
ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
  • Double-click cureit.exe to start the program.
  • Press Start and then OK to start the Express scan
  • The Express scan takes just a few moments to finish, if something is found, click Yes to cure it
  • Once the short scan has finished, Click Options->Change settings
  • Choose the Scan tab and remove the check mark from Heuristic analysis and press OK
  • Then select all hard drives to be scanned by clicking on them - choose all drives - a red dot confirms they will be scanned
  • Then click the green arrow on the right to start the scan
  • Click Yes to all if it asks if you want to cure/move a file
  • When the scan has finished, look if you can click next icon next to the files found:
    [external image: Posted Image]
    If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
    [external image: Posted Image]
    This will move it to the %userprofile%\DoctorWeb\quarantine-folder if it can't be cured.
  • Then click File-> Save report list and save the report to your desktop
  • Close Dr.Web Cureit and reboot your computer (this is important as files may be moved/deleted during reboot)
Please download F-Secure Blacklight (blbeta.exe):
https://europe.f-secure.com/blacklight/try.shtml
  • Click I ACCEPT and download the graphical user interface version to your Desktop
  • Double click the file to run it, choose I accept the agreement then press Scan
  • It will create the "fsbl-xxxxxxx.log" on your desktop.
  • The log will have a list of all items found.
  • Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
  • Exit Blacklight and post the contents of the log in your next reply.
Once complete, please post the startuplist.txt log, the Dr Web log, the Blacklight log and a new HijackThis log. Also, please tell me if there has been any change in the usability of the machine.
Post #11
Okay, I did all the above. Dr. Web Cureit found no virus, so the icon next to files found never enabled itself. Also, since no viruses were found, the command was unavailable, so unfortunately I dont have a report list to show you.

Then I ran the blacklight program, and it too didn't flash any message of finding any virus, but it did create the log file.

Anyway, here is the startuplist.txt log:

StartupList report, 4/11/2007, 9:57:19 PM
StartupList version: 1.52.2
Started from : C:\Program Files\Hijackthis\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\service32.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Hijackthis\HijackThis.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

CaAvTray = "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
CAVRID = "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
YOP = C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
(Default) =
InstantAccess = C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
RegisterDropHandler = C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
PRISMSVR.EXE = "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

RegisterDropHandler = C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe
RoboForm = "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll - {724d43a9-0d85-11d4-9908-00400523e39a}

————————————————–

Enumerating Download Program Files:

[YInstStarter Class]
InProcServer32 = C:\Program Files\Yahoo!\Common\yinsthelper.dll
CODEBASE = C:\Program Files\Yahoo!\common\yinsthelper.dll

[{33564D57-9980-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/D/0…D0C/wmv9dmo.cab

[WXcom Class]
CODEBASE = http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/…b?1162781728515

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdat…b?1175397217324

[F-Secure Online Scanner 3.0]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\fscax.dll
CODEBASE = http://support.f-secure.com/ols/fscax.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa…ash/swflash.cab

————————————————–

Enumerating Winsock LSP files:

Protocol #1: C:\WINDOWS\System32\VetRedir.dll
Protocol #2: C:\WINDOWS\System32\VetRedir.dll
Protocol #3: C:\WINDOWS\System32\VetRedir.dll
Protocol #15: C:\WINDOWS\System32\VetRedir.dll

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

————————————————–
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

1 = C:\WINDOWS\service32.exe

————————————————–

End of report, 5,872 bytes
Report generated in 6.016 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

=============================================================================

Here is the Blacklight log:

04/12/07 19:18:20 [Info]: BlackLight Engine 1.0.61 initialized
04/12/07 19:18:20 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/12/07 19:18:26 [Note]: 7019 4
04/12/07 19:18:26 [Note]: 7005 0
04/12/07 19:18:40 [Note]: 7006 0
04/12/07 19:18:41 [Note]: 7011 1776
04/12/07 19:18:41 [Note]: 7026 0
04/12/07 19:18:41 [Note]: 7026 0
04/12/07 19:19:23 [Note]: FSRAW library version 1.7.1021
04/12/07 20:19:58 [Note]: 7007 0


=============================================================================

And here is the new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 8:21:04 PM, on 4/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sbc.yahoo.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162781728515
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1175397217324
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe


=============================================================================
As for the computer's performance, I'll say that it does seem to reboot considerably faster now. And also, it's not finding the Doklin virus anymore. But starting new tasks is still quite slow, and also shortly after rebooting I get a Windows error, but this isn't new - this is a symptom I was having before I did your scans. The message appears in a dialog box entitled "Microsoft Windows", and the error message says "The system has recovered from a serious error. A log of this error has been created." I can choose between two buttons: , or . I think I've been clicking .

Also, although I had access to my home network when I rebooted, after awhile I lost access to it. It's possible this error I just spoke of is what's losing my network access.
Post #12
Hi Thromble,

First, we need to backup your registry using ERUNT - this program can be transferred over to the infected machine if required:
  • Please use the following link and scroll down to ERUNT and download it.
    http://aumha.org/freeware/freeware.php
  • For version with the Installer: use the setup program to install ERUNT on your computer
  • For the zipped version: Unzip all the files into a folder of your choice, such as C:\ERUNT
Run ERUNT from the start menu, or double-click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the backup folder and start ERDNT.exe

Then, open Notepad, and copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file.
Change the Save As Type to All Files and save it as fix.reg to your Desktop.

Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom.
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"1"=-

Locate fix.reg on your Desktop and double-click on it. When it asks if you want to merge with the registry, click Yes.

Then use Windows Explorer to find and delete this file (if present):
C:\WINDOWS\service32.exe

If this file is not present or you can't delete it then please let me know.

Next, I'd like to install and scan with AVG Antispyware. I don't know how difficult this will be for you, but you can at least transfer the files over to the machine and we will be doing the scan in Safe Mode so hopefully things will work more smoothly, but if you can't get it to work, then let me know :)

Please save/print a copy of these instructions as at times we will be using Safe Mode during which time you won't have access to the internet.

download, install, and update AVG Anti-Spyware 7.5
Download the installer from this page:
http://www.ewido.net/en/download/
Then download the full signature database from here:
http://downloads.ewido.net/avgas-signatures-full-current.exe
  • Save the the programs to your Desktop (and move them to the infected machine if required)
  • Double click the installer, select your language, and then select OK
  • Click NEXT->Do or don't read the "User License Agreement"
    Select I Agree->NEXT->INSTALL
  • AVG will now install and afterwards click FINISH
  • Then double-click the signatures installer and follow the on-screen instructions.
  • Once you have completed the signature installation, close all programs.
Reboot your computer into Safe Mode
To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads.
Select Safe Mode at the top, on the screen that appears.
Sign in with your normal user account

Once in safe mode:
  • Then run AVG Anti-Spyware 7.5 and click on the Scanner tab at the top
  • Click the Settings tab and then change the recommended action to Quarantine and ensure that Automatically generate report after every scan is selected and Un-check Only if Threats are found
  • Click back to the Scan tab and then click on Complete System Scan.
  • This scan can take quite a while to run, so be prepared.
  • AVG Anti-Spyware 7.5 will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action.
  • Click the Apply all actions button. AVG Anti-Spyware 7.5 will display All actions have been applied on the right hand side.
  • Click on Save Report, then Save Report As. This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Now reboot your computer normally

Once complete, please post the AVG Antispyware log and a new HijackThis log, also please tell me how you got on with the instructions and whether you found & deleted service32.exe or not.
Post #13

Reboot your computer into Safe Mode
To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads.
Select Safe Mode at the top, on the screen that appears.
Sign in with your normal user account


Just to clarify, I have two user accounts on my computer: one is an administrator account, and one is a user account without administrator privileges. I normally use the one that's not administrator, except throughout this whole process you've been coaching me through, I've been using the administrator account, because you've been having me install software, which requires the administrator. Above, when you say to sign in the normal user account, which one should I be logging in with?
Post #14
Hi Thromble, Please use the Administrator account for Safe Mode - you won't have the option of logging in as a limited user because Safe Mode only allows Administrators to log in.
Post #15
Something bad is happening. I followed your instructions down to the part of double-clicking on fix.reg. I then clicked 'Yes' to let it merge with the registry. Then while navigating inside Windows Explorer, before I could get a chance to see whether C:\WINDOWS\service32.exe exists or not, suddening my computer became quieter (but not completely quiet), and the screen went black. The keyboard then had no effect, nor did the mouse, nor ctrl-alt-delete. The screen was permanently black. Even the power button, which is supposed to force a reboot didn't work. So I unplugged it from the wall and plugged it back in again, and and got it to boot. Windows started up again, and I logged in as adminstrator. Once I launched Windows Explorer, the same thing happened. So I had to unplug again, and replug-in. This time I thought I'd try safe mode. That worked, and I was logged on as admininstrator in safe mode. Then I went to the shut down menu, and selected 'Restart'. It restarted, Windows came back, and I logged in as Administrator. It logged in, I saw my desktop, and before I could even click on Windows Explorer, it went black again (with much of the internal sounds dying down.) So at this point, I'm stuck and don't know how to continue.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI