Issues Getting Bigger - Part 2

Hi nikid506,

Let's rule out possible malware first.

Please set your system to show all files; please see here if you're unsure how to do this.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders, and delete them:
C:\WINDOWS\SYSTEM32\mobho.dll<=file
Exit Explorer, and reboot as normal afterwards.


GMER
Please create a new subfolder in the Program Files folder called GMER. If you have an older version of GMER installed, you must delete it.

• Download GMER and extract it to the C:\program files\GMER folder.
• Please rename the GMER file
  Note: You can rename gmer.exe to anything you like as long as you keep the .exe ending.
  Run the Gmer.exe renamed program by double-clicking the executable file (gmer.exe) in Windows Explorer.
  You may be prompted to scan immediately if GMER detects rootkit activity.
• If you are prompted to scan your system click "yes" to begin the scan.
• If you are not prompted, Click the "Rootkit" tab, then click "Scan".

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.

Please post (reply) with the results from the GMER scan, and a fresh hijackthis log.

=============================
If you have your Dell manual (I am looking at one called "Reference and Troubleshooting Guide"), there should be a section "Running the Dell Diagnostics" which tells you how to use the Dell Dimension ResourceCD to check your hardware. I would recommend that you do this and record and messages that you receive. This is out of my expertise but you may need to go to the Dell boards and receive help with this. Please let me know if you have the documentation for running the diagnostics.

Susan,
I have not idea how to start a fresh forum, so I'm naming this one Part 2, not the most brillaint idea. Anway, here is my log – I was able to delete that file in safe mode as well. I have the Dell Dimension ResourceCD for Reinstalling Device Driver etc…but no manual. I'll go online and see if I can get it. See below for my log. Thank you in advance. Nicole

GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-04-26 23:27:33
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.12 —-

SSDT 832DD630 ZwAlertResumeThread
SSDT 832E8690 ZwAlertThread
SSDT 83261B10 ZwAllocateVirtualMemory
SSDT 831D05A0 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwCreateKey
SSDT 8325E1C0 ZwCreateMutant
SSDT 8321B1B8 ZwCreateThread
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwDeleteKey
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwDeleteValueKey
SSDT 832DFCC8 ZwFreeVirtualMemory
SSDT 8325E8D8 ZwImpersonateAnonymousToken
SSDT 8325E9B0 ZwImpersonateThread
SSDT 831BEFB0 ZwMapViewOfSection
SSDT 832DC258 ZwOpenEvent
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess
SSDT 8323AC10 ZwOpenProcessToken
SSDT 832E1C08 ZwOpenThreadToken
SSDT 8322EDE0 ZwQueryValueKey
SSDT 831F9A40 ZwResumeThread
SSDT 831F3258 ZwSetContextThread
SSDT 832D8978 ZwSetInformationProcess
SSDT 832DCD98 ZwSetInformationThread
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS ZwSetValueKey
SSDT 832EB9F0 ZwSuspendProcess
SSDT 832E6958 ZwSuspendThread
SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess
SSDT 831D9148 ZwTerminateThread
SSDT 83271368 ZwUnmapViewOfSection
SSDT 831D9DE0 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.12 —-

? C:\WINDOWS\System32\DRIVERS\update.sys

—- Registry - GMER 1.0.12 —-

Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{5BE3D010-3EF3-EA3A-19EA72F7729702DF}\{352FFD75-9B70-D323-D2F13A6467AA3E3D}\{81CD47E4-7EF3-579C-2C259DBE42414B54}@63AUOURV1X6YIYB2ELIFO4LTRC1 0x01 0x00 0x01 0x00 …

—- EOF - GMER 1.0.12 —-