What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] so many ailments

120 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

Do you want to try and restore those from C:\Documents and Settings\DQ?
Look for a file / folder in C:\combofix named erdnt



i would like to restore some of the files if possible…. mainly just a folder of picture files from birthdays/parties/gatherings.

i found a file called erdnt.e_e
Post #17
Lets restore everything and start over. Navigate to and double click the following file: C:\WINDOWS\ERDNT\subs\erdnt.exe Restart your computer,
Post #18
C:\Program Files\AntiSpyKit 5.2
C:\Program Files\AntiSpyKit 5.2\Logs\scan_log_02152008-081718.html
C:\Program Files\Coupons
C:\Program Files\Coupons\Coupons.com.url
C:\Program Files\Coupons\uninstall.exe
C:\Program Files\Coupons\Uninstall\IRIMG1.JPG
C:\Program Files\Coupons\Uninstall\IRIMG2.JPG
C:\Program Files\Coupons\Uninstall\IRIMG3.JPG
C:\Program Files\Coupons\Uninstall\IRIMG4.JPG
C:\Program Files\Coupons\Uninstall\IRIMG5.JPG
C:\Program Files\Coupons\Uninstall\IRIMG6.JPG
C:\Program Files\Coupons\Uninstall\IRIMG7.JPG
C:\Program Files\Coupons\Uninstall\IRIMG8.JPG
C:\Program Files\Coupons\Uninstall\uninstall.dat
C:\Program Files\Coupons\Uninstall\uninstall.xml
C:\Program Files\FreeRIP2
C:\Program Files\FreeRIP2\bulgarian.lang
C:\Program Files\FreeRIP2\bundlic.txt
C:\Program Files\FreeRIP2\catalan.lang
C:\Program Files\FreeRIP2\community.url
C:\Program Files\FreeRIP2\czech.lang
C:\Program Files\FreeRIP2\danish.lang
C:\Program Files\FreeRIP2\deutsch.lang
C:\Program Files\FreeRIP2\english.lang
C:\Program Files\FreeRIP2\espanol.lang
C:\Program Files\FreeRIP2\finnish.lang
C:\Program Files\FreeRIP2\francais.lang
C:\Program Files\FreeRIP2\freerip.url
C:\Program Files\FreeRIP2\FreeRip2.cnt
C:\Program Files\FreeRIP2\freerip2.exe
C:\Program Files\FreeRIP2\FreeRip2.hlp
C:\Program Files\FreeRIP2\griechisch.lang
C:\Program Files\FreeRIP2\hebrew.lang
C:\Program Files\FreeRIP2\History.txt
C:\Program Files\FreeRIP2\hungarian.lang
C:\Program Files\FreeRIP2\italiano.lang
C:\Program Files\FreeRIP2\kbase.url
C:\Program Files\FreeRIP2\korean.lang
C:\Program Files\FreeRIP2\lame_enc.dll
C:\Program Files\FreeRIP2\latvian.lang
C:\Program Files\FreeRIP2\lgpl.txt
C:\Program Files\FreeRIP2\License.txt
C:\Program Files\FreeRIP2\mpglib.dll
C:\Program Files\FreeRIP2\nederlands.lang
C:\Program Files\FreeRIP2\norsk.lang
C:\Program Files\FreeRIP2\polski.lang
C:\Program Files\FreeRIP2\portugues_brasil.lang
C:\Program Files\FreeRIP2\Readme.txt
C:\Program Files\FreeRIP2\russian.lang
C:\Program Files\FreeRIP2\s_chinese.lang
C:\Program Files\FreeRIP2\slovak.lang
C:\Program Files\FreeRIP2\srpski.lang
C:\Program Files\FreeRIP2\svenska.lang
C:\Program Files\FreeRIP2\t_chinese.lang
C:\Program Files\FreeRIP2\Türkçe.lang
C:\Program Files\FreeRIP2\unins000.dat
C:\Program Files\FreeRIP2\unins000.exe
C:\Program Files\NetProject
C:\Program Files\NetProject\ot.ico
C:\Program Files\NetProject\sbmdl.dll
C:\Program Files\NetProject\sbmntr.exe
C:\Program Files\NetProject\sbsm.exe
C:\Program Files\NetProject\scit.exe
C:\Program Files\NetProject\scm.exe
C:\Program Files\NetProject\scu.exe
C:\Program Files\NetProject\ts.ico
C:\Program Files\NetProject\waun.exe
C:\Program Files\WinSpyKiller
C:\Program Files\WinSpyKiller\WinSpyKiller.lic
C:\Program Files\WinSpyKiller\WinSpyKiller0.wk
C:\Program Files\WinSpyKiller\WinSpyKiller1.wk
C:\WINDOWS\REFOSUVMIFFVSU5O\lHIimopgKIIpmoci.vbs
C:\Documents and Settings\DQ . . . . failed to delete
C:\Documents and Settings\DQ\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat . . . . failed to delete
C:\Documents and Settings\DQ\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG . . . . failed to delete
C:\Documents and Settings\DQ\NTUSER.DAT . . . . failed to delete
C:\Documents and Settings\DQ\ntuser.dat.LOG . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-01-16 to 2008-02-16 )))))))))))))))))))))))))))))))
.

2008-02-16 15:23 . 2008-02-16 15:23 4,816,078 –a—— C:\catchme.zip
2008-02-16 11:02 . 2008-02-16 11:03 284 –a—— C:\WINDOWS\wininit.ini
2008-02-16 10:24 . 2008-02-16 10:24 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-16 10:24 . 2008-02-16 11:03 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-16 10:17 . 2008-02-16 13:21 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-16 10:17 . 2008-02-16 10:17 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-16 00:16 . 2008-02-16 00:16 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-16 00:16 . 2008-02-16 00:17 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-15 11:33 . 2008-02-15 11:33 81,814 –a—— C:\WINDOWS\system32\instdump.dmp
2008-02-15 11:33 . 2008-02-15 11:33 14,449 –a—— C:\WINDOWS\system32\instdump.zip
2008-02-15 01:24 . 2008-02-15 11:30 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-04 06:10 . 2008-02-04 06:10 d——– C:\Program Files\CDisplay
2008-01-28 07:21 . 2008-01-28 07:21 d——– C:\Program Files\VideoLAN
2008-01-27 20:04 . 2008-02-09 17:06 d——– C:\Program Files\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-16 17:56 ——— d—–w C:\Program Files\Google
2008-02-16 08:31 ——— d—–w C:\Program Files\LongLifePC
2008-02-16 08:16 ——— d—–w C:\Program Files\Lavasoft
2008-02-11 02:55 ——— d—–w C:\Program Files\Full Tilt Poker
2008-01-20 19:41 ——— d—–w C:\Program Files\McAfee
2008-01-03 04:52 ——— d—–w C:\Program Files\Virtual Earth 3D
2008-01-01 07:30 ——— d—–w C:\Program Files\T-Minus Countdown Clock
2007-12-31 21:36 ——— d—–w C:\Program Files\Yahoo!
2007-12-23 22:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2007-12-23 22:49 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-23 22:49 ——— d—–w C:\Program Files\Dell
2007-12-22 14:58 ——— d—–w C:\Program Files\Common Files\aolshare
2007-12-22 14:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2007-12-22 14:56 ——— d—–w C:\Program Files\Real
2007-12-22 14:55 ——— d—–w C:\Program Files\LimeWire
2007-12-20 00:22 ——— d—–w C:\Program Files\Incomplete
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\system32\drivers\mrxdav.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DIAGENT"="C:\Program Files\Creative\SBLive\Creative Diagnostics 2.0\DIAGENT.exe" [2001-08-30 01:00 172122]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00 90112]
"AHQInit"="C:\Program Files\Creative\SBLive\Program\AHQInit.exe" [2001-03-27 17:00 102400]
"AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 15:31 655360]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 16:34 24576]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 13:52 331830]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-09-13 21:36 50688]
"LXSUPMON"="C:\WINDOWS\System32\LXSUPMON.exe" [2002-08-15 02:26 886272]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 10:22 155648]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 14:46 57393]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 15:04 40960]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-14 09:41 185896]
"SetDefPrt"="C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe" [2004-05-25 09:16 49152]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 09:34 851968]
"FLMOFFICE4DMOUSE"="C:\Program Files\Browser Mouse\mouse32a.exe" [2006-12-07 00:23 356352]
"VerizonServicepoint.exe"="C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe" [2006-02-01 18:33 1880064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"FlashGet"="C:\Program Files\FlashGet\FlashGet.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"{50E82035-0702-1033-0318-021220010001}"="C:\Program Files\Common Files\{50E82035-0702-1033-0318-021220010001}\Update.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42 267064]
"HostManager"="C:\Program Files\Common Files\AOL\1194988904\ee\AOLSoftware.exe" [2006-09-25 16:52 50736]
"{50E82035-0703-1033-0318-021220010001}"="C:\Program Files\Common Files\{50E82035-0703-1033-0318-021220010001}\Update.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digimax Viewer 2.0.lnk - C:\Program Files\Samsung\Digimax Viewer 2.0\STImgBrowser.exe [2007-03-26 09:32:32 626688]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56 65588]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 15:06:54 24633]

R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\Drivers\BrScnUsb.sys [2003-12-19 21:15]
R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27]
R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28]
S3 ACTNDIS5;ACTNDIS5 NDIS Protocol Driver;C:\PROGRA~1\ACTION~1\DslAOL\ACTNDIS5.SYS [2002-09-25 22:55]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-09-27 16:12]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-10 02:29:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 09:00:03 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-02-01 14:22:24 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-16 15:26:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
.
**************************************************************************
.
Completion time: 2008-02-16 15:32:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-16 23:31:56
ComboFix2.txt 2008-02-16 21:25:51
.
2008-02-16 11:25:22 — E O F —






there is the end of the combofix log…………… there is a gap between posts which is just a list of folders in the documents and settings/dq directory


all of which are unimportant to keep with the exception of this one location C:\Documents and Settings\DQ\My Documents\My Pictures\
Post #19

Lets restore everything and start over.
Navigate to and double click the following file: C:\WINDOWS\ERDNT\subs\erdnt.exe

Restart your computer,

Post #26
rebooted. here is a general rundown of what there is. the previous wallpaper was reset in the desktop settings…. but the actual file wasn't restored. spybot s&d lavasoft adaware and 1 or 2 other programs i recognize have been restored and are running normally. 2 or 3 desktop items (ie shortcuts ) are returned but other desktop items ( folders files and programs) are still missing. some erraneous music and picture files are in there respective "my pictures" and "my music" folders. but only a small handful and seemingly random from what i can tell. the computer is still behaving normally and responding well otherwise.
Post #29
Sorry about that.

Lets see some new logs.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.


Also post a new HijackThis log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI