What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

virus problems - please help.

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi,

I would very much appreciate some help with an attack on my PC.

The main problems I have seen are similar to what has been described here:

- starting windows was very difficult, each time I tried to start up, it seemed exhibit different behaviour, often locking up in diffferent places in the boot sequence
- whenever I try to use IE, I am redirected to different sites offering virus protection software,

I managed to get to a point where I could log in by eventually running an AVG virus scan can an manually rename some of the files that the attack had added. I identified the following files that had been installed at the time of the infection (they also agreed with some of the files describe in http://uk.mcafee.com/virusInfo/default.asp…virus_k=150856)
c:\windows\peltodgx.dll
c:\windows\fbxrqtwn.exe
c:\windows\ewnr.exe
c:\windows\dfmlxbpkxtst.dll
c:\windows\rwlfsdmk.dll
c:\windows\onfwbsak.dll
c:\windows\system32\lphc5qfj0er7c.exe
c:\windows\system32\maulqr.dll
c:\windows\system32\mxyvfybr.dll
c:\windows\system32\pch5qfj0er7c.bmp
c:\windows\system32\pnoLcyx.dll
c:\windows\system32\uguabbmn.dll

I could then log in, but the following problems persist.
- my permissions have been altered (e.g. I can't start taskmanager, many of the items are missing from teh start menu, e.g Run)
- my wallpaper had been changed to virus picture
- a new toolbar had been installed in IE (peltodgx)
- i get spurious virus / spyware pop-ups
- the machine locks up after a while

I ran the HiJackThis log as administrator (not my usual login of Damian) with the PC started in in safemode. This seem to give the most stable working environment.

Logfile of HijackThis v1.99.1
Scan saved at 10:28:30, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Webshots Toolbar - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O3 - Toolbar: peltodgx - {7AD00A4D-FE01-4515-A981-C428845ABCA6} - C:\WINDOWS\peltodgx.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Acronis†True†Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [PhiBtn] %SystemRoot%\System32\drivers\PhiBtn.exe
O4 - HKLM\..\Run: [Traymin900] %SystemRoot%\System32\drivers\Tray900.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [eTMonitor] C:\Program Files\Common Files\Aladdin Shared\eToken\PKIClient\x32\PKIMonitor.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [in3] C:\Documents and Settings\Damian.QUIETPC\Local Settings\Temp\.tt9B.tmp.exe /CR=32BDDFA41AB960FB7FD33779695D38B40311B3CA8C6CD3371A764721AC17F04BEA4C9FEBDCE6D
75DD3421856FBE89B2DD292ABE5A0A6D3245E8C17C22418300045F5AF4AC7543130FD2720FB65724
E
D964
O4 - HKLM\..\Run: [inrhc1qfj0er7c] C:\Documents and Settings\Damian.QUIETPC\Local Settings\Temp\.tt9B.tmp.exe /CR=D41D8CD98F00B204E9800998ECF8427E
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [jitofehele] Rundll32.exe "C:\WINDOWS\system32\madujeri.dll",s
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [d86ddf3c] rundll32.exe "C:\WINDOWS\system32\amfkvery.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: VPN Client.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1164705290828
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MSN Music Mediabar) - http://sib1.od2.com/common/musicmanager/in…nagerPlugin.CAB
O16 - DPF: {DCDC28C5-831C-43EA-9C02-78872CCCA409} (VPlayer Control) - http://thesecret.tv/movie/player/vivid_ocx.jpeg
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: maulqr.dll,C:\WINDOWS\system32\zayezeru.dll
O21 - SSODL: rwlfsdmk - {8CD0C31C-0DB1-4A0A-8C09-672B2EE4BCB9} - C:\WINDOWS\rwlfsdmk.dll (file missing)
O21 - SSODL: onfwbsak - {6908E483-D389-481D-8E98-5E82F8E5A13E} - C:\WINDOWS\onfwbsak.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adventus Interactive: Piano Suite Premier update permissions manager. 10365. - Unknown owner - C:\Program Files\Piano Suite\PSuite.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Thanks in advance for your help

Damian

sorry, just noticed a typo on the second line. It should read:

"The main problems I have seen are described here: "

Thanks

Damian.
Post #2
[external image: Posted Image]


Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #3
Hi, Thanks for your suggestions. I'm sorry to report that things aren't looking too bright at the moment! When I start in safe mode I get a blue screen saying 'video driver failed to initialise' when I start in normal mode, I get a pop up saying 'C:\windows\system32.dll\madujeri.dll The specified module could not be found'. The System Configuration Utility is also shown, if I try to disable majujeri.dll in the StartUp menu, when I click save, the PC locks up. If I 'cancel' the configuration edit, the machine is mostly totally unresponsive. I managed to get the task manager running once and the following processes were taking turns in running the CPU up to over 90% for quite a while: pctsGui.exe wscntfy.exe pctssvc.exe usnsvc.exe from a internet search i saw that the pctsXXX.exe files are to do with Spyware doctor. Eventually these processes stopped consuming CPU and I tried removing Spyware Doctor, but the uninstall process just sits at 97% CPU and doesn't complete. The Malwarebytes' Anti-Malware log is included below. Thanks Damian. Malwarebytes' Anti-Malware 1.28 Database version: 1221 Windows 5.1.2600 Service Pack 2 29/09/2008 12:01:19 mbam-log-2008-09-29 (12-01-19).txt Scan type: Quick Scan Objects scanned: 62613 Time elapsed: 2 minute(s), 29 second(s) Memory Processes Infected: 0 Memory Modules Infected: 3 Registry Keys Infected: 26 Registry Values Infected: 13 Registry Data Items Infected: 21 Folders Infected: 5 Files Infected: 89 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\augauyah.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\efcYPjHb.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\iifgEtut.dll (Trojan.Vundo.H) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{78130a3e-a403-4bb1-81c9-e263d4f880e8} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cba51002-7261-4600-a9e1-fee2654e4ea6} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{d3ccfaf7-df03-4e73-95ec-e5e139cc2bf2} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{f5c411f2-0d9e-4c8a-97cf-001d8ade1e6a} (Trojan.BHO.H) -> Delete on reboot. HKEY_CLASSES_ROOT\peltodgx.bdnx (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\peltodgx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instbndlkeyldr (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efcypjhb (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78130a3e-a403-4bb1-81c9-e263d4f880e8} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cba51002-7261-4600-a9e1-fee2654e4ea6} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d3ccfaf7-df03-4e73-95ec-e5e139cc2bf2} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f5c411f2-0d9e-4c8a-97cf-001d8ade1e6a} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bug doctor_is1 (Rogue.BugDoctor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\backupwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d3ccfaf7-df03-4e73-95ec-e5e139cc2bf2} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d86ddf3c (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inrhc1qfj0er7c (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jitofehele (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\onfwbsak (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\rwlfsdmk (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (55274-640-0000356-23332) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\iifgetut -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iifgetut -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Bug Doctor (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Bug Doctor\Bonus Software!.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Bug Doctor\BugDoctor.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Bug Doctor\Thumbs.db (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Bug Doctor\Uninstall BugDoctor.lnk (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Desktop\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Damian.QUIETPC\Local Settings\Temporary Internet Files\Content.IE5\OPE3SH2V\upd105320[1] (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Guest\Desktop\???? ??? ??????? ??? ?????.doc (Trojan.Extension.Exploit) -> Quarantined and deleted successfully. C:\Documents and Settings\Guest\Local Settings\Temp\rqRkIYpn.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\Bonus Software.url (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\Bug Doctor Help.chm (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\BugDoctor.exe (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\BugDoctorLiveUpdate.exe (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin.ini (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\LiveUpdate_disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\LiveUpdate_normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\LiveUpdate_pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\LiveUpdate_rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\SubMainDisable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\SubMainNormal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\SubMainPressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\SubMainRollOver.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\bug.swf (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fix_complete-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fix_complete-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fix_complete-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fix_complete-roll_over.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fixing_error-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fixing_error-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fixing_error-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\fixing_error-rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\main_disable.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\main_enable.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\main_pressed.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\main_roll_over.jpg (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\mask.bmp (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\mask1.bmp (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scan.swf (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scan_complete-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scan_complete-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scan_complete-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scan_complete-roll_over.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scancomplete.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scanning_error-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scanning_error-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scanning_error-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\scanning_error-rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\schedule_disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\schedule_normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\schedule_pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\schedule_rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\skin.ini (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\support_disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\support_normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\support_pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\support_rollover.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\unlock_key-disable.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\unlock_key-normal.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\unlock_key-pressed.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\skin\unlock_key-roll_over.gif (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\unins000.dat (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\Program Files\Bug Doctor\unins000.exe (Rogue.BugDoctor) -> Quarantined and deleted successfully. C:\WINDOWS\ewnr.old.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\amfkvery.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\augauyah.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\bummovin.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\efcYPjHb.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\fxhthark.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hayuagua.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\iifgEtut.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\krahthxf.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\madujeri.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\maulqr.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nivommub.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ratifuya.dll (Trojan.BHO.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tutEgfii.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tutEgfii.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xxyaaAtq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\yrevkfma.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
Post #4
Stay with this topic until I give you the all clean post.

You might want to print these instructions out.


Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.

Make sure you are disconnected from the net

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net

2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.
Give it atleast 20-30 minutes to finish if needed.
Post #5
Hi, My PC had become totally unusable, and I was running out of time. I've decided to reinstall the operating system. We can close out this post. Thanks anyway for your help. Damian.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI