What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] broken internet ntdll64.dll file missing

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
OK I have a feeling that userinit is infected I would like to check that out now and if it is I will have a fresh copy prepared for you to replace it with

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Post #17
well i ran the combo fix and rebooted and ran MBAM again and it found nothing this time so im guessing that it finally found the last thing on there…….

anyway here is the log from combo

ComboFix 09-01-21.04 - King of Suicide 2009-01-24 0:39:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.554 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
AV: Sunbelt VIPRE *On-access scanning disabled* (Outdated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\system32\win32hlp.cnf

—– BITS: Possible infected sites —–

hxxp://childhe.com
Infected copy of C:\WINDOWS\system32\userinit.exe was found and disinfected
Restored copy from - C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

.
((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.

2009-01-22 17:18 . 2009-01-22 20:38 d——– C:\Documents and Settings\King of Suicide\DoctorWeb
2009-01-22 17:11 . 2009-01-22 17:11 d——– C:\_OTScanIt
2009-01-18 21:21 . 2009-01-18 21:22 d——– C:\Program Files\SuperAdBlocker.com
2009-01-18 21:21 . 2009-01-18 21:21 d——– C:\Documents and Settings\King of Suicide\Application Data\SuperAdBlocker.com
2009-01-18 20:17 . 2009-01-18 20:17 d——– C:\Program Files\Paltalk Messenger Interop
2009-01-18 20:17 . 2009-01-18 20:17 d——– C:\Program Files\Activision
2009-01-06 00:24 . 2009-01-23 13:01 d——– C:\Program Files\Malwarebytes' Anti-Malware
2009-01-06 00:24 . 2009-01-06 00:24 d——– C:\Documents and Settings\King of Suicide\Application Data\Malwarebytes
2009-01-06 00:24 . 2009-01-06 00:24 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-01-06 00:24 . 2009-01-14 16:11 38,496 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2009-01-06 00:24 . 2009-01-14 16:11 15,504 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2009-01-05 20:39 . 2009-01-05 20:39 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-05 20:38 . 2009-01-05 20:38 d——– C:\Program Files\SUPERAntiSpyware
2009-01-05 20:38 . 2009-01-05 20:38 d——– C:\Documents and Settings\King of Suicide\Application Data\SUPERAntiSpyware.com
2009-01-05 20:36 . 2009-01-18 21:21 d——– C:\Program Files\Common Files\Wise Installation Wizard
2009-01-05 20:21 . 2009-01-05 20:21 d——– C:\Program Files\CCleaner
2009-01-05 18:54 . 2009-01-05 18:54 d——– C:\Program Files\Trend Micro
2009-01-01 20:05 . 2008-09-12 11:12 69,168 –a—— C:\WINDOWS\system32\drivers\sbapifs.sys
2009-01-01 20:05 . 2008-09-12 11:12 13,360 –a—— C:\WINDOWS\system32\drivers\sbaphd.sys
2009-01-01 19:51 . 2009-01-01 19:51 d——– C:\Documents and Settings\King of Suicide\Application Data\Sunbelt
2009-01-01 19:51 . 2009-01-01 19:51 d——– C:\Documents and Settings\All Users\Application Data\Sunbelt
2009-01-01 19:29 . 2008-10-09 10:21 202,928 –a—— C:\WINDOWS\system32\drivers\sbtis.sys
2009-01-01 19:28 . 2009-01-01 19:28 d——– C:\Program Files\Sunbelt Software
2009-01-01 18:45 . 2009-01-01 18:45 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2009-01-01 12:02 . 2009-01-01 12:03 d——– C:\WINDOWS\system32\Adobe
2008-12-31 09:19 . 2008-12-31 09:19 d——– C:\WINDOWS\system32\scripting
2008-12-31 09:19 . 2008-12-31 09:19 d——– C:\WINDOWS\system32\en
2008-12-31 09:19 . 2008-12-31 09:19 d——– C:\WINDOWS\system32\bits
2008-12-31 09:19 . 2008-12-31 09:19 d——– C:\WINDOWS\l2schemas
2008-12-31 09:15 . 2008-12-31 09:15 d——– C:\WINDOWS\ServicePackFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-07 22:12 ——— d–h–w C:\Program Files\InstallShield Installation Information
2009-01-07 22:06 ——— d—–w C:\Program Files\Verizon Online
2009-01-07 22:05 ——— d—–w C:\Program Files\Ubi Soft
2009-01-06 01:33 ——— d—–w C:\Program Files\LimeWire
2009-01-01 18:01 ——— d—–w C:\Documents and Settings\King of Suicide\Application Data\WeatherBug
2008-12-19 21:15 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-12-18 17:19 ——— d—–w C:\Program Files\Java
2007-12-19 03:33 22,328 —-a-w C:\Documents and Settings\King of Suicide\Application Data\PnkBstrK.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-07-20 11:01 67128]
"Weather"="C:\PROGRA~1\AWS\WEATHE~1\Weather.exe" [2006-04-07 14:02 1343488]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2007-01-12 02:09 488984]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2007-01-12 02:12 244512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-18 11:20 136600]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 05:24 286720]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-12 19:05 185896]
"SBAMTray"="C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe" [2008-10-28 16:30 955688]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 12:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-07 01:33 8720384]

C:\Documents and Settings\Naruto\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 20:44:36 101440]

C:\Documents and Settings\King of Suicide\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2007-08-28 16:43:52 256000]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-07-20 11:01:39 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-19 15:43:18 784912]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 09:13 77824]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [2006-11-07 12:58 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SABWinLogon]
2007-08-01 09:28 176128 C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 10:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2007-03-05 16:36 140976 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalStart.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalStart.lnk
backup=C:\WINDOWS\pss\PalStart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^King of Suicide^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\King of Suicide\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2007-03-09 10:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
——— 2008-04-13 18:12 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-06-29 05:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2007-08-30 17:43 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
–a—— 2007-06-08 08:59 224248 C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\TightVNC\\WinVNC.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Sierra\\FEAR\\fpupdate.exe"=
"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"C:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 SABKUTIL;SABKUTIL;C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.SYS [2007-02-20 16:02:54 32256]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 11:06:00 8944]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 11:05:58 55024]
R1 sbaphd;sbaphd;C:\WINDOWS\system32\drivers\sbaphd.sys [2009-01-01 20:05:44 13360]
R1 sbtis;sbtis;C:\WINDOWS\system32\drivers\sbtis.sys [2009-01-01 19:29:55 202928]
R4 LBeepKE;LBeepKE;C:\WINDOWS\system32\drivers\LBeepKE.sys [2007-07-19 15:43:20 3712]
R4 SBAMSvc;VIPRE Antivirus + Antispyware;C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe [2008-10-28 16:28:10 886056]
R4 sbapifs;sbapifs;C:\WINDOWS\system32\drivers\sbapifs.sys [2009-01-01 20:05:46 69168]
S1 SABDIFSV;SABDIFSV;C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabdifsv.sys [2005-09-21 11:17:26 5632]
S3 SASENUM;SASENUM;C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 11:06:02 7408]
S3 SBRE;SBRE;C:\WINDOWS\system32\drivers\SBREDrv.sys [2008-10-23 04:09:24 92464]
S3 urvpndrv;F5 Networks VPN Adapter;C:\WINDOWS\system32\DRIVERS\urvpndrv.sys –> C:\WINDOWS\system32\DRIVERS\urvpndrv.sys [?]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-Ulead AutoDetector v2 - C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe


.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
IE: &Search
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB
DPF: {447A07F8-1CC5-44FF-BE2D-854BCBB0D20C} - hxxp://www.ordea.com/objects/ax46/aiiwwax.cab
FF - ProfilePath - C:\Documents and Settings\King of Suicide\Application Data\Mozilla\Firefox\Profiles\olyk3lq7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
.
Post #18

Infected copy of C:\WINDOWS\system32\userinit.exe was found and disinfected
Restored copy from - C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

Cool that saves me having to give you a new copy and writting an FCopy batch.. OK you are now good to go. Sorry about that hiccup

Please revisit the security instructions

Keep safe
Post #20
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI