AnimeSuki Forums

kakakka · 2009-09-01, 15:41

Last week I got a problem in my computer, making it disable/close/unable to open some of these things

1) Task Manager
2) Yahoo Messenger
3) Yahoo Mail/MSN
4) Norton Anti-Virus
5) Any update
etc (that I don't know)

Now I got Malwarebytes' and Superantispyware to scan my computer for something bad, (Malwarebytes 2-3 times before PC restore and 1 time after PC restore then 1 time for SAS). Also did AVG before PC restore, but it mess up a bit (it didn't stop scanning). I also downloaded Spybot(?) after the PC restore, but it won't open/run for some reason.

Now I can access/do 2, 3, and 5 after PC restore and scanning. Didn't redownload Norton. Still can't access Task manager. I found out I can't access regedit. I remember from the logs (whose I don't have right now) from Malwarebyte's that somethings are hijacking those files that can't easily erased/solved by Malwarbytes' even by restarting, so what do I do now? I think there's still a problem.

Any websites that answers this question is also welcome.

Thanks in advance

Claies · 2009-09-01, 23:50

Sounds like malware. Have you tried doing the above in safe mode?

Also, can HijackThis run? If it can, please have it perform a scan and put the logs up here.
http://download.cnet.com/Trend-Micro...-10227353.html

I'd go for a full format and reinstall if this doesn't work out. That's pretty entrenched in the OS and it'd be difficult to render it completely clean again.

kakakka · 2009-09-02, 10:11

It doesn't go to Safe Mode

Here's the result from HiJackThis

Spoiler for hijackthis:

These entries always show up in Malwarebyte scans

Spoiler for mbam-log:

SaintessHeart · 2009-09-02, 12:39

Quote:

Originally Posted by kakakka

It doesn't go to Safe Mode

Here's the result from HiJackThis

Spoiler for hijackthis:

These entries always show up in Malwarebyte scans

Spoiler for mbam-log:

OT : Funny, your computer runs BOTH HP and Compaq's custom programs. Rule of the thumb : never install or run anything packaged under the computer's brand name, they are usually useless and full of bugs. Just install the drivers they give you.

You mean it hangs when you try to go into safemode?

Had the same problem recently, need to try a few times for me. Anyway I bolded the potential malware on hijackthis already, the red on being the most suspicious.

Regedit seems to be disabled, one of the first few signs of something wrong. Only the dumbest of system administrators managing a network would disable regedit IMO, because it doesn't help to slow infection of malware, only helps to deter port intrusions.

1. Uninstall Google toolbar and Superantispyware. For the latter product, DELETE anything it quarantined. Don't restart your computer yet if it does prompt.

2. Download and run CCleaner. Clean up your registry AND temp files, then go disable system restore. Now you can restart.

3. Backup your Registry if you can access regedit, and quarantine the backup in an antivirus. Delete the stuff I bolded on hijackthis. Before you do that, rename hijackthis.exe with something random like "uguuuguu123456.exe" and set the file as read-only. Post the new hijackthis log here if you can, and if possible, the safemode one too.

EDIT :

I am not sure if this works, but try if you want, since your computer is pretty much either a test subject or a gone case.

Open notepad and copypasta this in :

Quote:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System\DisableRegistryTools]

Save it as "Repair.reg" by selecting the file type to save as All Files, and putting in the filename.

This too :

Quote:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System\DisableTaskMgr]

Save this as "repair2.reg" under same methods.

Run both the .reg files and replace the registry values, then go back to step 3 before my edit to post a new hijackthis log.

P.S If they don't work modify the files with these

Spoiler for just in case:

I haven't been building .reg files for a bloody long time, close to half a decade.

kakakka · 2009-09-02, 15:45

Quote:

Funny, your computer runs BOTH HP and Compaq's custom programs. Rule of the thumb : never install or run anything packaged under the computer's brand name, they are usually useless and full of bugs. Just install the drivers they give you.

I think it already have them (Compaq files) when my family got the computer. Though it might got hp extras when we installed the printer.

Quote:

You mean it hangs when you try to go into safemode?

The computer restarts again if I try to choose any Safe Mode when I F8 while starting.

I'll try what you said. Thanks for the reply

________________

Unfortunately, that didn't work.

Added AVG. Then got up to no. 2 of your step

no. 3 seems no go since I still can't access regedit

CCleaner is also blocked, after I did no. 2

tried the EDIT: didn't work too

here's a log now...

Spoiler for hijackthis:

SaintessHeart · 2009-09-02, 23:22

Quote:

Originally Posted by kakakka

I think it already have them (Compaq files) when my family got the computer. Though it might got hp extras when we installed the printer.

Please tell me it is a second-hand!

Quote:

Originally Posted by kakakka

Unfortunately, that didn't work.

Added AVG. Then got up to no. 2 of your step

no. 3 seems no go since I still can't access regedit

CCleaner is also blocked, after I did no. 2

tried the EDIT: didn't work too

here's a log now...

Spoiler for hijackthis:

The CLOAKER.EXE looks bloody suspicious. Tried running your computer in administrator mode? Or that default user is the admin?

Here are some solutions :

Go run and type in cmd, press enter. Type in "chkdsk /f", pressing Y when it asks you to. Type in "shutdown -r -t 01". Let it fix any errors then try to boot in safemode for a hijackthis log.

If not :

1. Uninstall AVG, CCleaner, Spybot but keep their installation programs (other than AVG). Download Avast! BUT DON'T install it yet.

2. Then download these :

http://www.filefactory.com/file/ah52g1c/n/uguu_reg

http://www.filefactory.com/file/ah52h1a/n/desu_reg

3. And run uguu.reg FIRST, then desu.reg. You should be able to start up your registry now. Go under

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System

Modify ALL the values other than default to 0 (keeping value type as hexadecimal). Then go under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\

4. Modify these values to 1 :

AntiVirusDisableNotify
FirewallDisableNotify
UpdateDisableNotify

5. Install Avast and run a boot scan. If Avast does a restart run uguu and desu and loop the registry modifications before proceeding with the install.

6. Download Scar5's Simple File Shredder to shred out cloaker.exe if you find it on Windows search. At any rate, I need the hijackthis log in safe mode.

To try an alternate method in safe mode, go Start>Run and type in msconfig. Under BOOT.INI select /SAFEBOOT. Restart.

If it throws the computer into a loop, press F8 and start up in normal mode.

If such an error recurrs we are in trouble. I will try and find the solution to that CLOAKER.EXE program on my end.

Claies · 2009-09-03, 01:42

CLOAKER.exe looks like an HP driver. He doesn't need it anyway, but I'm much more worried of this one:

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1

I don't have time to search right now, but I'd prioritize sending that "Pol icies" directory to the sun.

demonix · 2009-09-03, 03:41

Quote:

Originally Posted by Claies

CLOAKER.exe looks like an HP driver.

It is and the location it's running from is correct according to process library.

Also you shouldn't have more then 1 anti-virus installed since it can cause problems and even I wouldn't have AVG installed since it's a complete and total placebo.

kakakka · 2009-09-03, 10:19

Quote:

Please tell me it is a second-hand!

It looks new 4 years ago >_>

Quote:

CLOAKER.exe looks like an HP driver. He doesn't need it anyway, but I'm much more worried of this one:

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1

I don't have time to search right now, but I'd prioritize sending that "Pol icies" directory to the sun.

Before I posted this problem here, malwarebyte's tried to fix it 2-3 times. Any additional suggestions are welcome

Quote:

Also you shouldn't have more then 1 anti-virus installed since it can cause problems

What do you mean? I don't think I got two, except if one isn't really working/being stopped to work.

Quote:

even I wouldn't have AVG installed since it's a complete and total placebo.

Yeah, been fooled twice now. I wouldn't go for the third...

I'll try your suggestion later SaintessHeart...

___________

Quote:

3. And run uguu.reg FIRST, then desu.reg. You should be able to start up your registry now.

This is no go, unfortunately

sa547 · 2009-09-03, 14:42

Waitasec... based on the HJT results, I notice that you seem to be running both Norton Antivirus (probably an old copy) and AVG altogether, which isn't good. Only one antivirus must be running, so you'll have to uninstall the other.

Rename Hijackthis.exe to something like "dehijack.exe" so that any potential trojan running wouldn't see and try to evade its presence.

If all other efforts fail, the last-ditch measure is to backup, reformat the whole hard disk, and reinstall the operating system.

Claies · 2009-09-03, 14:46

Quote:

Originally Posted by kakakka

Before I posted this problem here, malwarebyte's tried to fix it 2-3 times. Any additional suggestions are welcome

Have you tried getting your hands on a Windows XP install disc and performing a repair to try and get safe mode working again? I suggest trying that, and then rerunning Spybot or Malwarebytes under safe mode to remove it completely.

Oh, another thing: When you're doing all these scans, physically disconnect your computer from the Internet so the malware don't get the chance to redownload and reinstall various nasties that you've removed last time. This means unplugging the ethernet cable if there is one, or taking out the wireless router if that's how Internet works in your house. If taking out the router inconveniences someone else, open your computer and take out the wireless card. If necessary, post back to us on some other computer.

[EDIT]: Echoing what the rest said about antivirus software, do go ahead and take out AVG.

kakakka · 2009-09-04, 09:31

Quote:

Have you tried getting your hands on a Windows XP install disc and performing a repair to try and get safe mode working again? I suggest trying that, and then rerunning Spybot or Malwarebytes under safe mode to remove it completely.

I don't have one, as far as I know/

Quote:

1. Uninstall AVG, CCleaner, Spybot but keep their installation programs (other than AVG). Download Avast! BUT DON'T install it yet.

2. Then download these :

http://www.filefactory.com/file/ah52g1c/n/uguu_reg

http://www.filefactory.com/file/ah52h1a/n/desu_reg

3. And run uguu.reg FIRST, then desu.reg. You should be able to start up your registry now. Go under

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System

Modify ALL the values other than default to 0 (keeping value type as hexadecimal). Then go under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\

4. Modify these values to 1 :

AntiVirusDisableNotify
FirewallDisableNotify
UpdateDisableNotify

5. Install Avast and run a boot scan. If Avast does a restart run uguu and desu and loop the registry modifications before proceeding with the install.

Okay, I tried again after I got (temporarily?) access to regedit after I fix the DisableRegedit through Hijackthis. Though I can't install avast!

SaintessHeart · 2009-09-04, 10:32

Quote:

Originally Posted by kakakka

I don't have one, as far as I know/

There are many ways to get something you can't buy. For everything else (i.e Vista), there is Mastercard.

Quote:

Originally Posted by kakakka

Okay, I tried again after I got (temporarily?) access to regedit after I fix the DisableRegedit through Hijackthis. Though I can't install avast!

Can't install as in?

I shall be consistent and say : Uninstall AVG. I am not sure if Norton is disabled, but if you can run a boot time scan with it.

This is going to be tedious, but if u still can use Regedit help me find out ALL the HKEYs for under the Norton and Symantec keywords using the find. Several HKEYs can be found under different locales, so keep searching until the results repeat themselves. Then right click on the folders and click export to desktop. Finally, right click on the .reg file, select edit, and copypasta everything inside out here under spoiler tags.

Life sucks without your personal Windows disk.

kakakka · 2009-09-04, 10:57

For the installation, it doesn't load during the downloading setupeng.exe It closes automatically.

I tried to change the name of the setup..It went as far as asking some sort of agree/decline window. Then it closes

(EDIT: I'm trying to do it again now....)

I don't have AVG anymore. I don't have Norton anymore (I can't run it anyways, and doesn't do anything active).

Here's the curret one...

Spoiler for hijackthis:

kakakka · 2009-09-04, 13:18

From scanned from Registry Editor:
Windows Registry Editor Version 5.00

Spoiler for o:

Spoiler for NSI:

Spoiler for exe:

Spoiler for MUICache:

Spoiler for NortonSystemInfo:

kakakka · 2009-09-04, 13:19

Spoiler for installer:

kakakka · 2009-09-04, 13:20

Spoiler for installer (cont.):

2009-09-01, 15:41	Link #1
kakakka Senior Member Join Date: Sep 2008	A bit of a problem Last week I got a problem in my computer, making it disable/close/unable to open some of these things 1) Task Manager 2) Yahoo Messenger 3) Yahoo Mail/MSN 4) Norton Anti-Virus 5) Any update etc (that I don't know) Now I got Malwarebytes' and Superantispyware to scan my computer for something bad, (Malwarebytes 2-3 times before PC restore and 1 time after PC restore then 1 time for SAS). Also did AVG before PC restore, but it mess up a bit (it didn't stop scanning). I also downloaded Spybot(?) after the PC restore, but it won't open/run for some reason. Now I can access/do 2, 3, and 5 after PC restore and scanning. Didn't redownload Norton. Still can't access Task manager. I found out I can't access regedit. I remember from the logs (whose I don't have right now) from Malwarebyte's that somethings are hijacking those files that can't easily erased/solved by Malwarbytes' even by restarting, so what do I do now? I think there's still a problem. Any websites that answers this question is also welcome. Thanks in advance

2009-09-02, 10:11	Link #3
kakakka Senior Member Join Date: Sep 2008	It doesn't go to Safe Mode Here's the result from HiJackThis Spoiler for hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:05:29 PM, on 02/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HP\HP Software Update\HPwuSchd2.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe c:\windows\system\hpsysdrv.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SSC_UserPrompt] c:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [IS CfgWiz] c:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT" O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe -- End of file - 8587 bytes These entries always show up in Malwarebyte scans Spoiler for mbam-log: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0)

2009-09-03, 14:42	Link #10
sa547 Senior Member Author Join Date: Oct 2007 Location: Philippines Age: 47	Waitasec... based on the HJT results, I notice that you seem to be running both Norton Antivirus (probably an old copy) and AVG altogether, which isn't good. Only one antivirus must be running, so you'll have to uninstall the other. Rename Hijackthis.exe to something like "dehijack.exe" so that any potential trojan running wouldn't see and try to evade its presence. If all other efforts fail, the last-ditch measure is to backup, reformat the whole hard disk, and reinstall the operating system. __________________

2009-09-04, 10:57	Link #14
kakakka Senior Member Join Date: Sep 2008	For the installation, it doesn't load during the downloading setupeng.exe It closes automatically. I tried to change the name of the setup..It went as far as asking some sort of agree/decline window. Then it closes (EDIT: I'm trying to do it again now....) I don't have AVG anymore. I don't have Norton anymore (I can't run it anyways, and doesn't do anything active). Here's the curret one... Spoiler for hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:48:21 AM, on 05/09/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9.exe C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe C:\WINDOWS\vsnpstd3.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe c:\windows\system\hpsysdrv.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\regedit.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Program Files\Trend Micro\HijackThis\noname.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\5577497\Program\Compaq Connections.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 6414 bytes Last edited by kakakka; 2009-09-04 at 12:50.

2009-09-04, 13:18	Link #15
kakakka Senior Member Join Date: Sep 2008	From scanned from Registry Editor: Windows Registry Editor Version 5.00 Spoiler for o: [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\ComDlg32\OpenSaveMRU\] "a"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\jenoef.exe" "MRUList"="cbfajihged" "b"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\nams.exe" "c"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\lone.reg" "d"="C:\\Program Files\\Trend Micro\\HijackThis\\hijackthis5.txt" "e"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\Norton_Removal_To ol.exe" "f"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\avast_home_setup. exe" "g"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\uguu.reg" "h"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\desu.reg" "i"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\lolo.exe" "j"="C:\\Program Files\\Trend Micro\\HijackThis\\hijackthis6.txt" Spoiler* for NSI: [HKEY_LOCAL_MACHINE\SOFTWARE\Hewlett-Packard\Organize\LocalApps\NIS] "LaunchPath"="C:\\Program Files\\Common Files\\Symantec Shared\\NMAIN.EXE" "LaunchParameter"="/nosysworks /dat:C:\\Program Files\\Norton Internet Security\\NISPLUG.NSI" Spoiler for exe: [HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\ComDlg32\OpenSaveMRU\exe] "a"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\Norton_Removal_To ol.exe" "MRUList"="ebdca" "b"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\avast_home_setup. exe" "c"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\lolo.exe" "d"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\jenoef.exe" "e"="C:\\Documents and Settings\\Compaq_Owner\\Desktop\\nams.exe" Spoiler for MUICache: [HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell NoRoam\MUICache] "LangID"=hex:09,04 "@shell32.dll,-12691"="My Recent Documents" "@C:\\WINDOWS\\system32\\SHELL32.dll,-9227"="My Documents" "@C:\\WINDOWS\\system32\\SHELL32.dll,-9216"="My Computer" "@C:\\WINDOWS\\system32\\SHELL32.dll,-9217"="My Network Places" "C:\\WINDOWS\\system32\\logon.scr"="Logon Screen Saver" "@xpsp1res.dll,-11003"="Launch Internet Explorer Browser" "@xpsp2res.dll,-6100"="Show Desktop" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="Firefox" "@explorer.exe,-7024"="Internet" "@explorer.exe,-7025"="E-mail" "@explorer.exe,-7023"="&Run..." "@explorer.exe,-7020"="&Search" "@explorer.exe,-7021"="&Help and Support" "@xpsp1res.dll,-10077"="Set Program Access and Defaults" "@shell32.dll,-21790"="My Music" "@shell32.dll,-21779"="My Pictures" "C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"="RealPlayer " "@shell32.dll,-31233"="File and Folder Tasks" "@shell32.dll,-31236"="Make a new folder" "@shell32.dll,-31260"="Publish this folder to the Web" "@shell32.dll,-31374"="Share this folder" "@shell32.dll,-31272"="Other Places" "@shell32.dll,-31274"="Details" "C:\\WINDOWS\\Explorer.EXE"="Windows Explorer" "@shell32.dll,-31254"="Rename this folder" "@shell32.dll,-31256"="Move this folder" "@shell32.dll,-31258"="Copy this folder" "@shell32.dll,-31380"="E-mail this folder's files" "@shell32.dll,-31262"="Delete this folder" "@shell32.dll,-31396"="Video Tasks" "@shell32.dll,-31278"="Play all" "@shell32.dll,-31379"="Copy all items to CD" "@shell32.dll,-21791"="My Videos" "@shell32.dll,-31234"="These tasks apply to the files and folders you select." "@shell32.dll,-31397"="These tasks apply to the video files and folders you select." "@shell32.dll,-31243"="Gives this file or folder a new label that you type for it." "@shell32.dll,-31245"="Moves the selected items to a place you choose." "@shell32.dll,-31249"="Transfers copies of the selected items to a public Web page so that you can share them with other people." "@C:\\WINDOWS\\system32\\shimgvw.dll,-302"="GIF Image" "@shell32.dll,-31242"="Rename this file" "@shell32.dll,-31244"="Move this file" "@shell32.dll,-31246"="Copy this file" "@shell32.dll,-31248"="Publish this file to the Web" "@shell32.dll,-31370"="E-mail this file" "@shell32.dll,-31252"="Delete this file" "@shell32.dll,-31250"="Print this file" "C:\\WINDOWS\\system32\\shimgvw.dll"="Windows Picture and Fax Viewer" "C:\\WINDOWS\\system32\\mspaint.exe"="Paint" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqthb08.exe"="HP Image Zone" "C:\\PROGRA~1\\MICROS~4\\OFFICE11\\OIS.EXE"="Micro soft Office Picture Manager" "@shimgvw.dll,-550"="Pre&view" "@shell32.dll,-31352"="Copy to CD" "C:\\Program Files\\Windows Media Player\\wmplayer.exe"="Windows Media Player" "C:\\WINDOWS\\system32\\shell32.dll"="Windows Shell Common Dll" "C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AcroRd32.exe"="Adobe Reader 7.0" "C:\\Program Files\\Microsoft Office\\OFFICE11\\EXCEL.EXE"="Microsoft Office Excel" "C:\\Program Files\\Internet Explorer\\iexplore.exe"="Internet Explorer" "C:\\WINDOWS\\system32\\NOTEPAD.EXE"="Notepad" "C:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"="Microsoft Office Word" "C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE"="WordPad" "@shell32.dll,-12589"="Files Currently on the CD" "@shell32.dll,-12590"="Files Ready to Be Written to the CD" "C:\\Program Files\\Trend Micro\\HijackThis\\noname.exe"="HijackThis" "@C:\\WINDOWS\\system32\\SHELL32.dll,-9319"="Printers and Faxes" "@C:\\WINDOWS\\system32\\fxsres.dll,-114"="Fax Console" "@C:\\WINDOWS\\system32\\fxsres.dll,-112"="Fax Cover Page Editor" "@C:\\WINDOWS\\system32\\fxsres.dll,-110"="Send a Fax..." "@C:\\WINDOWS\\system32\\SHELL32.dll,-8964"="Recycle Bin" "@shdoclc.dll,-880"="Internet Explorer" "C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"="Symantec User Session" "C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe"="HP Boot Optimizer" "C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe"="hpwuSchd" "C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"="RealNetwor ks Scheduler" "C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe"="HP Framework Component Manager Service" "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\ \hpztsb09.exe"="hpztsb09" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpotdd01.exe"="hpotdd01" "C:\\WINDOWS\\vsnpstd3.exe"="CameraMonitor" "C:\\WINDOWS\\system32\\ctfmon.exe"="CTF Loader" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="Yah oo! Messenger" "@C:\\WINDOWS\\ime\\sptip.dll,-600"="Speech Recognition" "C:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"="Compaq Connections" "@C:\\WINDOWS\\system32\\netshell.dll,-1200"="Network Connections" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="HP Digital Imaging Monitor" "C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="Malwarebytes' Anti-Malware" "C:\\WINDOWS\\system32\\taskmgr.exe"="Windows TaskManager" "@shell32.dll,-12710"="&Run" "C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfi g.exe"="System Configuration Utility" "C:\\Documents and Settings\\Compaq_Owner\\Desktop\\Norton_Removal_To ol.exe"="Norton Removal Tool" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\7zS1A.tmp \\SymNRT.exe"="Symantec Removal Utility" "@xpsp1res.dll,-10078"="Chooses default programs for certain activities, such as Web browsing or sending e-mail, and specifies which programs are accessible from the Start menu, desktop, and other locations." "C:\\WINDOWS\\regedit.exe"="Registry Editor" "C:\\Documents and Settings\\Compaq_Owner\\Desktop\\avast_home_setup. exe"="avast! antivirus Update" "C:\\Documents and Settings\\Compaq_Owner\\Desktop\\lolo.exe"="avast! antivirus Update" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a03592\\setupeng.exe"="ALWIL Software Setup Engine" "@xpsp1res.dll,-11001"="Internet Explorer" "@xpsp1res.dll,-11004"="Outlook Express" "@C:\\WINDOWS\\system32\\xpsp1res.dll,-10077"="Set Program Access and Defaults" "@C:\\WINDOWS\\system32\\rcbdyctl.dll,-152"="Remote Assistance" "@C:\\PROGRA~1\\MOVIEM~1\\wmm2res.dll,-61446"="Windows Movie Maker" "@shell32.dll,-22075"="Windows Catalog" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a04044\\setupeng.exe"="ALWIL Software Setup Engine" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a03116\\setupeng.exe"="ALWIL Software Setup Engine" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_sfx.t m~a02308\\avast.setup"="avast! antivirus Update" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a02752\\setupeng.exe"="ALWIL Software Setup Engine" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_sfx.t m~a03404\\avast.setup"="avast! antivirus Update" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a02896\\setupeng.exe"="ALWIL Software Setup Engine" "@C:\\WINDOWS\\system32\\SHELL32.dll,-8503"="S&earch..." "@C:\\WINDOWS\\system32\\mycomput.dll,-400"="Mana&ge" "@shell32.dll,-31232"="System Tasks" "@shell32.dll,-31294"="View system information" "@shell32.dll,-31327"="Add or remove programs" "@shell32.dll,-31312"="Change a setting" "@C:\\WINDOWS\\system32\\SHELL32.dll,-22913"="Shows the disk drives and hardware connected to this computer." "@shell32.dll,-31317"="System Tasks" "@shell32.dll,-31321"="Hide the contents of this drive" "@shell32.dll,-31292"="Search for files or folders" "@shell32.dll,-31325"="Hide the contents of this folder" "@shell32.dll,-31237"="Creates a new, empty folder in the folder you have open." "@shell32.dll,-31318"="These tasks apply to your computer and to this protected folder." "@shell32.dll,-31293"="The Search Companion helps you find files, folders, printers, and people." "@shell32.dll,-31328"="Provides the steps necessary to add a new program, or to change or remove an existing program." "@shell32.dll,-31326"="Hides the items stored in this folder to protect them from being changed or deleted." "@shell32.dll,-31322"="Hides the files and folders stored on this drive to protect them from being changed or deleted." "@shell32.dll,-12693"="Favorites" "@C:\\WINDOWS\\system32\\notepad.exe,-469"="Text Document" "@shell32.dll,-31323"="Show the contents of this folder" "@C:\\WINDOWS\\system32\\shimgvw.dll,-304"="Bitmap Image" "@shell32.dll,-31273"="These links open other folders and take you quickly to useful places." "@shell32.dll,-31329"="Recycle Bin Tasks" "@shell32.dll,-31331"="Empty the Recycle Bin" "@shell32.dll,-31333"="Restore all items" "@C:\\WINDOWS\\system32\\SHELL32.dll,-22915"="Contains the files and folders that you have deleted." "@shell32.dll,-31336"="Moves the selected items to the places they were before they were put in the Recycle Bin." "@shell32.dll,-31334"="Restore this item" "@shell32.dll,-31383"="Copies the selected items to the CD-R folder so that you can burn them on a compact disc." "@shell32.dll,-31279"="Play selection" "@shell32.dll,-31264"="Move the selected items" "@shell32.dll,-31266"="Copy the selected items" "@shell32.dll,-31268"="Publish the selected items to the Web" "@shell32.dll,-31362"="E-mail the selected items" "@shell32.dll,-31270"="Delete the selected items" "@C:\\Program Files\\NetMeeting\\conf.exe,-12345"="H.323 Internet Telephony" "@C:\\WINDOWS\\system32\\accwiz.exe,-16"="Accessibility Wizard settings" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9903"="AIFF Format Sound" "@C:\\WINDOWS\\system32\\SHELL32.dll,-22978"="Briefcase" "@C:\\WINDOWS\\System32\\pdh.dll,-10023"="Performance Monitor File" "@C:\\WINDOWS\\System32\\cryptext.dll,-6145"="Security Catalog" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9918"="CD Audio Track" "@C:\\WINDOWS\\System32\\cdfview.dll,-4610"="Channel File" "@C:\\WINDOWS\\System32\\cryptext.dll,-6108"="Security Certificate" "@C:\\Program Files\\NetMeeting\\conf.exe,-12346"="SpeedDial" "@C:\\WINDOWS\\system32\\fxscover.exe,-2523"="Fax Cover Page File" "@C:\\WINDOWS\\System32\\cryptext.dll,-6110"="Certificate Revocation List" "@C:\\WINDOWS\\system32\\netshell.dll,-1300"="Dialup Networking File" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9927"="Microsoft Recorded TV Show" "@C:\\WINDOWS\\system32\\shimgvw.dll,-301"="EMF Image" "@C:\\Program Files\\NetMeeting\\conf.exe,-12347"="Intel IPhone Compatible" "@C:\\WINDOWS\\System32\\setupapi.dll,-2000"="Setup Information" "@C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwres.dll,-20003"="Internet Communication Settings" "@C:\\WINDOWS\\system32\\shimgvw.dll,-303"="JPEG Image" "@C:\\WINDOWS\\System32\\wshext.dll,-4804"="JScript Script File" "@C:\\WINDOWS\\System32\\wshext.dll,-4805"="JScript Encoded Script File" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9926"="M3U file" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9902"="Movie Clip" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9925"="MP3 Format Sound" "@C:\\WINDOWS\\system32\\mmcbase.dll,-130"="Microsoft Common Console Document" "@C:\\WINDOWS\\System32\\msi.dll,-34"="Windows Installer Package" "@C:\\WINDOWS\\System32\\msi.dll,-35"="Windows Installer Patch" "@C:\\WINDOWS\\System32\\RCBdyctl.dll,-150"="Microsoft Remote Assistance Incident" "@C:\\Program Files\\Movie Maker\\wmm2res.dll,-63097"="Windows Movie Maker Project" "@C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\msinfo .dll,-391"="MSInfo Document" "@C:\\Program Files\\NetMeeting\\nmwb.dll,-1234"="Microsoft NetMeeting T126 Compatible Whiteboard Document" "@C:\\WINDOWS\\System32\\cryptext.dll,-6111"="PKCS #7 Certificates" "@C:\\WINDOWS\\System32\\cryptext.dll,-6113"="PKCS #7 Signature" "@C:\\WINDOWS\\system32\\shimgvw.dll,-305"="PNG Image" "@C:\\WINDOWS\\System32\\scrobj.dll,-8192"="Windows Script Component" "@C:\\WINDOWS\\system32\\shscrap.dll,-258"="Scrap object" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9904"="AU Format Sound" "@C:\\WINDOWS\\System32\\cryptext.dll,-6112"="Microsoft Serialized Certificate Store" "@C:\\WINDOWS\\System32\\cryptext.dll,-6109"="Certificate Trust List" "@C:\\WINDOWS\\System32\\wshext.dll,-4803"="VBScript Encoded Script File" "@C:\\WINDOWS\\System32\\wshext.dll,-4802"="VBScript Script File" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9908"="Wave Sound" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9912"="Windows Media Audio file" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9920"="Windows Media Player Download Package" "@C:\\WINDOWS\\system32\\shimgvw.dll,-307"="WMF Image" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9915"="Windows Media Player Skin File" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9916"="Windows Media Player Skin Package" "@C:\\WINDOWS\\inf\\unregmp2.exe,-9923"="Windows Media playlist" "@\"C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE\",-208"="Write Document" "@C:\\WINDOWS\\System32\\wshext.dll,-4801"="Windows Script File" "@C:\\WINDOWS\\System32\\wshext.dll,-4800"="Windows Script Host Settings File" "@C:\\WINDOWS\\system32\\msxml3r.dll,-1"="XML Document" "@C:\\WINDOWS\\system32\\msxml3r.dll,-2"="XSL Stylesheet" "@C:\\WINDOWS\\system32\\zipfldr.dll,-10195"="Compressed (zipped) Folder" "@C:\\WINDOWS\\system32\\schedsvc.dll,-3407"="Task Object" "@C:\\WINDOWS\\system32\\SHELL32.dll,-32517"="Taskbar and Start Menu" "@C:\\WINDOWS\\system32\\Audiodev.dll,-510"="Portable Media Devices" "@C:\\WINDOWS\\system32\\SHELL32.dll,-22985"="Folder Options" "@C:\\WINDOWS\\system32\\SHELL32.dll,-22981"="Fonts" "@C:\\WINDOWS\\system32\\SHELL32.dll,-22982"="Administrative Tools" "@C:\\WINDOWS\\system32\\mstask.dll,-3408"="Scheduled Tasks" "@C:\\WINDOWS\\system32\\wiashext.dll,-331"="Scanners and Cameras" "C:\\WINDOWS\\system32\\rundll32.exe"="Run a DLL as an App" "@C:\\Program Files\\Internet Explorer\\iexplore.exe,-702"="Internet Explorer" "@xpob2res.dll,-41519"="Windows Messenger" "@%SystemRoot%\\system32\\shell32.dll,-22538"="Enables you to clear your disk of unnecessary files." "C:\\Documents and Settings\\Compaq_Owner\\Desktop\\jenoef.exe"="avas t! antivirus Update" "C:\\Documents and Settings\\Compaq_Owner\\Desktop\\nams.exe"="avast! antivirus Update" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a01712\\setupeng.exe"="ALWIL Software Setup Engine" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a01180\\setupeng.exe"="ALWIL Software Setup Engine" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_sfx.t m~a02508\\avast.setup"="avast! antivirus Update" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_inet. tm~a03812\\setupeng.exe"="ALWIL Software Setup Engine" "C:\\DOCUME~1\\COMPAQ~1\\LOCALS~1\\Temp\\_av_sfx.t m~a03624\\avast.setup"="avast! antivirus Update" "@C:\\WINDOWS\\system32\\fxsres.dll,-118"="Fax" "C:\\WINDOWS\\system32\\cleanmgr.exe"="Disk Space Cleanup Manager for Windows" "@explorer.exe,-7003"="Opens a program, folder, document, or Web site." Spoiler for NortonSystemInfo: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\C ompatibility\NortonSystemInfo] "Name"="SI32.EXE" "ID"=hex:29,ea,63,32 "Flags"=hex:04,00,00,00

2009-09-01, 23:50	Link #2
Claies Good-Natured Asshole. Join Date: May 2007 Age: 34	Sounds like malware. Have you tried doing the above in safe mode? Also, can HijackThis run? If it can, please have it perform a scan and put the logs up here. http://download.cnet.com/Trend-Micro...-10227353.html I'd go for a full format and reinstall if this doesn't work out. That's pretty entrenched in the OS and it'd be difficult to render it completely clean again.

2009-09-03, 01:42	Link #7
Claies Good-Natured Asshole. Join Date: May 2007 Age: 34	CLOAKER.exe looks like an HP driver. He doesn't need it anyway, but I'm much more worried of this one: O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 I don't have time to search right now, but I'd prioritize sending that "Pol icies" directory to the sun.