Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

MicrosoftRepair Virus - Help Please

Started by mcjenniffer , Apr 02 2011 07:35 AM

  • Please log in to reply

#1
mcjenniffer
Posted 02 April 2011 - 07:35 AM

mcjenniffer

    Member

  • Member
  • PipPip
  • 14 posts
I somehow got a virus, when I started my computer up popped this scan called MicrosoftRepair, and it automatically started scanning, I stopped the scan, but could do nothing. The box refused to go away. I started getting pop-ups that the hard drive was bad, virtual memory overfull, and so on. I found instructions on how to remove the virus, and did so. (Going thru onecase.live.com/site/en-us/default.htm) It removed it/them. Now when I click START, and ALL PROGRAMS I have no programs in there. I can click PICTURES, DOCUMENTS, anything, and nothing is showing. I am only getting online because it is pinned to the start menu. Otherwise I couldn't do anything. I have tried a system restore, and I have selected a previous date, but when I click NEXT, nothing happens. I did go into ADD/REMOVE PROGRAMS and all my programs are still showing. I do not know a whole lot about computers, and do not know how to fix this problem. I am scared to do too much and ruin something. Even my background and desktop icons are gone. Can someone please help me out here. Thanks.

Sorry, I posted in the wrong forum.

I ran the OTL and it didn't seem to find anything. Below is the results.

OTL logfile created on: 4/2/2011 9:15:00 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 38.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 20.42 Gb Free Space | 54.80% Space Free | Partition Type: NTFS

Computer Name: JENNIFFER | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/02 09:14:34 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2011/01/13 07:20:00 | 000,041,296 | -H-- | M] (AOL Inc.) -- C:\Program Files\AOL Desktop 9.6\waol.exe
PRC - [2011/01/13 07:19:58 | 000,045,392 | -H-- | M] (AOL Inc.) -- C:\Program Files\AOL Desktop 9.6\shellmon.exe
PRC - [2010/11/22 18:19:45 | 002,201,936 | -H-- | M] (AOL Inc.) -- C:\Program Files\AOL Desktop 9.6\AOLBrowser\aolbrowser.exe
PRC - [2010/10/18 15:08:40 | 000,039,240 | -H-- | M] (AOL Inc.) -- C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe
PRC - [2010/09/13 18:18:32 | 000,308,656 | -H-- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe
PRC - [2010/09/02 09:23:28 | 001,638,400 | -H-- | M] (Eastman Kodak Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
PRC - [2010/06/10 06:58:32 | 000,865,832 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2010/03/08 03:27:49 | 000,041,800 | -H-- | M] (AOL Inc.) -- C:\Program Files\Common Files\AOL\1164753136\ee\aolsoftware.exe
PRC - [2009/10/29 07:54:44 | 001,218,008 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/10/27 12:19:46 | 000,895,696 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2009/09/16 10:22:08 | 000,144,704 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe
PRC - [2009/09/16 09:28:38 | 000,606,736 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe
PRC - [2009/07/08 11:54:34 | 000,359,952 | -H-- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009/07/07 19:10:02 | 002,482,848 | -H-- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/10/23 08:50:35 | 000,046,640 | RH-- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2006/07/12 20:50:17 | 000,057,344 | -H-- | M] (Lanovation) -- C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
PRC - [2004/12/13 05:34:32 | 000,049,152 | -H-- | M] (Ulead Systems, Inc.) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


========== Modules (SafeList) ==========

MOD - [2011/04/02 09:14:34 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2011/01/13 07:19:51 | 000,007,168 | -H-- | M] (AOL Inc.) -- C:\Program Files\AOL Desktop 9.6\idleproc.dll
MOD - [2010/08/23 12:12:02 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/07/12 01:02:02 | 000,653,120 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010/09/13 18:18:32 | 000,308,656 | -H-- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service)
SRV - [2010/06/10 06:58:32 | 000,865,832 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2009/10/27 12:19:46 | 000,895,696 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)
SRV - [2009/09/16 11:23:32 | 000,365,072 | -H-- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2009/09/16 10:22:08 | 000,144,704 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2009/09/16 09:28:38 | 000,606,736 | -H-- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2009/07/08 11:54:34 | 000,359,952 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2009/07/07 19:10:02 | 002,482,848 | -H-- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2006/10/23 08:50:35 | 000,046,640 | RH-- | M] (AOL LLC) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS)
SRV - [2006/07/12 20:50:17 | 000,057,344 | -H-- | M] (Lanovation) [Auto | Running] -- C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2004/12/13 05:34:32 | 000,049,152 | -H-- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)


========== Driver Services (SafeList) ==========

DRV - [2010/07/15 15:18:22 | 000,120,136 | -H-- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)
DRV - [2010/02/17 20:17:38 | 000,049,904 | RH-- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2009/09/16 10:22:48 | 000,214,664 | -H-- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/09/16 10:22:48 | 000,079,816 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2009/09/16 10:22:48 | 000,040,552 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009/09/16 10:22:48 | 000,035,272 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009/09/16 10:22:14 | 000,034,248 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2008/04/13 14:56:49 | 000,012,800 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2007/04/16 13:28:02 | 000,194,362 | -H-- | M] (Jungo) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2007/02/02 03:00:00 | 000,009,464 | -H-- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\windows\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2007/02/02 03:00:00 | 000,009,336 | -H-- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\windows\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2006/07/13 09:56:49 | 000,008,552 | -H-- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\windows\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2004/03/30 11:29:36 | 000,118,106 | -H-- | M] (Mars Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mr97310v.sys -- (MR97310_VGA_DUAL_CAMERA)
DRV - [2003/03/26 12:17:14 | 000,025,930 | -H-- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\windows\System32\drivers\Dvd_2k.sys -- (dvd_2K)
DRV - [2003/03/26 12:17:12 | 000,030,662 | -H-- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\windows\System32\drivers\Mmc_2k.sys -- (mmc_2K)
DRV - [2003/03/26 12:17:10 | 000,144,250 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\windows\System32\drivers\pwd_2K.sys -- (pwd_2k)
DRV - [2003/03/26 12:15:28 | 000,206,464 | -H-- | M] (Roxio) [File_System | System | Running] -- C:\windows\System32\drivers\udfreadr_xp.sys -- (UdfReadr_xp)
DRV - [2003/03/26 12:15:02 | 000,241,280 | -H-- | M] (Roxio) [File_System | System | Stopped] -- C:\windows\System32\drivers\cdudf_xp.sys -- (cdudf_xp)
DRV - [2003/01/10 17:13:04 | 000,033,588 | RH-- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2001/08/17 09:28:00 | 000,871,388 | -H-- | M] (BCM) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMDM.sys -- (BCMModem)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0



O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,734 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1164753136\ee\aolsoftware.exe (AOL Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKCU..\Run: [AOL Fast Start] C:\Program Files\AOL Desktop 9.6\AOL.EXE (AOL Inc.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Webshots.lnk = C:\Program Files\Webshots\Launcher.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 5.01\MediaManager\grab.html ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .UVR - C:\Program Files\Internet Explorer\PLUGINS\NPUPano.dll (Ulead Systems, Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: overstock.com ([www] * in Trusted sites)
O15 - HKCU\..Trusted Domains: overstock.com ([www.auctions] * in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.micros...tes/ieawsdc.cab (Reg Error: Key error.)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onec...lscbase6886.cab (Windows Live Safety Center Base Module)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/.../GrooveAX27.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg...l_v1-0-31-0.cab (EPUImageControl Class)
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} https://ediagnostics....com/serval.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://3dlifeplayer....l/installer.exe (Virtools WebPlayer Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\windows\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Soap Bubbles.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Soap Bubbles.bmp
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/02 09:14:32 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/04/01 14:03:05 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center
[2011/04/01 03:42:28 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2011/03/31 21:38:01 | 012,502,472 | -H-- | C] (Microsoft Corporation) -- C:\Documents and Settings\Owner\My Documents\windows-kb890830-v3.17.exe
[2011/03/31 17:36:05 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Start Menu\Programs\Windows Repair
[2011/03/23 13:39:26 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Desktop\sams school stuff
[2011/03/23 11:14:17 | 000,398,760 | RH-- | C] (Coupons, Inc.) -- C:\windows\System32\cpnprt2.cid
[2011/03/23 11:14:15 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Coupons
[2011/03/23 11:14:10 | 000,000,000 | -H-D | C] -- C:\Program Files\Coupons
[2011/03/15 15:48:12 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Application Data\imeshbandmltbpi
[2011/03/15 15:44:33 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\iMesh
[2011/03/15 15:42:15 | 000,000,000 | -H-D | C] -- C:\Program Files\iMesh Applications
[2011/03/15 15:40:18 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\PackageAware
[2011/03/11 10:32:37 | 000,058,696 | -H-- | C] (AOL Inc.) -- C:\windows\System32\AOLParconLink.exe
[2011/03/11 10:19:45 | 000,000,000 | -H-D | C] -- C:\Program Files\AOL Desktop 9.6
[3 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]
[10 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/02 09:14:34 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/04/01 21:46:40 | 000,002,422 | -H-- | M] () -- C:\windows\System32\wpa.dbl
[2011/04/01 21:44:58 | 000,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2011/03/31 21:38:07 | 012,502,472 | -H-- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner\My Documents\windows-kb890830-v3.17.exe
[2011/03/31 17:38:42 | 000,000,040 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~18341684
[2011/03/31 17:36:09 | 000,000,809 | -H-- | M] () -- C:\Documents and Settings\Owner\Desktop\Windows Repair.lnk
[2011/03/31 16:50:37 | 000,310,132 | -H-- | M] () -- C:\Documents and Settings\Owner\My Documents\ssa-3820.pdf
[2011/03/31 16:49:42 | 000,080,672 | -H-- | M] () -- C:\Documents and Settings\Owner\My Documents\SSA-3819.pdf
[2011/03/31 16:49:09 | 000,350,022 | -H-- | M] () -- C:\Documents and Settings\Owner\My Documents\Checklist%20-%20Child.pdf
[2011/03/31 16:47:08 | 000,189,074 | -H-- | M] () -- C:\Documents and Settings\Owner\Desktop\Factsheet-CHLD.pdf
[2011/03/29 17:43:03 | 000,000,284 | -H-- | M] () -- C:\windows\tasks\AppleSoftwareUpdate.job
[2011/03/28 09:34:13 | 000,026,023 | -H-- | M] () -- C:\windows\System32\Config.MPF
[2011/03/23 11:14:17 | 000,398,760 | RH-- | M] (Coupons, Inc.) -- C:\windows\System32\cpnprt2.cid
[2011/03/18 14:32:10 | 000,071,072 | -H-- | M] () -- C:\windows\CouponPrinter.ocx
[2011/03/16 07:22:28 | 000,432,686 | -H-- | M] () -- C:\windows\System32\perfh009.dat
[2011/03/16 07:22:28 | 000,067,516 | -H-- | M] () -- C:\windows\System32\perfc009.dat
[2011/03/15 01:08:10 | 000,000,340 | -H-- | M] () -- C:\windows\tasks\McDefragTask.job
[2011/03/11 17:38:56 | 000,000,676 | -H-- | M] () -- C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Webshots.lnk
[2011/03/11 10:34:19 | 000,000,722 | -H-- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL Desktop 9.6.lnk
[2011/03/11 10:34:13 | 000,000,756 | -H-- | M] () -- C:\Documents and Settings\All Users\Desktop\AOL Desktop 9.6.lnk
[3 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]
[10 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/31 17:38:27 | 000,000,040 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18341684
[2011/03/31 17:36:09 | 000,000,809 | -H-- | C] () -- C:\Documents and Settings\Owner\Desktop\Windows Repair.lnk
[2011/03/31 16:50:37 | 000,310,132 | -H-- | C] () -- C:\Documents and Settings\Owner\My Documents\ssa-3820.pdf
[2011/03/31 16:49:42 | 000,080,672 | -H-- | C] () -- C:\Documents and Settings\Owner\My Documents\SSA-3819.pdf
[2011/03/31 16:49:09 | 000,350,022 | -H-- | C] () -- C:\Documents and Settings\Owner\My Documents\Checklist%20-%20Child.pdf
[2011/03/31 16:47:08 | 000,189,074 | -H-- | C] () -- C:\Documents and Settings\Owner\Desktop\Factsheet-CHLD.pdf
[2011/03/11 10:34:18 | 000,000,722 | -H-- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\AOL Desktop 9.6.lnk
[2010/10/24 18:02:00 | 000,057,395 | -H-- | C] () -- C:\windows\System32\pthreadVC.dll
[2010/07/07 10:23:38 | 000,307,200 | -H-- | C] () -- C:\windows\System32\AscSQLite.dll
[2010/04/20 08:10:23 | 000,327,168 | -H-- | C] () -- C:\windows\System32\cutil32.dll
[2009/12/25 14:05:58 | 000,008,802 | RH-- | C] () -- C:\windows\AmvTransform.ini
[2009/12/25 14:05:58 | 000,007,763 | RH-- | C] () -- C:\windows\AmvPlayer.ini
[2009/08/17 22:27:13 | 000,162,304 | -H-- | C] () -- C:\windows\System32\ztvunrar36.dll
[2009/08/17 22:27:13 | 000,077,312 | -H-- | C] () -- C:\windows\System32\ztvunace26.dll
[2009/08/17 22:27:13 | 000,075,264 | -H-- | C] () -- C:\windows\System32\unacev2.dll
[2009/08/17 22:27:12 | 000,153,088 | -H-- | C] () -- C:\windows\System32\unrar3.dll
[2009/08/15 22:36:01 | 000,000,045 | -H-- | C] () -- C:\windows\System32\RPVersion.ini
[2008/12/26 19:41:52 | 000,223,232 | -H-- | C] () -- C:\windows\System32\sqlite3.dll
[2008/12/23 11:18:13 | 000,000,111 | -H-- | C] () -- C:\windows\Sansa Media Converter.INI
[2008/10/15 15:13:26 | 000,012,288 | -H-- | C] () -- C:\windows\System32\LXF3PMRC.DLL
[2008/04/14 08:46:26 | 000,708,548 | -HS- | C] () -- C:\windows\System32\jjfynatg.ini
[2008/04/13 21:01:00 | 000,000,077 | -H-- | C] () -- C:\windows\wininit.ini
[2008/04/11 16:32:21 | 000,709,539 | -HS- | C] () -- C:\windows\System32\ykebpwkm.ini
[2008/04/11 16:29:08 | 000,174,934 | -HS- | C] () -- C:\windows\System32\Qsvxayxx.ini
[2007/12/04 12:55:41 | 000,000,121 | -H-- | C] () -- C:\windows\disney.ini
[2007/12/04 12:55:12 | 000,000,199 | -H-- | C] () -- C:\windows\disneysy.ini
[2007/06/01 21:22:26 | 000,000,029 | -H-- | C] () -- C:\windows\PControl.ini
[2007/05/31 13:25:13 | 000,027,136 | -H-- | C] () -- C:\windows\System32\VERMONT1.DLL
[2007/05/31 13:25:13 | 000,012,416 | -H-- | C] () -- C:\windows\System32\VRX1.DLL
[2007/05/31 13:25:12 | 000,107,520 | -H-- | C] () -- C:\windows\System32\SIMANT.DLL
[2007/03/30 10:11:01 | 000,000,092 | -H-- | C] () -- C:\windows\QTW.INI
[2007/01/14 18:36:15 | 000,000,635 | -H-- | C] () -- C:\windows\eReg.dat
[2007/01/05 11:48:00 | 000,000,109 | -H-- | C] () -- C:\windows\dellstat.ini
[2006/12/08 07:58:22 | 000,000,022 | -H-- | C] () -- C:\windows\blackops.ini
[2006/11/28 18:19:09 | 000,000,006 | -H-- | C] () -- C:\windows\msoffice.ini
[2006/10/02 21:42:21 | 000,000,031 | -H-- | C] () -- C:\windows\album.ini
[2006/09/30 21:04:25 | 000,000,754 | -H-- | C] () -- C:\windows\WORDPAD.INI
[2006/09/14 15:18:08 | 000,000,096 | -H-- | C] () -- C:\windows\marscam.ini
[2006/09/14 15:17:46 | 000,000,444 | -H-- | C] () -- C:\windows\videoimp.ini
[2006/09/14 15:17:45 | 000,000,256 | -H-- | C] () -- C:\windows\photoprn.ini
[2006/09/14 15:17:27 | 000,010,240 | -H-- | C] () -- C:\windows\System32\vidx16.dll
[2006/08/20 16:08:58 | 000,000,018 | -H-- | C] () -- C:\windows\upst.ini
[2006/07/13 10:34:00 | 000,000,042 | -H-- | C] () -- C:\windows\PCSPATS.DAT
[2006/07/13 10:33:47 | 000,343,040 | -H-- | C] () -- C:\windows\System32\lffpx7.dll
[2006/07/13 10:33:47 | 000,116,736 | -H-- | C] () -- C:\windows\System32\lfkodak.dll
[2006/07/13 09:55:00 | 000,000,335 | -H-- | C] () -- C:\windows\nsreg.dat
[2006/07/13 09:52:03 | 000,000,029 | -H-- | C] () -- C:\windows\atid.ini
[2006/07/12 20:51:18 | 000,282,624 | -H-- | C] () -- C:\windows\System32\PCDrSystemInformation.dll
[2006/07/12 20:51:12 | 000,094,208 | -H-- | C] () -- C:\windows\System32\PcdrKernelModeServices.dll
[2006/07/12 20:51:12 | 000,077,824 | -H-- | C] () -- C:\windows\System32\ProgressTrace.dll
[2006/07/12 20:33:04 | 000,000,687 | -H-- | C] () -- C:\windows\lexstat.ini
[2006/07/12 20:12:16 | 000,002,048 | --S- | C] () -- C:\windows\bootstat.dat
[2006/07/12 20:06:33 | 000,021,640 | -H-- | C] () -- C:\windows\System32\emptyregdb.dat
[2006/07/12 17:36:14 | 000,013,312 | -H-- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/07/12 13:00:11 | 000,004,161 | -H-- | C] () -- C:\windows\ODBCINST.INI
[2006/07/12 12:59:02 | 000,118,152 | -H-- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2006/03/06 11:41:02 | 000,073,728 | -H-- | C] () -- C:\windows\System32\AMV_DecDLL.dll
[2004/09/16 14:26:40 | 000,012,634 | -H-- | C] () -- C:\windows\System32\drivers\ADFUUD.SYS
[2004/09/16 14:26:40 | 000,012,634 | -H-- | C] () -- C:\windows\ADFUUD.SYS
[2004/08/04 08:00:00 | 013,107,200 | -H-- | C] () -- C:\windows\System32\oembios.bin
[2004/08/04 08:00:00 | 000,673,088 | -H-- | C] () -- C:\windows\System32\mlang.dat
[2004/08/04 08:00:00 | 000,432,686 | -H-- | C] () -- C:\windows\System32\perfh009.dat
[2004/08/04 08:00:00 | 000,272,128 | -H-- | C] () -- C:\windows\System32\perfi009.dat
[2004/08/04 08:00:00 | 000,218,003 | -H-- | C] () -- C:\windows\System32\dssec.dat
[2004/08/04 08:00:00 | 000,067,516 | -H-- | C] () -- C:\windows\System32\perfc009.dat
[2004/08/04 08:00:00 | 000,046,258 | -H-- | C] () -- C:\windows\System32\mib.bin
[2004/08/04 08:00:00 | 000,028,626 | -H-- | C] () -- C:\windows\System32\perfd009.dat
[2004/08/04 08:00:00 | 000,004,569 | -H-- | C] () -- C:\windows\System32\secupd.dat
[2004/08/04 08:00:00 | 000,004,461 | -H-- | C] () -- C:\windows\System32\oembios.dat
[2004/08/04 08:00:00 | 000,001,804 | -H-- | C] () -- C:\windows\System32\dcache.bin
[2004/08/04 08:00:00 | 000,000,741 | -H-- | C] () -- C:\windows\System32\noise.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F1175E1D

< End of report >
  • 0

Advertisements

#2
RKinner
Posted 03 April 2011 - 01:00 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Let's first clean up some malware signs and some deadwood then run a couple of scans to make sure it is really gone.

Copy the text in the code box by highlighting and Ctrl + c 




:OTL
O2 - BHO: (no name) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.micros...tes/ieawsdc.cab (Reg Error: Key error.)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/.../GrooveAX27.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} https://ediagnostics....com/serval.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
[2011/03/31 17:38:27 | 000,000,040 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18341684
[2011/03/31 17:36:09 | 000,000,809 | -H-- | C] () -- C:\Documents and Settings\Owner\Desktop\Windows Repair.lnk
[2008/04/14 08:46:26 | 000,708,548 | -HS- | C] () -- C:\windows\System32\jjfynatg.ini
[2008/04/11 16:32:21 | 000,709,539 | -HS- | C] () -- C:\windows\System32\ykebpwkm.ini
[2008/04/11 16:29:08 | 000,174,934 | -HS- | C] () -- C:\windows\System32\Qsvxayxx.ini
    
:Commands
[RESETHOSTS]
[purity]
[emptytemp]
[Reboot]
then run OTL and Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the Run Fix button at the top
Let the program run unhindered, OTL will reboot the PC when it is done. Save the log and copy and paste it to a reply.

Open OTL again and select either the Use SafeList or All option in the Extra Registry group then the Run Scan button. Post the two logs it produces in your next reply.

Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwarebytes.org/mbam.php

SAVE Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.



ComboFix
:!: If you have a previous version of Combofix.exe, delete it and download a fresh copy. :!:

:!: It must be saved to your desktop, do not run it :!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Rename this file -- (call it george.exe ) to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Doubleclick on george to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix. Allow it to install the Recovery Console then Continue. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.


A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.

Re-activate your anti-virus at this time :!:

To get back most of your stuff we need to run the following three commands from a command prompt:


cd  \
attrib  -r  -h  -s   *.*  /s 
attrib  -r  -h  -s   *  /s

the attrib commands will take a few minutes to complete. (I use two spaces in the code box so you can see where one space goes.)

Probably the surest way to get to a command prompt is to reboot and when you see the maker's logo, hear a beep or it mentions F8, start slowly tapping the F8 key until you see the Save Mode Menu. Choose Save Mode with Command Prompt. Login normally. Run the three commands (you may not need the first one but it won't hurt). then reboot into normal mode.

Ron
  • 0

#3
RKinner
Posted 07 April 2011 - 11:20 PM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Found another program called unhide.exe which might also be useful:

http://download.blee...nler/unhide.exe

Ron
  • 0

#4
mcjenniffer
Posted 11 April 2011 - 12:16 PM

mcjenniffer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
I am so sorry I didn't get back with you before now. I finally removed the virus and found everything. Seems this virus put's all your icons, folders, and programs in a HIDDEN mode. After I got rid of the virus using Mal-Ware, and SuperAntiSpyware programs, both free programs. I figured out the files where still there and started screwing around until I noticed they all said HIDDEN, so I had to go in and uncheck the hidden, and read only boxes, and clicked apply. I had to do this for each and every program. I know there was probably an easier way to do that. I am not sure where this virus is coming from, but since I first got it, until now it seems there have been millions who have gotten it. My daughter just got it 2 days ago. I want to thank you guys for your help.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP