BleepingComputer.com: System32 Folder Is Going Nuts!

Computer is acting funny. It freezes up a lot, and was giving a message that the C:/ drive was full. Took some programs off to free up space, but still having problems. iTunes, in particular, is affected--will not open up. Tried running a CA virus scan, but it went for 2 hours and wasn't even CLOSE to finishing. The system32 folder seemed to have a lot of files in it--and, lo and behold--when I click on the properties for the folder, the size of the folder is increasing at a rapid and constant rate! Tried disconnecting from the internet, but the system32 folder is still running rampant! The files--from what I saw on the CA scan--are .tmp files. Ran coolwebshredder, which fixed something. Ran HJT and fixed a number of things, but the problem is still occurring. Has anyone seen this, and how do I stop it? Thank you!

Do you have a flash drive?

If you do, please download Dr Web Cure It to the flash drive from a different computer. Follow these instructions, but run Dr web from the flash drive. If you don't have a flash drive, follow these instructions exactly.

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
  
• Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click Options > Change settings
  
• Choose the "Scan tab" and UNcheck "Heuristic analysis"
  
• Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
  
• Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
  
• When done, a message will be displayed at the bottom advising if any viruses were found.
  
• Click "Yes to all" if it asks if you want to cure/move the file.
  
• When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
  (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  
• Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  
• Save the DrWeb.csv report to your desktop.
  
• Exit Dr.Web Cureit when done.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

More will follow > Please put your results here when you are finished.

Thank you!!!!! I'm running the scan now, but am very very very sleepy (couldn't find a little picture for that)! Off to bed, and I'll be back in the morning with the results. Have a good night!

Wow! That took a LONG time! Glad I didn't wait up for it! Here's the log:

U.exe;C:\;Trojan.MulDrop.8001;Deleted.;
index[5].htm\javascript.0;C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\K5A3S9MR\index[5].htm;VBS.PackFor;;
index[5].htm;C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\K5A3S9MR;Archive contains infected objects;Moved.;
KillWind.exe;C:\hp\bin;Tool.ProcessKill;Moved.;

I rebooted--still in safe mode--and the folder is still going nuts.

Thank you!!!!!

Try running the Avast virus cleaner

the same way as previously let us know the results, please.

Good morning, O.F.! I'm so happy to see you! I downloaded the program and will run it right away--will post when it's done. Thank you!!!!!

OK--scan is running. 2 other things I'd like to "pick your brain" about:
I spent $40 on a program called "RegistrySmart." Obviously, it did not correct my problem--but is it worth having, or should I send it back?
Also, when rebooting, the computer was wanting to run Chkdsk--and would not make any progress in so doing. While running this new scan, we got a popup "aswclnr.tmp--corrupt file The file or directory C:\Documents and Settings\Owner\Application Data\Lavasoft\Ad-Aware\description.ini is corrupt and unreadable. Please run the Chkdsk utility"
I believe we un-installed Ad-Aware before we realized that we were dealing with a virus and not a full C:\ drive--so I don't know if that's where that message is coming from.
Any thoughts?
Thank you, again!

My advice on the registry is: don't "Mess" with it, registry cleaners are the worst thing there is, they can seriously hose your machine. Once you are done with the Avast scan, we need to remove some of the temporary files, I will post more about that later.

Here it is!

avast! Virus Cleaner Tool - version 1.0.211 Unicode

Creating log file: L:\aswclnr.log

7/31/2007, 11:56:33 AM
Memory scanning started...
No virus body found in memory.
Memory scanning finished (3.1s).
----------
Files scanning started...
C:\Documents and Settings\Owner\Application Data\Lavasoft\Ad-Aware\description.ini... file could not be scanned!
C:\Documents and Settings\Owner\My Documents\My Music\iTunes\iTunes Music Library.xml... file could not be scanned!
C:\WINDOWS\system32\adfdebcddafcb.dll... file could not be scanned!
No virus body found.
Files scanning finished (438526 files, 0 infected, 11579.0s).
Drives scanned: C: D: G: L:

Doesn't look like it found anything . . . . .

Thank you!

Actually, it did find what I needed, the easiest way for to get the hijack this log done is to read and follow the directions in the Preparation guide for posting a hijack this log. If you have already done part of the steps, there is no need to repeat.

this is what I needed C:\WINDOWS\system32\adfdebcddafcb.dll... file could not be scanned! not good. Please reference this thread in your hijack this log post.

OK, 1st AdAware scan just finished--3-1/2 hours! It found 150 "privacy objects," which I asked it to delete. Rebooted, and am now scanning again.

When I'm ready to post the HJT log, how do I go about referencing this thread?

Once again, THANK YOU!

Just copy the text in bold http://www.bleepingcomputer.com/forums/topic102101.html here is what I have done so far and paste into the body along with the hijack this log.