BleepingComputer.com: Task Manager disabled, hidden icons

Malware remnant was removed, let's see if there's still more by running an online scan.


ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan.
  

  Quote

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth Technology


• Now click on:
  
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  
• When completed the Online Scan will begin automatically.
  
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  
• Now click on:
  
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

This post has been edited by sempai: 31 May 2011 - 09:42 AM

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6522
# api_version=3.0.2
# EOSSerial=8f721a1600b6e14592d8a07953be1144
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-05-31 04:30:03
# local_time=2011-05-31 12:30:03 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=79837
# found=3
# cleaned=0
# scan_time=5675
C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\jar.class-36ac7ff-7152c3f8.class a variant of Java/TrojanDownloader.OpenStream.NBV trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\mndrtdsf.jar-4017acd-44deb267.zip multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\IncrediMail\bin\IncrediMail_Install.exe probably a variant of Win32/Agent.DYVNCLY trojan (unable to clean) 00000000000000000000000000000000 I

ESET online scan reported a couple of malicious applets and a possible false positive.


1. Please go to http://virscan.org/

• Navigate the following file path into the "Suspicious files to scan" box on the top of the page:
  
  
  C:\Program Files\IncrediMail\bin\IncrediMail_Install.exe
  
  
• Click on the Upload button
  
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  
• Paste the contents of the Clipboard in your next reply.

2. Please reopen OTL on your desktop.

• Copy and Paste the following code into the Custom Scan/Fixes text box.
  
  

  :Files
  C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\jar.class-36ac7ff-7152c3f8.class
  C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\mndrtdsf.jar-4017acd-44deb267.zip
  
  :Commands
  [EMPTYTEMP] 
  

  
  
  
• Push the Run Fix button.
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• A massage box "Fix complete! Click OK to open the fix log." will pop-up.
  
• Click the OK button and a report will open.
  
• Copy and Paste that report in your next reply.

3. Let's clean your Java cache.

• Please click start > control panel > Java.
  
• Then go to General tab and click on settings under Temporary internet files.
  
• Click delete files and press ok.

VirSCAN.org Scanned Report :
Scanned time : 2011/06/01 08:14:02 (EDT)
Scanner results: 16% Scanner(s) (6/37) found malware!
File Name : IncrediMail_Install.exe
File Size : 525664 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : d785355f276fc063e879c1035c224e40
SHA1 : b28f8b8f98e77f1fb190eb079f2dd880177d5b81
Online report : http://file.virscan.org/report/096d859bd653e5fa16a36d0cad20563a.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.2 20110601190500 2011-06-01 10.91 Riskware.Downloader.Win32.ImLoader.e!A2
AhnLab V3 2011.05.31.03 2011.05.31 2011-05-31 15.57 -
AntiVir 8.2.5.6 7.11.8.216 2011-06-01 0.30 -
Antiy 2.0.18 20110205.7694535 2011-02-05 0.02 -
Arcavir 2011 201105080215 2011-05-08 0.07 -
Authentium 5.1.1 201106010101 2011-06-01 4.19 -
AVAST! 4.7.4 110601-0 2011-06-01 0.06 -
AVG 8.5.850 271.1.1/3668 2011-05-30 0.36 -
BitDefender 7.90123.7406640 7.37559 2011-05-24 0.00 -
ClamAV 0.96.5 13132 2011-05-31 0.16 -
Comodo 4.0 8910 2011-06-01 1.34 -
CP Secure 1.3.0.5 2011.06.01 2011-06-01 0.11 -
Dr.Web 5.0.2.3300 2011.06.01 2011-06-01 13.78 -
F-Prot 4.4.4.56 20110531 2011-05-31 4.95 -
F-Secure 7.02.73807 2011.06.01.03 2011-06-01 12.48 -
Fortinet 4.2.257 13.288 2011-05-31 0.59 -
GData 22.498/22.134 20110601 2011-06-01 10.84 -
ViRobot 20110601 2011.06.01 2011-06-01 0.39 -
Ikarus T3.1.32.20.0 2011.06.01.78513 2011-06-01 4.70 -
JiangMin 13.0.900 2011.05.30 2011-05-30 2.68 -
Kaspersky 5.5.10 2011.06.01 2011-06-01 0.18 not-a-virus:Downloader.Win32.ImLoader.e
KingSoft 2009.2.5.15 2011.6.1.18 2011-06-01 1.93 -
McAfee 5400.1158 6340 2011-05-08 10.14 -
Microsoft 1.6903 2011.06.01 2011-06-01 5.59 -
NOD32 3.0.21 6165 2011-05-30 0.05 probably a variant of Win32/Agent.DYVNCLY trojan
Norman 6.07.08 6.07.00 2011-05-31 12.01 -
Panda 9.05.01 2011.05.31 2011-05-31 19.75 -
Trend Micro 9.200-1012 8.196.06 2011-06-01 0.05 -
Quick Heal 11.00 2011.06.01 2011-06-01 1.34 Downloader.ImLoader.e (Not a Virus)
Rising 20.0 23.60.01.05 2011-05-31 2.68 -
Sophos 3.19.1 4.65 2011-06-01 5.33 -
Sunbelt 3.9.2493.2 9451 2011-05-31 1.23 -
Symantec 1.3.0.24 20110531.002 2011-05-31 0.10 -
nProtect 20110531.02 3459675 2011-05-31 23.80 -
The Hacker 6.7.0.1 v00176 2011-04-18 0.95 Aplicacion/ImLoader.e (Unwanted)
VBA32 3.12.16.0 20110530.2033 2011-05-30 4.58 Downloader.Win32.ImLoader.e
VirusBuster 5.3.0.4 14.0.59.0/5288748 2011-05-31 0.00 -



All processes killed
========== FILES ==========
File move failed. C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\jar.class-36ac7ff-7152c3f8.class scheduled to be moved on reboot.
C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\mndrtdsf.jar-4017acd-44deb267.zip moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 373795 bytes
->Flash cache emptied: 456 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 56504 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Marlu Taylor
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: MTaylor
->Temp folder emptied: 231584 bytes
->Temporary Internet Files folder emptied: 1857381 bytes
->Java cache emptied: 11564905 bytes
->Flash cache emptied: 56996 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: nsmith
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 3594257 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 17.00 mb


OTL by OldTimer - Version 3.2.23.0 log created on 06012011_083721

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\MTaylor\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\jar.class-36ac7ff-7152c3f8.class not found!
C:\Documents and Settings\MTaylor\Local Settings\Temporary Internet Files\Content.IE5\XI6LSNK2\index[1].htm moved successfully.
C:\Documents and Settings\MTaylor\Local Settings\Temporary Internet Files\Content.IE5\XI6LSNK2\index[2].htm moved successfully.
C:\Documents and Settings\MTaylor\Local Settings\Temporary Internet Files\Content.IE5\Q58UW4SL\online-scanner[1].htm moved successfully.
C:\Documents and Settings\MTaylor\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

Please delete this file -> C:\Program Files\IncrediMail\bin\IncrediMail_Install.exe

Do you still have any question or concern?


Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Download the latest version of Java Runtime Environment (JRE) Version 6.
  
• Look for "JDK 6 Update 25 (JDK or JRE).
  
• Click the "Download JRE" button to the right.
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
  
  • Select "Windows x86 Offline" and click on jre-6u25-windows-i586.exe
  
  
• Save it to your desktop
  
• Close any programs you may have running - especially your web browser.
  
• Uninstall all older versions of Java (any item with Java Runtime Environment, JRE or J2SE in the name).
  
• Reboot your computer once all Java components are removed.
  
• Install the newest version by double clicking (run as Administrator for Windows Vista/Seven) the downloaded file.

sempai, everything looks fine as far as I can tell. It's slow to boot, but I'm pretty sure it was that way before it was infected and I can dig into that now that you've guided me through the exorcism. ;)

I can't thank you enough for your assistance.

OK, please try the following and see if the performance will improve.

1. Please check volume for errors.

• To check the volume for errors:
  
• Click start and then My Computer.
  
• Right click the drive C and select Properties.
  
• Under Tools tab press Check Now...
  
• Put a check mark in both items and press start.
  
• If you get a message click Yes to schedule the disk check and click OK and then restart your computer to start the disk check. Please be patient and let the system run. In some cases it might take a couple of hours and you don't have to sit there the whole time.

2. Please go to this link -> http://www.bleepingcomputer.com/tutorials/the-importance-of-disk-defragmentation/ and follow the steps to perform a Disk Defragmentation.

This post has been edited by sempai: 01 June 2011 - 08:08 AM
Reason for edit: Typo

This topic will be close if I didn't hear from you within 24 hours.

sempai, it was not my intention for you to devote your time to my boot issue, though I appreciate that you are willing to do so.

I did check the volume for errors and it is clean. The OS says defragmentation is not necessary.

The delay occurs after the POST and after user login. the Windows Start sound plays and the mouse cursor appears against the default blue background, but the taskbar and desktop do not appear for over a minute.

Hi scpanther,

It's a policy to close a topic whether it's resolved or stale, in the event of an stale topic... we need to make a call when to close that topic and in my case I will close it if the user didn't reply within 5 days but I always bump the topic first just to alert the topic starter. And this is the reason why I told you that I will close the topic after 24 hours.

But anyway if you still wish to fix this issue, you can start a new topic in Windows XP Home and Professional forum for a deeper analysis.


Let's move on housekeeping to properly remove the tools.

Uninstall:


Delete:


Clean-up with OTL:

• Run OTL
  
• Click on the CleanUp! button.

Your log is clean, take the time to read below to secure your machine and take the necessary steps to keep it Clean

Thank you, sempai. I appreciate the heads-up on closing the thread. Again, I had thought we were finished once the computer was malware-free and hadn't expected the further tips on addressing the boot speed issue, but they are appreciated.

I have removed the tools and will check out the resources you've recommended.

Thanks again, so much, for your assistance with this infection. I did not want to format this machine and thanks to you it will not be necessary.

God bless.

You're welcome.

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.