BleepingComputer.com: Think virus is gone

System Fix, removed with combo fix and malwarez, have ran the unhide.exe program, chkdsk will not run....tdskiller now finds nothing....


aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-28 01:51:31
-----------------------------
01:51:31.480 OS Version: Windows 6.0.6001 Service Pack 1
01:51:31.480 Number of processors: 2 586 0x1706
01:51:31.480 ComputerName: SAMANTHA UserName: keith
01:52:10.184 Initialize success
01:53:06.382 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2
01:53:06.382 Disk 0 Vendor: WDC_WD3200BEVT-75ZCT0 11.01A11 Size: 305245MB BusType: 3
01:53:08.441 Disk 0 MBR read successfully
01:53:08.441 Disk 0 MBR scan
01:53:08.441 Disk 0 Windows VISTA default MBR code
01:53:08.441 Disk 0 scanning sectors +625137345
01:53:08.535 Disk 0 scanning C:\Windows\system32\drivers
01:53:15.165 Service scanning
01:53:17.099 Modules scanning
01:53:22.403 Disk 0 trace - called modules:
01:53:22.419 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys
01:53:22.435 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85c4d1f8]
01:53:22.435 3 CLASSPNP.SYS[8bba5745] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-2[0x85a7eba0]
01:53:22.435 Scan finished successfully
01:53:41.327 Disk 0 MBR has been saved successfully to "C:\Users\keith\Documents\MBR.dat"
01:53:41.327 The log file has been saved successfully to "C:\Users\keith\Documents\aswMBR.txt"

My HiJackthis log......

I have office installed, can open a word document, yet in the start menu it shows the folder as empty.All of my programs showed after the unhide, but they show as empty...

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:00:06 AM, on 11/28/2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18639)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.campuslive.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\keith\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dldt_device - - C:\Windows\system32\dldtcoms.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\615\g2aservice.exe
O23 - Service: Google Update Service (gupdate1c9e40ca4ca6d80) (gupdate1c9e40ca4ca6d80) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 8417 bytes

This post has been edited by hamluis: 29 November 2011 - 10:34 PM
Reason for edit: Merged posts, moved from Am I Infected to Malware Removal Logs.

Now I seem to have a new problem.. .while waiting on an answer I was promted for a windows update... It was for service pack 2. I allowed it to download and install... then rebooted, and now I am stuck in a loop... If I try to start in safe mode it hangs up in safe mode at crcdisk.sys, will not restart in last known good configuation... try to do a start up repair and can't complete, gives me the detail problems of corrupt Boot Manager.

I am fairly savey, have tried to do a chkdsk /r from the command prompt, will run that, gives me some errors,(deleting index entry shsvcs.dll in index $I30 of file 1437 says it fixes) and (t2embed.dll) then recovers them both, and completes.

IDK what to do... I just want it to start normally!!! If I could stop the service pack 2 from installing, this would help... I think... any suggestions would be greatly appreciated, IDK where to even start now...




Hangs up on reboot on assuming trying to finsh service pack 2 install ... !! 0xc0190036 !! 722/68498 (t2embed.dll)

Do you think I should run a defrag from DOS?....

This post has been edited by moselbee: 29 November 2011 - 03:08 PM

While waiting for assistance from removing the virus, I was prompted to install SP2.. (VISTA).. I accepted it, now I am stuck... IDK what to do!!

Now I seem to have a new problem.. .while waiting on an answer I was promted for a windows update... It was for service pack 2. I allowed it to download and install... then rebooted, and now I am stuck in a loop... If I try to start in safe mode it hangs up in safe mode at crcdisk.sys, will not restart in last known good configuation... try to do a start up repair and can't complete, gives me the detail problems of corrupt Boot Manager.

I am fairly savey, have tried to do a chkdsk /r from the command prompt, will run that, gives me some errors,(deleting index entry shsvcs.dll in index $I30 of file 1437 says it fixes) and (t2embed.dll) then recovers them both, and completes.

IDK what to do... I just want it to start normally!!! If I could stop the service pack 2 from installing, this would help... I think... any suggestions would be greatly appreciated, IDK where to even start now...


Hangs up on reboot on assuming trying to finsh service pack 2 install ... !! 0xc0190036 !! 722/68498 (t2embed.dll)

Any help would be great, I have a second computer that I can work from to try to obtain files and info to fix this problem... Thank you again in advance,

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/429655 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

I can't get past the boot up, Running vista, I am not 100% if it is a 32 or 64 bit.... BUT once the service pack 2 downloaded and it wanted to restart, I get stuck when it is installing it, I can use the recovery disk to get to the repair, dos prompt... I believe if I could delete the Service pack completely, or tell the computer to not finish installing it, everything would be ok. I ran a spinrite and it says there are no bad sectors or hard drive damage. Thanks

Try doing a system restore from the installation dvd or recovery partition to the entry directly before the install.

If that doesn't work, get to a an elevated command prompt and copy and paste:

rename c:\windows\winsxs\pending.xml pending.old

If still not working at a command prompt type :
regedit

Then find and delete the following keys:

AdvancedInstallersNeedResolving
PendingXmlIdentifier

Thank YOU!!

I can't do a system restore.

I can't get to the start screen in safe more or normal. I only can get to the system recover options with the boot disk, vista, I have done a start up repair, it show's no problems... I can get into dos, the x:\sources and change to the c drive...

I received a syntax error when I typed the command file, I made certain it was exactly as you put it...

I deleted the two registry entry's...It still wants to install the service pack... !! 0xc0000034 !! 557/68498 (kd1394.dll) and freezes...

Greetings

I need you to make a bootable usb - follow the instructions below to do this

How to create a bootable Puppy USB Drive

• Download and save a copy of the latest Puppy ISO file
  
• Download and save a copy of Unetbootin for Windows.
  
• Insert an empty formatted USB drive into a USB port on the computer that's being used to create the bootable USB.
  
• Launch Unetbootin ....
  
• Ensure that Disk Image is selected.
  
• Using the browse button ... browse to and select the Puppy ISO file.
  
• Ensure that Type: is set to USB Drive and that the Drive: letter corresponds to the USB drive.
  
• Click OK

Unetbootin will now copy the Puppy files to the USB and make it a bootable device.

Next

You need to change the boot order of the computer to boot from a USB drive ....

• Read HERE for instructions how to do this.

Now boot into Puppylinux

when you get to the desktop Click on each of the drive items found in the bottom left corner to mount them (when mounted they will have a red cross next to them)

the C will be named different something like sba1 but navigate to this file and rename it

c:\windows\winsxs\pending.xml


then try and boot the computer

THANK YOU!!!!!!!!!!

I finnaly got the SP Stopped, but I am going to assume from all of the restarting and stopping vista is now mad!! I Can get to the windows screen, then it goes black, like does nothing... I did a windows repair, it runs it, says everthing is ok... but still won't boot... I am now running a chkdsk and I think it will be a while so as soon as it finishes I will get back to you, unless of course you have another solution as to which way I should go.... Thank you again.....

let it finish - have you tried safe mode?


gringo

OK... It finished and in safe mode I get hung up on the crcdisk.sys... in normal it just passes the windows and then stays on a black screen, I know it is not booting up all the way.. it just has a black screen... but I can still see colors around the edge so I know it didn't shut down... I am almost certain the hard drive is not damaged, just the virus did some kind of damage that started this mess....


I have no back up, which is why I am trying to not do a complete restore at this point...

Any suggestions are appreciated....

Hello

You can start to remove any files you may want to keep with puppy (just in case)


System Recovery Environment

To access the System Recovery Environment, simply boot your PC,

• just before the system loads the Windows operating system, hit the [F8] Function 8 key on your keyboard which will launch the Advanced Boot Options menu.
  
  
• There you will see a new option 'Repair Your Computer', select this option and hit 'Enter' on your keyboard.
  
  
• Now, from the System Recovery Options dialog, select the "Operating System" you want to repair, then click Next:
  
  
• From the "Choose a Recovery Tool" dialog menu, select "Command Prompt":
  
  
• Type the following into the "Command Prompt Window": and press enter
  
  
  bootrec.exe /fixmbr
  

If you have problems booting the computer after you have run that command boot back into the System Recovery Environment and Type the following into the "Command Prompt Window": and press enter

bootrec.exe /fixboot

I assume I would do that from the c:\> drive... not the x:\>sources at the prompt?!I don't like to assume so I just want to double check...

yes from the c drive



gringo

OK.. .I did both and it still won't boot... I just don't understand!!!!!!!!!


Same errors....


It will go to the windows in normal and then flash like it wants to, then the screen just remains black and then from safe mode it freezes are the crcdisk.sys