Help
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
This topic is locked
have a problem with something that invaded my home computer through my teenager's profile. She was savvy enough to run Microsoft Security Essentials but then turned off the computer and didn't tell me. When I logged on using my profile, with Admin rights, all heck broke loose. MSE identified Trojan: win32/sirefef.j and win32/alureon.fl but even after quarantine I still had System Fix overwhelming my computer with fake scans and alerts. Everything on start and my desktop was gone. I ran MBAM.exe once I figured out how to get back the Run box. MBAM found a bunch of rogue.fakeHDD and PUM.hijack.
I used the unhide.exe from this site to see everything again. My System Restore was completely dead in the water, not working, and all my restore points gone. I ran SFC/ scannow based on advice from another site as I can't find my original XP disk. I have a lot better functionality but I'm still missing Administrative Tools (not just from the Start but also the Control Panel). System Fix, while not popping up, was showing up on the task bar and I was able to stop it by going to All Users. My Office seems to be working fine after I ran a repair off of the original disk.
I've scanned with MSE and MBAM. Both indicate my computer is clean but I have a bunch of empty folders on the Start and can't find Administrative Tools. I'm scared to death to touch the Registry myself but can't seem to find a reliable tool. One site said do not delete temporary files, that is probably where the things in the empty folders were moved to, but how do I get them back to the right place (without somehow reactivating the malware if it's still lurking in my computer)?
I may be better with using a program to do the fixing that's needed because I am a computer chicken but what's a good program? I'm just scared if I touch the Registry I'm going to mess something up really bad.
Your advice would be greatly appreciated.
MBAM logged:
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12/19/2011 8:38:57 PM
mbam-log-2011-12-19 (20-38-57).txt
Scan type: Quick scan
Objects scanned: 220046
Time elapsed: 25 minute(s), 58 second(s)
Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 8
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
c:\documents and settings\all users\application data\kddbmaciksdmig.exe (Rogue.FakeHDD) -> 2308 -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KDDBMACIkSDmIg.exe (Rogue.FakeHDD) -> Value: KDDBMACIkSDmIg.exe -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\all users\application data\kddbmaciksdmig.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\documents and settings\Caitlin\local settings\temp\gijxfifpya90gt.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully.
Unfortunately, I can't figure out how to download a log from MSE, which is what detected the Sirefef and Alureon trojans. I'm trying to get help off the Microsoft site and will revise this thread as soon as I figure it out.
This post has been edited by Christine_R: 25 December 2011 - 10:57 AM
Back to top
In order to continue receiving help at BleepingComputer.com, 
If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:
