Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Autorun on a New Laptop :(


  • This topic is locked This topic is locked
13 replies to this topic

#1 cutletsupreme

cutletsupreme

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:22 PM

Posted 22 June 2009 - 10:00 PM

Recycler has been running rampant on my university's computers and I'm almost certain that my home laptop is infected because of my USB use. I ran auto eater and it brought up

[AUTORUN]
ShellExecute=Info.exe protect.ed 480 480

as being suspicious. It was not able to delete the file.

Have there been any tools developed to remove autorun viruses from USBs and computers alike?

Anyways...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:35 PM, on 6/22/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\windows\SMINST\Components\scheduler\STService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Dell Remote Access\ezi_ra.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Autorun Eater\oldmcdonald.exe
C:\Program Files\Autorun Eater\billy.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\wsqmcons.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [Autorun Eater] C:\Program Files\Autorun Eater\oldmcdonald.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\Components\scheduler\Launcher.exe
O4 - HKLM\..\RunOnce: [DSUpdateLauncher] "C:\Program Files\Dell DataSafe Local Backup\Components\DSUpdate\runhstart.bat"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe
O4 - Global Startup: Dell Remote Access.lnk = ?
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Advanced Networking Service (hnmsvc) - Dell Inc. - c:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks - C:\Windows\sminst\sftservice.EXE
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

--
End of file - 8998 bytes


Thank you in advance for your help. I'll be more vigilant from now on where I stick my disk.

BC AdBot (Login to Remove)

 


#2 Guest_superbird_*

Guest_superbird_*

  • Guests
  • OFFLINE
  •  

Posted 27 June 2009 - 10:26 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

#3 cutletsupreme

cutletsupreme
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  

Posted 27 June 2009 - 06:49 PM

Functionally my computer is OK. But I inserted a USB that has been autorun in computers infected with Recyler Virus. I downloaded autorun eater to see if I was infected and it brought up suspicious autorun.inf detected [AUTORUN]
ShellExecute=Info.exe protect.ed 480 480
in the E recovery drive, and that it was unable to delete the file. I am wondering if that file means I am infected and how do I go about ridding myself of it.

Thank you


Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3545.2034 [GMT -4:00]

SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe
c:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\sminst\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\RUNDLL32.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Windows\system32\Dwm.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\windows\SMINST\Components\scheduler\STService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Dell Remote Access\ezi_ra.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Autorun Eater\oldmcdonald.exe
C:\Program Files\Autorun Eater\billy.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\SoulseekNS\slsk.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\XX\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [QuickSet] c:\program files\dell\quickset\QuickSet.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [Dell DataSafe Online] "c:\program files\dell datasafe online\DataSafeOnline.exe" /m
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [Autorun Eater] c:\program files\autorun eater\oldmcdonald.exe
mRunOnce: [Launcher] %WINDIR%\SMINST\Components\scheduler\Launcher.exe
mRunOnce: [DSUpdateLauncher] "c:\program files\dell datasafe local backup\components\dsupdate\runhstart.bat"
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\users\xx~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\dellre~1.lnk - c:\windows\installer\{f66a31d9-7831-4fba-ba02-c411c0047cc5}\NewShortcut4_F66A31D978314FBABA02C411C0047CC5.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\xx\appdata\roaming\mozilla\firefox\profiles\gxsb0nf7.default\
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-7 64160]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_f6ef8056\AEstSrv.exe [2009-5-27 81920]
R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-12-18 155648]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1003344]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2008-12-4 226640]
R2 SftService;SoftThinks Agent Service;c:\windows\sminst\SftService.exe [2009-5-27 632048]
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc --> RUNDLL32.EXE ykx32coinst,serviceStartProc [?]
S3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\dellsu~1\hwdiag\bin\PCD5SRVC.pkms [2008-11-4 22904]

=============== Created Last 30 ================

2009-06-22 23:03 <DIR> --d----- c:\users\chrisb~1\appdata\roaming\Malwarebytes
2009-06-22 23:03 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-22 23:03 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-06-22 23:03 <DIR> --d----- c:\programdata\Malwarebytes
2009-06-22 23:03 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-22 23:03 <DIR> --d----- c:\progra~2\Malwarebytes
2009-06-22 22:53 <DIR> --d----- c:\program files\Trend Micro
2009-06-22 22:43 <DIR> --d----- c:\program files\Autorun Eater
2009-06-22 22:29 9,161 a------- c:\windows\system32\Config.MPF
2009-06-22 22:29 143,360 a------- c:\windows\system32\dunzip32.dll
2009-06-22 22:29 125,728 a------- c:\windows\system32\drivers\Mpfp.sys
2009-06-22 22:28 <DIR> --d----- c:\program files\McAfee.com
2009-06-22 22:28 <DIR> --d----- c:\program files\common files\McAfee
2009-06-22 22:28 <DIR> --d----- c:\program files\McAfee
2009-06-22 22:05 <DIR> --d----- c:\programdata\Autorun Eater
2009-06-22 22:05 <DIR> --d----- c:\progra~2\Autorun Eater
2009-06-20 19:03 <DIR> --d----- c:\programdata\WindowsSearch
2009-06-18 20:00 190 a------- c:\windows\_delis43.ini
2009-06-18 19:35 201,216 a------- c:\windows\system32\hlvdd.dll
2009-06-18 19:35 23,040 a------- c:\windows\system32\drivers\aksusb.sys
2009-06-18 19:34 <DIR> --d----- c:\program files\Galactic
2009-06-18 19:34 1,062,704 a------- c:\windows\system32\MSCOMCTL.OCX
2009-06-18 19:34 1,347,344 a------- c:\windows\system32\MSVBVM50.DLL
2009-06-18 19:34 140,096 a------- c:\windows\system32\COMDLG32.OCX
2009-06-18 19:34 29,696 a------- c:\windows\system32\VB5STKIT.DLL
2009-06-18 19:34 304,128 a------- c:\windows\IsUninst.exe
2009-06-18 19:24 <DIR> --d----- c:\program files\DivX
2009-06-18 19:24 <DIR> --d----- c:\program files\common files\DivX Shared
2009-06-18 19:09 <DIR> --d----- c:\program files\OriginLab
2009-06-18 19:06 <DIR> --d----- c:\users\chrisb~1\appdata\roaming\ACD Systems
2009-06-18 19:06 <DIR> --d----- c:\programdata\ACD Systems
2009-06-18 19:06 <DIR> --d----- c:\progra~2\ACD Systems
2009-06-18 19:05 <DIR> --d----- c:\program files\common files\ACD Systems
2009-06-18 19:05 <DIR> --d----- c:\program files\ACD Systems
2009-06-14 14:03 428,544 a------- c:\windows\system32\EncDec.dll
2009-06-14 14:03 293,376 a------- c:\windows\system32\psisdecd.dll
2009-06-14 14:03 217,088 a------- c:\windows\system32\psisrndr.ax
2009-06-14 14:03 177,664 a------- c:\windows\system32\mpg2splt.ax
2009-06-14 14:03 69,632 a------- c:\windows\system32\Mpeg2Data.ax
2009-06-14 14:03 80,896 a------- c:\windows\system32\MSNP.ax
2009-06-14 14:03 57,856 a------- c:\windows\system32\MSDvbNP.ax
2009-06-14 12:37 15,688 a------- c:\windows\system32\lsdelete.exe
2009-06-11 22:20 720 a------- c:\users\xx~1\appdata\roaming\wklnhst.dat
2009-06-10 06:40 2,033,152 a------- c:\windows\system32\win32k.sys
2009-06-10 06:40 636,928 a------- c:\windows\system32\localspl.dll
2009-06-10 06:40 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-06-07 14:41 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-06-07 10:04 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-06-07 10:02 <DIR> -cd-h--- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-07 10:02 <DIR> -cd-h--- c:\progra~2\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-07 10:02 <DIR> --d----- c:\programdata\Lavasoft
2009-06-07 10:02 <DIR> --d----- c:\program files\Lavasoft
2009-06-07 09:59 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
2009-06-07 09:59 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-06-07 09:59 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
2009-06-06 16:14 <DIR> --d----- c:\program files\uTorrent
2009-06-06 16:12 <DIR> --d----- c:\users\chrisb~1\appdata\roaming\uTorrent
2009-06-06 15:03 97,800 a------- c:\windows\system32\infocardapi.dll
2009-06-06 15:03 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-06 15:03 622,080 a------- c:\windows\system32\icardagt.exe
2009-06-06 15:03 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-06-06 15:03 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-06-06 15:03 11,264 a------- c:\windows\system32\icardres.dll
2009-06-06 15:03 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-06-06 15:03 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-06-06 14:58 96,760 a------- c:\windows\system32\dfshim.dll
2009-06-06 14:58 282,112 a------- c:\windows\system32\mscoree.dll
2009-06-06 14:58 41,984 a------- c:\windows\system32\netfxperf.dll
2009-06-06 14:58 158,720 a------- c:\windows\system32\mscorier.dll
2009-06-06 14:58 83,968 a------- c:\windows\system32\mscories.dll
2009-06-06 14:56 562,176 a------- c:\windows\system32\msdtcprx.dll
2009-06-06 14:56 38,912 a------- c:\windows\system32\xolehlp.dll
2009-06-06 14:56 147,456 a------- c:\windows\system32\Faultrep.dll
2009-06-06 14:56 125,952 a------- c:\windows\system32\wersvc.dll
2009-06-06 14:56 7,680 a------- c:\windows\system32\spwmp.dll
2009-06-06 14:56 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-06-06 14:56 4,096 a------- c:\windows\system32\msdxm.ocx
2009-06-06 14:56 4,096 a------- c:\windows\system32\dxmasf.dll
2009-06-06 14:55 <DIR> --d----- c:\programdata\Soulseek
2009-06-06 14:55 <DIR> --d----- c:\progra~2\Soulseek
2009-06-06 14:53 <DIR> --d----- c:\program files\SoulseekNS
2009-06-06 14:50 1,524,736 a------- c:\windows\system32\wucltux.dll
2009-06-06 14:50 83,456 a------- c:\windows\system32\wudriver.dll
2009-06-06 14:50 162,064 a------- c:\windows\system32\wuwebv.dll
2009-06-06 14:50 31,232 a------- c:\windows\system32\wuapp.exe
2009-06-06 14:48 <DIR> --dsh--- C:\System Recovery
2009-06-06 14:45 <DIR> --d----- c:\users\xx\appdata\roaming\Dell
2009-06-06 14:45 <DIR> --d----- c:\users\XX
2009-06-06 14:41 <DIR> --dsh--- c:\programdata\Documents
2009-06-06 14:41 <DIR> --dsh--- C:\Documents and Settings

==================== Find3M ====================

2009-05-27 22:55 665,600 a------- c:\windows\inf\drvindex.dat
2009-05-27 22:54 26,112 a------- c:\windows\system32\hidserv.dll
2009-05-27 22:54 22,016 a------- c:\windows\system32\hid.dll
2009-05-27 22:53 1,191,936 a------- c:\windows\system32\msxml3.dll
2009-05-27 22:52 468,992 a------- c:\windows\system32\newdev.dll
2009-05-27 22:52 74,752 a------- c:\windows\system32\newdev.exe
2009-05-27 22:52 172,032 a------- c:\windows\system32\scrrun.dll
2009-05-27 22:52 155,648 a------- c:\windows\system32\wscript.exe
2009-05-27 22:52 135,168 a------- c:\windows\system32\cscript.exe
2009-05-27 22:52 430,080 a------- c:\windows\system32\vbscript.dll
2009-05-27 22:52 180,224 a------- c:\windows\system32\scrobj.dll
2009-05-27 22:52 90,112 a------- c:\windows\system32\wshext.dll
2009-05-27 22:50 1,645,568 a------- c:\windows\system32\connect.dll
2009-05-27 22:50 296,960 a------- c:\windows\system32\gdi32.dll
2009-05-27 22:50 2,927,104 a------- c:\windows\explorer.exe
2009-05-27 22:49 738,304 a------- c:\windows\system32\inetcomm.dll
2009-05-27 22:48 269,312 a------- c:\windows\system32\es.dll
2009-05-27 22:47 2,048 a------- c:\windows\system32\tzres.dll
2009-05-27 22:46 361,984 a------- c:\windows\system32\IPSECSVC.DLL
2009-05-27 22:46 288,768 a------- c:\windows\system32\drivers\srv.sys
2009-05-27 22:45 303,616 a------- c:\windows\system32\wmpeffects.dll
2009-05-27 22:43 885,248 a------- c:\windows\system32\RacEngn.dll
2009-05-27 22:43 1,314,816 a------- c:\windows\system32\quartz.dll
2009-05-27 22:43 425,472 a------- c:\windows\system32\PhotoMetadataHandler.dll
2009-05-27 22:43 712,704 a------- c:\windows\system32\WindowsCodecs.dll
2009-05-27 22:43 347,648 a------- c:\windows\system32\WindowsCodecsExt.dll
2009-05-27 22:42 12,240,896 a------- c:\windows\system32\NlsLexicons0007.dll
2009-05-27 22:42 2,644,480 a------- c:\windows\system32\NlsLexicons0009.dll
2009-05-27 22:42 801,280 a------- c:\windows\system32\NaturalLanguage6.dll
2009-05-27 22:40 212,480 a------- c:\windows\system32\drivers\mrxsmb10.sys
2009-05-27 22:40 1,334,272 a------- c:\windows\system32\msxml6.dll
2009-05-27 22:40 2,868,736 a------- c:\windows\system32\mf.dll
2009-05-27 22:40 996,352 a------- c:\windows\system32\WMNetMgr.dll
2009-05-27 22:40 94,720 a------- c:\windows\system32\logagent.exe
2009-05-27 22:38 320,512 a------- c:\windows\system32\imapi2.dll
2009-05-27 22:38 1,312,256 a------- c:\windows\system32\WMALFXGFXDSP.dll
2009-05-27 22:38 338,944 a------- c:\windows\system32\SysFxUI.dll
2009-05-27 22:38 167,424 a------- c:\windows\system32\drivers\portcls.sys
2009-05-27 22:38 130,048 a------- c:\windows\system32\drivers\drmk.sys
2009-05-27 22:38 5,632 a------- c:\windows\system32\drivers\drmkaud.sys
2009-05-27 22:38 177,208 a------- c:\windows\system32\halmacpi.dll
2009-05-27 22:38 141,880 a------- c:\windows\system32\halacpi.dll
2009-05-27 22:35 3,468 a------- c:\windows\system32\drivers\1028_Dell_INS_1545.mrk
2009-05-27 20:38 143,360 a------- c:\windows\inf\infstrng.dat
2009-05-27 20:38 86,016 a------- c:\windows\inf\infstor.dat
2009-05-27 20:38 51,200 a------- c:\windows\inf\infpub.dat
2009-05-27 20:16 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-27 15:00 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2009-05-27 14:59 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-05-01 17:02 90,112 a------- c:\windows\system32\dpl100.dll
2009-05-01 17:02 823,296 a------- c:\windows\system32\divx_xx0c.dll
2009-05-01 17:02 823,296 a------- c:\windows\system32\divx_xx07.dll
2009-05-01 17:02 815,104 a------- c:\windows\system32\divx_xx0a.dll
2009-05-01 17:02 811,008 a------- c:\windows\system32\divx_xx16.dll
2009-05-01 17:02 802,816 a------- c:\windows\system32\divx_xx11.dll
2009-05-01 17:02 685,056 a------- c:\windows\system32\DivX.dll
2009-04-24 12:05 827,904 a------- c:\windows\system32\wininet.dll
2009-04-24 12:02 78,336 a------- c:\windows\system32\ieencode.dll
2009-04-24 09:44 26,624 a------- c:\windows\system32\ieUnatt.exe
2009-04-01 04:56 8,198,680 a------- c:\windows\system32\TVWSetup.exe
2009-04-01 04:56 59,392 a------- c:\windows\system32\oemdspif.dll
2009-04-01 03:00 3,514,368 a------- c:\windows\system32\stlang.dll
2009-04-01 03:00 404,992 a------- c:\windows\system32\stcplx.dll
2009-04-01 03:00 835,072 a------- c:\windows\system32\stapo.dll
2009-04-01 03:00 432,128 a------- c:\windows\system32\stapi32.dll
2009-04-01 03:00 171,520 a------- c:\windows\system32\st326162.dll
2009-04-01 03:00 536,576 a------- c:\windows\system32\idtmini1.exe
2009-04-01 03:00 499,712 a------- c:\windows\system32\ctapo32.dll
2009-04-01 03:00 47,104 a------- c:\windows\system32\ctppld.dll
2009-04-01 03:00 368,640 a------- c:\windows\system32\aestecap.dll
2009-04-01 03:00 86,016 a------- c:\windows\system32\AESTCom.dll
2009-04-01 03:00 142,848 a------- c:\windows\system32\aestacap.dll
2009-04-01 03:00 61,440 a------- c:\windows\system32\aestaren.dll
2009-04-01 02:19 1,419,232 a------- c:\windows\system32\WdfCoInstaller01005.dll
2009-04-01 02:18 107,622 a------- c:\windows\system32\Vxdif.dll
2008-01-20 22:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

#4 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 29 June 2009 - 01:15 PM

Hello.

Please download and run flash-drive disinfector and then run OTL.

Download and Run FlashDisinfector
You may have a flash drive infection. These worms travel through your portable drives. If they have been connected to other machines, they may now be infected.
  • Please download Flash_Disinfector.exe by sUBs and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection.

Download and Run OTL

We need to create an OTL Report
  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
With regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#5 cutletsupreme

cutletsupreme
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:22 PM

Posted 30 June 2009 - 06:48 AM

I ran the first tool to completion and an "OK" box appeared, and when I ran OTL, the scan stopped while scanning HKEY_CURRENT USER_ ASSOCIATION KEYS and an error popped up saying "access violation at address 00528BBF in module OTL.exe". When I ran the tool again, a similar error with a different address appeared.


Now I'm wondering, can I insert a USB with Recycler on it, or a similar autorun, so long as I do not have the autorun option checked in my control panel? Or does merely sticking in the USB make me infected?


THANK YOU.

#6 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 30 June 2009 - 09:17 AM

Hello.

It should be fine now. Flash-drive disinfector creates a hidden autorun.inf folder to help prevent future autorun.inf infections and disables your autorun so prevents autorun infections to spread. However, other infection can spread to USB drives as well.

Try OTS.

Download and Run OTS
Download OTS by OldTimer to your Desktop.
  • Double-click on OTS.exe to start the program. If you are running on Vista then right-click the program and choose Run as Administrator.
  • Check the Scan all users box at the top left.
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Use the Add Reply button in the forum and Attach the scan back here (do not copy/paste it as it will be too big to fit into the post). It will be located in the OTScanIt folder and named OTScanIt.txt.
With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#7 cutletsupreme

cutletsupreme
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:22 PM

Posted 30 June 2009 - 06:16 PM

The OTL Report is 22 pages Long, and I'm not sure I should paste it. What should someone be looking for that is suspicious?

Thanks.

#8 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 30 June 2009 - 06:53 PM

Hello.

Please upload it to me then.

Upload File to Submission Channel
  • Please click on this link
  • Under Link to topic where this file was requested, input:
    http://www.bleepingcomputer.com/forums/t/236012/autorun-on-a-new-laptop/
  • Under Browse to the file you want to submit, please press Browse and select the log you want to send me.
  • Under the comments section, say that Extremeboy asked for the submission.
If there were any problems let me know.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#9 cutletsupreme

cutletsupreme
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:22 PM

Posted 01 July 2009 - 08:57 PM

The OTS log was uploaded this morning. Thank you for checking it.

#10 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 02 July 2009 - 09:55 AM

Hello.

Let's begin. First BACKUP your REGISTRY using ERUNT.

Download and Install ERUNT
This tool will create a complete backup of your registry. After every reboot, a new backup is created to ensure we have a safety net after each step. Do not delete these backups until we are finished.

Do not use the NTREGOPT that comes with the installation package.
  • Please download erunt-setup.exe to your desktop.
  • Double click erunt-setup.exe. If you are using Windows Vista, right click the icon and select "Run As Administrator." Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes only if you are using Windows XP. You can delete the installation file after use.
  • Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

Run Script with OTS

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.
  • Double-click on the Posted Image on your desktop to run it. If you are using Windows Vista, please right-click on it and select run as administrator.
  • Do not change any settings.
  • Close ALL OTHER PROGRAMS that you have opened currently.
  • Copy and Paste the information in the codebox below into the Posted Image box.
    [Registry - Safe List]
    < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    YN -> {5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
    < Drives with AutoRun files > -> 
    NY -> E:\AUTORUN.INF  -> E:\AUTORUN.INF [ NTFS ]
    < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
    YN -> \{29fb9f05-4af0-11de-b8da-806e6f6e6963} -> 
    YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{29fb9f05-4af0-11de-b8da-806e6f6e6963}\shell -> 
    YN -> \{29fb9f05-4af0-11de-b8da-806e6f6e6963}\shell\\"" -> [AutoRun]
    [Files/Folders - Modified Within 30 Days]
    NY -> 16 C:\Users\Chris Badalucco\AppData\Local\Temp\*.tmp files -> C:\Users\Chris Badalucco\AppData\Local\Temp\*.tmp
    NY -> 3 C:\Windows\Temp\*.tmp files -> C:\Windows\Temp\*.tmp
    [Alternate Data Streams]
    NY -> @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:5D432CE3
    [Custom Items]
    :files
    F:\autorun.inf
    G:\autorun.inf
    H:\autorun.inf
    I:\autorun.inf
    C:\$RECYCLE.BIN\
    E:\$RECYCLE.BIN\
    :end
    [Empty Temp Folders]
    [Reboot]
  • Now click the Posted Image button at the top.
  • The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix.
If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.

Then, re-run OTS like before and post back with the logs.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#11 cutletsupreme

cutletsupreme
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:22 PM

Posted 03 July 2009 - 08:26 AM

Ran the fix in OTS and got to a screen of just my wallpaper and total inactivity. So I logged off and ran a scan and here are the results. Thanks.

#12 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 03 July 2009 - 09:28 AM

Ran the fix in OTS and got to a screen of just my wallpaper and total inactivity. So I logged off and ran a scan and here are the results. Thanks.

I think you forgot to post it or attach it? I don't see the log :thumbup2:

Also, afterwards make sure you get the new OTS log attached as well.

Then, re-run OTS like before and post back with the logs.


~Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#13 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 06 July 2009 - 11:31 AM

Bump
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#14 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:22 PM

Posted 08 July 2009 - 01:13 PM

Hello.

Due to Lack of feedback, this topic is now Closed

If you need this topic reopened, please Send Me a Message. In your message please include the address of this thread in your request.
This applies only to the original topic starter.

Everyone else please start a new topic in the Hijackthis-Malware Removal forum.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users