Help! Possibly Vundo and others

gth44331 · May 27, 2009

Aircrack suite was to test my wireless. (WEP for the loss) Can't remember what Ethereal was for... OPHcrack/pwdump was mucking around at school. Forgot I still had them!

So if there's no 'active infection' then why else would my Automatic Updates be broken? It started after a reboot when I attempted to play Monster Truck Madness 2 as I mentioned so maybe the virus is gone but something just needs a reg fix maybe?

katana · May 27, 2009

Let's have a look at the update settings

Create A Batch File
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad.
Save it as "All Files" and name it look.bat Please save it on your desktop.

@echo off
if exist C:\klook*.txt del /q C:\klook*.txt
if exist C:\kresults.txt del /q C:\kresults.txt
regedit /e C:\klook1.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
type C:\klook*.txt >> C:\kresults.txt
start notepad C:\kresults.txt
del /q C:\klook*.txt
del /q %0
exit

Double click on look.bat
Please be patient, as this will search the registry

Notepad will open, please copy/paste the results here.

gth44331 · May 27, 2009

Be patient? It took about half a second!

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate]
"SusClientId"="998c5c4d-35b8-4924-853c-ffda53d959d5"
"SusClientIdValidation"=hex:04,01,00,01,06,00,22,15,ba,74,b4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"AUOptions"=dword:00000003
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000009
"ConfigVer"=dword:00000001
"ResetAU"=dword:00000001
"IncludeRecommendedUpdates"=dword:00000000
"NextDetectionTime"="2009-05-18 17:07:47"
"ScheduledInstallDate"="2009-05-18 23:00:00"
"BalloonTime"="2009-04-28 23:11:07"
"BalloonType"=dword:00000006
"DownloadExpirationTime"="2009-05-19 08:49:05"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Detect]
"LastError"=dword:00000000
"LastSuccessTime"="2009-05-17 22:51:27"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Download]
"LastSuccessTime"="2009-05-13 05:09:06"
"LastError"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install]
"LastSuccessTime"="2009-05-13 08:49:04"
"LastError"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting]
"BatchFlushAge"=dword:00001fd2
"SequenceNumber"=dword:00000003
"SamplingValue2"=dword:00000125

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache\Sus]
"CurrentCacheFile"="C:\\WINDOWS\\SoftwareDistribution\\EventCache\\{8E92F483-4CBC-4AD3-8C3D-08EEF46C6D53}.bin"
"FlushCacheFiles"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\EventCache\WU]
"CurrentCacheFile"="C:\\WINDOWS\\SoftwareDistribution\\EventCache\\{C85A700F-6F72-4B6D-A927-FCE857C8C63D}.bin"
"FlushCacheFiles"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services]
"DefaultService"="7971f918-a847-4430-9279-4a52d1efe18d"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\7971f918-a847-4430-9279-4a52d1efe18d]
"AuthorizationCab"="authcab.cab"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending]
"ValidatedPreWsus3RegistrationRequests"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup]

katana · May 27, 2009

We need to repair some of windows' internal registration settings

Please download Dial-A-Fix from one of the following mirrors:
- Primary Mirror
- Secondary Mirror
Extract the zip file to your desktop.
Double click Dial-a-Fix.exe to start the program.
Press the green double checkmark box (Looks like this:

)
UNcheck "Empty Temp Folders", as well as "Adjust Time/Date" in the prep section. The prep section should then look like this:
When the window looks like this, press the GO button in the bottom of the window.
Exit/Close Dial-A-Fix

Please check AutoUpdates now

gth44331 · May 28, 2009

Failed

8:20:10 AM | Dial-a-fix was unable to determine your version of Internet Explorer
Notes about this log:
1) "->" denotes an external command being executed, and "-> (number)" indicates
the return code from the previous command
2) Not all external command return codes are accurate, or useful
3) Sometimes commands return 0 (no error) even when they fail or crash
4) If an error occurs while registering an object, please send an email to:
dial-a-fix@DjLizard.net and include a copy of this log

DAF version: v0.60.0.24

--- System info ---
OS: Microsoft Windows XP Service Pack 3
IE version: 8.0.6001.18702
MPC: 76487-OEM
CPU: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz (~3580MHz)
CPU: CPU is 64-bit or has 64-bit extensions
CPU: 2 CPU cores present
BIOS: 30/10/2008
Memory (approx): 2047MB
Uptime: 0 hour(s)
Current directory: C:\Documents and Settings\HP_Administrator\Desktop\Dial-a-fix-v0.60.0.24
---

28/05/2009 8:20:10 AM -- Dial-a-fix : [v0.60.0.24] -- started
8:20:10 AM | Policy scan started
8:20:10 AM | Policy scan ended - no restrictive policies were found
--- MSI ---
8:21:10 AM | Registered: C:\WINDOWS\system32\msi.dll
--- Windows Update ---
--- Registration: Windows Update/Automatic Update DLLs ---
8:21:15 AM | Unregistered: C:\WINDOWS\system32\msxml.dll
8:21:15 AM | Registered: C:\WINDOWS\system32\msxml.dll
8:21:16 AM | Unregistered: C:\WINDOWS\system32\msxml2.dll
8:21:16 AM | Registered: C:\WINDOWS\system32\msxml2.dll
8:21:27 AM | Error during unregistration of C:\WINDOWS\system32\msxml3.dll - version: . The error returned is: Unspecified error
(-2147467259)
8:21:37 AM | Error during registration of C:\WINDOWS\system32\msxml3.dll - version: . The error returned is: Access is denied.
(-2147024891)
8:21:37 AM | Unregistered: C:\WINDOWS\system32\msxml4.dll
4:09:31 PM | Error during registration of C:\WINDOWS\system32\msxml4.dll - version: . The error returned is: Access is denied.
(-2147024891)
4:09:31 PM | Unregistered: C:\WINDOWS\system32\qmgr.dll
4:09:32 PM | Registered: C:\WINDOWS\system32\qmgr.dll
4:09:32 PM | Unregistered: C:\WINDOWS\system32\qmgrprxy.dll
4:09:32 PM | Registered: C:\WINDOWS\system32\qmgrprxy.dll
4:09:40 PM | Error during unregistration of C:\WINDOWS\system32\muweb.dll - version: . The error returned is: Access is denied.
(-2147024891)
4:09:50 PM | Error during registration of C:\WINDOWS\system32\muweb.dll - version: . The error returned is: Access is denied.
(-2147024891)
4:09:50 PM | Unregistered: C:\WINDOWS\system32\winhttp.dll
4:09:50 PM | Registered: C:\WINDOWS\system32\winhttp.dll
4:09:54 PM | Error during registration of C:\WINDOWS\system32\wuapi.dll - version: 7.2.6001.788. The error returned is: Access is denied.
(-2147024891)
4:09:54 PM | Unregistered: C:\WINDOWS\system32\wuaueng.dll
4:09:55 PM | Registered: C:\WINDOWS\system32\wuaueng.dll
4:09:55 PM | Unregistered: C:\WINDOWS\system32\wuaueng1.dll
4:09:55 PM | Registered: C:\WINDOWS\system32\wuaueng1.dll
4:09:55 PM | Unregistered: C:\WINDOWS\system32\wucltui.dll
4:09:55 PM | Registered: C:\WINDOWS\system32\wucltui.dll
4:09:55 PM | Unregistered: C:\WINDOWS\system32\wups.dll
4:09:55 PM | Registered: C:\WINDOWS\system32\wups.dll
4:09:55 PM | Unregistered: C:\WINDOWS\system32\wups2.dll
4:09:55 PM | Registered: C:\WINDOWS\system32\wups2.dll
4:09:56 PM | Unregistered: C:\WINDOWS\system32\wuweb.dll
4:09:56 PM | Registered: C:\WINDOWS\system32\wuweb.dll
4:09:56 PM | Registered: C:\WINDOWS\system32\ole32.dll
--- SSL/HTTPS/Cryptography ---
4:10:08 PM | Executed 'cmd.exe /c rmdir /q /s C:\WINDOWS\system32\Catroot2'
--- Registration: SSL/HTTPS/Cryptography ---
4:10:12 PM | Unregistered: C:\WINDOWS\system32\cryptdlg.dll
4:10:12 PM | Registered: C:\WINDOWS\system32\cryptdlg.dll
4:10:12 PM | Unregistered: C:\WINDOWS\system32\cryptui.dll
4:10:12 PM | Registered: C:\WINDOWS\system32\cryptui.dll
4:10:12 PM | Unregistered: C:\WINDOWS\system32\cryptext.dll
4:10:12 PM | Registered: C:\WINDOWS\system32\cryptext.dll
4:10:12 PM | Unregistered: C:\WINDOWS\system32\dssenh.dll
4:10:12 PM | Registered: C:\WINDOWS\system32\dssenh.dll
4:10:12 PM | Unregistered: C:\WINDOWS\system32\gpkcsp.dll
4:10:12 PM | Registered: C:\WINDOWS\system32\gpkcsp.dll
4:10:12 PM | Unregistered: C:\WINDOWS\system32\initpki.dll
4:10:45 PM | Registered: C:\WINDOWS\system32\initpki.dll
4:10:45 PM | Unregistered: C:\WINDOWS\system32\licdll.dll
4:10:45 PM | Registered: C:\WINDOWS\system32\licdll.dll
4:10:45 PM | Unregistered: C:\WINDOWS\system32\mssign32.dll
4:10:45 PM | Registered: C:\WINDOWS\system32\mssign32.dll
4:10:45 PM | Unregistered: C:\WINDOWS\system32\mssip32.dll
4:10:45 PM | Registered: C:\WINDOWS\system32\mssip32.dll
4:10:46 PM | Unregistered: C:\WINDOWS\system32\scardssp.dll
4:10:46 PM | Registered: C:\WINDOWS\system32\scardssp.dll
4:10:46 PM | Unregistered: C:\WINDOWS\system32\sccbase.dll
4:10:46 PM | Registered: C:\WINDOWS\system32\sccbase.dll
4:10:46 PM | Unregistered: C:\WINDOWS\system32\scecli.dll
4:10:46 PM | Registered: C:\WINDOWS\system32\scecli.dll
4:10:46 PM | Unregistered: C:\WINDOWS\system32\softpub.dll
4:10:46 PM | Registered: C:\WINDOWS\system32\softpub.dll
4:10:47 PM | Unregistered: C:\WINDOWS\system32\slbcsp.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\slbcsp.dll
4:10:47 PM | Unregistered: C:\WINDOWS\system32\regwizc.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\regwizc.dll
4:10:47 PM | Unregistered: C:\WINDOWS\system32\rsaenh.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\rsaenh.dll
4:10:47 PM | Unregistered: C:\WINDOWS\system32\winhttp.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\winhttp.dll
4:10:47 PM | Unregistered: C:\WINDOWS\system32\wintrust.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\wintrust.dll
--- Registration: ActiveX controls/codecs ---
4:10:47 PM | Registered: C:\WINDOWS\system32\acelpdec.ax
4:10:47 PM | Registered: C:\WINDOWS\system32\actxprxy.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\asctrls.ocx
4:10:47 PM | Registered: C:\WINDOWS\system32\daxctle.ocx
4:10:47 PM | Registered: C:\WINDOWS\system32\hhctrl.ocx
4:10:47 PM | Registered: C:\WINDOWS\system32\l3codecx.ax
4:10:47 PM | Registered: C:\WINDOWS\system32\licmgr10.dll
4:10:47 PM | Registered: C:\WINDOWS\system32\mpg4ds32.ax
4:10:49 PM | Registered: C:\WINDOWS\system32\msdxm.ocx
4:10:49 PM | Registered: C:\WINDOWS\system32\proctexe.ocx
4:10:49 PM | Registered: C:\WINDOWS\system32\tdc.ocx
4:10:49 PM | Registered: C:\WINDOWS\system32\wshom.ocx
--- Registration: Control Panel applets ---
4:10:49 PM | DllInstalled: C:\WINDOWS\system32\inetcpl.cpl
4:10:49 PM | DllInstalled: C:\WINDOWS\system32\appwiz.cpl
4:10:49 PM | Registered: C:\WINDOWS\system32\appwiz.cpl
4:10:49 PM | DllInstalled: C:\WINDOWS\system32\nusrmgr.cpl
4:10:49 PM | Registered: C:\WINDOWS\system32\nusrmgr.cpl
--- Registration: Direct[X|Draw|Show|Media] ---
4:10:49 PM | Registered: C:\WINDOWS\system32\quartz.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\danim.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\dmscript.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\dmstyle.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\dxmasf.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\dxtmsft.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\dxtrans.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\sbe.dll
--- Registration: Programming cores/runtimes ---
4:10:50 PM | Registered: C:\WINDOWS\system32\atl.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\corpol.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\jscript.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\dispex.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\scrrun.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\scrobj.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\vbscript.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\wshext.dll
--- Registration: Explorer/IE/OE/shell/WMP ---
4:10:50 PM | Registered: C:\WINDOWS\system32\activeds.dll
4:10:50 PM | Registered: C:\WINDOWS\system32\audiodev.dll
4:10:51 PM | DllInstalled: C:\WINDOWS\system32\browseui.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\browseui.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\browsewm.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\cabview.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\cdfview.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\clbcatex.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\clbcatq.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\comcat.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\cscui.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\credui.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\datime.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\devmgr.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\dfsshlex.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\dmdlgs.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\dmdskmgr.dll
4:10:51 PM | Registered: C:\WINDOWS\system32\dmloader.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\dmocx.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\dmview.ocx
4:10:52 PM | DllInstalled: C:\WINDOWS\system32\dsuiext.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\dsuiext.dll
4:10:52 PM | DllInstalled: C:\WINDOWS\system32\dsquery.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\dsquery.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\dskquoui.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\els.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\es.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\fontext.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\hlink.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\hnetcfg.dll
4:10:52 PM | Registered: C:\WINDOWS\system32\iedkcs32.dll
4:10:53 PM | Registered: C:\WINDOWS\system32\iepeers.dll
4:10:53 PM | Error 127: C:\WINDOWS\system32\iesetup.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:03 PM | Error 127: C:\WINDOWS\system32\iesetup.dll is not DLLInstall-able or the file is corrupted. Version: 8.00.6001.18702
4:11:07 PM | Registered: C:\WINDOWS\system32\ils.dll
4:11:07 PM | Error 127: C:\WINDOWS\system32\imgutil.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:11 PM | Registered: C:\WINDOWS\system32\inetcfg.dll
4:11:11 PM | Registered: C:\WINDOWS\system32\inetcomm.dll
4:11:11 PM | Error 127: C:\WINDOWS\system32\inseng.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:14 PM | Error 127: C:\WINDOWS\system32\inseng.dll is not DLLInstall-able or the file is corrupted. Version: 8.00.6001.18702
4:11:16 PM | Registered: C:\WINDOWS\system32\laprxy.dll
4:11:17 PM | Registered: C:\WINDOWS\system32\lmrt.dll
4:11:17 PM | Registered: C:\WINDOWS\system32\mlang.dll
4:11:17 PM | Registered: C:\WINDOWS\system32\mmcndmgr.dll
4:11:17 PM | Registered: C:\WINDOWS\system32\mmcshext.dll
4:11:18 PM | Registered: C:\WINDOWS\system32\mscoree.dll
4:11:18 PM | Error 127: C:\WINDOWS\system32\mshtml.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:19 PM | Error 127: C:\WINDOWS\system32\mshtml.dll is not DLLInstall-able or the file is corrupted. Version: 8.00.6001.18702
4:11:19 PM | Registered: C:\WINDOWS\system32\mshtmled.dll
4:11:20 PM | Registered: C:\WINDOWS\system32\msieftp.dll
4:11:20 PM | Registered: C:\WINDOWS\system32\msoeacct.dll
4:11:20 PM | Registered: C:\WINDOWS\system32\msr2c.dll
4:11:20 PM | Error 127: C:\WINDOWS\system32\msrating.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:21 PM | DllInstalled: C:\WINDOWS\system32\mydocs.dll
4:11:21 PM | Registered: C:\WINDOWS\system32\mydocs.dll
4:11:21 PM | Registered: C:\WINDOWS\system32\mstime.dll
4:11:21 PM | Registered: C:\WINDOWS\system32\netcfgx.dll
4:11:22 PM | DllInstalled: C:\WINDOWS\system32\netplwiz.dll
4:11:22 PM | Registered: C:\WINDOWS\system32\netplwiz.dll
4:11:22 PM | Registered: C:\WINDOWS\system32\netman.dll
4:11:22 PM | Registered: C:\WINDOWS\system32\netshell.dll
4:11:22 PM | Registered: C:\WINDOWS\system32\ntmsevt.dll
4:11:22 PM | Registered: C:\WINDOWS\system32\ntmsmgr.dll
4:11:23 PM | DllInstalled: C:\WINDOWS\system32\ntmssvc.dll
4:11:23 PM | Registered: C:\WINDOWS\system32\ntmssvc.dll
4:11:23 PM | Error 127: C:\WINDOWS\system32\occache.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:26 PM | Error 127: C:\WINDOWS\system32\occache.dll is not DLLInstall-able or the file is corrupted. Version: 8.00.6001.18702
4:11:27 PM | Registered: C:\WINDOWS\system32\ole32.dll
4:11:27 PM | Registered: C:\WINDOWS\system32\oleaut32.dll
4:11:28 PM | Registered: C:\WINDOWS\system32\oleacc.dll
4:11:28 PM | Registered: C:\WINDOWS\system32\olepro32.dll
4:11:28 PM | DllInstalled: C:\WINDOWS\system32\photowiz.dll
4:11:28 PM | Registered: C:\WINDOWS\system32\photowiz.dll
4:11:28 PM | Error 127: C:\WINDOWS\system32\pngfilt.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:28 PM | Registered: C:\WINDOWS\system32\remotepg.dll
4:11:28 PM | Registered: C:\WINDOWS\system32\rpcrt4.dll
4:11:28 PM | Registered: C:\WINDOWS\system32\rshx32.dll
4:11:29 PM | Registered: C:\WINDOWS\system32\sendmail.dll
4:11:29 PM | Registered: C:\WINDOWS\system32\slayerxp.dll
4:11:30 PM | DllInstalled: C:\WINDOWS\system32\shdocvw.dll
4:11:36 PM | Error during registration of C:\WINDOWS\system32\shdocvw.dll - version: 6.00.2900.5694. The error returned is: Error accessing the OLE registry.
(-2147319780)
4:11:36 PM | Registered: C:\WINDOWS\system32\shell32.dll
4:11:39 PM | DllInstalled: C:\WINDOWS\system32\shell32.dll
4:11:40 PM | Registered: C:\WINDOWS\system32\shmedia.dll
4:11:40 PM | DllInstalled: C:\WINDOWS\system32\shimgvw.dll
4:11:40 PM | Registered: C:\WINDOWS\system32\shimgvw.dll
4:11:40 PM | DllInstalled: C:\WINDOWS\system32\shsvcs.dll
4:11:40 PM | Registered: C:\WINDOWS\system32\shsvcs.dll
4:11:40 PM | Registered: C:\WINDOWS\system32\srclient.dll
4:11:41 PM | Unregistered: C:\WINDOWS\system32\stobject.dll
4:11:41 PM | Registered: C:\WINDOWS\system32\stobject.dll
4:11:41 PM | DllInstalled: C:\WINDOWS\system32\themeui.dll
4:11:41 PM | Registered: C:\WINDOWS\system32\themeui.dll
4:11:41 PM | Registered: C:\WINDOWS\system32\twext.dll
4:11:42 PM | DllInstalled: C:\WINDOWS\system32\urlmon.dll
4:11:42 PM | Registered: C:\WINDOWS\system32\urlmon.dll
4:11:42 PM | Registered: C:\WINDOWS\system32\userenv.dll
4:11:42 PM | Error 127: C:\WINDOWS\system32\webcheck.dll is not registerable or the file is corrupted. Version: 8.00.6001.18702
4:11:43 PM | Error 127: C:\WINDOWS\system32\webcheck.dll is not DLLInstall-able or the file is corrupted. Version: 8.00.6001.18702
4:11:44 PM | Registered: C:\WINDOWS\system32\webvw.dll
4:11:44 PM | Registered: C:\WINDOWS\system32\winhttp.dll
4:11:44 PM | DllInstalled: C:\WINDOWS\system32\wininet.dll
4:11:44 PM | Registered: C:\WINDOWS\system32\zipfldr.dll
4:11:44 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdadc.dll
4:11:44 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaenum.dll
4:11:44 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaer.dll
4:11:45 PM | Error during registration of C:\Program Files\Common Files\system\Ole DB\msdaipp.dll - version: 12.0.6211.1000. The error returned is: Access is denied.
(-2147024891)
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaora.dll
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaosp.dll
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaps.dll
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdasc.dll
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdasql.dll
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdatt.dll
4:11:45 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdaurl.dll
4:11:46 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdmeng.dll
4:11:46 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msdmine.dll
4:11:46 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msmdcb80.dll
4:11:48 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msmdgd80.dll
4:11:50 PM | Error during registration of C:\Program Files\Common Files\system\Ole DB\msolap80.dll - version: 8.00.2216. The error returned is: Unspecified error
(-2147467259)
4:11:51 PM | Error during registration of C:\Program Files\Common Files\system\Ole DB\msolui80.dll - version: 8.00.2039. The error returned is: Unspecified error
(-2147467259)
4:11:51 PM | Registered: C:\Program Files\Common Files\system\Ole DB\msxactps.dll
4:11:51 PM | Registered: C:\Program Files\Common Files\system\Ole DB\oledb32.dll
4:11:51 PM | Registered: C:\Program Files\Common Files\system\Ole DB\oledb32r.dll
4:11:51 PM | Registered: C:\Program Files\Common Files\system\Ole DB\sqloledb.dll
4:11:51 PM | Registered: C:\Program Files\Common Files\system\Ole DB\sqlxmlx.dll

gth44331 · May 28, 2009

I was prompted by the software to try Tools -> Repair Permissions. (To fix some issues around the Automatic Updates part) Although I haven't attempted this as of yet. I'll wait for the go ahead.

gth44331 · May 28, 2009

Should have tried this earlier. But I opened up Security Center and hit 'Turn Automatic Updates On' which wasn't previously an option. (Was yellow 'caution' instead of red 'off')

I'm yet to reboot, but it claims to be turned on. :bigthumb:

katana · May 28, 2009

gth44331 said:
Should have tried this earlier. But I opened up Security Center and hit 'Turn Automatic Updates On' which wasn't previously an option. (Was yellow 'caution' instead of red 'off')

I'm yet to reboot, but it claims to be turned on. :bigthumb:

Please reboot and see if we have cracked it

gth44331 · May 28, 2009

Restarted and it looks to be sweet! :thanks:

katana · May 28, 2009

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Please delete RSIT.exe, DialAFix (Zip & Folder) and C:\RSIT (entire folder)
You can also delete any logs we have produced, and empty your Recycle bin.

Uninstall Combofix

This will clear your System Volume Information restore points and remove all the infected files that were quarantined
Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.

Please download OTCleanup from HERE
Click the OTC.exe icon and then click the CleanUp button.
If you get any pop ups asking if it is OK let the program proceed. At the end the program will ask to let it reboot the computer. Let it do so.
Let me know if there were any problems with OT CleanIt
----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean.

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy <<< A must have program
- It includes host protection and registry protection
- A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware <<< A New and effective program
a-squared Free <<< A good "realtime" or "on demand" scanner
superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol
- An excellent startup manager and then some !!
- Notifies you if programs are added to startup
- Allows delayed startup
- A must have addition
SpywareBlaster 4.0
- SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2
- SpywareGuard provides real-time protection against spyware.
- Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut
- Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS
- This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
- For information on how to download and install, please read this tutorial by WinHelp2002.
- Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
    - Change the Download signed ActiveX controls to Prompt
    - Change the Download unsigned ActiveX controls to Disable
    - Change the Initialise and script ActiveX controls not marked as safe to Disable
    - Change the Installation of desktop items to Prompt
    - Change the Launching programs and files in an IFRAME to Prompt
    - Change the Navigate sub-frames across different domains to Prompt
    - When all these settings have been made, click on the OK button.
    - If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
- FireFox
  - With many addons available that make customization easy this is a very popular choice
  - NoScript and AdBlockPlus addons are essential
- Opera
  - Another popular alternative
- Netscape
  - Another popular alternative
  - Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner
- Free and very simple to use
CCleaner
- Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

gth44331 · May 29, 2009

Yep, all good. Thanks again!

Help! Possibly Vundo and others

gth44331

New member

katana

Security Expert-Emeritus

gth44331

New member

katana

Security Expert-Emeritus

gth44331

New member

gth44331

New member

gth44331

New member

katana

Security Expert-Emeritus

gth44331

New member

katana

Security Expert-Emeritus

gth44331

New member