Infected. Can't disable system restore!

Hi Guy's,

My background has been replaced with a black warning screen, and it is continuously refreshing the page.

I have gone through and done all of the recommended steps I could, and most notably I cannot disable the system restore. I go into My Computer Properties and the tab is just not there.

I know I currently have shnlog.exe and intmon.exe which I cannot remove, but I am not sure what else.

I have downloaded all of the recommended programs and run them all but they haven't appeared to do anything.

Any help would be great.

Jeff.

 

Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Here is my HJT log. Thanks.

Jeff.

 

First please uninstall Microsoft Antispyware so it will not block anything we try to fix. Also disable any other antispyware or antivirus programs so they will not block anything either!

Please download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster

• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program.

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://allstarsearch.net
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://allstarsearch.net
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://allstarsearch.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oneclicksearches.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oneclicksearches.com/search.php?qq=%1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://allstarsearch.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oneclicksearches.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpA149.tmp

O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O13 - FTP Prefix:
O13 - Gopher Prefix:

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\System32\shnlog.exe

C:\WINDOWS\System32\intmon.exe

C:\WINDOWS\System32\intell32.exe

C:\WINDOWS\System32\hpA149.tmp

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.

 

Hi,

I wnet through all of those steps. The computer is still running the same. The background is still there on the desktop, and the screen is still constantly refreshing itself.

I removed shnlog, intmon, and intell32 and I checked and they haven't come back. I didn't find hpA149.tmp, but there was a file named hpA4B0.tmp which I left there.

I went and looked and the system restore tab is still not there. I also forgot to mention i keep getting warnings popping up saying,

"...Internet Explorer cannot find the Active Desktop HTML file. This file is needed for your Active Desktop. To turn off your Active Desktop,click OK...'

Any ideas?

Thanks,

Jeff.

 

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file desktopfix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the desktopfix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES!


Click Start > Run > type regedit

Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Look for a DWORD value called "NoViewContextMenu"

When located right click and delete it!


Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Look for a DWORD value called "NoViewContextMenu"

When located right click and delete it!


Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

Look for a DWORD value called "NoChangingWallPaper"

When located right click and delete it!



Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Only Should have "NoDriveTypeAutoRun"

Remove This Value "NoActiveDesktop"
Remove This Value "ForceActiveDesktopOn"

Navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop

There should on be the (default) string here

Remove This Value NoComponents
Remove This Value NoAddingComponents
Remove This Value NoDeletingComponents
Remove This Value NoEditingComponents
Remove This Value NoHTMLWallpaper


Now, Navigate to and delete the following file:

C:\WINDOWS\Web\wallpaper.html


Final Step:

Right Click on your desktop, click properties, click the Desktop Tab, click Customize Desktop, click the Web Tab. Now, uncheck everything in this tab.

After you have completed ALL of the above, reboot and see if problem remains!

 

Hi,

I went through and did what I could.

The folder;
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
Is not there on my system? Niether is the Desktop tab in the desktop properties.

Any other ideas? Nothing seems to be working...?

Thanks,

Jeff.

 

After you complete this post reboot and let me know if problem is resolved.

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixsmit.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

Double-click on the fixsmit.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge, click YES!

 

Hi,

I added that to the registry, but still no joy. The Warning page is still on my backound and the system is still continually refreshing...

Jeff.

 

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixadt.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixadt.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

After you merge this into the registry REBOOT YOUR COMPUTER. After you have rebooted come back and let me know if problem remains.

 

Nope, still the same. Although now my Windows start menu etc looks like an older version, not the rounded style of XP???

Jeff.

 

Something isnt right, can you attach a screenshot of your desktop so I can see which one we are talking about?

 

Here is a pic of the desktop.

Thanks,

Jeff.

 

Do a manual search for the following files. Delete any that are found! Note the ones that are found and removed, reboot and let me know if problem is resolved.

Also, Right Click on your desktop, click properties, click the Desktop Tab, click Customize Desktop, click the Web Tab. Now, uncheck everything in this tab.

C:\wp.exe
C:\wp.bmp
C:\bsw.exe
C:\winstall.exe

C:\WINDOWS\desktop.html
C:\WINDOWS\Web\desktop.html
C:\WINDOWS\screen.html
C:\WINDOWS\uninstIU.exe

C:\WINDOWS\System\w8673492.exe
C:\WINDOWS\System\wp.bmp
C:\WINDOWS\System\oleadm.dll

C:\WINDOWS\System32\wp.bmp
C:\WINDOWS\System32\winnook.exe
C:\WINDOWS\System32\hookdump.exe

 

I am doing a search now on the files that you listed, however, I cant click on the desktop tab in properties, as it and a few others seem to have been removed, i have added a pic of it so you can see...

 

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixdesktop and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixdesktop.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

After you complete the above, reboot and see if tabs are back and if problem remains.

 

Hey,

No the tabs are still not there...?
Still doing the same, but the start menu is back to looking like the XP one.

Jeff.

 

Did you find any other the files I metioned?

Make sure you search for the files below and remove any that are found:

wp.exe
wp.bmp
desktop.html

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixdesktop1 and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixdesktop1.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

 

Hi,

No we didn't find any of the mentioned files anywhere on the system???

Added that patch, and still the same...

Jeff.

 

Before we go any further I would like you to run a few things.

First, please run Panda Online Scan. After the scan attach the log to your next post. Also please follow the below:

Download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report. And tell me if you are still having any problems.

 

Ok,

I did the online scan and I have attached the report. I also have atached the Ewido report.

I rebooted and the refreshing has stopped and now the background message is gone and a plain black background remains (yay!).

The tabs for the display settings are still not there, and niether is the System Restore tab.

Now I can't start up MSN Explorer (which is the browser I was using) as I am getting an error message:

" MSN6.EXE Unable to Locate Component

This application has failed to start because WININET.dll was not found. Re-installing the application may fix this problem. "

At least we are making progress

Jeff.

 

Download Pocket KillBox
(Don't run it yet)

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer ←–– Delete this whole folder if it exist!

C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer ←–– Delete this whole folder if it exist!


Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

• If you get an error message about Pending Operations, just reboot your computer manually.

C:\WINDOWS\uninstIU.exe

C:\WINDOWS\system32\intell32.exe
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\hhk.dll
C:\WINDOWS\system32\ole32vbs.exe
C:\WINDOWS\system32\wininet.dll
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\hpC225.tmp
C:\WINDOWS\system32\hpA4B0.tmp
C:\WINDOWS\system32\wppp.html
C:\WINDOWS\system32\hp5676.tmp

After you complete the above, procede with the below:

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixadt.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixadt.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

After you complete the above, reboot and attach a fresh HJT log.

 

Ok, now all of the display options are back again. The system restore tab is still not there and I am still getting the same error message,

..." MSN6.EXE Unable to Locate Component

This application has failed to start because WININET.dll was not found. Re-installing the application may fix this problem. "...

Here is my new HJT log file.


Thanks,

Jeff.

 

Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oneclicksearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.oneclicksearches.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.oneclicksearches.com/

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


After you complete the above, reboot and let me know if all of the Malware problems have been taken care of. We will address the error msg. but before we need to clean your system.

 

Did the HJT fixes, but when I went to use CCleaner it says.

..." dwwin.exe - Unable to Locate Component

This application has failed to start because WININET.dll was not found. Re-installing the application may fix this problem. "...


Jeff.

 

Do you have your Windows disk?

 

Yeah I do. Should I just run it and reinstall windows?

Jeff.

 

I just had a look and the C:\WINDOWS\SYSTEM32\DLLCACHE folder is not on my system.

Jeff

 

Jeff, follow the below instructions very closely!

Insert your Windows XP CD-ROM, close the autorun menu. Now click Start, RUN and type cmd

Once the command prompt opens, type in the below:

cd C:\ now press ENTER and type in the below:

copy D:\i386\wininet.dll C:\WINDOWS\System32

It should say 1 file(s) copied!

After you complete the above, type exit to exit the command prompt. Now REBOOT and see if problem remains.

 

It says "...The system cannot find the file specified..."

Jeff.

 

Before we go to plan F, is your CD drive listed as drive D:\ ??

 

Lol, yes. I actually have 2 CD Rom drives (D: and E: ), and I tried it from both just in case, and I got the same message.

Jeff.

 

Let's give this a try...

Download the file: wininet.dll
Locate where it says "Click here to go to the download of wininet.dll" and click it. This will take you to the download.

Extract the contents to C:\WINDOWS\System32

Afterwards reboot and see if problem remains.

 

Excellent. That worked.

Now everything seems to be workiing again.

The only issues that remain is that the System restore tab is still not there and the minor point, that the start menu tab looks like the Windows 98 style not XP.

Thanks heaps

Jeff.

 

For the System Restore tab issue, follow the below...

Click Start >> Run >> Type in regedit and press ENTER

Navigate to the following registry key:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore

Single click once on the entry; "SystemRestore" to empty its contents into the right pane.

Find the entry "DisableSR", right click on it and delete it.

After you complete the above, reboot and see if tab re-appears.

 

In that folder all there is, is another folder called Terminal Services, and a REG_SZ file with the label (Default)...?

Jeff.

 

Click Start > Run > Type in regedit

Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies

You shou only have 2 keys here, NonEnum & Ratings. If you have a System key right click and delete it.

Now navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

You should on have the key named Explorer with a DWORD Value named NoDriveTypeAutoRun. If anything else besides the DWORD Value exist right click and delete it.

Also, if you have a System key right click and delete it also. After you have completed the above, reboot and see if tab appears.

 

Ok,

In the first location;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies

There was NonEnum, Ratings, Explorer and System.

I removed System, should I remove Explorer too?


In;

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

In Explorer there was DWORD Value named NoDriveTypeAutoRun. There was also Classic Shell, NoSaveSettings and No Themes Tab, which I removed.

I deleted the System key.


I rebooted and the tab is still not there?

Jeff.

 

Yes, then reboot and see if shows.

 

Also, check to see if the service is running.

Click Start > Run > Type in services.msc

Search for "System Restore Service" and make sure its Started and set to Automatic.

 

I got rid of the explorer key, but no change.

I went to;

Click Start > Run > Type in services.msc

..and "System Restore Service" is not there. The closest is "System Event Notifiaction"

Jeff.

 

Download the attachment, save to your desktop and run the VBS file.

Let me know what it does.

 

It doesn't run, it asks me to select a program to run it with?

Jeff.

 

Download the file below:

http://www.dougknox.com/xp/fileassoc/xp_vbs_file_association.zip

After you download, extract and run the reg file. Afterwards run the first file I requested again.