I'm still having issues....

nordn8 · Dec 12, 2008

Hello....

I ran the "Read Me Run Me First" and I'm still having issues. Istarted having issues with a slugish system and my currsor would move on it's own and move to my start button from accross the screen even when I was controling my mouse.

Spybot S&D found Microsoft.Security.Internet Exporer and a missing DLL for WINDOWS\system32\mamman.vdk.

And ComboFix found WINDOWS\system32\mamman.vdk.vir. And my clock time wasn't reset from military time to regular time. Also, my Google toolbar was disabled to where I couldn't place a check on it to activate it in my browser. I tried to remove it from Add/Remove programs and it wouldn't let me remove it and when I clicked on Remove there was a visual glitch.

I am also still having issues with my currsor too and I am in need of assistance. I re-downloaded Google toolbar and I have installed it, but I can't activate it either. And I noticed what looks like a second Windows partition when I had to rebootin safe mode. I trid to access it but every time I tried my computer rebooted and returned to the same menue and options--weird.

I am going to install the Kapernski Virus Removal tool to see if this helps. I am currently running AVG 8 Free, but I will disable this to run tool. I've also tried Avenger.exe and Smitfraudfix.exe but those didn't help.

I'm attaching logs from scans per upload. Neither Malwarebytes, Supper AntiApyware, or Bitdefender Root Kit found anything.

Thanks,
nordn8

chaslang · Dec 14, 2008

Welcome to Major Geeks!

nordn8 said: ↑

Istarted having issues with a slugish system and my currsor would move on it's own and move to my start button from accross the screen even when I was controling my mouse.
Click to expand...

You are not having malware problems. Try a different mouse.

nordn8 said: ↑

And my clock time wasn't reset from military time to regular time.
Click to expand...

This just means that ComboFix was unable to 100% finish properly.

You can fix your clock from Control Panel ->Regional and Language Options and then on the Regional Options tab click the Customize button then on the next form click the Time tab. Then change the Time format to what you want. It explains there what the lower case and upper case letters will do. Upper case H is giving you 24 hour clock settings.

nordn8 said: ↑

Also, my Google toolbar was disabled to where I couldn't place a check on it to activate it in my browser. I tried to remove it from Add/Remove programs and it wouldn't let me remove it and when I clicked on Remove there was a visual glitch.
Click to expand...

Not a malware problem as you do not have any malware.

Do you have any idea what the below file is for/from?
Code:
c:\windows\system32\drivers\RKLB0.tmp.sys
nordn8 said: ↑
You should not install things like below into a Temp folder which are subject to deletion during any file system cleanup or by malware.

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\John\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

Below are a few other tips/things for you to do.

You need to remove the below from the c:\Program Files folder and start saving your downloads somewhere else with appropriate folders for each download. This is not a safe folder to save things in and this folder should only contain installed programs not the installers.
Code:
2008-05-23 02:31 3,230,781 ----a-w c:\program files\ASRLSetup.exe
2008-04-21 03:44 18,202,216 ----a-w c:\program files\setup_blazemp.exe
2008-04-04 01:24 2,400,784 ----a-w c:\program files\WLinstaller.exe
2008-04-04 01:09 2,400,784 ----a-w c:\program files\Windows Live Installer.exe
2008-04-01 23:29 35,960,792 ----a-w c:\program files\avg75free_519a1276.exe
2008-04-01 03:17 9,722,720 ----a-w c:\program files\spybotsd152.exe
2008-04-01 03:10 233,984 ----a-w c:\program files\HiddenXP.msi
2008-03-08 23:38 23,454,528 ----a-w c:\program files\AdbeRdr812_en_US.exe
2008-02-21 19:47 636,192 ----a-w c:\program files\DMSetup.exe
2008-01-24 07:48 59,054,032 ----a-w c:\program files\avg75iswt_516a1225.exe
2008-01-03 01:46 16,395,480 ----a-w c:\program files\gimp-help-2-0.13-eng-setup.exe
2008-01-03 01:34 15,180,000 ----a-w c:\program files\gimp-2.4.2-i686-setup.exe
2007-12-25 18:43 44,932,856 ----a-w c:\program files\avg75afwt_516a1225.exe
2007-12-24 03:24 6,026,816 ----a-w c:\program files\Firefox Setup 2.0.0.11.exe
2006-08-29 14:43 882,489 ----a-w c:\program files\pg2-050918-nt.exe
2006-05-10 02:56 2,912,201 ----a-w c:\program files\mp3wavc_268.exe
2006-04-02 19:40 5,692,032 ----a-w c:\program files\FirefoxGoogleToolbarSetup.exe
2006-03-07 18:57 749,760 ----a-w c:\program files\JunoSetup.exe
Similar to the above, you should cleanup your Desktop and avoid long term saving of unnecessary files on your Desktop which again is not safe, provides easy hiding for malware, can be deleted by malware, and can slow your PC down.

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (disabled by BHODemon)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

After clicking Fix, exit HJT.

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:

C:\MGlogs.zip

Make sure you tell me how things are working now!
Click to expand...

Log in or Sign up

I'm still having issues....

nordn8 Private E-2

Attached Files:

MGlogs.zip

1log.txt

mbam-log-2008-12-09 (09-12-46).txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Log in or Sign up

I'm still having issues....

nordn8 Private E-2

Attached Files:

MGlogs.zip

1log.txt

mbam-log-2008-12-09 (09-12-46).txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches