Generic Host process for Win32

What is this?
C:\windows\system32\rundll32.exe.Z-missing.txt

I regard the below to be crap, uninstall it if you really don't use or need it.

• SweetIM for Messenger 3.3
• SweetIM Toolbar for Internet Explorer 4.0

Uninstall the below outdated Java.

• J2SE Runtime Environment 5.0 Update 10
• J2SE Runtime Environment 5.0 Update 6

Can you please attach the following pair of SAS logs:

• C:\Documents and Settings\Pauline Mui\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 03-03-2011 - 18-07-28.log
• C:\Documents and Settings\Pauline Mui\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 03-04-2011 - 10-52-20.log

Could you please get this: WMADMOD4.dll into a zipped file and attach it for me in your next post? To do this, see the below:

Please go to start > Run and paste in the following:

log retrievable @ C:\collect.zip


Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

DirLook::
C:\Kpcms
c:\windows\system32\Color
c:\documents and settings\All Users\Application Data\nJcEeIi15400
c:\documents and settings\Pauline Mui\Application Data\updates
File::
C:\WINDOWS\pchealth\helpctr\binaries\SET75A.tmp
C:\Documents and Settings\Pauline Mui\Application Data\5CCA.7
c:\windows\Uzulebiweyifeg.bin
C:\WINDOWS\Dwutafiseq.dat
RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{05AF50AA-22D7-AA1D-A4F48F393CAE2202}\{78C6AA3D-BD77-7FA2-B188C82FA3887936}\{102B7915-3D5B-6524-E77B0FDDDBDD9024}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
   de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{454884EE-A952-6288-D98E4C6628C57FD8}\{4E2828CC-5D4E-CAA4-0B0E2FF0C61DD876}\{D33FFB02-83E4-6D49-8432C9C83D6B1A26}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
   de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{48418982-249C-E344-B1C048196FA2EDFD}\{A41EB0B4-3EE0-E472-B7C2AAEB5A9566C4}\{DB4C8A45-FEFF-6FD9-65B4662880A15182}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,37,1f,1d,
   dd,e3,0d,5b,d1,d1,d5,c4,a7,3d,b5,f9,e1,03,4b,44,ea,4b,23,4b,3f,49,09,ca,64,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{564572D7-BA6B-A81E-17332C14105A24EF}\{35AC4256-1B84-66D8-7C4583AC3B4AA35B}\{791C0703-8CF5-813B-67470F66B09458B3}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
   de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{61F22E4F-B27F-AFC4-A522A9C3D24CB12E}\{1AB70131-6AEF-F29E-373C8656BA527ED6}\{4909E9D0-65F5-FEDD-EF93FC8CC6374EF9}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
   de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AB53ABC9-60C7-8B2C-A2AB126EB1F03A59}\{6511FF0A-0202-CA71-9BBA47A5377501DE}\{CE12CB05-B8C7-0E6B-6DC342F04A20B600}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,37,1f,1d,
   dd,e3,0d,5b,d1,d1,d5,c4,a7,3d,b5,f9,e1,03,4b,44,ea,4b,23,4b,3f,49,09,ca,64,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C9E2B393-56C9-49A0-E9536816E76F722D}\{C3EAC204-1FBE-55E0-B9FAECEF4AC48E44}\{36C3AF1D-C1DF-E2E1-C86849C42C7FDBDC}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
   de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DCB42C02-2C7E-50EC-E2B5A792F7765BFB}\{38286259-1A12-EDE0-84E2CD6A1D76E8F7}\{2C2658AF-F73E-73C6-89D45D0D6FCCCFF2}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,37,1f,1d,
   dd,e3,0d,5b,d1,d1,d5,c4,a7,3d,b5,f9,e1,03,4b,44,ea,4b,23,4b,3f,49,09,ca,64,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E8569B02-E577-013D-C3A3C50EF410F5FE}\{D07ADE0E-79DB-2CFB-D413AB0F0F722520}\{6AF39A39-D459-97F6-AE29B5DA7826690D}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,37,1f,1d,
   dd,e3,0d,5b,d1,d1,d5,c4,a7,3d,b5,f9,e1,03,4b,44,ea,4b,23,4b,3f,49,09,ca,64,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EE14E6F1-2126-B92D-85C1E367ED532B77}\{B41DACD9-CA91-C5AB-B721AF64407C4FEE}\{02A113E6-1FE6-618B-B5A2DF9FB3CCBD20}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,37,1f,1d,
   dd,e3,0d,5b,d1,d1,d5,c4,a7,3d,b5,f9,e1,03,4b,44,ea,4b,23,4b,3f,49,09,ca,64,\
Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.


Run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Go to TDSSKiller and Download TDSSKiller.zip to your Desktop

• Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
• Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor.
• Allow the application to run and a window will open showing that it is TDSSkiller from Kaspersky
• Click Start scan
• It will run rather quickly and will notify you of whether anything is found or not.
• Follow the instructions to delete/quarantine if asks you what to do when if finds something.

Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )


Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some data on it
• Right click on the screen and select > Select All
• Press Control+C
• Open a notepad and press Control+V
• now please ATTACH that report to this thread

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

 

Try Revo Uninstaller.

Choose the option on the bottom of the list (#4). Be very careful while deleting the bolded registry items ONLY!! This software will create a system restore point for you as well prior to uninstalling a software program.

Delete these folders using windows explorer.

• c:\documents and settings\All Users\Application Data\nJcEeIi15400
• c:\documents and settings\Pauline Mui\Application Data\updates

Delete this file:

• C:\Documents and Settings\Pauline Mui\Application Data\5CCA.73B

Do you have all important data backed up? You really should do this before continuing since we will need to rewrite your MBR to fix this and while most times this can be done without any problem, these infections can react badly and that could result in a PC not being bootable. You really don't have much choice though since these infections are too dangerous to your security to leave on a PC.

Also note if you have a Dell PC which uses a non-standard MBR ( or another manufacturer's who does similar to Dell) , fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not continue but you risk serious problems leaving this infection in place and thus your only other option would be to try using the Dell Restore Utility to return a factory ship state which will remove everything you additional you have put onto the PC.

Now if you wish to continue and fix the malware - please do the following:

• Run MBRCheck.exe
• Wait until you see the following lines:
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Options:
    [1] Dump the MBR of a physical disk to file.
    [2] Restore the MBR of a physical disk with a standard boot code.
    [3] Exit.
    Enter your choice:

• Please push the 'Y' key and then press Enter
• When the program asks you to Enter your choice: enter 2 to Rstore the MBR and press the Enter key
• Now the program will ask you to "Enter the physical disk number to fix (0-99, -1 to cancel): Both Physical drives 0 and 1 need fixing so you might need to do this twice to get both done.
  
  • Enter 0 and press the Enter key.
• The program will show Available MBR codes as below

• You need to select your version of Windows frrom the list. For example, enter 0 or 1 for XP or enter 3 for Vista.....etc. and then press Enter.
• The program will prompt for confirmation. Type 'YES' and hit Enter.
• Left click on the title bar (where program name and path is written). From menu chose Edit -> Select All
• You will see all the text in the window get highlighted.
• Hit the Enter key on your keyboard to copy all of the text into the clipboard.
• Paste that text into Notepad, save it to your desktop as MBRfix.txt
• Restart your PC.
• Attach the MBRfix.txt file to your next message..

Also tell me how things are working.


Please go to virustotal and upload the following files for analysis, and let me know the results.

c:\windows\system32\WMADMOD4.dll

Now re run MBRCheck the way you did the first time and attach the log.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

What is this? (You did not tell me when I asked before)
C:\windows\system32\rundll32.exe.Z-missing.txt

 

Well that did not work at all.

You will need to boot to the Recovery Console to remove this infection.

Now boot to the Recovery Console and run the fixmbr to clear a Master Boot Record infection that you have.

You can read the below to help you do this:

http://support.microsoft.com/kb/307654


Then boot back into normal mode.

Then re-run MBRCheck again as you did in post #2 and attach the new log.

 

You can read the microsoft article I linked you to in my previous post You already have the recovery console installed from when you installed Combofix.

 

Yes I wanted you to fix it!! One down, one to go then. Follow instructions carefully.

• Run MBRCheck.exe
• Wait until you see the following lines:
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Options:
    [1] Dump the MBR of a physical disk to file.
    [2] Restore the MBR of a physical disk with a standard boot code.
    [3] Exit.
    Enter your choice:

• Please push the 'Y' key and then press Enter
• When the program asks you to Enter your choice: enter 2 to Rstore the MBR and press the Enter key
• Now the program will ask you to "Enter the physical disk number to fix (0-99, -1 to cancel): Physical drive 1 needs fixing!!
  
  • Enter 0 and press the Enter key.
• The program will show Available MBR codes as below

• You need to select your version of Windows frrom the list. For example, enter 0 or 1 for XP or enter 3 for Vista.....etc. and then press Enter.
• The program will prompt for confirmation. Type 'YES' and hit Enter.
• Left click on the title bar (where program name and path is written). From menu chose Edit -> Select All
• You will see all the text in the window get highlighted.
• Hit the Enter key on your keyboard to copy all of the text into the clipboard.
• Paste that text into Notepad, save it to your desktop as MBRfix.txt
• Restart your PC.
• Attach the MBRfix.txt file to your next message..

Now run MBRCheck again as we did in post # 2.

Attach the two logs.

 

No, don't know what happened but it did not work. Physical Drive 1 is still in need of being fixed.

Repeat the instructions again. Are you seeing options to enter in '1' to fix the physical drive 1?

 

The wrong disk number was chosen. The below line is seen in the log.

0 was chosen when 1 should have been chosen at that point.

 

Ahhh! Thanks for pointing this out Chas.

@ lesroches - This is why I said instructions had to be followed carefully. Until you fix it correctly the infection will remain in place.

 

I'm sorry but you are not choosing number 1!!

According to the log you are still choosing 0

We will get to other problems after this one has been solved.

 

When you see the below line, you need to choose 1 to select Physical Disk 1

Then when you see the below, you also choose 1 to select Windows XP

 

That did not work either although I see this time you did actually choose number 1. Hmm... I am going to wait and see what Chaslang says but in the mean time I want you to run TDSSKiller again and attach the log for me.

 

Sigh. Try this please. As we never did get to doing this although I do not know whether it will fix us or not but worth a try never the less. (Helpful instructions included in clickable link)

Now boot to the Recovery Console and run the fixmbr to clear a Master Boot Record infection that you have.

You can read the below to help you do this:

http://support.microsoft.com/kb/307654


Then boot back into normal mode.

Then re-run MBRCheck again as you did in post #2 and attach the new log.

 

If you are going to run fixmbr, you need to give specific instructions to fix the second physical drive. Just running fixmbr with no options will only fix the main Windows boot drive. For example, see the info on fixmbr here: http://support.microsoft.com/kb/314058

 

Chas why did the last MBRCheck fix not work? :confused

 

It is not reliable anymore for some reason. It is worth trying as it is an easier method if it works.

 

Do you have your XP boot CD? :confused

 

Starting the Windows Recovery Console from the Windows XP CD-ROM

If you have not preinstalled the Windows Recovery Console, you can start the computer and use the Recovery Console directly from your original Windows XP installation disc. If your computer is already in Windows and you want to add the Windows Recovery Console as a startup option, go to the next section "Adding the Windows Recovery Console as a startup option."

1. Insert the Windows XP CD into your CD drive and restart your computer. If you are prompted, select any options required to start (boot) from the CD.
2. When the text-based part of Setup begins, follow the prompts. Select the repair or recover option by pressing R.
3. If you have a dual-boot or multiboot system, select the installation that you want to access from the Recovery Console.
4. When you are prompted, type the Administrator password.
5. At the command prompt, type fixmbr \device\harddisk1

Reboot back into normal mode and re-run MBRCheck and attach the log.

 

I realise that. However to be rid of the infection we are going to have to do it exactly as I said in post # 35.

 

That will do it!