core.sys.dsk woes

Hi,

Help, I am having a hard time getting rid of core.sys.dsk which is what I suspect to be the cause of the pop-ups I am getting. Using PC Tools Spyware Doctor is not able to get rid of it from the C:\ drive.

I have done what needs to be done:
1. Running MSconfig in Normal mode
2. Read and did the cleaning procedure as mentioned
3. Ran combofix
4. MGtools
5. AVG anti-spyware (free trial) - nothing shows up after running it the second time.
6. AVG Free Edition - nothing found

AVG Antispyware found nothing, but I can be sure the core.sys.dsk is still there everytime I reboot. I have tried booting XP into safe mood to try to delete core.sys.dsk from C:\, but problem is, it does not show up or manages to hide itself somehow in safe mode.

Attached are the required files. Please advise.

 

Hi mitsjc!
Welcome to Major Geeks!

Please be patient while we go through your logs. This takes some time.
abri

 

No problem, I am willing to wait.

 

Hi mitsjc!

Before you begin, please close all your browser windows and run CCleaner in the default setting with the windows tab as the top one. After you've finished come back and continue with the following instructions:


1) I don't see any Windows updates on your computer. As soon as your system is clean, you need to get the updates or you will be plagued with problems. Also, if you don't have a two-way firewall, this is very important. We give our recommendations for firewalls and other protective software in our final cleanup instructions.


2) Disable your guest account if this has not already been done.

3) You seem to have two antivirus programs on your computer. Please uninstall one of them, preferably the TrendMicro. Keep the AVG free.

Then do the following:

4) Go to add/remove programs and uninstall the below:

- J2SE Runtime Environment 5.0 Update 6

5) Reboot after uninstalling the above.

6) Install the current version of Sun Java from: Sun Java Runtime Environment

7) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Does the following belong to programs you know or want to keep? If not, please fix it as well.

O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -

After you click fix, just close hijackthis.


8) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger

9) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

10) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

11) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip it generates along with the Avenger log.


Let me know how things are running now?

abri

 

Hi abri,

I uninstalled Java and installed the new one as instructed.

Have not uninstalled antivirus and Windows Messenger.

I removed the objects as told and used the Avenger. But got the following message:
Syntax error in line -- does not appear to be a valid registry path. Line will be ignored.
I think this refers to: HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a91ea04-ff2a-11d9-944d-000d6010a652}
but funny thing is it is in the registry when I checked.

After rebooting my laptop for the first time, it sort of hanged during start up so I restarted it again. Avenger log says the core.cache.dsk has been removed but when I checked my C drive, it is still there.

Attached is the Avenger log and new MGlogs.

 

Hi mitsjc,

1) About points 1 and 2 of post number 4?

2) I would like for you to run Avenger again as you did in Step 4, but this time use the contents of this box:

3) When you finish running Avenger, please run ATF Cleaner again.

4) Then please do step 11 of post 4 again.

Thanks.
abri

 

Thanks once again abri for your time.

1) I have installed the latest Windows High Priority updates, all except for IE7. I do not know how to disable the guest account since I have been using the Administrator account to login all along.

2) Ran Avenger and rebooted my laptop, upon startup it made some funny beeps. Checked C:\ and the core.cache.sys is gone.

3) Ran ATF again.

4) Attached are the latest logs.

So far so good, the pop-ups have not reappeared.

 

Hi mitsjc!

The funny beeps may be related to a hardware problem. Please be sure your data is backed up. You might wish to post about this in the Hardware Forum.

To disable the guest acount, go to Start / Control Panel / User Accounts. Look for the account called guest and see if it is turned off.

abri