Explorer.exe Crashing

My problems all began at the same time. 8/21/08 8:40 pm. I was doing nothing more then chatting on yahoo messenger and listening to music when spybot reported an attempt to alter my registry by "pmnKBQkL.dll". I hit deny, again and again it popped up, 15 times in all, each time i hit deny. The pop-ups stopped and i thought it was done. Without warning explorer.exe crashed. I closed out ymessenger & IE and rebooted my system. On reboot explorer.exe opened for about 5 seconds then closed. I rebooted a 2nd time with the same results.

In task manager i found nothing out of the ordinary.
I tried restarting explorer.exe and got the error message...

"Windows - no disk
Exception Processing Message c0000013 Parameters 75b6bf9c 4 75b6bf9c 75b6bf9c".

So began a pc hell of epic proportions. Explorer loads on startup but shuts down after 5 seconds. If I try to manually run it... it runs for 5 seconds, give me the error message, then shuts down.

In Spybot I found new entries in my registry.

[SIZE="1][B]"]{72FFD9A0-7FC6-49B2-8FC3-0603BE57BC48} ()
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:
Path: C:\WINNT\system32\
Long name: pmnKBQkL.dll
Short name:
Date (created): 8/21/2008 8:41:38 PM
Date (last access): 8/21/2008 8:41:38 PM
Date (last write): 8/21/2008 8:41:40 PM
Filesize: 39424
Attributes:
MD5: 662A80454B5D1069DE042D12C2DA6A9D
CRC32: 50830428

{B5594E1B-FEF2-49DD-9161-7B616489ED54} ()
location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:
Path: C:\WINNT\system32\
Long name: qoMdCvSj.dll
Short name:
Date (created): 8/21/2008 9:56:42 PM
Date (last access): 8/21/2008 9:56:42 PM
Date (last write): 8/21/2008 9:56:52 PM
Filesize: 249856
Attributes: archive
MD5: 70332B4F8BD30AE16C2679C213BF41EF
CRC32: 7B3C3949[/B][/SIZE]

though these .dll show up in the registry list in spybot they are not detected by hijackthis, advanced windows care, avg, ccleaner or regcure. In spybot's registry list ive tried unchecking & deleting these entry, in the bho window i tried toggling & deleting them... they reappear or recheck or retoggle themselves. when i try to delete it in the system32 folder, "pmnKBQkL.dll" is running under winlogon.exe so i get the message "being used by another application". "qoMdCvSj.dll" simply says access denied. To make matters worse i cant find any info on either file on the net.
NONE! NOTHING! NADA!

My delima...
1. How do i remove these two .dll files.
2. How do i repair my explorer and stop the error messages.

Ive tried booting in safe mode and running my atv, spybot & maintance programs.
Ive tried deleting the files at their source.
Ive tried removing them from windows registry. they reappear!
Ive tried disabling them in IE's options... they re-enable upon IE restart.
Ive tried updating XP... Even installed service pack 3. (Oh yeah, Im running windows XP home addition.)
Ive tried windows restore... doesnt work. nor does spybot, ccleaner, regcure, or advanced windows care registry restore!
Ive tried renaming my drives... Disk Mngt wont load
Ive tried sfc /scannow... windows file protection ran then closed... it reported no results... so... im lost where that thing is concerned.

I fear my only recourse is to reinstall XP... Problem being... This pc was given to me a year ago and i dont have a XP installation disk.

Please Help Im At My Wits End!

 

go ahead and run these steps:
http://forums.majorgeeks.com/showthread.php?t=35407
as it seems you might have some unwanted nasties on your computer....if all your scans come out clean, then report back here and we can help you further.

 

reading wrong... trying this again

 

Finished all the scan... it appears the problems have all been fixed. Heck, my system is running better then ever! The offending files are gone and no more error pop ups... :celebrate
i didnt post in the malware forum because i thought i had removed all the lil beasties from my pc and i only needed to repair the damage.

Thank you, TheSmokingGun...
:strongYOU ARE THE MAN!!:strong

 

you should maybe still post your logs from the scans (if you still have them) in the malware forum, just to have those guys take a look see at em (they're pretty good at it)