Malware removal steps didn't fix everything

Discussion in 'Malware Help (A Specialist Will Reply)' started by curlyred, May 2, 2012.

  1. curlyred

    curlyred Private E-2

    My first post.
    Problem computer is on a domain. User clicked on a link in an email they thought was from Linked In. Problems included multiple windows claiming read/write delay; bad hdd-memory. All desktop icons disappeared, etc. Symantec reports "Suspicious.Ad" infection.
    I ran the malware removal steps. mbam, MG, RR & Superantispyware logs are attached. Combofix hung up at the scanning stage ("may take ten minutes . . . could be double") so I never got a log. This may be due to Symantec Real time Scanning which I couldn't disable because this is an Endpoint client machine on the network. I may have to uninstall that.
    After cleaning symptoms:
    no browser redirects but occassionally a browser window opens on its own for facebook login or something about twitter. This user doesn't do facebook or twitter.
    Most folders on C drive are marked hidden; start>programs folder is empty; memory errors when trying to create PDF files. Trying not to use the computer so there may be other symptoms I haven't encountered.
    Your help is appreciated.
    Thank You,
    Jody
     
    curlyred, May 2, 2012
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    No logs attached I'm afraid.

    Also you need to take a look at this:

    I want you to run TDSSKiller so refer to the below for how to do so.

    TDSSkiller - How to run


    Please also download MBRCheck to your desktop
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
     
    Kestrel13!, May 2, 2012
    #2
  3. curlyred

    curlyred Private E-2

    Wow, I expected to wait 4-5 days for a reply.
    What follows is the TDSSKiller and MBRcheck logs. I put the original malware scan logs at the end - in case you still wanted to see them. and again tried to attach the MGlogs.zip
     

    Attached Files:

    Last edited by a moderator: May 2, 2012
    curlyred, May 2, 2012
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Kestrel13!, May 2, 2012
    #4
  5. curlyred

    curlyred Private E-2

    My apologies. The first time I attached it didn't work. Here are attachments.
     

    Attached Files:

    curlyred, May 2, 2012
    #5
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You need to re-run TDSSKiller and have it fix this:

    Attach the log.


    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    • O4 - HKLM\..\Run: [wPjGphJJBAmDwX.exe] C:\Documents and Settings\All Users\Application Data\wPjGphJJBAmDwX.exe
    • O4 - HKLM\..\Policies\Explorer\Run: [57810] C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\msvcftqf.exe

    After clicking Fix exit HJT.



    Download and run OTM.

    Download OTM by Old Timer and save it to your Desktop.

    Code:
    :reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"wPjGphJJBAmDwX.exe"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"57810"=-

:files
C:\Documents and Settings\All Users\Application Data\wPjGphJJBAmDwX.exe
C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\msvcftqf.exe

:Commands
[emptytemp]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it into notepad, save it as something appropriate and attach it into your next reply.

    NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.



    All of your Files and folders are in the below smtmp folders. You will have to move them all back to their proper place:

    Try this first, Please download and save the below to your Desktop or anywhere else you can find it ( if the Desktop is not showing )

    http://download.bleepingcomputer.com/grinler/unhide.exe

    Now run it. Did that help? If not:

    To restore the moved files, open %User Temp%\smtmp and copy the files.

    For %User Temp%\smtmp\1, copy the files to %Start Menu%
    For %User Temp%\smtmp\2, copy the files to %Desktop%


    Code:
    d--h--w                 0 2012-04-30 12:28:54  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1
d--h--w                 0 2012-04-30 12:28:54  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2
---ha-w             2,333 2007-02-06 14:33:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Adobe Acrobat 7.0 Professional.lnk
---ha-w             1,768 2006-07-03 13:08:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Adobe Stock Photos.lnk
--sha-w               272 2008-10-20 21:04:00  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\desktop.ini
---ha-w             2,505 2008-07-28 18:57:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\New Office Document.lnk
---ha-w             2,515 2008-07-28 18:57:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Open Office Document.lnk
d--h--w                 0 2012-04-30 12:28:54  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs
---ha-w             1,485 2011-06-08 17:39:13  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Remote Desktop Connection.lnk
---ha-w             1,563 2008-10-20 21:04:00  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Set Program Access and Defaults.lnk
---ha-w               398 2004-08-11 21:15:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Windows Catalog.lnk
---ha-w             1,507 2006-04-27 16:38:54  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Windows Update.lnk
d--h--w                 0 2012-04-30 12:28:44  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories
---ha-w             2,365 2012-03-02 21:16:04  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Acrobat Distiller 7.0.lnk
d--h--w                 0 2012-04-30 12:28:45  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools
d--h--w                 0 2012-04-30 12:28:45  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe
---ha-w             2,353 2012-03-02 21:16:04  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Acrobat 7.0 Professional.lnk
---ha-w             1,800 2006-07-03 12:55:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Bridge.lnk
---ha-w             2,359 2012-03-02 21:16:04  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Designer 7.0.lnk
---ha-w               736 2006-08-22 13:07:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe GoLive CS2.lnk
---ha-w             1,744 2006-08-22 12:44:53  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Help Center.lnk
---ha-w             2,245 2006-08-22 12:58:37  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Illustrator CS2.lnk
---ha-w             1,773 2006-08-22 12:45:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe ImageReady CS2.lnk
---ha-w               758 2006-08-22 12:48:58  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe InDesign CS2.lnk
---ha-w             1,776 2006-08-22 12:45:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Photoshop CS2.lnk
---ha-w             2,323 2006-12-05 13:09:53  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe Reader 6.0.lnk
d--h--w                 0 2012-04-30 12:28:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\APS 3.0
d--h--w                 0 2012-04-30 12:28:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Broadcom
d--h--w                 0 2012-04-30 12:28:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE
d--h--w                 0 2012-04-30 12:28:48  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Compact Wireless-G USB Adapter
d--h--w                 0 2012-04-30 12:28:48  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell
--sha-w               150 2004-08-11 21:13:20  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\desktop.ini
---ha-w               529 2007-07-23 19:35:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\DWGSee Pro.lnk
d--h--w                 0 2012-04-30 12:28:49  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Extensis
---ha-w             2,134 2008-04-07 13:46:40  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\FileMaker Pro Advanced.lnk
d--h--w                 0 2012-04-30 12:28:49  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\FileZilla FTP Client
d--h--w                 0 2012-04-30 12:28:50  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games
d--h--w                 0 2012-04-30 12:28:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office
d--h--w                 0 2012-04-30 12:28:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Mozilla Firefox
---ha-w               730 2012-01-26 14:13:52  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Mozilla Firefox.lnk
---ha-w             1,890 2004-08-11 21:11:50  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\MSN.lnk
d--h--w                 0 2012-04-30 12:28:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Pinecoast
d--h--w                 0 2012-04-30 12:28:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QB Connection Diagnostic Tool
d--h--w                 0 2012-04-30 12:28:52  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickBooks
d--h--w                 0 2012-04-30 12:28:52  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickTime
d--h--w                 0 2012-04-30 12:28:53  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup
d--h--w                 0 2012-04-30 12:28:53  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\SUPERAntiSpyware
d--h--w                 0 2012-04-30 12:28:53  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Symantec Endpoint Protection
---ha-w             1,011 2006-04-27 16:48:37  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Windows Media Connect.lnk
---ha-w               609 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Windows Messenger.lnk
---ha-w               690 2004-08-11 21:13:20  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Windows Movie Maker.lnk
---ha-w             1,803 2008-12-10 14:44:07  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Windows Search.lnk
d--h--w                 0 2012-04-30 12:28:40  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Accessibility
---ha-w             1,498 2006-11-17 17:39:03  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Calculator.lnk
d--h--w                 0 2012-04-30 12:28:41  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications
--sha-w               255 2007-05-16 14:46:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\desktop.ini
d--h--w                 0 2012-04-30 12:28:42  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Entertainment
d--h--w                 0 2012-04-30 12:28:42  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Microsoft Interactive Training
---ha-w             1,419 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Paint.lnk
---ha-w             1,585 2011-02-17 16:24:29  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Remote Desktop Connection.lnk
---ha-w               710 2007-05-16 14:46:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Scanner and Camera Wizard.lnk
d--h--w                 0 2012-04-30 12:28:44  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools
d--h--w                 0 2012-04-30 12:28:44  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Windows PowerShell
---ha-w               783 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\WordPad.lnk
---ha-w             1,424 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Accessibility\Accessibility Wizard.lnk
--sha-w                90 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Accessibility\desktop.ini
--sha-w               516 2008-10-20 21:07:20  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\desktop.ini
d--h--w                 0 2012-04-30 12:28:41  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Fax
---ha-w               690 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\HyperTerminal.lnk
---ha-w             1,661 2004-08-11 21:11:00  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Network Connections.lnk
---ha-w             1,640 2010-12-17 17:25:28  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Network Setup Wizard.lnk
---ha-w             1,550 2004-08-11 21:11:00  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\New Connection Wizard.lnk
---ha-w             1,656 2008-10-20 21:07:20  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk
--sha-w               283 2004-08-11 21:11:46  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Fax\desktop.ini
---ha-w             1,509 2004-08-11 21:11:46  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Fax\Fax Console.lnk
---ha-w             1,614 2004-08-11 21:11:46  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Fax\Fax Cover Page Editor.lnk
---ha-w             1,497 2004-08-11 21:11:46  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Communications\Fax\Send a Fax....lnk
--sha-w               146 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Entertainment\desktop.ini
---ha-w             1,432 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Entertainment\Sound Recorder.lnk
---ha-w             1,432 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Entertainment\Volume Control.lnk
---ha-w               707 2004-08-11 21:25:56  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Microsoft Interactive Training\Microsoft Interactive Training Help.lnk
---ha-w               800 2004-08-11 21:25:56  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Microsoft Interactive Training\Microsoft Interactive Training.lnk
---ha-w             1,436 2004-08-11 21:15:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\Backup.lnk
---ha-w             1,425 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\Character Map.lnk
--sha-w               757 2004-08-11 21:15:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\desktop.ini
---ha-w             1,532 2009-02-03 23:24:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\Disk Cleanup.lnk
---ha-w             1,572 2008-04-09 21:13:01  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\Disk Defragmenter.lnk
---ha-w             1,495 2004-08-11 21:15:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
---ha-w             1,753 2006-07-10 15:52:40  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\Scheduled Tasks.lnk
---ha-w               974 2004-08-11 21:13:14  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\System Information.lnk
---ha-w             1,616 2008-11-08 13:17:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\System Tools\System Restore.lnk
---ha-w             2,011 2009-12-03 09:13:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk
---ha-w             2,081 2009-12-03 09:13:49  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
---ha-w             1,486 2004-08-11 21:11:58  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Component Services.lnk
---ha-w             1,602 2006-12-18 16:39:36  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Computer Management.lnk
---ha-w             1,596 2008-03-21 22:53:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Data Sources (ODBC).lnk
--sha-w               615 2006-08-28 18:28:34  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\desktop.ini
---ha-w             1,592 2009-03-24 18:13:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Event Viewer.lnk
---ha-w             1,661 2006-08-28 18:28:34  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Internet Information Services.lnk
---ha-w             1,590 2009-08-02 14:11:20  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Local Security Policy.lnk
---ha-w             1,011 2004-08-11 21:22:10  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Configuration.lnk
---ha-w             1,062 2004-08-11 21:22:10  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Wizards.lnk
---ha-w             1,495 2004-08-11 21:15:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Performance.lnk
---ha-w             1,602 2006-05-10 15:44:11  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Administrative Tools\Services.lnk
---ha-w             1,918 2006-07-03 12:54:32  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Adobe\ExtendScript Toolkit.lnk
---ha-w             1,857 2007-05-17 21:09:09  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\APS 3.0\APS 3.0.lnk
---ha-w             1,876 2006-04-20 10:52:07  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Broadcom\Broadcom Advanced Control Suite 2.lnk
---ha-w               640 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\CADE Help.lnk
---ha-w               729 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\CADE Samples.lnk
---ha-w               640 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\CADE.lnk
---ha-w               513 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\Uninstall CADE.lnk
d--h--w                 0 2012-04-30 12:28:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\Web
---ha-w               443 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\Web\New Web Drawing.lnk
---ha-w               445 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\Web\Open Web Drawing.lnk
---ha-w               441 2009-07-14 20:33:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\CADE\Web\Web Project.lnk
---ha-w             2,204 2006-04-25 17:47:25  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Compact Wireless-G USB Adapter\Uninstall.lnk
---ha-w             1,817 2006-04-25 17:47:25  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Compact Wireless-G USB Adapter\Wireless Network Monitor.lnk
d--h--w                 0 2012-04-30 12:28:48  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers
d--h--w                 0 2012-04-30 12:28:48  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1600n
d--h--w                 0 2012-04-30 12:28:49  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815
---ha-w             1,824 2006-04-27 18:16:05  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1600n\Dell MFP Software Uninstall.lnk
---ha-w             1,795 2006-04-27 18:16:02  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1600n\Network Scan.lnk
---ha-w             1,970 2006-04-27 18:15:13  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1600n\User's Guide.lnk
---ha-w             1,845 2007-09-06 19:57:29  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815\Configure PC Fax.lnk
---ha-w             1,949 2007-09-06 19:58:11  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815\Dell MFP Software Uninstall.lnk
---ha-w             1,788 2007-09-06 19:57:49  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815\Network Scan.lnk
---ha-w             1,794 2007-09-06 19:56:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815\Network Status Monitor Center.lnk
---ha-w             1,171 2007-09-06 19:57:59  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815\Set IP Address Utility.lnk
---ha-w             1,965 2007-09-06 19:58:07  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Dell\Dell Printers\Dell Laser MFP 1815\User's Guide.lnk
d--h--w                 0 2012-04-30 12:28:49  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Extensis\Suitcase 9.2
---ha-w               861 2006-05-15 20:03:34  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Extensis\Suitcase 9.2\Suitcase Help.lnk
---ha-w               651 2006-05-15 20:03:33  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Extensis\Suitcase 9.2\Suitcase.lnk
---ha-w               783 2012-04-02 15:35:14  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\FileZilla FTP Client\FileZilla.lnk
---ha-w               783 2012-04-02 15:35:14  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\FileZilla FTP Client\Uninstall.lnk
--sha-w               798 2006-08-28 18:28:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\desktop.ini
---ha-w             1,522 2006-06-19 17:28:46  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Freecell.lnk
---ha-w             1,424 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Hearts.lnk
---ha-w               913 2006-08-28 18:28:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Internet Backgammon.lnk
---ha-w               913 2006-08-28 18:28:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Internet Checkers.lnk
---ha-w               913 2006-08-28 18:28:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Internet Hearts.lnk
---ha-w               913 2006-08-28 18:28:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Internet Reversi.lnk
---ha-w               913 2006-08-28 18:28:27  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Internet Spades.lnk
---ha-w             1,419 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Minesweeper.lnk
---ha-w               789 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Pinball.lnk
---ha-w             1,491 2007-09-08 01:54:30  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Solitaire.lnk
---ha-w             1,406 2004-08-11 21:12:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Games\Spider Solitaire.lnk
---ha-w             2,583 2008-07-28 18:57:23  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Excel 2003.lnk
---ha-w             2,533 2011-06-03 22:08:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Outlook 2003.lnk
d--h--w                 0 2012-04-30 12:28:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools
---ha-w             2,509 2012-02-20 14:20:14  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Word 2003.lnk
---ha-w             2,553 2008-07-28 18:57:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Digital Certificate for VBA Projects.lnk
---ha-w             2,533 2008-07-28 18:57:22  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk
---ha-w             2,433 2008-07-28 18:57:23  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Language Settings.lnk
---ha-w             2,453 2008-07-28 18:57:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2003 Save My Settings Wizard.lnk
---ha-w             2,407 2008-07-28 18:57:23  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Application Recovery.lnk
---ha-w             2,691 2008-07-28 18:57:23  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Imaging.lnk
---ha-w             2,693 2008-07-28 18:57:23  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Document Scanning.lnk
---ha-w             2,509 2008-07-28 18:57:23  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk
---ha-w             1,636 2009-04-28 13:52:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Mozilla Firefox\Mozilla Firefox (Safe Mode).lnk
---ha-w             1,614 2009-04-28 13:52:24  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Mozilla Firefox\Mozilla Firefox.lnk
d--h--w                 0 2012-04-30 12:28:51  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Pinecoast\GISView
---ha-w               730 2009-08-18 16:02:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Pinecoast\GISView\GISView.lnk
---ha-w               737 2009-08-18 16:02:16  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Pinecoast\GISView\Uninstall GISView.lnk
---ha-w             1,153 2011-04-12 22:25:57  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QB Connection Diagnostic Tool\QB Connection Diagnostic Tool.lnk
---ha-w             1,011 2011-04-12 22:25:57  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QB Connection Diagnostic Tool\Uninstall QB Connection Diagnostic Tool.lnk
---ha-w             1,902 2011-04-01 18:55:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickBooks\QuickBooks Database Server Manager.lnk
---ha-w             1,886 2011-04-01 18:55:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickBooks\QuickBooks Pro 2011.lnk
---ha-w             2,009 2011-04-01 18:55:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickBooks\Web Connector.lnk
---ha-w               692 2006-06-13 16:06:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickTime\About QuickTime.lnk
---ha-w             1,624 2006-06-13 16:06:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickTime\PictureViewer.lnk
---ha-w             1,638 2006-06-13 16:06:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickTime\QuickTime Player.lnk
---ha-w             2,044 2006-06-13 16:06:47  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\QuickTime\Uninstall QuickTime.lnk
---ha-w             2,359 2012-04-30 12:12:35  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
---ha-w               988 2006-08-22 12:44:28  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\Adobe Gamma.lnk
--sha-w                84 2004-08-11 21:15:06  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\desktop.ini
---ha-w             1,930 2011-04-01 18:55:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\Intuit Data Protect.lnk
---ha-w             2,109 2011-04-01 18:55:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\QuickBooks Update Agent.lnk
---ha-w             1,761 2011-04-01 18:55:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\QuickBooks_Standard_21.lnk
---ha-w               663 2006-05-15 20:03:34  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Startup\Suitcase Startup.lnk
---ha-w               770 2008-11-08 18:38:56  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\SUPERAntiSpyware\BootSafe.lnk
---ha-w             1,736 2008-11-08 18:38:56  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\SUPERAntiSpyware\SUPERAntiSpyware Free Edition.lnk
---ha-w               836 2008-11-08 18:38:56  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\SUPERAntiSpyware\SUPERAntiSpyware Help.lnk
---ha-w             1,882 2008-11-08 18:38:56  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\SUPERAntiSpyware\SUPERAntiSpyware Repair.lnk
---ha-w               769 2008-11-08 20:00:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection Help.lnk
---ha-w               697 2008-11-08 20:00:43  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\1\Programs\Symantec Endpoint Protection\Symantec Endpoint Protection.lnk
--sha-w               119 2008-10-21 12:26:20  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\desktop.ini
---ha-w             1,018 2008-04-07 13:46:44  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\Launch FileMaker Pro Advanced.lnk
---ha-w               815 2009-10-09 18:11:09  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\Launch Internet Explorer Browser.lnk
---ha-w               792 2011-05-13 16:20:19  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\Launch Microsoft Office Outlook.lnk
---ha-w               742 2012-01-26 14:13:52  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\Mozilla Firefox.lnk
---ha-w                79 2004-08-11 21:20:42  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\Show Desktop.scf
---ha-w               800 2011-09-19 14:30:38  C:\Documents and Settings\jgordon\Local Settings\TEMP\smtmp\2\Windows Media Player.lnk
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
    Kestrel13!, May 2, 2012
    #6
  7. curlyred

    curlyred Private E-2

    Things seem to be running correctly. Some minor things I can fix are custom color profiles (this is a graphics production machine). Quick launch toolbar was still empty but that was easy.
    The start menu contains all the folders but most of them are empty. Most of that doesn't concern me except the System tools and Administrative Tools that are also empty. Admin tools is also empty from the control panel.
    I know how to get shortcuts back manually for most things if I have to (except system & admin tools) but is there something that will fix it?
    A "Fix it" button would be nice ;)
     

    Attached Files:

    curlyred, May 3, 2012
    #7
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hopefully the below will help.

    You can restore the defaults for the Start Menu, Accessories and Administrative Tools as follows:


    Restore Admin Tools Program Files Menu

    Please download this tool here

    • You will need to unzip the tool first.
    • Once you've unzipped the tool, please double-click on it to run it.
    • Click on the Restore Administrative Tools Items button.
     
    Kestrel13!, May 3, 2012
    #8
  9. curlyred

    curlyred Private E-2

    That did it. Thanks so much. I've been using the computer all day and haven't discovered anything else wrong.
    Your help Made my week
     
    curlyred, May 3, 2012
    #9
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Glad everything is running nicely again. :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, May 4, 2012
    #10
  11. curlyred

    curlyred Private E-2

    Sorry for the delay. I completed the clean up steps and everything running as it should. Thanks again, without you all would be lost.
     
    curlyred, May 9, 2012
    #11
  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You're most welcome curlyred. :)
     
    Kestrel13!, May 9, 2012
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds