Many trojans found

Continue by downloading a tool we will need - Pocket KillBox

Save it to its own folder somewhere that you will be able to locate it later.

Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINNT\System32\iexplore.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
O4 - HKLM\..\Run: [Windows Explorer] C:\WINNT\System32\explorer.exe
O4 - HKLM\..\RunServices: [Windows MS Update 32] sucker.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Marda Loop\Start Menu\Programs\>IMVU\Run IMVU.lnk (file missing)
O16 - DPF: {C3D96A02-EEA7-4264-98D7-D882A7338DE5} - http://imgfarm.com/images/nocache/community/ExciteNotifierInitialSetup1.0.0.12.exe

After clicking Fix, exit HJT.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

* Delete on Reboot
* then Click on the All Files button.
* Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\winstall.exe
C:\WINNT\system32\wins\DLLHOST.EXE
C:\us22.exe
C:\WINNT\system32\dwsnj.exe
C:\WINNT\system32\awgvut.exe
C:\WINNT\system32\iaqtcgz.exe
C:\WINNT\system32\krber.exe
C:\WINNT\system32\ndilsmo.exe
C:\WINNT\system32\nujhvcwt.exe
C:\WINNT\system32\setup_35130.exe
C:\WINNT\system32\setup_44686.exe
C:\WINNT\termsrv.exe
C:\WINNT\system32\xlibgfl254.dll
C:\WINNT\system32\algs.exe
C:\WINNT\system32\lssas.exe
C:\WINNT\System32\iexplore.exe

* Return to Killbox, go to the File menu, and choose Paste from Clipboard.
* Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

Run CCleaner

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

 

* Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
* On the page that opens, scroll down to SYSTEMSVC
* then right click the entry, select Properties and press Stop Service.
* When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
* Click OK until you get back to Windows.

* Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
* At the lower right, click on the Config button
* Then click the Misc tools button
* Select Delete an NT Service
* Copy/paste SYSTEMSVC into the box that opens, and press OK
* If you receive any error messages just ignore them and continue.
* Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now re-Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:


O4 - HKLM\..\Run: [Services] C:\WINNT\System32\iexploler.exe
O23 - Service: LWEVHP - Unknown owner - C:\DOCUME~1\MARDAL~1\LOCALS~1\Temp\LWEVHP.exe (file missing)
O23 - Service: Windows System Service (SYSTEMSVC) - Unknown owner - C:\WINNT\system\system.exe
O23 - Service: Terminal Server-Services - Unknown owner - C:\WINNT\termsrv.exe (file missing)
O23 - Service: UPPEKVX - Unknown owner - C:\DOCUME~1\MARDAL~1\LOCALS~1\Temp\UPPEKVX.exe (file missing)

After clicking fix, exit HJT.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

* Delete on Reboot
* then Click on the All Files button.
* Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINNT\system\system.exe
C:\g.exe
C:\WINNT\system32\91.exe
C:\WINNT\system32\lyll.exe
C:\WINNT\system32\iexploler.exe
C:\DOCUME~1\MARDAL~1\LOCALS~1\Temp\LWEVHP.exe
C:\DOCUME~1\MARDAL~1\LOCALS~1\Temp\UPPEKVX.exe

* Return to Killbox, go to the File menu, and choose Paste from Clipboard.
* Click the red-and-white Delete File button. lick on the processes tab and make sure none of the .exe files are running (if found,ckick kill). Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.


arcldr.exe and arcsetup.exe/ are leftovers from trying to install sp/4.

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

 

Does this service exist: Windows System Service (SYSTEMSVC) ....

Are you sure you are following the steps for the Reg. edit? and yes it is a = followed by a minus sign.

If you are unable to run this or stop the service, we may have to use Process explorer.
Let me know.

 

Do the rest of the instructions and post the logs.

 

Download and run Prevx1.

Attach the logs.

 

Are you able to download Firefox, reboot into normal mode and install it? Have you tried any other browser?

 

Disable or better yet, uninstall Zone Alarm ....reboot and see if you can connect in normal mode.

 

Where your logs from normal mode? Spooisv.exe is not showing in your previous logs.

Kill logon.exe process and remove logon.exe from Windows startup using RegRun (http://majorgeeks.com/download.php?det=531). Post the log from it.

 

Progress.

Can you run counterspy now?

 

Run Installer Cleanup

If that doesn't help ...attach the logs from normal mode.

We will get there yet!

 

ShowNew
GetRun
HJT

Are you able to use Firefox in normal mode?
If so:
http://www.trendmicro.com/hc_intro/default.asp

save the report and attach it also.

 

Sophos Anti-Rootkit will scan your computer for files that have been hidden using rootkit technology.

Many of the newer malware infections use this technology to hide themselves and to make them more difficult to remove.

Installation

Download Sophos Anti-Rootkit 1.1 and save to a location you will be able to find such as your desktop

Run sarsfx.exe by double clicking on it.

Click Accept to agree to the EULA

Click Install (if you wish to change the default installation location do so here but remember where you install to, the default is C:\SOPHTEMP)

Once it finishes copying files, exit the installer​

Running the scan

Navigate to the location that you installed the software to (Default: C:\SOPHTEMP)

Run sargui.exe by double clicking on it.

Ensure that all three of the options are checked

Click Start Scan

Once the scan is complete, close Sophos Anti-Rootkit by closing the scan window and clicking Exit in the main window

DO NOT CLICK 'CLEAN UP CHECKED ITEMS' OR ATTEMPT TO HAVE SOPHOS ANTI-ROOTKIT FIX ANYTHING UNLESS SPECIFICALLY INSTRUCTED TO IN THE THREAD YOU ARE WORKING ON​

Finding the logsClick on Start --> Run

Type in %TEMP%\sarscan.log and press enter

The log file will open in the default editor (probably Notepad)

Click File --> Save As and save the file to your desktop or other location for easy retrieval.

 

You may be having other problems (ie- hardware....however)
http://www.windowsreinstall.com/install/win2k/installw2k/page1.htm
Run a check disc to make sure the hard drive is ok first.

 

Put the ghoul mask on and harvest the parts ....Sorry ...guess it falls under the looking a gift horse in the mouth....