Random files/folders/user accounts disappear - please help if you can

jay4paz · Apr 6, 2009

Running WinXP SP3. On Friday one of the user accounts on my PC was "locked out", then disappeared. Noticed a zero-byte file with the name Ÿ9Ÿ9 in the folder of that account under Docs and Settings. Was suspicious of this file. Now contents of folders seem to be disappearing. I'm panicked. Posted on this forum on Friday because I jumped into a thread from a google search, but didn't follow the READ AND RUN FIRST b/c I hadn't seen it yet. Sorry, didn't know the drill.

Now I've done the whole procedure. If someone would be able to take a look, I have no idea whether I'm clean or not, and scared to death that things are going to keep disappearing.

jay4paz · Apr 6, 2009

NEW INFO Re: Random files/folders/user accounts disappear - please help if you can

New information...In Safe mode I was able to delete "Y9Y9" 0-byte file which was under c:\documents and settings\(username), and in c:\WINDOWS\system32, also from the root of a flash drive.

Have tried using my pc a little bit and no further evident malfunctioning, but I'm still scared b/c the RUN ME FIRST tools only told me they found two things - Rogue.Multiple and Diabled.SecurityCenter which I've searched up and don't look like they would have caused my user account to get disabled as it did. So I'm afraid there's still something lurking -would sure appreciate a look at my logs to see if anything of concern.

Thanks,
Jay

chaslang · Apr 10, 2009

In the future, please remember to stay in one thread.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)

After clicking Fix, exit HJT.

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

Open Notepad and copy/paste the text in the below quote box into it:

KILLALL::

Driver::
vuckitgk

File::
C:\Documents and Settings\Jay1\y9y9
C:\WINDOWS\system32\drivers\vuckitgk.sys
c:\program files\gzakuf.txt
Click to expand...

Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner to clean out only temp files and nothing else!

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

C:\ComboFix.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

Random files/folders/user accounts disappear - please help if you can

jay4paz Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 04-03-2009 - 09-00-15.log

mbam-log-2009-04-03 (06-54-52).txt

combofix log.txt

MGlogs.zip

jay4paz Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member