Virus/Malware: win32/pacthed.L and ws2_32.dll

1. Ad-Aware SE Personal <--- outdated and ineffective, I suggest you uninstall it.



2. It is a very bad idea to have so many users on one machine all with admin priviledges!

3. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix exit HJT.

4. Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

5. Could you please get this: ws2_32.dllEC806495 into a zipped file and attach it for me in your next post? To do this, see the below:

Please go to start > Run and paste in the following:

log retrievable @ C:\collect.zip

6.

Reinstall your antivirus software now.

7. Attach the collect.zip into your next reply.

8. Let me know how things are running now.

 

I am going to need to see logs from running the malware removal procedures on the "Dad" account since we have been checking out logs from a different account. This is still more likely to be an issue for the Software Forum, but I need to check logs for the proper user account. Also whilst logged into the Dad account I need you to do the below:

Now download Registry Search (see the link titled RegSearch Download Link)

• Extract the files from Regsearch.zip into a folder.
• Doubleclick regsearch.exe to start the program.
• In the top 3 boxes under the Enter search strings case independen) and click Ok... option, enter the below string (use copy and paste)

• Then click "OK".
• Notepad will be opened with text in it (the file named RegSearch.txt will be saved in the program's folder as well).
• Attach this RegSearch.txt file.

Attach all of the requested logs into your next reply.

 

Not sure exactly how this happened. Perhaps someone gave the account the name Temp to begin with and then later renamed the account to Dad. Doing this will not change the folder names. It just changes the user account name. Your problems with the Recycle Bin may some how be related to what was done, but either way not a problem for the malware forum. I can however give you a fix to try for your recycle bin problem on the Dad account:

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


If you are not having any other malware problems it will be time for final steps. Remember to visit the software forum if you need help sorting out the account with the "Temp" name.

 

You're welcome!

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
8. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!