Computer help forum: Virus, Trojan, PUP

I did what you suggested and I got rid of a lot of garbage that has had years of accumulation, I'm sure. My system seems to be working better, but I still can not access my "Help and Support" on my computer,when I click on it I get nothing at all. When I click on my recycle bin, I get a folder with a flashlight searching, but nothing comes up. I still get a "can't create DB box message when the system reboots, and when I use IE, I can get into my hotmail, but any other address that I put into it,comes up "That module is missing" is there a cure for these things? Or have I lost them forever?

Thank you so much for the help you have given... I will be completely content if I find a way to restore what is lost.

Thank you so very much.

Thank you Grif,
I tried to check files and what it came back with was " the files that are required for windows XP to run properly have been replaced with unrecognizable versions. To maintain system stability, windows must restore the original versions of these files. Insert windows XP home edition service pack 2 CD now. The problem is that I think I purchased my windows XP on line at the MSN update store for the windows 95 and I know that the Service Pack 2 was an automatic Windows XP update a couple of years ago or so. So now I don't know what I'm suppose to do.

I have included the reports and actions of the smitfraudfix scan. After that I ran the Malwarebytes_anti-malware quick scan and have included the results of that here. At the end, I ran the full scan and have also included the results to that scan.
SmitFraudFix v2.345

Scan done at 0:57:57.69, Wed 09/03/2008
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

Killing process


hosts

102.54.94.97 rhino.acme.com # source server
38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost

VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
Generic Renos Fix

GenericRenosFix by S!Ri


Deleting infected files

C:\WINDOWS\system32\migicons.exe Deleted

IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



RK


DNS

Description: Winbond W89C940-Based Ethernet Adapter (Generic)
DNS Server Search Order: 192.168.254.254
DNS Server Search Order: 192.168.254.254

Description: Winbond W89C940-Based Ethernet Adapter (Generic)
DNS Server Search Order: 68.113.206.10
DNS Server Search Order: 66.169.221.10

HKLM\SYSTEM\CCS\Services\Tcpip\..\{569E0EFF-B219-4E5D-AC86-9FC81D2D430B}: DhcpNameServer=68.113.206.10 66.169.221.10
HKLM\SYSTEM\CCS\Services\Tcpip\..\{EDC31E55-AE80-47D4-95B5-B84B43E7DE37}: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{569E0EFF-B219-4E5D-AC86-9FC81D2D430B}: DhcpNameServer=68.113.206.10 66.169.221.10
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EDC31E55-AE80-47D4-95B5-B84B43E7DE37}: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{569E0EFF-B219-4E5D-AC86-9FC81D2D430B}: DhcpNameServer=68.113.206.10 66.169.221.10
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EDC31E55-AE80-47D4-95B5-B84B43E7DE37}: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254


Deleting Temp Files


Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


Registry Cleaning

Registry Cleaning done.

SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


End




Malwarebytes_Antimalware Report
Quick Scan

Malwarebytes' Anti-Malware 1.26
Database version: 1106
Windows 5.1.2600 Service Pack 2

9/3/2008 3:45:07 AM
mbam-log-2008-09-03 (03-45-07).txt

Scan type: Quick Scan
Objects scanned: 65136
Time elapsed: 37 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 33
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 40
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\alot (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\alotToolbar (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Owner\Application Data\alot (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\postInstallLayout (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_11 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_10 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_9 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_8 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_7 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_6 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_5 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_4 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_3 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_2 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\configurator (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_1 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Button_0 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\TimerManager (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Updater (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\ToolbarSearch (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\products (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_8 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_8\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_7 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_7\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_6 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_6\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_5 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_5\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_4 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_4\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Shared (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Shared\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_3 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_3\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_2 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_2\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_1 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_1\images (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_0 (Adware.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Application Data\alot\Resources\Button_0\images (Adware.BHO) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.




Malwarebytes_Anti-malware Report
Complete Scan

Malwarebytes' Anti-Malware 1.26
Database version: 1106
Windows 5.1.2600 Service Pack 2

9/3/2008 1:00:16 PM
mbam-log-2008-09-03 (13-00-16).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 387071
Time elapsed: 5 hour(s), 52 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{A1CE8DB8-877F-47A1-A06B-47EA48E87A1B}\RP674\A0089328.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A1CE8DB8-877F-47A1-A06B-47EA48E87A1B}\RP691\A0098882.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A1CE8DB8-877F-47A1-A06B-47EA48E87A1B}\RP748\A0117535.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A1CE8DB8-877F-47A1-A06B-47EA48E87A1B}\RP770\A0127101.dll (Adware.BHO) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A1CE8DB8-877F-47A1-A06B-47EA48E87A1B}\RP693\A0105992.dll (Adware.BHO) -> Quarantined and deleted successfully.

Thank you Grif... I went to the link that you included, but it is for IT professionals and multiple machine networks. My daughter and I have a network of 2 computers, one a PC and the other a laptop. She is using VISTA so I went to the windows updates and downloaded the service pack from there and installed it. However the response from the file checker remains the same. They have a service pack 3 which says that it contains all of the updates to windows XP plus a few more. Would it be recommendable to install that and see if it adds the missing files?

Thanks,

Jersuha

Oh, no, it is for my computer, but I only meant that her vista computer is on the same home network with me and I thought that if I used the SP@ you mentioned it could cause problems if it downloaded to her computer too....I don't understand much about a lot of computer things and so I don't know what happens across a network. I'm sorry

I will go ahead and down load the SP3 from the site that you sent me.

Thanks.

I tried the SP2 file that was suggested, and after about 20 minutes of checking and updating the files on my computer I received a message saying the "SP2 file .....permission denied"

So I guess the only alternative is to get a hold of a windows XP cd.
I am trying to retrace my tracks to see if I might discover where it has gone.

Thank you Grif for all you help. I really do appreciate it.

Jersuha

...using your older version in the CD, you'll need to perform a full format of the drive, which will wipe everything from the hard drive, then reinstall the older version.. Once that's done, you install the drivers for the computer, then start upgrading to the newest service packs. Below is a link to a step by step guide on how to do that with your original version of XP with no service pack or SP1.:

http://www.windowsxphome.windowsreinstall.com/installxpcdoldhdd/indexfullpage.htm

So at some point you'll need to make the decision to keep tinkering with the system and see if you can fix the error you're seeing...or...move on a reinstall everything from scratch.

Hope this helps.

Grif

Or do you mean that you install Internet Explorer 7?

Windows 7 is the "in development" version of Windows that hasn't been released yet.. Are you sure you installed Windows 7?

Just trying to get things straight for others...

Grif

..and yes, that means IE 7 as well.. But it's NOT the browser itself that causes malware to be installed.. It's the sites you visit, the actions YOU perform, and vulnerabilities in the browser that allow for the "bad" websites to install those types of bad programs.

Hope this helps.

Grif