Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Another "application cannot be executed" infection  (Read 16421 times)

0 Members and 1 Guest are viewing this topic.

Crazywumbat

    Topic Starter


    Rookie

    Re: Another "application cannot be executed" infection
    « Reply #30 on: February 24, 2010, 11:20:49 AM »
    Ok did that step:

    All processes killed
    ========== PROCESSES ==========
    No active process named explorer.exe was found!
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys\ deleted successfully.
    ========== FILES ==========
    File/Folder C:\WINDOWS\system32\drivers\TDSSmhct.sys not found.
    File/Folder C:\WINDOWS\system32\drivers\TDSSoiqn.dll not found.
    File/Folder C:\WINDOWS\system32\TDSSrtqp.dll not found.
    File/Folder C:\WINDOWS\system32\TDSSlxwp.dll not found.
    File/Folder C:\WINDOWS\system32\TDSSxfum.dll not found.
    File/Folder C:\WINDOWS\system32\TDSSnmxh.log not found.
    File/Folder C:\WINDOWS\system32\TDSSsihc.dll not found.
    File/Folder C:\WINDOWS\system32\TDSSrhyp.log not found.
    File/Folder C:\WINDOWS\system32\TDSSkkbi.log not found.
    File/Folder C:\WINDOWS\system32\TDSSorvd.dat not found.
    File/Folder C:\WINDOWS\system32\TDSShrsr.dll not found.
    ========== COMMANDS ==========
     
    [EMPTYTEMP]
     
    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
     
    User: All Users
     
    User: Default User
    ->Temp folder emptied: 59964 bytes
    ->Temporary Internet Files folder emptied: 32768 bytes
     
    User: Kevin
    ->Temp folder emptied: 2472997 bytes
    ->Temporary Internet Files folder emptied: 988641 bytes
    ->Java cache emptied: 12666849 bytes
    ->FireFox cache emptied: 81933871 bytes
     
    User: LocalService
    ->Temp folder emptied: 65984 bytes
    ->Temporary Internet Files folder emptied: 82054 bytes
     
    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
     
    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 5315680 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 49901568 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes
    RecycleBin emptied: 0 bytes
     
    Total Files Cleaned = 146.00 mb
     
     
    OTM by OldTimer - Version 3.1.9.0 log created on 02242010_131158

    Files moved on Reboot...
    C:\Documents and Settings\Kevin\Local Settings\Temp\clclean.0001.dir.0000\~df394b.tmp moved successfully.
    C:\Documents and Settings\Kevin\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp moved successfully.
    File move failed. C:\WINDOWS\SEEAF423F.tmp scheduled to be moved on reboot.

    Registry entries deleted on Reboot...

    evilfantasy

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Calm like a bomb
    • Thanked: 493
    • Experience: Experienced
    • OS: Windows 11
    Re: Another "application cannot be executed" infection
    « Reply #31 on: February 24, 2010, 11:23:09 AM »
    * Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
    * Now type Combofix /Uninstall in the runbox
    * Make sure there's a space between Combofix and /Uninstall
    * Then hit Enter

    * The above procedure will:
    * Delete the following:
    * ComboFix and its associated files and folders.
    * Reset the clock settings.
    * Hide file extensions, if required.
    * Hide System/Hidden files, if required.
    * Set a new, clean Restore Point.

    ----------

    Clean out your temporary internet files and temp files.

    Download TFC by OldTimer to your desktop.

    Double-click TFC.exe to run it.

    Note: If you are running on Vista, right-click on the file and choose Run As Administrator

    TFC will close all programs when run, so make sure you have saved all your work before you begin.

    * Click the Start button to begin the cleaning process.
    * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. 
    * Please let TFC run uninterrupted until it is finished.

    Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

    ----------

    ESET Online Scan

    Scan your computer with the ESET FREE Online Virus Scan

    * Click the ESET Online Scanner button.

    * For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    * Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
    * Double click on the esetsmartinstaller_enu.exe icon on your desktop.
    * Place a check mark next to YES, I accept the Terms of Use.

    * Click the Start button.
    * Accept any security warnings from your browser.
    * Leave the check mark next to Remove found threats and place a check next to Scan archives.
    * Click the Start button.
    * ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
    * When the scan completes, click List of found threats.
    * Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
    * Click the <<Back button then click Finish.

    In your next reply please include the ESET Online Scan Log

    Crazywumbat

      Topic Starter


      Rookie

      Re: Another "application cannot be executed" infection
      « Reply #32 on: February 25, 2010, 09:12:04 PM »
      Okay, all done.

      [Saving space, attachment deleted by admin]

      evilfantasy

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Calm like a bomb
      • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: Another "application cannot be executed" infection
      « Reply #33 on: February 26, 2010, 09:51:18 AM »
      How is the computer running now?

      Crazywumbat

        Topic Starter


        Rookie

        Re: Another "application cannot be executed" infection
        « Reply #34 on: February 26, 2010, 01:27:00 PM »
        Its running pretty good, I'm still a little apprehensive about logging into any websites requiring me to enter a password other than this one though. Would you say its reasonably safe to do so at this point?

        evilfantasy

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Calm like a bomb
        • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11
        Re: Another "application cannot be executed" infection
        « Reply #35 on: February 26, 2010, 02:20:27 PM »
        Would you say its reasonably safe to do so at this point?

        From what I can tell everything is good to go now.


        Final suggestions.

        Use the Secunia Software Inspector to check for out of date software.

        * Click Start Scanner
        * Check the box next to Enable thorough system inspection.
        * Click Start
        * Allow the scan to finish and scroll down to see if any updates are needed.
        * Update anything listed.

        ----------

        Go to Microsoft Windows Update and get all critical updates.

        ----------

        If you are using or have installed IE6 you are using an outdated and soon to be unsupported version of Internet Explorer and I strongly suggest you update to the latest version directly from Microsoft Internet Explorer 8: Home page.

        ----------

        I recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no realtime protection so will not interfere with each other. They do not use any significant amount of resources (except a little disk space) until you run a scan.

        I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

        SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
        * Using SpywareBlaster to protect your computer from Spyware and Malware
        * If you don't know what ActiveX controls are, see here

        Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy.
        * Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

        Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

        Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

        Crazywumbat

          Topic Starter


          Rookie

          Re: Another "application cannot be executed" infection
          « Reply #36 on: February 26, 2010, 03:25:29 PM »
          Okay, thanks so much, you've been a lifesaver.

          evilfantasy

          • Malware Removal Specialist
          • Moderator


          • Genius
          • Calm like a bomb
          • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: Another "application cannot be executed" infection
          « Reply #37 on: February 26, 2010, 03:44:57 PM »
          Your welcome.

          Safe surfing...