Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: badly infected  (Read 19723 times)

0 Members and 1 Guest are viewing this topic.

nikis360

    Topic Starter


    Beginner

    Re: badly infected
    « Reply #15 on: January 25, 2012, 09:33:27 AM »
    it's doing better, but not at 100%. Sorry for the delay, but I had some medical issues.

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ToolbarFacemood77.zip   Win32/Bagle.gen.zip worm   cleaned by deleting - quarantined
    C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\18\691e3112-6c97148a   Java/Agent.DW trojan   deleted - quarantined
    C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\61\69928a3d-5f46b25e   a variant of Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\Documents and Settings\HP_Administrator\My Documents\Downloads\cnet_ringmake_v529_exe.exe   a variant of Win32/InstallCore.D application   cleaned by deleting - quarantined
    C:\Documents and Settings\HP_Administrator\My Documents\Downloads\GingerBreak-v1.10(1).apk   Linux/Exploit.Lotoor.AJ trojan   deleted - quarantined
    C:\Documents and Settings\HP_Administrator\My Documents\Downloads\GingerBreak-v1.10.apk   Linux/Exploit.Lotoor.AJ trojan   deleted - quarantined
    C:\Documents and Settings\HP_Administrator\My Documents\Downloads\SetupArcadeWeb.exe   a variant of Win32/Adware.Gamevance.BE application   cleaned by deleting - quarantined
    C:\Documents and Settings\HP_Administrator\My Documents\Downloads\XvidSetup.exe   Win32/Toolbar.Zugo application   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\17\6e684651-213a5662   multiple threats   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\19\6b527313-52162753   a variant of Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\2\3aa4da42-1dabd47d   multiple threats   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\22\1dccba96-2f0d1591   a variant of Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\23\390a5597-203759f6   a variant of Java/TrojanDownloader.OpenConnection.AQ trojan   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\55\5db226b7-3f9e3b6b   multiple threats   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\56\408dfaf8-1a3f4650   a variant of Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\57\7cea6c39-52161e0c   a variant of Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0ATC9NEA\czkzimczfpdmg[1].pdf   JS/Exploit.Pdfka.PGF.Gen trojan   cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\kn5KXoCPJI5FDa.exe.vir   a variant of Win32/Injector.MAS trojan   cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\NJKgUKkjfTHNlDI.exe.vir   Win32/TrojanDownloader.Prodatect.BK trojan   cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Documents and Settings\HP_Administrator\Local Settings\Application Data\1cf6efbe\X.vir   Win32/Sirefef.DD trojan   cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Documents and Settings\HP_Administrator\Local Settings\Application Data\1cf6efbe\U\[email protected]   a variant of Win32/Sirefef.DV trojan   cleaned by deleting - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Common Files\LightScribe\LSSrvc.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Common Files\Motive\McciCMService.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Google\Update\GoogleUpdate.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\iPod\bin\iPodService.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Java\jre6\bin\jqs.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\Program Files\Norton Safe Web Lite\Engine\1.2.0.6\ccSvcHst.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\Qoobox\Quarantine\C\WINDOWS\system32\nvsvc32.exe.vir   Win32/Patched.HN trojan   cleaned - quarantined
    C:\WINDOWS\$hf_mig$\KB950762\update\eula.txt   Win32/Adware.Virtumonde.NEO application   cleaned by deleting - quarantined
    C:\WINDOWS\system32\drivers\Udfreadr.sys   Win32/Rootkit.Agent.NUT trojan   cleaned by deleting - quarantined
    C:\WINDOWS\temp\jar_cache1173086613976580267.tmp   Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\WINDOWS\temp\jar_cache4319357173442203831.tmp   Java/TrojanDownloader.Agent.NDJ trojan   deleted - quarantined
    C:\WINDOWS\temp\jar_cache5290585592826776061.tmp   Java/TrojanDownloader.Agent.NDJ trojan   deleted (after the next restart) - quarantined
    C:\_OTL\MovedFiles\12312011_230339\c_documents and settings\all users\application data\gfhYdHclcK.exe   a variant of Win32/Injector.MAS trojan   cleaned by deleting - quarantined
    Operating memory   a variant of Win32/Olmarik.AWO trojan   

    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: badly infected
    « Reply #16 on: January 25, 2012, 12:31:09 PM »
    Quote
    it's doing better, but not at 100%
    Please describe "not at 100%".
    Windows 8 and Windows 10 dual boot with two SSD's

    nikis360

      Topic Starter


      Beginner

      Re: badly infected
      « Reply #17 on: January 26, 2012, 10:29:18 AM »
      I am no longer getting the pop-up boxes.
      I have my desktop icons and my startup menu. the red circle with an x in it near my clock along with a system check icon is gone.
      but when I click on start, and all programs. the folders still show empty. to access them I have to click start, right click all programs and click explore.

      SuperDave

      • Malware Removal Specialist


      • Genius
      • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: badly infected
      « Reply #18 on: January 26, 2012, 12:03:27 PM »
      Please try running UnHide again. You'll find it in Reply # 1
      Windows 8 and Windows 10 dual boot with two SSD's

      nikis360

        Topic Starter


        Beginner

        Re: badly infected
        « Reply #19 on: January 31, 2012, 12:51:55 PM »
        ran unhide again and the folders still show empty

        SuperDave

        • Malware Removal Specialist


        • Genius
        • Thanked: 1020
        • Certifications: List
        • Experience: Expert
        • OS: Windows 10
        Re: badly infected
        « Reply #20 on: January 31, 2012, 04:55:39 PM »
        Please do this even if you don't have the OS disk.

        Do you have an XP CD?

        If so, place it in your CD ROM drive and follow the instructions below:
        •Click on Start > Run and type sfc /scannow then press Enter (note the space between scf and /scannow)
        *Let this run undisturbed until the window with the blue  progress bar goes away
        SFC - Which stands for System File Checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.
        Windows 8 and Windows 10 dual boot with two SSD's

        nikis360

          Topic Starter


          Beginner

          Re: badly infected
          « Reply #21 on: February 29, 2012, 12:16:56 PM »
          I don't have a xp cd

          SuperDave

          • Malware Removal Specialist


          • Genius
          • Thanked: 1020
          • Certifications: List
          • Experience: Expert
          • OS: Windows 10
          Re: badly infected
          « Reply #22 on: February 29, 2012, 05:38:00 PM »
          I don't have a xp cd
          Please run it anyway. If it finds a missing or corrupt file it will ask for the disk. That will give us a clue.
          Windows 8 and Windows 10 dual boot with two SSD's