Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Recent virus, lost Libraries, Thunderbird & Catalyst CC won't open.

20 Feb 2013   #11
shawn77

32 bit
 
 

Grinler's UNHIDE tool should restore them and resolve catalyst error but before that follow cottonball's suggestion to remove infections.


My System SpecsSystem Spec
.
20 Feb 2013   #12
cottonball

Windows 7 Home Premium
 
 

Slartybart and shawn77,

Thanks for the info!!

That is exactly where we are headed, get rid of the malware, and then, use Grinler's unhide.exe

RogueKiller, and in particular, FRST, should identify the Rootkit and anything else that is lurking in that system.

Trying to reveal the files and folders now is probably an exercise in futility...
My System SpecsSystem Spec
20 Feb 2013   #13
VistaKing

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Files should be in %temp%\smtmp\1,2,3,4


%Temp%\smtmp\1 files in there will go C:\ProgramData\Microsoft\Windows\Start Menu

%Temp%\smtmp\2 files in there will go to C:\Users\<your login name here>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

%Temp%\smtmp\3 will in there will go to C:\Users\<your login name here>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

%Temp%\smtmp\4 files inside there will go to C:\Users\Public\Desktop

Save the smtmp folder to a flash drive. Then remove the virus . Don't run any temp files remover programs like Ccleaner .
My System SpecsSystem Spec
.

20 Feb 2013   #14
cottonball

Windows 7 Home Premium
 
 

Thanks for the info, VistaKing!

Y'all making this easier, keep 'em coming!
My System SpecsSystem Spec
20 Feb 2013   #15
VistaKing

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

No problem , Cottonball .
My System SpecsSystem Spec
22 Feb 2013   #16
viciii3

Windows 7 home premium 32bit
 
 

here is the text of the Rogue Killer report (hope I did this correctly).

RogueKiller V8.5.1 [Feb 21 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : mom [Admin rights]
Mode : Scan -- Date : 02/22/2013 11:58:29
| ARK || FAK || MBR |
Bad processes : 6
[SUSP PATH] zuqeanypyqyb.exe -- C:\Users\mom\zuqeanypyqyb.exe [-] -> KILLED [TermProc]
[SUSP PATH] exp7E33.tmp.exe -- C:\Users\mom\AppData\Local\Temp\exp7E33.tmp.exe [-] -> KILLED [TermProc]
[SVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]
[SVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]
[SVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]
[SVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]
Registry Entries : 6
[RUN][SUSP PATH] HKCU\[...]\Run : KB01192703.exe ("C:\Users\mom\AppData\Roaming\KB01192703.exe") [-] -> FOUND
[RUN][SUSP PATH] HKCU\[...]\Run : zuqeanypyqyb (C:\Users\mom\zuqeanypyqyb.exe) [-] -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-4093826796-1630646369-247549289-1000[...]\Run : KB01192703.exe ("C:\Users\mom\AppData\Roaming\KB01192703.exe") [-] -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-21-4093826796-1630646369-247549289-1000[...]\Run : zuqeanypyqyb (C:\Users\mom\zuqeanypyqyb.exe) [-] -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
Particular Files / Folders:
[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-21-4093826796-1630646369-247549289-1000\$32bf8f5f13097800106f306c78257dcb\n [-] --> FOUND
[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-4093826796-1630646369-247549289-1000\$32bf8f5f13097800106f306c78257dcb\@ [-] --> FOUND
[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-4093826796-1630646369-247549289-1000\$32bf8f5f13097800106f306c78257dcb\U --> FOUND
[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-4093826796-1630646369-247549289-1000\$32bf8f5f13097800106f306c78257dcb\L --> FOUND
Driver : [LOADED]
Infection : ZeroAccess
HOSTS File:
--> C:\windows\system32\drivers\etc\hosts

MBR Check:
+++++ PhysicalDrive0: TOSHIBA MK2555GSX ATA Device +++++
--- User ---
[MBR] ecb72268cfc86f4eba0f32634df3dadc
[BSP] 115bdc51753a8a8a697d04b3e5af154d : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 228693 Mo
2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 471437312 | Size: 8281 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_02222013_02d1158.txt >>
RKreport[1]_S_02222013_02d1158.txt
My System SpecsSystem Spec
22 Feb 2013   #17
viciii3

Windows 7 home premium 32bit
 
 

I am not allowed to post the text from the FRST.txt file...it is too many characters? I can upload the file by FTP to my page, if that will work?
My System SpecsSystem Spec
22 Feb 2013   #18
viciii3

Windows 7 home premium 32bit
 
 

The FRST.txt file is here:

http://users.frii.com/viciii3/FRST.txt
My System SpecsSystem Spec
22 Feb 2013   #19
cottonball

Windows 7 Home Premium
 
 

Please run RogueKiller once again:

Close all windows and browsers
Right-click RogueKiller and select 'Run as Administrator'

Wait until the Prescan finishes
The Status box shows PreScan Finished
Press: Scan

When done, on the right, click: Delete (or Remove)
Wait until the Status box shows: Deleting Finished
Click on Report and provide the content of the new Rkreport (Mode: Remove) in your reply.
My System SpecsSystem Spec
22 Feb 2013   #20
VistaKing

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Looking at the FRST.txt . I see that you have an adware by the name of Conduit. Also random numbers.exe running which is located inside your registry .
HKCU\Software\Microsoft\Windows\CurrentVersion\Run : KB01192703.exe
C:\Users\mom\AppData\ Roaming\KB01192703.exe

Download Malwarebytes by clicking on this link Malwarebytes Anti-Malware - CNET Download.com and click on Download Now . Install the program update the definitions and click on start trial . On the Scanner tab, make sure the Perform full scan option is selected and then click on the Scan button to start scanning your computer for infections.

** Don't worry it will remove what ever it finds even though its a trial version .
My System SpecsSystem Spec
Reply

 Recent virus, lost Libraries, Thunderbird & Catalyst CC won't open.




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Lost Thunderbird & important folders when synchronising computers!
Hi I bought a new Dell PC with Windows 8.1 and wanted to transfer files from my old PC (Windows 7) to it. I used a program called Goodsync which has a function called Goodsync Connect which connects and synchronises the 2 computers. To my horror, at the end of the synchronisation, the files from...
Backup and Restore
How do I open XP icon libraries which have libraries within them
I am new to WIN7, and have the rest of my computers running XP. I have a number of icon libraries in a folder c:\icons which contain contain icon libries within them. eg C:\icons\animals.ico contains further folders cats.ico, dogs.ico ... I have not been able to get WIN7 to open these,...
General Discussion
Help! Catalyst 12.2 wont open.
Hi, I am currently using ATI 6970 and every time I reinstall Catalyst, it works briefly, but once I restart my system, it fails to work again. I have tried uninstalling and reinstalling, I have tried using Driver Cleaner from safe mode, updating my .NET framework, I have reinstalled my...
Graphic Cards
Lost ALL Photos and Videos in Libraries/Album Art Screwed Up :o
I'm in such a mess! I'm new to Windows 7 and "Libraries". Just as I got it all figured out and organized, I seem to have really made a mess by trying to keep WMP from monitoring my video and picture libraries. Now when I click on Start/Pictures or Start/Videos it's EMPTY! Also, and I don't know...
Music, Pictures & Video
Lost Libraries
Ok this one has me a bit stumped. I have not done a lot of troubleshooting with Windows 7 in the past and the libraries are new, though I think I have them figured out. What happened to me is my Windows 7 Ultimate 32 bit machine crashed when I went to install Firefox's new browser. Computer went...
General Discussion
Win 7 SP1 cannot open Mozilla Thunderbird
Hi, Newbie here so excuse my deemed as inane questions and comments. Foolishly I installed Windows 7 SP1 Update on my kid's Toshiba Mini Notebook yesterday. They have Win 7 Starter. It locked the whole desktop and all of the programs as insufficient permissions. Uninstalled WIN 7 SP1...
Windows Updates & Activation


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 21:01.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App