Bad virus/trojan/malware: after login no graphical icons or menus show up

Viruses and worms
21

OK, So I forgot to update, I am updating right now and will rescan. This is the log for the 1st scan

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 16
Registry Values Infected: 7
Registry Data Items Infected: 8
Folders Infected: 6
Files Infected: 36

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINDOWS\system32\johakehe.dll (Trojan.Vundo.H) → Delete on reboot.
C:\WINDOWS\system32\majubilu.dll (Trojan.Vundo) → Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{b45a4b16-23f2-41ad-f4e4-00aac39c0004} (Trojan.Vundo.H) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{b45a4b16-23f2-41ad-f4e4-00aac39c0004} (Trojan.Vundo.H) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{6a2a6263-87a3-40ab-b669-e707680980a4} (Trojan.Vundo.H) → Delete on reboot.
HKEY_CLASSES_ROOT\CLSID{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib{014c4232-6904-47b9-9144-7e0fb7277444} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface{0ab02d6c-f605-425f-b7cb-b9e96c9faf1e} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface{32864a05-9d09-472c-abd0-081818ec713b} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{beac7dc8-e106-4c6a-931e-5a42e7362883} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{beac7dc8-e106-4c6a-931e-5a42e7362883} (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gamevance (Adware.Gamevance) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AVR (Rogue.AdvancedVirusRemover) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify__c0031fc4 (Trojan.Vundo) → Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mizepobip (Trojan.Vundo.H) → Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\38514930 (Trojan.FakeAlert.H) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler{6a2a6263-87a3-40ab-b669-e707680980a4} (Trojan.Vundo.H) → Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\yabivumok (Trojan.Vundo.H) → Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Agent.exe (Trojan.FraudPack) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) → Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) → Data: c:\windows\system32\johakehe.dll → Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) → Data: system32\johakehe.dll → Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) → Bad: (1) Good: (0) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) → Bad: (1) Good: (0) → Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\All Users\Application Data\38514930 (Rogue.Multiple) → Quarantined and deleted successfully.
C:\Program Files\AdvancedVirusRemover (Rogue.AdvancedVirusRemover) → Quarantined and deleted successfully.
C:\Program Files\Gamevance (Adware.Gamevance) → Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\AntiVirus Plus (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Start Menu\Programs\AntiVirus Plus (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec (Stolen.data) → Quarantined and deleted successfully.

22

and… Files Infected:
c:\WINDOWS\system32\johakehe.dll (Trojan.Vundo.H) → Delete on reboot.
C:\Documents and Settings\All Users\Application Data\38514930\38514930.exe (Trojan.FakeAlert.H) → Quarantined and deleted successfully.
C:\Program Files\Gamevance\gamevancelib32.dll (Adware.Gamevance) → Quarantined and deleted successfully.
C:\WINDOWS\system32__c0025596.exe (Rogue.Installer) → Quarantined and deleted successfully.
C:\WINDOWS\system32__c00C63E0.exe (Rogue.Installer) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Local Settings\Temporary Internet Files\Content.IE5\3G7RL133\logo[1].htm (Trojan.Vundo.H) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Local Settings\Temporary Internet Files\Content.IE5\7B5GSE1L\KB959433[1].exe (Rogue.Installer) → Quarantined and deleted successfully.
C:\Program Files\Gamevance\ars.cfg (Adware.Gamevance) → Quarantined and deleted successfully.
C:\Program Files\Gamevance\gamevance32.exe (Adware.Gamevance) → Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvtl.dll (Adware.Gamevance) → Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvun.exe (Adware.Gamevance) → Quarantined and deleted successfully.
C:\Program Files\Gamevance\icon.ico (Adware.Gamevance) → Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\AntiVirus Plus\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\AntiVirus Plus\EULA.url (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Start Menu\Programs\AntiVirus Plus\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Start Menu\Programs\AntiVirus Plus\EULA.url (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) → Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Desktop\Advanced Virus Remover.lnk (Rogue.AdvancedVirusRemover) → Quarantined and deleted successfully.
C:\Program Files\Shared_lib.sig (Adware.Deepdive) → Quarantined and deleted successfully.
C:\Program Files\Shared\lib.sig (Adware.Deepdive) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk (Rogue.AdvancedVirusRemover) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Start Menu\Advanced Virus Remover.lnk (Rogue.AdvancedVirusRemover) → Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Start Menu\Programs\Startup\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) → Quarantined and deleted successfully.
C:\WINDOWS\system32__c0081D40.exe (Trojan.Vundo) → Quarantined and deleted successfully.
C:\WINDOWS\system32\critical_warning.html (Trojan.FakeAlert) → Quarantined and deleted successfully.
C:\WINDOWS\system32\majubilu.dll (Trojan.Vundo) → Delete on reboot.
C:\WINDOWS\system32\pajafiba.dll (Trojan.Vundo) → Quarantined and deleted successfully.
C:\WINDOWS\system32\tebihoti.dll (Trojan.Vundo) → Quarantined and deleted successfully.
C:\WINDOWS\system32\zupejaku.dll (Trojan.Vundo) → Quarantined and deleted successfully.
C:\Documents and Settings\Nancy\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) → Quarantined and deleted successfully.
C:\WINDOWS\msa.exe (Trojan.Agent) → Quarantined and deleted successfully.
C:\WINDOWS\win32k.sys (Trojan.Dropper) → Quarantined and deleted successfully.
C:\Documents and Settings\Doc\Application Data\CC\agent.exe (Trojan.FraudPack) → Quarantined and deleted successfully.

23

and yet more infected files in the second scan. Restarted and got bad image errors. Says — is not a valid image. Please check against your installation diskette.

Also, nothing has changed about the viewing icons and menus or task manager.

Reading the Malware link from before I guess it says to use the hijack thingy, where do I get it? or can I use something easier?

24

The system is infected with Vundo so it is quite hard to remove. :frowning:

Even backup files could be corrupted so it will need special care to have a system that is reliable again.