Desktop Hijacked - Lots of infections

Viruses and worms
1

I have a laptop, dell XPS m1210 with windows XP on it.

I DO NOT have the xp discs (yet…trying to locate them)

Computer wont let you double click items, need to use the rightclick/OPEN to get things open.
Will not connect to internet…IE flashes open but closes right away.

was able to update avast and ran it. 5 infections found and removed. Issues persist.

When I tried to install malwarebytes, spybot and some others I get near the end of the installation and get the follwoing error:
CoCreation Instance Failed
Class Not Registered

I was able to run adwCleaner, Roguekiller, aswMBR (logs attached)

Any help would be great.

2

one more log attached

3

hey also attach the OTL log please.

http://forum.avast.com/index.php?topic=53253.0

4

While running OTL got an ACCESS VIOLATION at address 0052CDD7 in module OTL.exe
clicked ok and it just appears to have hung up at "Scanning C:|Documents and Settings\All Users\Start Menu\Programs\start Menu Folder…
I am leaving it alone now to see if it finishes the scan or not. If it does finish, Ill post the log.

Note: still cant access internet from that laptop.
Also now I am getting popups asking to block/unblock the following (I Keep saying to “ask me later”)

  1. ActiveSync RAPI Manager
  2. BackWeb-8876480

also wirless networks found window popsup every few seconds.

5

hey. okey you have to wit for an malware expert to guide you from here. it could be because of the infection why the otl is not running.

6

Hi could you try to run this… From safe mode if necessary

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

7

Combofix ran see attached

8

OK lets now look at the net problem

Download and run farbar service scanner

http://i1224.photobucket.com/albums/ee362/Essexboy3/Farbar/FSS-1.jpg

Tick “All” options.
Press “Scan”.
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

9

FSS log attached

10

FSS can access the web

Download Windows Repair (all in one) from this site

Install the programme then run

https://dl.dropbox.com/u/73555776/waio%20start.JPG

Go to step 3 and allow it to run SFC

https://dl.dropbox.com/u/73555776/waio%20step3.JPG

On the start repairs tab click start

https://dl.dropbox.com/u/73555776/waiostart%20rep.JPG

Select the following items and tick restart system when finished

https://dl.dropbox.com/u/73555776/waio%20rep%20list.JPG

11

Errors I encountered. When trying to install directly to desktop it would not let me. Could not install unistall dorectory…
Ran the program from my flash drive.
In the SFC section, it asked for the windows XP disc multiple times(which i currently dont have but am trying to find) so I had to skip/cancel that section…

Ran repair option and system restarted.

Some items seem to be working now…IE stays connected…

What now?

12

What are the current problems after running the repair

13

s l o w …

When I tried to install malwarebytes, spybot and some others I get near the end of the installation and get the follwoing error:
CoCreation Instance Failed
Class Not Registered

14

Download and run MBAM clean exe from here http://downloads.malwarebytes.org/file/mbam_clean the try a reinstall of MBAM

15

cleaned mbam…reinstall and got same errors. It installs and wants to run/update, but all those errors are poping up during install of it.

EDIT: tried to run OTL…same errors as before

EDIT: still have to open some items by right clicking and selecting OPEN

EDIT: trying to run malwarebytes to see what happens…EDIT#2: so far objects are beging detected. Will post when its complete EDIT #3: been running for about 1hour 45minutes…im going to bed…will post reulsts tomarrow

16

Malwarebytes ran, al where checked off except the PUP items.

I did not do anything yet to the files. See log

17

Could you run windows updates and let me know if that works

18

Yes updates appear to be working.

Should I let Malwarebytes delte the items found?

19

Yes as the are unwanted items

If all is still well tomorrow let me know and I will tidy up. It seems as though you will need to run SFC and for that you will require the disc

20

OK let me see if we can get the xp discs.

I will report back asap