Hi, sorry about the delay, but I’m but to my butt in snow.
Now to your problem. If I’ve got this straight, you left the laptop running and it went into hibernation, you open it and all h— had broke loose. If that’s the case let’s take care of one thing that may be the source of some of this.
Open the Windows Control Panel
Double-click Power Options
Click the Hibernate tab, uncheck the ‘Enable hibernate support’ check box, and then click Apply.
Restart your computer. We can re-enable it when we are done.
Please rename combofix.exe to bugout.exe When I ask you to run combofix, run the renamed exe.
Now we find we this ones living.
1. Launch Notepad, and copy/paste the contents of the quote box below into a new Notepad file. Save it with file name options.txt and save as file type: all files to your desktop.
RegSearch Options File
[Search]
catchme.sys
[Exclude]
[Options]
Filter=KVDLUI
2. Download Registry Search to your desktop.
[*]Right click on the compressed RegSearch folder, and choose “Extract All”. In the box that pops open, click “Next”, then “Next” again, and then “Finish”. You now have another RegSearch folder on your desktop.
[*]Open the new folder, and double click on regsearch.exe
[*]Click “Import” in the lower left corner and browse to the options.txt file that you just saved on your desktop. Do not choose the one in the RegSearch folder itself.
[]Click OK and Registry Search will scan your registry for the file(s), and a Notepad box will open with a report.
[] Please reply here with the entire contents of the Notepad file from RegSearch
NOTE: it’s important to get this imformation before running avenger. If you are not sure that you set it up right or are having problems, please do not hesitate to ask.
Now let’s see if we can get this guy’s attention.
Please download The Avenger by Swandog46 to your Desktop.
1.[*]Click on Avenger.zip to open the file[*]Extract avenger.exe to your desktop
Do not run it yet fiirst do this
Open HJT, run a system scan only, check mark these lines if present
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll (file missing)
O4 - HKLM..\Run: [horygyxi] C:\Program Files\WindowsUpdate\horygyxi22011.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - AppInit_DLLs: c:\windows\system32\jkhebcy.dll
Close all other browsers/windows, click fix, close HJT.
Now for Avenger
[QUOTE]Drivers to unload:
catchme
Files to delete:
c:\docume~1\carrie\locals~1\temp\catchme.sys
c:\windows\system32\jkhebcy.dll
[/quote]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
2. Now, start The Avenger program by clicking on its icon on your desktop.
[*] Under “Script file to execute” choose “Input Script Manually”.
[*]Now click on the Magnifying Glass icon which will open a new window titled “View/edit script”
[*] Copy/Paste [b]all[b] the text in the above quote box into this window by
[*] MAKE SURE THE TEXT MATCHES EXACTLY
[*] Click Done
[*] Now click on the Green Light to begin execution of the script
[*] Answer “Yes” twice when prompted.
3. The Avenger will automatically do the following:
[*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Unload”, The Avenger will actually restart your system twice.)
[*]On reboot, it will briefly open a black command window on your desktop, this is normal.
[*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
- Please copy/paste the content of c:\avenger.txt into your reply along with a fresh DSS log
Then run the renamed combofix, followed by DSS. Please post the avenger results, the combofix and DSS logs, and the registry search results.
You can attach the logs by using the additional options button on the reply page. You may have to scroll down to see the browse button.
