Hacktool.rootkit - aftermath

Reply

Join Date: Aug 2005
Posts: 7
Reputation: CooperS is an unknown quantity at this point 
Solved Threads: 0
CooperS CooperS is offline Offline
Newbie Poster

Hacktool.rootkit - aftermath

 
0
  #1
Aug 23rd, 2005
After successfully removing this virus, when I boot up my computer I get a message: Can't Load ADMDLL.DLL, Can't load library.

Is this related to the virus and how do I get rid off it?
Reply With Quote Quick reply to this message  
Join Date: Jul 2004
Posts: 2,964
Reputation: dlh6213 is on a distinguished road 
Solved Threads: 210
Team Colleague
dlh6213 dlh6213 is offline Offline
Posting Maven

Re: Hacktool.rootkit - aftermath

 
0
  #2
Aug 23rd, 2005
Have the file scanned at http://virusscan.jotti.org/
(Upload the file and click Submit to have it scanned); let us know the results.
Links to help you help yourself :

Protect Your PC & Avoid Infections -- http://www.daniweb.com/techtalkforums/thread27519.html

Cleanup Procedures & Tools -- http://www.daniweb.com/techtalkforums/thread27570.html

Infection Removal & HijackThis Use -- http://www.daniweb.com/techtalkforums/thread28196.html
Reply With Quote Quick reply to this message  
Join Date: Aug 2005
Posts: 7
Reputation: CooperS is an unknown quantity at this point 
Solved Threads: 0
CooperS CooperS is offline Offline
Newbie Poster

Re: Hacktool.rootkit - aftermath

 
0
  #3
Aug 23rd, 2005
upload what file?
Reply With Quote Quick reply to this message  
Join Date: Jul 2005
Posts: 642
Reputation: swatkat is an unknown quantity at this point 
Solved Threads: 50
swatkat's Avatar
swatkat swatkat is offline Offline
Small Town Boy

Re: Hacktool.rootkit - aftermath

 
0
  #4
Aug 23rd, 2005
Hi,
Open NotePad and copy the contents of the below "Quote" box:-
regedit /e test1.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test2.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce"
regedit /e test3.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices"
regedit /e test4.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test5.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce"
regedit /e test6.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices"
copy test1.txt + test2.txt + test3.txt + test4.txt + test5.txt + test6.txt = Info.txt
del test1.txt
del test2.txt
del test3.txt
del test4.txt
del test5.txt
del test6.txt
Then go to File Menu > Save As and type the filename as runlist.BAT and save it. Exit from NotePad.
Double-click on the runlist.bat file, a DOS type window should open and close immediately. After this, there would be a file called Info.txt in the same location where the batch file is present. Open this Info.txt file and post its contents here.
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
-Albert Einstein.
Reply With Quote Quick reply to this message  
Join Date: Jul 2004
Posts: 2,964
Reputation: dlh6213 is on a distinguished road 
Solved Threads: 210
Team Colleague
dlh6213 dlh6213 is offline Offline
Posting Maven

Re: Hacktool.rootkit - aftermath

 
0
  #5
Aug 24th, 2005
Originally Posted by CooperS
upload what file?
Sorry about that, I must have somehow got your thread mixed up with another one. :o
Reply With Quote Quick reply to this message  
Join Date: Aug 2005
Posts: 7
Reputation: CooperS is an unknown quantity at this point 
Solved Threads: 0
CooperS CooperS is offline Offline
Newbie Poster

Re: Hacktool.rootkit - aftermath

 
0
  #6
Aug 24th, 2005
Originally Posted by swatkat
Hi,
Open NotePad and copy the contents of the below "Quote" box:-

Then go to File Menu > Save As and type the filename as runlist.BAT and save it. Exit from NotePad.
Double-click on the runlist.bat file, a DOS type window should open and close immediately. After this, there would be a file called Info.txt in the same location where the batch file is present. Open this Info.txt file and post its contents here.
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"MMTray"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe"
"mmtask"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"vptray"="C:\\Program Files\\NavNT\\vptray.exe"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"GoToMyPC"="C:\\Program Files\\Citrix\\GoToMyPC\\g2svc.exe -logon"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
Reply With Quote Quick reply to this message  
Join Date: Jul 2005
Posts: 642
Reputation: swatkat is an unknown quantity at this point 
Solved Threads: 50
swatkat's Avatar
swatkat swatkat is offline Offline
Small Town Boy

Re: Hacktool.rootkit - aftermath

 
0
  #7
Aug 24th, 2005
Hi,
Go to Start > Run and type regsvr32 /u ADMDLL.DLL and press ENTER. Reboot the Sytsem and check whether you recieve the error or not, and post back the results.
(Note that there is a SPACE after regsvr32 and /)
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
-Albert Einstein.
Reply With Quote Quick reply to this message  
Join Date: Aug 2005
Posts: 7
Reputation: CooperS is an unknown quantity at this point 
Solved Threads: 0
CooperS CooperS is offline Offline
Newbie Poster

Re: Hacktool.rootkit - aftermath

 
0
  #8
Aug 31st, 2005
Originally Posted by swatkat
Hi,
Go to Start > Run and type regsvr32 /u ADMDLL.DLL and press ENTER. Reboot the Sytsem and check whether you recieve the error or not, and post back the results.
(Note that there is a SPACE after regsvr32 and /)
After trying to run this, I get:
Loadlibrary ("ADMDLL.DLL") failed. The specific module could not be found

I rebooted and the same error came up again.
Reply With Quote Quick reply to this message  
Join Date: Jul 2005
Posts: 642
Reputation: swatkat is an unknown quantity at this point 
Solved Threads: 50
swatkat's Avatar
swatkat swatkat is offline Offline
Small Town Boy

Re: Hacktool.rootkit - aftermath

 
0
  #9
Aug 31st, 2005
Hi,
Download RegCleaner and install it. Run it, go to Tools Menu > Registry CleanUp > Do them all. This starts the Registry cleaning. When the scan is complete, select all the junk entry it may find and click "Remove Selected".
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
-Albert Einstein.
Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the Viruses, Spyware and other Nasties Forum


Views: 2789 | Replies: 8
Thread Tools Search this Thread



Tag cloud for Viruses, Spyware and other Nasties
About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC