944,061 Members | Top Members by Rank

Ad:
Aug 23rd, 2005
0

Hacktool.rootkit - aftermath

Expand Post »
After successfully removing this virus, when I boot up my computer I get a message: Can't Load ADMDLL.DLL, Can't load library.

Is this related to the virus and how do I get rid off it?
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
CooperS is offline Offline
7 posts
since Aug 2005
Aug 23rd, 2005
0

Re: Hacktool.rootkit - aftermath

Have the file scanned at http://virusscan.jotti.org/
(Upload the file and click Submit to have it scanned); let us know the results.
Team Colleague
Reputation Points: 63
Solved Threads: 213
Posting Maven
dlh6213 is offline Offline
2,962 posts
since Jul 2004
Aug 23rd, 2005
0

Re: Hacktool.rootkit - aftermath

upload what file?
Reputation Points: 10
Solved Threads: 0
Newbie Poster
CooperS is offline Offline
7 posts
since Aug 2005
Aug 23rd, 2005
0

Re: Hacktool.rootkit - aftermath

Hi,
Open NotePad and copy the contents of the below "Quote" box:-
Quote ...
regedit /e test1.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test2.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce"
regedit /e test3.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices"
regedit /e test4.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test5.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce"
regedit /e test6.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices"
copy test1.txt + test2.txt + test3.txt + test4.txt + test5.txt + test6.txt = Info.txt
del test1.txt
del test2.txt
del test3.txt
del test4.txt
del test5.txt
del test6.txt
Then go to File Menu > Save As and type the filename as runlist.BAT and save it. Exit from NotePad.
Double-click on the runlist.bat file, a DOS type window should open and close immediately. After this, there would be a file called Info.txt in the same location where the batch file is present. Open this Info.txt file and post its contents here.
Reputation Points: 25
Solved Threads: 51
Practically a Master Poster
swatkat is offline Offline
642 posts
since Jul 2005
Aug 24th, 2005
0

Re: Hacktool.rootkit - aftermath

Quote originally posted by CooperS ...
upload what file?
Sorry about that, I must have somehow got your thread mixed up with another one. :o
Team Colleague
Reputation Points: 63
Solved Threads: 213
Posting Maven
dlh6213 is offline Offline
2,962 posts
since Jul 2004
Aug 24th, 2005
0

Re: Hacktool.rootkit - aftermath

Quote originally posted by swatkat ...
Hi,
Open NotePad and copy the contents of the below "Quote" box:-

Then go to File Menu > Save As and type the filename as runlist.BAT and save it. Exit from NotePad.
Double-click on the runlist.bat file, a DOS type window should open and close immediately. After this, there would be a file called Info.txt in the same location where the batch file is present. Open this Info.txt file and post its contents here.
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"MMTray"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe"
"mmtask"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"vptray"="C:\\Program Files\\NavNT\\vptray.exe"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"GoToMyPC"="C:\\Program Files\\Citrix\\GoToMyPC\\g2svc.exe -logon"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
Reputation Points: 10
Solved Threads: 0
Newbie Poster
CooperS is offline Offline
7 posts
since Aug 2005
Aug 24th, 2005
0

Re: Hacktool.rootkit - aftermath

Hi,
Go to Start > Run and type regsvr32 /u ADMDLL.DLL and press ENTER. Reboot the Sytsem and check whether you recieve the error or not, and post back the results.
(Note that there is a SPACE after regsvr32 and /)
Reputation Points: 25
Solved Threads: 51
Practically a Master Poster
swatkat is offline Offline
642 posts
since Jul 2005
Aug 31st, 2005
0

Re: Hacktool.rootkit - aftermath

Quote originally posted by swatkat ...
Hi,
Go to Start > Run and type regsvr32 /u ADMDLL.DLL and press ENTER. Reboot the Sytsem and check whether you recieve the error or not, and post back the results.
(Note that there is a SPACE after regsvr32 and /)
After trying to run this, I get:
Loadlibrary ("ADMDLL.DLL") failed. The specific module could not be found

I rebooted and the same error came up again.
Reputation Points: 10
Solved Threads: 0
Newbie Poster
CooperS is offline Offline
7 posts
since Aug 2005
Aug 31st, 2005
0

Re: Hacktool.rootkit - aftermath

Hi,
Download RegCleaner and install it. Run it, go to Tools Menu > Registry CleanUp > Do them all. This starts the Registry cleaning. When the scan is complete, select all the junk entry it may find and click "Remove Selected".
Reputation Points: 25
Solved Threads: 51
Practically a Master Poster
swatkat is offline Offline
642 posts
since Jul 2005

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: IE Explorer & Messenger 7.0 is dead
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Error # 317 & IE Hijacked by Terra.es HELP





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC