Member Avatar for texasbuttah

Your PC looks like it could well be infected.

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

_____________________________________

Here is what my log on notepad stated:

Malwarebytes' Anti-Malware 1.40
Database version: 2769
Windows 6.0.6001 Service Pack 1

9/10/2009 7:08:32 AM
mbam-log-2009-09-10 (07-08-32).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 273413
Time elapsed: 1 hour(s), 5 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\serauth1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\serauth2.dll (Trojan.Agent) -> Quarantined and deleted successfully.

  • 2 Contributors
  • 1 Reply
  • 207 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by Suspishio

Dani AI

Generated

Good first steps — running Malwarebytes (as recommended) and repeating scans (as advised) are exactly where to start. The Control Panel / My Computer / My Documents symptoms often come from leftover policy registry entries, a changed shell value, or persistent shell extensions/startup DLLs that survive one cleanup pass. Treat this as a staged cleanup: scan, remove, verify system integrity, then repair any remaining policy/shell damage.

Practical next steps (in order):

  1. Boot Safe Mode and run Malwarebytes again until no new detections appear.
  2. Run a different, second-opinion scanner from normal Windows (HitmanPro or an online scanner) and a rootkit scan from a bootable rescue tool if available.
  3. Use Autoruns (Sysinternals) to find non-Microsoft Explorer shell extensions, context-menu handlers, or suspicious startup DLLs and disable them. Export the Autoruns log for review before deleting anything.
  4. Verify and repair system/policy values (see next paragraph) and run System File Checker.

Registry and system checks to perform (backup first): inspect these locations for unwanted policy or shell changes:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell  -> should be "explorer.exe"

Look for values such as NoControlPanel, NoDrives, NoViewOnDrive, NoFolderOptions. Export any key before changing or deleting it.

Final notes: always back up user data and export registry keys before edits. Run sfc /scannow after cleaning. If problems persist, consider a repair install or a clean install after backing up files. Post the latest Malwarebytes log plus an Autoruns output here — those two logs make it possible to give targeted next actions.

Member Avatar for Suspishio

I recommend that you run malwarebytes several times without doing anything else to ensure that the trojan's self replication features are defeated. You can expect still to have problems otherwise.

Let us know.

ADDED:
Read this thread - it'll tell what might still be lurking. Read right to the bottom please.

Edited by Suspishio because: Omission
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.