Thursday 6.3.2025 / 11:28
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > computer a mess: adware, missing/corrupt cmd.exe, userinit.exe, ect.
Computer a mess: adware, missing/corrupt cmd.exe, userinit.exe, ect.
robbster
Newbie
3. August 2008 @ 04:26 Link to this message
Hello, my computer is in a pickle at the moment. For some reason I was infected with some sort of virus/trojan/adware that slowed/completely stopped loading some websites such as google/yahoo and it also kept giving me some popup ads. I tried many scans to get rid of the problem but to no solution. And to make matters worst after one of my scan it sent my computer in chaos. The desktop doesn't load up while an application error message informs me that my userinit.exe failed to initialized properly and which goes the same for my cmd.exe, find.exe, etc. The only way I can fully load my desktop is to manual run task explorer.exe. Any advise? A complete format is the last option... Hopefully which doesn't ocurr.
Advertisement
AfterDawn Addict
5. August 2008 @ 02:33 Link to this message
robbster
Newbie
5. August 2008 @ 16:33 Link to this message
Thank you 2oldGeek for replying. I did SFC a couple of times but found no improvements. Userinit.exe, Cmd.exe and the others will still give me an application error. Here is my log.
HijackThis v2.0.2
Starter Edition\3.0\Apps\apdproxy.exe
http://www.yahoo.com/
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
http://www.yahoo.com/
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
Spybot -S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
http://favorites.live.com/quickadd.aspx
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
http://asp.mathxl.com/wizmodules/testgen...GenXInstall.cab
http://update.microsoft.com/windowsupdat...b?1149627387406
http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
http://asp.mathxl.com/books/_Players/MathPlayer.cab
Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
AfterDawn Addict
6. August 2008 @ 01:20 Link to this message
OK, robbster, let?s take it a step at a time?
Fix entries using HiJackThis
HiJackThis
Do a system scan only button
O2 - BHO: (no name) - {09085C63-BDAC-43D5-B22C-D35A586B01A2} - C:\WINDOWS\system32\cbXNHBRj.dll
http://asp.mathxl.com/wizmodules/testgen...GenXInstall.cab
click fix until you exit all browser sessions including the one you are reading in right now
HiJackThis
Delete Files on Reboot
Hijackthis
Config button
Misc Tools button
Delete a file on reboot ...
Open button.
C:\WINDOWS\system32\cbXNHBRj.dll
Yes button if you are finished, otherwise click on the No button to reboot later and enter the next file.
Malwarebytes' Anti-Malware to your desktop.
mbam-setup.exe and follow the prompts to install the program.
Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
Perform full scan , then click Scan.
OK, then Show Results to view the results.
Remove Selected.
log-date.txt
robbster
Newbie
6. August 2008 @ 05:32 Link to this message
Sweet, after the removal with trend micro, my start up is fine. However, the selection tab to my task manager disappeared.. Don't know how that happened. Anyways, I noticed I keep getting infected with Trojan.Vundo.. What's up with that? Anyhow, here are the logs and thanks again for the help 2OG!
HijackThis v2.0.2
Starter Edition\3.0\Apps\apdproxy.exe
http://www.yahoo.com/
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
http://www.yahoo.com/
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
Spybot -S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
http://favorites.live.com/quickadd.aspx
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
http://update.microsoft.com/windowsupdat...b?1149627387406
http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
http://asp.mathxl.com/books/_Players/MathPlayer.cab
Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
robbster
Newbie
6. August 2008 @ 05:36 Link to this message
Malwarebytes' Anti-Malware 1.24
Pack 2
robbster
Newbie
6. August 2008 @ 05:43 Link to this message
Nvm about the task manager situation, just fixed it.
AfterDawn Addict
6. August 2008 @ 05:54 Link to this message
You may be getting the Vundo back because you?re not getting rid of ALL of it.
ComboFix from Here to your Desktop.
Very Important! disable your anti-virus, script blocking and any anti-malware real-time protection before "unpredictable results".
combofix.exe and follow the prompts.
Combofix log and a HiJackthis Note: Do not mouseclick combofix's window while its running. That may cause it to stall.
robbster
Newbie
6. August 2008 @ 06:59 Link to this message
I just want to say I appropriate your time and effort 2OG! I just used combo scan and I believe it removed some of my Avast files, which is no problem, I'll install again. Anyways, here are the logs.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! 0 00001_.tmp
Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
Peer-to-Peer Grouping
Resolution Protocol (PNRP)
USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57]
FireFox -: Profile - C:\Documents and Settings\Robbster\Application Data\Mozilla\Firefox\Profiles\e3t7e5el.default\
Gmer , http://www.gmer.net
Pack 2 NTFS
robbster
Newbie
6. August 2008 @ 07:05 Link to this message
Logfile of Trend Micro HijackThis v2.0.2
Starter Edition\3.0\Apps\apdproxy.exe
http://go.microsoft.com/fwlink/?LinkId=69157
http://go.microsoft.com/fwlink/?LinkId=54896
http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
http://go.microsoft.com/fwlink/?LinkId=54896
http://www.yahoo.com/
http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
Spybot -S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
http://favorites.live.com/quickadd.aspx
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
http://update.microsoft.com/windowsupdat...b?1149627387406
http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
http://asp.mathxl.com/books/_Players/MathPlayer.cab
Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
AfterDawn Addict
6. August 2008 @ 08:14 Link to this message
It didn?t get any of your Avast. It did get your FunWebProducts, a nasty.
Notepad - it must be Notepad, not Wordpad.
Ctrl+C
Quote: Edit > Paste
File > Save
"CFScript.txt" (including the quotes)
CFScript into ComboFix.exe
Combofix.txt in your next reply.
robbster
Newbie
6. August 2008 @ 14:54 Link to this message
Ah I see, but the thing is that avast doesn't auto load at start-up is why i figured some items were deleted. Also, I had SP2 for awhile now honestly.. And would it be wise to get SP3? Anyhow, here is the log for ComboFix. :)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! 0 00001_.tmp
Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
Peer-to-Peer Grouping
Resolution Protocol (PNRP)
USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57]
Gmer , http://www.gmer.net
Pack 2 NTFS
AfterDawn Addict
6. August 2008 @ 23:11 Link to this message
Congratulations robbster, your log looks CLEAN HERE
Antivir over Avast, but that?s just my opinion?
There are a few things you must do once you are completely clean: 1. Time for some housekeeping
download the OTMoveIt2 by OldTimer
Save it to your desktop.
Run the tool by clicking on the icon.
Cleanup button.
2. Please download ATF Cleaner by Atribune.
ATF-Cleaner.exe to run the program.
Main "Select Files to Delete " choose: Select All.
Empty Selected button.
Firefox browser click Firefox at the top and choose: Select All
Empty Selected button.
No at the prompt.
Opera browser click Opera Select All
Empty Selected button.
No at the prompt.
Exit on the Main menu to close the program.
3. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them.
Please follow these steps to remove older version Java components and update:
Java Runtime Environment (JRE) 6 Update 7 and save it to your desktop.
The Java SE Runtime Environment (JRE) allows end-users to run Java applications..
Download button to the right.
the box that says:
Accept License Agreement.Add/Remove Programs and remove all older versions of Java.
(highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Remove or Change/Remove button.
jre-6u7-windows-i586-p.exe to install the newest version.
4. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.
The easiest and safest way to do this is:
Start > Programs > Accessories > System Tools and click "System Restore ".
Create a Restore Point " on the first screen then click "Next ". Give the R.P. a name then click "Create ". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Start > Run and type: Cleanmgr
OK "
C:
OK
More Options " Tab.
Clean Up " in the System Restore section to remove all previous restore points except the newly created one.
5. Defragment your Hard Drive
Properties.
Defragment Now.
Defragment.
And here are some tips to reduce the potential for spyware infection in the future: firewall to protect your computer from hackers. We don't recommend the firewall that comes built in to Windows. It doesn't block everything that may try to get in, and the entire firewall is written to the registry. As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions. Two good ones are are Comodo Free and Online Armor Personal Firewall
Make sure you keep your Windows OS current Windows update
I strongly recommend installing the following applications:
Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Malware, Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know Malware sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
So how did I get infected in the first place?
robbster
Newbie
7. August 2008 @ 05:19 Link to this message
I love you 2OG! You're my hero ! Knight in shining armor!
Advertisement
AfterDawn Addict
7. August 2008 @ 05:49 Link to this message
Just send MONEY! I am very over worked and underpaid? LMAO
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > computer a mess: adware, missing/corrupt cmd.exe, userinit.exe, ect.
