Inactive PC Performance and Stability analysis report

keeth7 · Aug 17, 2011

Hi,

All the icons on my desktop have been lost and the data in the folders is showing empty. There was a pop up window saying "pc performance & stability analysis report" and indicated several errors.

I had run the malware scan, GMER and DDS.... i don't know these scans would help me to restore the data, but it was just a try.

Could you please help me to get back my system in good condition.

Bobbye · Aug 17, 2011

Welcome to TechSpot! I'll help with the malware, but I need information:

If you would like us to check the system for malware, please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

When you have finished, leave the logs for review in your next reply .
NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

You can also run the following. Please note: although this may restore some of your missing data, it does not remove the malware. So running it now is a convenience only:

Download Unhide.exe and save to the desktop.

Double-click on Unhide.exe icon to run the program.
This program will remove the +H, or hidden, attribute from all the files on your hard drives.

=====================================
My Guidelines: please read and follow:

Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
Read my instructions carefully. If you don't understand or have a problem, ask me.
If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
Follow the order of the tasks I give you. Order is crucial in cleaning process.
File sharing programs should be uninstalled or disabled during the cleaning process..
Observe these:
[o] Don't use any other cleaning programs or scans while I'm helping you.
[o] Don't use a Registry cleaner or make any changes in the Registry.
[o] Don't download and install new programs- except those I give you.
Please let me know if there is any change in the system.

If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
=====================================

keeth7 · Aug 18, 2011

Thanks Bobbye for your reply. I have followed your steps and completed the scans. But I still find the hidden recyclebin and no programs are found in start button , missing desktop wallpaper etc etc.

Here are the logs for Malware:

Malwarebytes' Anti-Malware 1.51.1.1800

Database version: 7450

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

8/12/2011 3:50:14 PM
mbam-log-2011-08-12 (15-50-14).txt

Scan type: Quick scan
Objects scanned: 176876
Time elapsed: 28 minute(s), 41 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
c:\programdata\qulyhhruog.exe (Trojan.FakeAlert) -> 4104 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qulYhhRuoG (Trojan.FakeAlert) -> Value: qulYhhRuoG -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\qulyhhruog.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\p1kalmig2kb7fz.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\Users\Sreenath\AppData\Local\Temp\tmpDCDE.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

keeth7 · Aug 18, 2011

Log for GMER:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-16 23:00:59
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000069 ST916082 rev.3.BH
Running: ubz74szt.exe; Driver: C:\Users\Sreenath\AppData\Local\Temp\kxldipow.sys

---- System - GMER 1.0.15 ----

INT 0x83 ? 951A2CD0

---- Kernel code sections - GMER 1.0.15 ----

.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C40E340, 0x3ED9C7, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

Edit: Excess GMER entries deleted by Bobbye

keeth7 · Aug 18, 2011

Continuation for GMER Log:

Edit: Excess GMER entries deleted by Bobbye

keeth7 · Aug 18, 2011

Continuation for GMER log:

Edit: Excess GMER entries deleted by Bobbye

keeth7 · Aug 18, 2011