Can't run regedit after malware infection. Please help!

[alexsomma]

Hi

I was stupid enough to doubleclick what looked liked a rar file to get a archive password. I've always managed to stay out of trouble before but that one error was more than enough to screw everything up.


initial symptoms:
In addition to giving me fake trojan warnings (that looked like defender warnings) leading me to fake anti-malware sites, it installed some extra toolbar in internet explorer and disabled ctrl+alt+del and also regedit i think.

remaining problem:
I think I've managed to fix most of it, but I still cant get regedit to run.
When I try to run regedit I get the user account control prompt, but when I click continue, nothing happens.


Here's what I've done so far:

- I've downloaded ad-aware, spybot search & destory, malwarebyte's anti-malware and run them all. Both adaware and malware found and fixed some stuff, but spybot didnt find anything after that.

- I then purchased and downloaded BitDefender Antivirus 2009 and run deep system scan, and it too removed something.

- I've downloaded cc cleaner and fixed all the issues it listed.

- I've used killbox to clear all temp files.

- And finally I've used Hijackthis to get rid of some other stuff.


I still cant run regedit, so there has to be something wrong.

I've attached my hijack log, hope you guys can help me!!

 

[kimsland]

Download RatsCheddar

It contains a program written by Rathat, and it is a Policy Controller.
Save and extract this program to the desktop.
Once extracted, Double click on the RatsCheddar.exe file.
Enable everything, then click Exit
Reboot your Computer.

 

[alexsomma]

I tried using ratscheddar like you said, but regedit still wont run.

 

[kimsland]

Your HJT log contains 23 file missing lines

Please tick and fix all of them (it's very difficult to read with all of these)

Then run IE Reset:

How to use Reset Internet Explorer Settings (RIES

To use RIES in Internet Explorer 7, follow these steps:

1. Click the Tools menu, and then click Internet Options.
2. On the Advanced tab, click Reset.
3. In the Reset Internet Explorer Settings dialog box, click Reset.
4. When Internet Explorer 7 finishes restoring the default settings, click Close, and then click OK two times.
5. Close Internet Explorer 7. The changes take effect the next time that you open Internet Explorer 7.



Then run CCleaner

Then Restart

Then re-attach a new HJT log, to a new reply

 

[alexsomma]

I fixed the 23 lines with missing file in them, and then did the IE reset.
I then ran CC cleaner and restarted.

The 23 lines are still there when i run hijack this tho...

what next?

heres is the new hijack log:

 

[alexsomma]

Btw...Do you have any idea why all those files are missing? They seem like important files right?

 

[tw0rld]

To enable regedit do the following

1. Open the Start Menu.
2. In the white line (Start Search) area, type gpedit.msc and press Enter.
3. Click Continue for the UAC prompt.
4. In the left pane, click on User Configuration, Administrative Templates, and System.
5. In the right pane, right click on Prevent acces to registry editing tools and click on Properties.
6.Select Not configured or disabled(if Not configured is already selected then selecte disabled), then click apply, and ok to exit.
Now try to run regedit again. If that doesn't work let me know as there is another way of getting this done

 

[alexsomma]

I set it to disabled as you suggested. Still doesn't work.

Just to be clear, when I try starting regedit, I get the user account control prompt, and when i click continue, nothing happens. I think its strange that I get the user account prompt and then nothing. Wouldnt it be more logical if i got nothing at all?

what now?

 

[Tedster]

boot in safe mode then remove the infection. ensure you turn off system restore before removal as you can end up with a zombie virus.

 

[alexsomma]

boot in safe mode then remove the infection. ensure you turn off system restore before removal as you can end up with a zombie virus.

Can you explain a bit more. None of my programs find any viruses. Should I run them all in safe mode or are you thinking about one in particular.

Im running vista 64bit, is disabling system restore necessary on vista systems?

Whats a zombie virus?

 

[kimsland]

Well I had a look at your 2nd HJT log
And see that the "file missing" entries are still there (as you stated they came back)

But then I saw you have Spybot - Search & Destroy installed, and thought if that is stopping any change whatsoever to your system (Possibly I feel)



Can you please un-install Spybot - Search & Destroy and anyother live protection program (other than your Antivirus) This includes any personal firewall you may have as well.

Once fully uninstalled, you could either start at the top ^^ or possibly a better option, go here, and complete all steps:

Viruses/Spyware/Malware Preliminary Removal Instructions

 

[BlkHeartWolf]

I am confused since i see no spyware in the log's only possible bad install's or things installed without uninstalling previous versions. Much like Adobe Reader * willnot install untill user uninstalls version 7.
I would remove / uninstall the related programs, clean the REG and get a clean install of these and make sure you removed the related config files if asked, "you can always make a copy somewhere"

looks to me as if you only have bad reg keys vsserv.exe is missing from the system32 folder but loads from the install folder under Program files. They come back from system restore or because it is protected by another service.
my hunch anyways

 

[kimsland]

Well the thread is 2 and half months old
Any further issues, the original member would have to do a complete scan first, using the updated guide:
Have a look at:

UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions