UNSOLVED
Trojan and System 32
Dell Dimension 4600 running WinXP was infected with Trojan Downloader 'Win32.ZLOB.cu. Cleared Virus (I thought) but it kept re-appearing until I disabled System Restore. PC now OK and Restore re-enabled except that each bootup brings "System 32". I do not have a Audigy Sound Card or an /L:ENG entry in MSCONFIG Start up. Any suggestions for a novice?
Message Edited by BARMAC on 04-24-200608:54 AM
Message Edited by BARMAC on 04-24-200608:55 AM
- This can be caused by a blank registry entry, such as can be left behind by
an incomplete program removal. If you are using Windows XP, give this a try from Kelly's web site:
Line 260 - right hand side > "System32 Folder Opens Upon Boot"
http://www.kellys-korner-xp.com/xp_tweaks.htm
The registry fix should correct this problem without your having to manually edit the registry. Save the .vbs file to your desktop and then double click it to run. Because it will be changing a registry setting, you may wish to create a System Restore point first. - Bamajim,To clarify - The problem is the System32 folder appearing each time the PC is booted. The reference to the Audigy sound card is because I have read that this problem and that sound card can be related and also because a fix involving deleting /L:ENG (which I do not have) can provide an answer.
Barmac
Thanks for your reply
What problems are you having with your pc, other than the "system32" error, if any?
I'm trying to narrow this down
bamajim
Training at Malware Removal University
- Despite Norton Antivirus, AOL Spyware Protection and Ad-aware all assuring me that I had a clean PC, I updated my copy of Spybot and did a sweep. Surprise, surprise! - Smitfraud-C, Tibs.vq and Spysheriff all crawled out of the woodwork and were duly zapped. Full of optimism, I rebooted and the System 32 file came up again. Back to the drawing board...
BARMAC
We are seeing a lot of different system 32 errors lately. Heres a link fo a fix for 2 other ones, I would like to see if resolves your issue as well, here is your link
http://forum.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=34432
If it resolves your issue please reply.
If not
Go here and download Hijackthis
http://dsvs.org/5/HijackThis.exe
Save it in a convenient permanent folder such as C:\\HJT\\, double click HijackThis.exe, and hit "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, save the log, Ctrl-A to Select All, and copy its contents AT THE LINK BELOW
http://forums.us.dell.com/supportforums/board?board.id=si_hijack
and include a description of the problem along with your log
Please do not be tempted to "fix" on your own. Hijackthis is a very powerful tool, if used incorrectly can cause system problems
bamajim
Training at Malware Removal University- Bamajim,A eureka moment! No need to download a hammer from the toolrack and apply it to the PC!I tried the SmitFraudFix and it worked. No more irritating System 32 at boot and fingers crossed that it stays that way. Thank you very much for your help; I was about to try the Microsoft route which has enough caveats to scare a lawyer.If it helps, the before and after rapport logs were:-SmitFraudFix v2.37Scan done at 20:09:17.42, 01/05/2006
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\taskdir.exe FOUND !»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Barry\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Barry\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!! Attention, follow keys are not inevitably infected !!!SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» EndandSmitFraudFix v2.37Scan done at 20:14:51.25, Mon 05/01/2006
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected filesC:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\taskdir.exe Deleted»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.»»»»»»»»»»»»»»»»»»»»»»»» EndThanks again for your help,BarMac BARMAC
Glad to here it resolved your issue.
Thanks for the reply :smileyhappy:
bamajim
Training at Malware Removal University
bamajim
10376 Posts
161
0
Posted April 24th, 2006 13:00
BARMAC
I'm not sure I understand your question?
You wrote " except that each bootup brings "System 32".
Then "I do not have a Audigy Sound Card or an /L:ENG entry in MSCONFIG Start up"
Is the error message related to this device, or does the error just say "System32"?
bamajim
Training at Malware Removal University