Trojan and System 32

Question

Dell Dimension 4600 running WinXP was infected with Trojan Downloader 'Win32.ZLOB.cu. Cleared Virus (I thought) but it kept re-appearing until I disabled System Restore. PC now OK and Restore re-enabled except that each bootup brings "System 32". I do not have a Audigy Sound Card or an /L:ENG entry in MSCONFIG Start up. Any suggestions for a novice?

Message Edited by BARMAC on 04-24-200608:54 AM

Message Edited by BARMAC on 04-24-200608:55 AM

bamajim · Answer

BARMAC

I'm not sure I understand your question?

You wrote " except that each bootup brings "System 32".

Then "I do not have a Audigy Sound Card or an /L:ENG entry in MSCONFIG Start up"

Is the error message related to this device, or does the error just say "System32"?

bamajim

Training at Malware Removal University

Bugbatter · Answer

This can be caused by a blank registry entry, such as can be left behind by
an incomplete program removal. If you are using Windows XP, give this a try from Kelly's web site:
Line 260 - right hand side > "System32 Folder Opens Upon Boot"
http://www.kellys-korner-xp.com/xp_tweaks.htm
The registry fix should correct this problem without your having to manually edit the registry. Save the .vbs file to your desktop and then double click it to run. Because it will be changing a registry setting, you may wish to create a System Restore point first.

BARMAC · Answer

Bamajim,   To clarify - The problem is the System32 folder appearing each time the PC is booted. The reference to the Audigy sound card is because I have read that this problem and that sound card can be related and also because a fix involving deleting  /L:ENG (which I do not have) can provide an answer.

BARMAC · Answer

Bugbatter,   Thanks for that but the result was a message saying 'This script cannot repair your issue. The expected Registry value was not found.'  Any other ideas?   BARMAC Message Edited by BARMAC on 04-24-200601:20 PM

BARMAC · Answer

Bamajim,

Apart from the System32 folder appearing each time the PC boots, everything else seems to be normal. It's not fatal - just annoying. I'm assuming the Trojan virus changed some setting but I cannot pinpoint what it is.

bamajim · Answer

Barmac Thanks for your reply What problems are you  having with your pc, other than the 'system32' error, if any? I'm trying to narrow this down bamajim Training at Malware Removal University

BARMAC · Answer

Despite Norton Antivirus, AOL Spyware Protection and Ad-aware all assuring me that I had a clean PC, I updated my copy of Spybot and did a sweep. Surprise, surprise! - Smitfraud-C, Tibs.vq and Spysheriff all crawled out of the woodwork and were duly zapped. Full of optimism, I rebooted and the System 32 file came up again. Back to the drawing board...

bamajim · Answer

BARMAC

We are seeing a lot of different system 32 errors lately. Heres a link fo a fix for 2 other ones, I would like to see if resolves your issue as well, here is your link

http://forum.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=34432

If it resolves your issue please reply.

If not

Go here and download Hijackthis

http://dsvs.org/5/HijackThis.exe

Save it in a convenient permanent folder such as C:\\HJT\\, double click HijackThis.exe, and hit "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, save the log, Ctrl-A to Select All, and copy its contents AT THE LINK BELOW

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

and include a description of the problem along with your log

Please do not be tempted to "fix" on your own. Hijackthis is a very powerful tool, if used incorrectly can cause system problems

bamajim

Training at Malware Removal University

BARMAC · Answer

Bamajim,

A eureka moment! No need to download a hammer from the toolrack and apply it to the PC!

I tried the SmitFraudFix and it worked. No more irritating System 32 at boot and fingers crossed that it stays that way. Thank you very much for your help; I was about to try the Microsoft route which has enough caveats to scare a lawyer.

If it helps, the before and after rapport logs were:-

SmitFraudFix v2.37

Scan done at 20:09:17.42, 01/05/2006
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ld????.tmp FOUND !
C:\WINDOWS\system32\taskdir.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Barry\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Barry\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!! Attention, follow keys are not inevitably infected !!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

and

SmitFraudFix v2.37

Scan done at 20:14:51.25, Mon 05/01/2006
Run from C:\unzipped\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ld????.tmp Deleted
C:\WINDOWS\system32\taskdir.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» End

Thanks again for your help,

BarMac

bamajim · Answer

BARMAC Glad to here it resolved your issue. Thanks for the reply :smileyhappy: bamajim Training at Malware Removal University

Virus & Spyware

Trojan and System 32

Was this post helpful?