Terriers4ever

Ive done something really stupid.

I woke up to find i had a virus that tells me to download systemerrorfixer.com.
I ran AVG and it cured a virus so i thought that was that. However i went to google, did a search but kept getting redirected to a blank page. Another virus. So i typed the web address into google and found someone on a forum who had used combofix to solve the problem. I used it and it deleted about 5 files (which foolishly i did not record).

Now my internet isnt working i just get the usual internet error try refresh etc.
I seem to remember some of the files ending in .dll or .dsl?.
Any help is very very much appreciated, i'm really worried as i have university work due in.

Thank you for your time

Blink2k

try restoring your system to a previous date when it was fine?

Terriers4ever

How do i do that? I have no idea about computers.

Terriers4ever

Right hp is telling me i have no restore points so i dont think that wil work. I've managed to find the combofix log which says what has been deleted so here it is


ComboFix 07-12-02.6 - Administrator 2007-12-06 11:22:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.363 [GMT 0:00]
Running from: CDocuments and Settings\Administrator\My Documents\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

CWINDOWS\system32\{ABF9C770-AEC1-4100-9E64-039E5CC4CD97}.exe
CWINDOWS\system32\adsldps.dll
CWINDOWS\system32\kernel32.exe
CWINDOWS\system32\koos.exe
CWINDOWS\system32\kprof
CWINDOWS\system32\poof
CWINDOWS\Tasks.\At1.job
DAutorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_POOF
-------\xoaswgid


((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-06 09:32 . 2007-12-06 09:32116,480--a------CWINDOWS\system32\mdecjofl.dat
2007-12-06 09:27 . 2007-12-06 09:27<DIR>d--------CWINDOWS\system32\AppCert
2007-12-06 09:25 . 2004-08-04 08:0084,992--a------CWINDOWS\system32\adsldps.dll.bak
2007-12-06 09:24 . 2004-02-25 08:3484,992--a------CWINDOWS\system32\ASAPHooki.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2007-12-06 09:27359,808----a-wCWINDOWS\system32\drivers\tcpip.sys
2007-12-06 09:27---------d-----wCDocuments and Settings\Administrator\Application Data\AVG7
2007-12-05 22:42---------d-----wCProgram Files\Lx_cats
2007-12-03 17:20---------d-----wCProgram Files\Google
2007-11-30 20:55---------d--h--wCProgram Files\InstallShield Installation Information
2007-11-30 20:44---------d-----wCProgram Files\Java
2007-11-05 22:12---------d--h--rCDocuments and Settings\Administrator\Application Data\SecuROM
2007-11-05 22:05---------d-----wCProgram Files\Sports Interactive
2007-11-03 11:50---------d-----wCProgram Files\iTunes
2007-11-03 11:50---------d-----wCProgram Files\iPod
2007-11-02 23:33---------d-----wCProgram Files\Real
2007-11-02 23:33---------d-----wCProgram Files\Common Files\xing shared
2007-11-02 23:33---------d-----wCProgram Files\Common Files\Real
2007-11-02 22:37---------d-----wCProgram Files\Lexmark 1400 Series
2007-10-14 21:13---------d-----wCDocuments and Settings\Administrator\Application Data\Sports Interactive
2007-10-14 21:11---------d--h--wCProgram Files\Zero G Registry
2007-10-09 13:08---------d-----wCDocuments and Settings\Administrator\Application Data\AdobeUM
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D6827AA-D586-496D-98E5-3E55021898A2}]
2004-02-25 08:3484992--a------CWINDOWS\system32\ASAPHooki.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F4E0AE-83F7-4374-B79F-65BE25E7073C}]
2004-02-25 08:3484992--a------CWINDOWS\system32\ASAPHooki.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"SoundMAXPnP"="CProgram Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11]
"SoundMAX"="CProgram Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-06 22:06]
"SunJavaUpdateSched"="CProgram Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"ATICCC"="CProgram Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 18:12]
"PTHOSTTR"="CProgram Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.exe" [2006-02-14 18:56]
"HP Software Update"="cProgram Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 06:11]
"DLA"="CWINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-31 12:20]
"SynTPEnh"="CProgram Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 16:01]
"hpWirelessAssistant"="CProgram Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-03-28 21:13]
"CognizanceTS"="CPROGRA~1\HPQ\IAM\Bin\AsTsVcc.dl l" [2003-12-22 18:12]
"Cpqset"="CProgram Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-04-21 16:30]
"Recguard"="CWINDOWS\Sminst\Recguard.exe" [2005-12-20 23:51]
"Reminder"="CWINDOWS\Creator\Remind_XP.exe" [2006-03-10 00:38]
"Scheduler"="CWINDOWS\SMINST\Scheduler.exe" [2006-02-15 15:43]
"WatchDog"="CProgram Files\InterVideo\DVD Check\DVDCheck.exe" [2006-03-31 12:58]
"AVG7_CC"="CPROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-22 18:58]
"QuickTime Task"="CProgram Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"Sony Ericsson PC Suite"="CProgram Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 00:07]
"Adobe Photo Downloader"="CProgram Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46]
"lxdjmon.exe"="CProgram Files\Lexmark 1400 Series\lxdjmon.exe" []
"lxdjamon"="CProgram Files\Lexmark 1400 Series\lxdjamon.exe" [2007-03-06 02:40]
"LXDJCATS"="CWINDOWS\System32\spool\DRIVERS\W32X 86\3\LXDJtime.dll" [2007-02-09 23:21]
"TkBellExe"="CProgram Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-02 23:33]
"iTunesHelper"="CProgram Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="CWINDOWS\system32\CTFMON.EXE" [2004-08-04 08:00]
"AVG7_Run"="CPROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 18:59]

CDocuments and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - CProgram Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 05:05:26]
DVD Check.lnk - CProgram Files\InterVideo\DVD Check\DVDCheck.exe [2007-06-12 13:16:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
IfxWlxEN.dll 2006-03-03 15:08 434176 CWINDOWS\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
CProgram Files\HPQ\IAM\Bin\AsWlnPkg.dll 2005-07-25 18:41 40960 CProgram Files\HPQ\IAM\Bin\AsWlnPkg.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
CognizanceREG_MULTI_SZ ASChannel

.
Contents of the 'Scheduled Tasks' folder
"2007-11-03 11:47:03 CWINDOWS\Tasks\AppleSoftwareUpdate.job"
- CProgram Files\Apple Software Update\SoftwareUpdate.exe
.
************************************************** ************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 11:26:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = CProgram Files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????M??????R?@?????,?@

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2007-12-06 11:27:49 - machine was rebooted
.
--- E O F ---

Gregg Carter

Shut your machine down.

Unplug everything.

Put PC into box it came in.

Flabarama

lolz gregg.

The Rafalution

because clearly anyone who doesnt know exactly what to do in every situation shouldnt have a computer at all.

Gregg Carter

because clearly anyone who doesnt know exactly what to do in every situation shouldnt have a computer at all. </BLOCKQUOTE>

Of course not, that'd be ridiculous. However, anybody who willingly deletes files without knowing what they're deleting and without backing those files up, shouldn't be allowed to use them.

billy manutdfan

:thup:

Terriers4ever

I did not know combofix deleted files so did not do it wilingly.. However i have recognized in the op that i was foolish using a program that i was unsure of what it did.