retired_meggan14

Ive done something really stupid.

I woke up to find i had a virus that tells me to download systemerrorfixer.com.
I ran AVG and it cured a virus so i thought that was that. However i went to google, did a search but kept getting redirected to a blank page. Another virus. So i typed the web address into google and found someone on a forum who had used combofix to solve the problem. I used it and it deleted about 5 files (which foolishly i did not record).

Now my internet isnt working i just get the usual internet error try refresh etc.
I seem to remember some of the files ending in .dll or .dsl?.
Any help is very very much appreciated, i'm really worried as i have university work due in.

Thank you for your time

retired_newlicore

try restoring your system to a previous date when it was fine?

retired_meggan14

How do i do that? I have no idea about computers.

retired_meggan14

Right hp is telling me i have no restore points so i dont think that wil work. I've managed to find the combofix log which says what has been deleted so here it is


ComboFix 07-12-02.6 - Administrator 2007-12-06 11:22:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.363 [GMT 0:00]
Running from: CDocuments and Settings\Administrator\My Documents\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

CWINDOWS\system32\{ABF9C770-AEC1-4100-9E64-039E5CC4CD97}.exe
CWINDOWS\system32\adsldps.dll
CWINDOWS\system32\kernel32.exe
CWINDOWS\system32\koos.exe
CWINDOWS\system32\kprof
CWINDOWS\system32\poof
CWINDOWS\Tasks.\At1.job
DAutorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_POOF
-------\xoaswgid


((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-06 09:32 . 2007-12-06 09:32116,480--a------CWINDOWS\system32\mdecjofl.dat
2007-12-06 09:27 . 2007-12-06 09:27<DIR>d--------CWINDOWS\system32\AppCert
2007-12-06 09:25 . 2004-08-04 08:0084,992--a------CWINDOWS\system32\adsldps.dll.bak
2007-12-06 09:24 . 2004-02-25 08:3484,992--a------CWINDOWS\system32\ASAPHooki.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2007-12-06 09:27359,808----a-wCWINDOWS\system32\drivers\tcpip.sys
2007-12-06 09:27---------d-----wCDocuments and Settings\Administrator\Application Data\AVG7
2007-12-05 22:42---------d-----wCProgram Files\Lx_cats
2007-12-03 17:20---------d-----wCProgram Files\Google
2007-11-30 20:55---------d--h--wCProgram Files\InstallShield Installation Information
2007-11-30 20:44---------d-----wCProgram Files\Java
2007-11-05 22:12---------d--h--rCDocuments and Settings\Administrator\Application Data\SecuROM
2007-11-05 22:05---------d-----wCProgram Files\Sports Interactive
2007-11-03 11:50---------d-----wCProgram Files\iTunes
2007-11-03 11:50---------d-----wCProgram Files\iPod
2007-11-02 23:33---------d-----wCProgram Files\Real
2007-11-02 23:33---------d-----wCProgram Files\Common Files\xing shared
2007-11-02 23:33---------d-----wCProgram Files\Common Files\Real
2007-11-02 22:37---------d-----wCProgram Files\Lexmark 1400 Series
2007-10-14 21:13---------d-----wCDocuments and Settings\Administrator\Application Data\Sports Interactive
2007-10-14 21:11---------d--h--wCProgram Files\Zero G Registry
2007-10-09 13:08---------d-----wCDocuments and Settings\Administrator\Application Data\AdobeUM
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D6827AA-D586-496D-98E5-3E55021898A2}]
2004-02-25 08:3484992--a------CWINDOWS\system32\ASAPHooki.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F4E0AE-83F7-4374-B79F-65BE25E7073C}]
2004-02-25 08:3484992--a------CWINDOWS\system32\ASAPHooki.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"SoundMAXPnP"="CProgram Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11]
"SoundMAX"="CProgram Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-06 22:06]
"SunJavaUpdateSched"="CProgram Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"ATICCC"="CProgram Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 18:12]
"PTHOSTTR"="CProgram Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.exe" [2006-02-14 18:56]
"HP Software Update"="cProgram Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 06:11]
"DLA"="CWINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-31 12:20]
"SynTPEnh"="CProgram Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 16:01]
"hpWirelessAssistant"="CProgram Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-03-28 21:13]
"CognizanceTS"="CPROGRA~1\HPQ\IAM\Bin\AsTsVcc.dl l" [2003-12-22 18:12]
"Cpqset"="CProgram Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-04-21 16:30]
"Recguard"="CWINDOWS\Sminst\Recguard.exe" [2005-12-20 23:51]
"Reminder"="CWINDOWS\Creator\Remind_XP.exe" [2006-03-10 00:38]
"Scheduler"="CWINDOWS\SMINST\Scheduler.exe" [2006-02-15 15:43]
"WatchDog"="CProgram Files\InterVideo\DVD Check\DVDCheck.exe" [2006-03-31 12:58]
"AVG7_CC"="CPROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-22 18:58]
"QuickTime Task"="CProgram Files\QuickTime\qttask.exe" [2007-06-29 05:24]
"Sony Ericsson PC Suite"="CProgram Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 00:07]
"Adobe Photo Downloader"="CProgram Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46]
"lxdjmon.exe"="CProgram Files\Lexmark 1400 Series\lxdjmon.exe" []
"lxdjamon"="CProgram Files\Lexmark 1400 Series\lxdjamon.exe" [2007-03-06 02:40]
"LXDJCATS"="CWINDOWS\System32\spool\DRIVERS\W32X 86\3\LXDJtime.dll" [2007-02-09 23:21]
"TkBellExe"="CProgram Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-02 23:33]
"iTunesHelper"="CProgram Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="CWINDOWS\system32\CTFMON.EXE" [2004-08-04 08:00]
"AVG7_Run"="CPROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-22 18:59]

CDocuments and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - CProgram Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 05:05:26]
DVD Check.lnk - CProgram Files\InterVideo\DVD Check\DVDCheck.exe [2007-06-12 13:16:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
IfxWlxEN.dll 2006-03-03 15:08 434176 CWINDOWS\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
CProgram Files\HPQ\IAM\Bin\AsWlnPkg.dll 2005-07-25 18:41 40960 CProgram Files\HPQ\IAM\Bin\AsWlnPkg.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
CognizanceREG_MULTI_SZ ASChannel

.
Contents of the 'Scheduled Tasks' folder
"2007-11-03 11:47:03 CWINDOWS\Tasks\AppleSoftwareUpdate.job"
- CProgram Files\Apple Software Update\SoftwareUpdate.exe
.
************************************************** ************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 11:26:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = CProgram Files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????M??????R?@?????,?@

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2007-12-06 11:27:49 - machine was rebooted
.
--- E O F ---

retired_derek

Shut your machine down.

Unplug everything.

Put PC into box it came in.

retired_jean2

lolz gregg.

retired_heidus17

because clearly anyone who doesnt know exactly what to do in every situation shouldnt have a computer at all.

retired_derek

because clearly anyone who doesnt know exactly what to do in every situation shouldnt have a computer at all. </BLOCKQUOTE>

Of course not, that'd be ridiculous. However, anybody who willingly deletes files without knowing what they're deleting and without backing those files up, shouldn't be allowed to use them.

retired_betsyt

:thup:

retired_meggan14

I did not know combofix deleted files so did not do it wilingly.. However i have recognized in the op that i was foolish using a program that i was unsure of what it did.