Computer help!

[twoqu]

Hi!
My brother has bought his computer to me in the vain hope that I can sort out it's issues! Basically his kids have obviously downloaded something that has caused a repetative pop up to occur which then freezes the computer so that you have to power off the computer.
I started it in Safe mode and didn't get any pop ups. I then sort of followed Evilgoats advice in this thread http://www.s2forum.com/forum/showthread.php?t=44629.
As his wireless has died, this was pre pop up problem, I did not load Combifix but downloaded both Avast! and Malwarebytes from another computer on to it.
After using both I noticed a file called asam.exe. Googling that seems to indicate it was responsible. I followed some additional advice with reguard to IE temp files and proxy server stuff and the computer seems to function correctly now other than one thing.
When starting the computer a dialog box comes up RUNDLLL Error loading C:\WINDOWS\hcden1.dll
This files is in the Avast! Treasure chest still and is flagged up as Malware. Can't really find anything definitive so I thought I would ask here!
Should I reinstate this file from the Avast Chest or should I follow the Combifix/Avast/Malwarebyte procedure. I can now get the computer on line.
Any help much appreciated in laymans terms!

[Nuvo]

Click on Start->Run and then type 'regedit' followed by return to launch the windows registry editor.

Now navigate to the following lengthy path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

Highlight the Run folder and then click the right mouse button and select Export from the context menu.

Choose a suitable name and location for this exported file. Open up a copy of Notepad the drag and drop this file onto Notepad. This will give you an ASCII representation of this particular folder.

You then need to copy and paste this text into your reply.

You can try deleting the key which is responsible for lauching the suspicious hcden1.dll by hightlighting it and selecting Delete from the context menu.

Reboot the machine and you should no longer see this error message.

Launch all the installed programs and have a play with them to see if they run without error.

If you find that this is not the problem you can always export the .reg file back into the registry to restore the deleted key.

Perhaps you could upload the hcden1.dll file (zipped and password protectd of course) and I'll download it and have a quick poke around to see if it is malicious or harmless.

[twoqu]

Thanks for the reply.Think this is what you were after. Think I might need some more step by step instructions for the next steps! Oh, perhaps I should have mentioned its XP SP3 I think, on a Toshiba hence all the Toshiba stuff.
Anyway, be grateful for your opinion nd any further assistance.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"AGRSMMSG"="AGRSMMSG.exe"
"Apoint"="C:\\Program Files\\Apoint2K\\Apoint.exe"
"CeEKEY"="C:\\Program Files\\TOSHIBA\\E-KEY\\CeEKey.exe"
@=""
"TPNF"="C:\\Program Files\\TOSHIBA\\TouchPad\\TPTray.exe"
"HWSetup"="C:\\Program Files\\TOSHIBA\\TOSHIBA Applet\\HWSetup.exe hwSetUP"
"SVPWUTIL"="C:\\Program Files\\Toshiba\\Windows Utilities\\SVPWUTIL.exe SVPwUTIL"
"Zooming"="ZoomingHook.exe"
"TCtryIOHook"="TCtrlIOHook.exe"
"TPSMain"="TPSMain.exe"
"SmoothView"="C:\\Program Files\\TOSHIBA\\TOSHIBA Zooming Utility\\SmoothView.exe"
"TFncKy"="TFncKy.exe"
"NDSTray.exe"="NDSTray.exe"
"PadTouch"="C:\\Program Files\\TOSHIBA\\Touch and Launch\\PadExe.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.ex e"
"Tvs"="C:\\Program Files\\TOSHIBA\\Tvs\\TvsTray.exe"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"CFSServ.exe"="CFSServ.exe -NoClient"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"Anunu"="rundll32.exe \"C:\\WINDOWS\\efaqazefij.dll\",Startup"
"avast5"="C:\\PROGRA~1\\ALWILS~1\\Avast5\\avastUI. exe /nogui"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[Nuvo]

Yes, I see it is a Toshiba you have there. You have posted enough info for now to get an idea of the problem. The other stuff is less relevant for the moment.

Looking at the this, the only thing that looks highly suspect is the following entry:
"Anunu"="rundll32.exe \"C:\\WINDOWS\\efaqazefij.dll\",Startup"

I would suggest that you still have a rootkit running some and its dropping a randomly named .dll in the C:\WINDOWs folder and lauching it via startup at boot time.

I would delete the file: C:\WINDOWS\efaqazefij.dll and I would also delete the registry key shown at the top of this reply. I would then reboot the sytem and follow the steps described by Evilgoat76 again and hopefully you will be able to remove the rootkit once and for all.

[twoqu]

Thanks for that. Must say I didn't like the sound of that Anunu file!
So delete that from the registry and find and destroy the other.
One thing that troubled me was Evilgoats comment on downloading a known good copy of Combifix. Not having the n to know what the diference would be I am very reluctant to download anything as a rule. Seems the net is populated with offers to download fixes for problems!
I'll report back.
Cheers!

[twoqu]

Hmm....
C:\WINDOWS\efaqazefij.dll
This file has access denied so am unable to delete it. Avast! scan of that file only says it is malware. Malwarebyte scan says it isn't! Upon runing the cursor over that file it say it was created 25/08/2005 which seems consistant with most of the original software. The Avast! log shows it was last modified 14/04/2008.
Will try and fid a Combifix download I like the look of methinks!
The registry entry has also reappeared after deletion and restart!

[Nuvo]

One thing that troubled me was Evilgoats comment on downloading a known good copy of Combifix. Not having the n to know what the diference would be I am very reluctant to download anything as a rule. Seems the net is populated with offers to download fixes for problems!

You are very wise to be wary about downloading tools offering to rid your PC of all its nasties. Some of these tools are not what they purport to be.

Downloading Combifix from here as that is a trusted source.

Hmm....
C:\WINDOWS\efaqazefij.dll
This file has access denied so am unable to delete it. Avast! scan of that file only says it is malware. Malwarebyte scan says it isn't! Upon runing the cursor over that file it say it was created 25/08/2005 which seems consistant with most of the original software. The Avast! log shows it was last modified 14/04/2008.
Will try and fid a Combifix download I like the look of methinks!

You are probably unable to delete it as the file has been locked to protect it. You can override this lock by unloading it and deleting it using a utility such as Unlocker


That's the trouble with all heuristic scanning tools, you can't rely on them completely to identify a rogue file. You also have the added complication of false positive to contend with. Sometimes you need to play detective and make an informed decison on the validity of the results.

I would agree with your observation about the date stamps on this file. Having said that malware authors are slimy toads so they may have adjusted the date stamps so as to fool the casual malware sleuth!

[twoqu]

I nearly abandoned the whole thing. I typed Combifix into Google and all I got was a load of plumbers and central heating engineers! I then realised that i is next to o on the keyboard. So Combofix it is!
Bit fraught as you don't know what to expect. The log file was quite long but I say that dodgy file listed on it so kept my fingers crossed. Loaded the Malwarebytes and that showed no infected files. Re booted normally and the dialog box did not appear. Just leting Avast run now. Guess it would be policy to look for those files again just in case.
Hopefuly that has done the trick.
Nearly as much fun as working on your car plus you don't get dirty hands. Assuming it works that is. If not, then its just as frustrating as working on your car!
Thanks once again for all your help.

[twoqu]

Here is the latest Current version:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"AGRSMMSG"="AGRSMMSG.exe"
"Apoint"="C:\\Program Files\\Apoint2K\\Apoint.exe"
"CeEKEY"="C:\\Program Files\\TOSHIBA\\E-KEY\\CeEKey.exe"
"TPNF"="C:\\Program Files\\TOSHIBA\\TouchPad\\TPTray.exe"
"HWSetup"="C:\\Program Files\\TOSHIBA\\TOSHIBA Applet\\HWSetup.exe hwSetUP"
"SVPWUTIL"="C:\\Program Files\\Toshiba\\Windows Utilities\\SVPWUTIL.exe SVPwUTIL"
"Zooming"="ZoomingHook.exe"
"TCtryIOHook"="TCtrlIOHook.exe"
"TPSMain"="TPSMain.exe"
"SmoothView"="C:\\Program Files\\TOSHIBA\\TOSHIBA Zooming Utility\\SmoothView.exe"
"TFncKy"="TFncKy.exe"
"NDSTray.exe"="NDSTray.exe"
"PadTouch"="C:\\Program Files\\TOSHIBA\\Touch and Launch\\PadExe.exe"
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.ex e"
"Tvs"="C:\\Program Files\\TOSHIBA\\Tvs\\TvsTray.exe"
"RTHDCPL"="RTHDCPL.EXE"
"CFSServ.exe"="CFSServ.exe -NoClient"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"avast5"="C:\\PROGRA~1\\ALWILS~1\\Avast5\\avastUI. exe /nogui"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

The file from the C:\Windows has also gone!
Guess I will keep scanning it until the weekend to see what if anything happens.
Cheers!

[Nuvo]

You're very welcome.

Oops , I mistyped "Combofix" just to confuse matters a little. All looks to be well as far as I can tell, just keep an eye on it and be sure to update the definition files for Combofix/Malwarebytes/Avast before scanning the drive again.

Here's hoping you are free from this annoyance once and for all.

[newsh]

Has Combofix gone? I can't find it, Bleeping Computer wants me to download StopZilla..

[Nuvo]

You can still grab it from here or here.