Computer Restrictions After Virus Infection

[Sucrose]

Recently I downloaded a trojan virus from ZimLabs.net (Note: If you decide to visit that website, do not download anything! All software offered on that website is infected and at the moment, undetected through scanners of all types.) The virus at first modified my clock settings to 24-Hour time and had about 8 ?'s after it. It looked like this: 21:34 ????????

After realizing I just downloaded something very unsafe, I did a full virus/spyware scan and noticed that the virus (W32/Generic!im) had attached itself to every executable file I ran after the virus was installed. The icons were changed to a black box and on the properties menu of every infected file said: Made by ZimLabs.net

Later on in the night, my brother notified me of very weird things happening such as the mouse buttons being reversed, passwords being changed, etc. I then decided I need to get this server off of my computer somehow. I started visiting search engines on how to remove it and all of a sudden he typed the following line in one of the search engines: Zim was here

After this I immediatly shut down the computer, only to find out that he blocked access to EVERYTHING possible after I started it back up with the modem turned off. The 'Run...', 'Search...', Control Panel options are hidden from the Start menu now. There are 0 icons on the desktop. Everytime I try to run a program or do anything, this error message is received: This operation has been canceled due to restrictions in effect on this computer. Please contact your system administrator.

I cannot run any scanners or anything GUI because of the limitations I have now. I know all of my files are still intact, I made sure within DOS. Are there any suggestions on how to fix this situation I'm in?

 

[Motoxrdude]

looks like you are going to have to reformat.

 

[Buzz1927]

Post a Hijackthis log.
http://www.computerforum.com/showthread.php?t=24672

 

[Sucrose]

Reformatting is definatly not an option for me, unless there is a way I can backup some data in some specific directories because I am a seller on eBay with all of my 250+ customers' e-mail addresses all on one file. If I lose that, I lose my job. Is there such software that allows backup through DOS without having an extra harddrive or network connection? I have a wireless network and I'm sure DOS wouldn't support that.

I got to thinking, and I don't know if this will work or not but maybe if I install another OS on the same partition, on a different drive letter, would I be able to access the files on my other OS that had the infection?

Post a Hijackthis log.
http://www.computerforum.com/showthread.php?t=24672

Um, how do you expect me to post a "Hijackthis log" when my computer will not execute anything? Please read before you give instructions.

 

[Buzz1927]

Is it the same in safemode?

 

[Sucrose]

Yes, it is the same.

 

[Buzz1927]

What exactly did you download from that site? I'll download it and see what I can do.

 

[Sucrose]

This is the file I downloaded: http://www.zimlabs.net/Zelda Online - Client 11456.zip

I just started the computer in Safe Mode, and surprisingly I am able to access programs and the Windows Explorer by opening the Recycle Bin first. Can Windows burn CD's while in safe mode? I need to back my stuff up.

 

[Buzz1927]

You might not need to back anything up. Boot to safemode with networking and download Hijackthis and post a log. I'll download that file and play around with it.

 

[Sucrose]

Logfile of HijackThis v1.99.1
Scan saved at 1:57:18 PM, on 3/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: (no name) - {9AFD91F9-6B03-4D22-A1E1-67D224CB7AB1} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /QS
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136960925389
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137092112125
O16 - DPF: {AE609930-A6EB-4A78-B7DA-B3200705FEBD} (Mophun Control) - http://www.mophun.com/codebase/mophun.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: HXD Service 100 (HackerDefender100) - Unknown owner - C:\DOCUME~1\JON&BR~1\LOCALS~1\Temp\Rar$EX00.313\hxdef100.exe (file missing)
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

 

[Buzz1927]

You're doing better with it than I am. My AV flagged it before I downloaded, hopefully it can clean it. Download Nod32 trial and run a full scan in safemode.
http://u4.eset.com/eval/win/v2/nentenst.exe

 

[Sucrose]

Here are my scan results from NOD32:

Scanning Log
NOD32 version 1.1361 (20060111) NT
Checking CRC of NOD32.EXE: Status OK
Error occurred while scanning operating memory. System memory cannot be scanned (the kernel service is not running or an error occurred while loading nod32m1.vxd).
Date: 11.3.2006 Time: 14:26:59
Scanned disks, folders and files: C:
C:\pagefile.sys - error opening (Access denied) [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterHomeHolder.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterHomeHelper.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterHomeOperations.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterPOAInvokeHandler.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterHomePOAInvokeHandler.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterOperations.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\EuroConverterBeanTestClient1.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\currencyconverter\_EuroConverterHome_Stub.class - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\dependency cache\currencyconverter.dependency - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHomePOA.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterPOATie.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterPOA.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHomePOATie.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterOperations.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHomeOperations.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHomeHelper.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHomeHolder.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterPOAInvokeHandler.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHomePOAInvokeHandler.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverter.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHelper.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHolder.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\EuroConverterHome.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\_EuroConverterHomeStub.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\_EuroConverterHome_Stub.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\_EuroConverterStub.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\classes\Generated Source\currencyconverter\_EuroConverter_Stub.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\Delphi 7\Delphi7.By.HeCTOr.FWBz\program files\Borland\Delphi7\Demos\Corba\Idl2Pas\EJB\euroconverter\Java\src\currencyconverter\EuroConverterBeanTestClient1.java - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\FruityLoops Studio 6.0.8 Producer XXL Edition\My Music\Sex 30 mins Debbie Does New Orleans movie with a plot harcore ****ing oral orgy group cheerleaders blond adult porn xxx.mpg - error opening [4]
invalid_name - error opening [4]
invalid_name - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Desktop\Jon's Documents\Downloads\Programs & Applications\FruityLoops Studio 6.0.8 Producer XXL Edition\My Music\wife butt****ing and drinking neighbors cum anal sex pussy blowjob **** blonde orgy cock **** slut whore mpg.MPG - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Local Settings\Temp\Temporary Internet Files\Content.IE5\7RIJEN8J\Type=click&FlightID=10778&AdID=22329&TargetID=393&Segments=4,7,11,23,26,41,43,64,70,85,86,111,133,145,154,278,337,465,594,600,626,686,717,759,821,870,885,894,1257,1279,1[1].htm - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Local Settings\Temp\Temporary Internet Files\Content.IE5\OTM34P2N\Type=click&FlightID=12014&AdID=21778&TargetID=2769&Segments=6,7,25,26,41,43,63,70,85,86,111,133,145,154,280,337,465,594,600,626,686,717,759,821,870,885,894,1257,1279,128[1].htm - error opening [4]
C:\Documents and Settings\Jon & Bryan Bales\Local Settings\Temp\Temporary Internet Files\Content.IE5\Y1QGJWPV\Type=click&FlightID=12011&AdID=21726&TargetID=2770&Segments=4,7,11,23,26,41,43,64,70,85,86,111,133,145,154,278,337,465,594,600,626,686,717,759,821,870,885,894,1257,1279,[1].htm - error opening [4]
C:\Documents and Settings\LocalService\ntuser.dat - error opening (File locked) [4]
C:\Documents and Settings\LocalService\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\NTUSER.DAT - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\Administrator\NTUSER.DAT - error opening (File locked) [4]
C:\Documents and Settings\Administrator\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Program Files\Cheat Engine\sbm32.sys - probably unknown NewHeur_PE virus [7] - quarantined - unable to clean - deleted
C:\Program Files\MSN Messenger\msnmsgr.exe - probably unknown NewHeur_PE virus [7] - quarantined - unable to clean - deleted
C:\System Volume Information\_restore{ACAD39C7-3A82-433E-BC65-A2A2D9055662}\RP1\A0003086.sys - probably unknown NewHeur_PE virus [7] - quarantined - unable to clean - deleted
C:\System Volume Information\_restore{ACAD39C7-3A82-433E-BC65-A2A2D9055662}\RP1\A0003087.exe - probably unknown NewHeur_PE virus [7] - quarantined - unable to clean - deleted
C:\WINDOWS\winp9.exe - Win32/PSW.Stealer.C trojan - quarantined - unable to clean - deleted
C:\WINDOWS\system32\1.exe - a variant of Win32/Bifrose trojan - quarantined - unable to clean - deleted
C:\WINDOWS\system32\holla.exe - Win32/Downloader.Cone.A application - quarantined - unable to clean - deleted
C:\WINDOWS\system32\source.exe - a variant of Win32/Bifrose trojan - quarantined - unable to clean - deleted
C:\WINDOWS\system32\SucroseAimbot.exe - a variant of Win32/KeyLogger.Ardamax application - quarantined - unable to clean - deleted
C:\WINDOWS\system32\config\default - error opening (File locked) [4]
C:\WINDOWS\system32\config\default.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\SAM - error opening (File locked) [4]
C:\WINDOWS\system32\config\SAM.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\SECURITY - error opening (File locked) [4]
C:\WINDOWS\system32\config\SECURITY.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\software - error opening (File locked) [4]
C:\WINDOWS\system32\config\software.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\system - error opening (File locked) [4]
C:\WINDOWS\system32\config\system.LOG - error opening (File locked) [4]
Number of scanned files: 62216
Number of threats found: 9
Number of files cleaned: 9
Time of completion: 14:37:35 Total scanning time: 636 sec (00:10:36)
Notes:
[4] File cannot be opened. It may be in use by another application or operating system.
[7] File is probably infected with an unknown virus.

As you can see, some of the system configuration files are locked. This looks like a hassle.

 

[cell4me]

Just wondering what antivirus you was using because mine caught it right away too. Try booting into safe mode with networking and run an online scan with panda.

 

[Buzz1927]

Debbie Does New Orleans

I've heard of this, but never come across it. I'm still playing with it, but I think it only effects exe. files, so you should be able to back up all other types of files. It'll probably take me a few more hours until I know if we can clean it up or not.

 

[cell4me]

Hey buzz I dont know if there is more than one virus attached to that file or not but norton flagged it as W32.DINOXI so it might be possible that he has more than one virus.

 

[mrbagrat]

My friend caught something like that. He had to reformat, but only because he was to lazy to try to fix it. Good luck!

 

[sidthereal]

This is an interesting case.....
Buzz....did you manage to do anything ??

 

[kof2000]

isn't debbie does dallas some porn movie?

 

[sidthereal]

isn't debbie does dallas some porn movie?

well im sure hes red faced about tht arent you mate?

 

[Cloudius]

(To origional message) HA ZIM POWNED JOO.

(now that thats done) I have downloaded every file on zimlabs, both the free and the stuff you have to pay for. I have never had any problems with them nor have I found any such viruses in them, also, if you have half a brain, you would have noticed the part where it says to download his fix if oyu have suffered any of his viruses. He has a file that will fix it no problem, but now that his site has gone down for the time, theres nothing you can do.