Hacktool.rootkit - aftermath

[CooperS]

After successfully removing this virus, when I boot up my computer I get a message: Can't Load ADMDLL.DLL, Can't load library.

Is this related to the virus and how do I get rid off it?

[dlh6213]

Have the file scanned at http://virusscan.jotti.org/
(Upload the file and click Submit to have it scanned); let us know the results.

[CooperS]

upload what file?

[swatkat]

Hi,
Open NotePad and copy the contents of the below "Quote" box:-

regedit /e test1.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test2.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce"
regedit /e test3.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices"
regedit /e test4.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e test5.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce"
regedit /e test6.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices"
copy test1.txt + test2.txt + test3.txt + test4.txt + test5.txt + test6.txt = Info.txt
del test1.txt
del test2.txt
del test3.txt
del test4.txt
del test5.txt
del test6.txt

Then go to File Menu > Save As and type the filename as runlist.BAT and save it. Exit from NotePad.
Double-click on the runlist.bat file, a DOS type window should open and close immediately. After this, there would be a file called Info.txt in the same location where the batch file is present. Open this Info.txt file and post its contents here.

[dlh6213]

upload what file?

Sorry about that, I must have somehow got your thread mixed up with another one. :o

[CooperS]

Hi,
Open NotePad and copy the contents of the below "Quote" box:-

Then go to File Menu > Save As and type the filename as runlist.BAT and save it. Exit from NotePad.
Double-click on the runlist.bat file, a DOS type window should open and close immediately. After this, there would be a file called Info.txt in the same location where the batch file is present. Open this Info.txt file and post its contents here.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
"IntelWireless"="C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"MMTray"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mm_tray.exe"
"mmtask"="C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe"
"RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"vptray"="C:\\Program Files\\NavNT\\vptray.exe"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"GoToMyPC"="C:\\Program Files\\Citrix\\GoToMyPC\\g2svc.exe -logon"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]

[swatkat]

Hi,
Go to Start > Run and type regsvr32 /u ADMDLL.DLL and press ENTER. Reboot the Sytsem and check whether you recieve the error or not, and post back the results.
(Note that there is a SPACE after regsvr32 and /)

[CooperS]

Hi,
Go to Start > Run and type regsvr32 /u ADMDLL.DLL and press ENTER. Reboot the Sytsem and check whether you recieve the error or not, and post back the results.
(Note that there is a SPACE after regsvr32 and /)

After trying to run this, I get:
Loadlibrary ("ADMDLL.DLL") failed. The specific module could not be found

I rebooted and the same error came up again.

[swatkat]

Hi,
Download RegCleaner and install it. Run it, go to Tools Menu > Registry CleanUp > Do them all. This starts the Registry cleaning. When the scan is complete, select all the junk entry it may find and click "Remove Selected".