This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] VIMAX MALWARE/VIRUS - CAN'T OPEN AV SOFTWARE, PLEASE

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Contracted this VIMAX problem a couple of days ago, possibly after downloading what I thought was a Java update. Won't allow me to open/download ANY AV software and McAfee is useless. Keep getting redirects from google searches and VIMAx ads everywhere. Also, when I startup I get a bluescreen message until the 4/5th reboot. This also happens when I try to download AV programs or run them. Occasionally happens randomly too. I don't know what to do, don't want to run ComboFix without guidance, worried it'll make everything worse. ANY help would be very much appreciated!! DDS log: If you require any more logs, please let me know. DDS (Ver_09-03-16.01) - NTFSx86 Run by [removed] at 2:14:45.59 on 03/28/2009 Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_07 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1789.963 [GMT 0:00] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\SYSTEM32\WISPTIS.EXE C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\agrsmsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\ProgramData\Epac\EpacDownloadManagerService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\Program Files\McAfee\VirusScan\McShield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\PSIService.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\Wacom_Tablet.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\SYSTEM32\WISPTIS.EXE C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\Explorer.EXE C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Windows\system32\WTablet\Wacom_TabletUser.exe C:\Windows\system32\Wacom_Tablet.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Windows\System32\spool\drivers\w32x86\3\E_FATIADE.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe C:\Users\Captain Handicrafts\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.myspace.com/fanfic_geek mDefault_Page_URL = hxxp:\\www.samsungcomputer.com uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [Aim6] uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe" mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [NSLauncher] c:\program files\nokia\nokia software launcher\NSLauncher.exe /startup mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [EPSON Stylus DX4800 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatiade.exe /f "c:\windows\temp\E_S9DAA.tmp" /EF "HKLM" mRun: [c:\program files\free video zilla\FVZilla.exe] mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\tabuse~1.lnk - c:\windows\system32\wtablet\TabUserW.exe mPolicies-system: NoHotStart = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~1.0_0\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab TCP: NameServer = 85.255.112.77,85.255.112.206 TCP: {03A802CD-C56B-4B66-BD3D-D28A2C928B41} = 85.255.112.77,85.255.112.206 TCP: {B01D4519-116D-460B-B373-DE8EBF7729D3} = 85.255.112.77,85.255.112.206 ================= FIREFOX =================== FF - ProfilePath - ============= SERVICES / DRIVERS =============== R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312] R2 Epac Center;Epac Center;c:\programdata\epac\Epacdownloadmanagerservice.exe [2008-11-30 442368] R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\drivers\KMDFMEMIO.sys [2008-2-19 13312] R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-9-20 3406120] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-9-17 24652] S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712] S3 NETw2v32;Intel® PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184] S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-9-22 15656] =============== Created Last 30 ================ 2009-03-28 01:23 –d—– c:\program files\SUPERAntiSpyware 2009-03-25 00:47 –d—– c:\program files\common files\Wise Installation Wizard 2009-03-22 23:49 –d—– c:\program files\common files\Corel 2009-03-22 23:39 –d—– c:\programdata\Corel 2009-03-22 23:39 –d—– c:\progra~2\Corel 2009-03-22 23:39 –d—– c:\program files\Corel 2009-03-19 17:12 7,680 a——- c:\windows\system32\spwmp.dll 2009-03-19 17:12 8,147,456 a——- c:\windows\system32\wmploc.DLL 2009-03-19 17:12 4,096 a——- c:\windows\system32\msdxm.ocx 2009-03-19 17:12 4,096 a——- c:\windows\system32\dxmasf.dll 2009-03-19 17:12 268,288 a——- c:\windows\system32\schannel.dll 2009-03-19 17:12 2,033,152 a——- c:\windows\system32\win32k.sys 2009-03-18 21:26 107,368 a——- c:\windows\system32\GEARAspi.dll 2009-03-18 21:26 23,848 a——- c:\windows\system32\drivers\GEARAspiWDM.sys 2009-03-18 21:25 –d—– c:\program files\iPod 2009-03-18 21:25 –d—– c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} 2009-03-18 21:25 –d—– c:\program files\iTunes 2009-03-18 21:25 –d—– c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} 2009-03-16 22:41 –d—– c:\program files\Windows Live SkyDrive 2009-03-03 02:08 –d—– C:\downloads 2009-03-03 02:08 –d—– c:\users\captai~1\appdata\roaming\FVZilla 2009-03-03 02:08 –d—– c:\program files\Free Video Zilla 2009-02-27 09:09 97,800 a——- c:\windows\system32\infocardapi.dll 2009-02-27 09:09 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-02-27 09:09 622,080 a——- c:\windows\system32\icardagt.exe 2009-02-27 09:09 43,544 a——- c:\windows\system32\PresentationHostProxy.dll 2009-02-27 09:09 37,384 a——- c:\windows\system32\infocardcpl.cpl 2009-02-27 09:09 11,264 a——- c:\windows\system32\icardres.dll 2009-02-27 09:09 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll 2009-02-27 09:09 326,160 a——- c:\windows\system32\PresentationHost.exe 2009-02-26 19:34 96,760 a——- c:\windows\system32\dfshim.dll 2009-02-26 19:34 282,112 a——- c:\windows\system32\mscoree.dll 2009-02-26 19:34 41,984 a——- c:\windows\system32\netfxperf.dll 2009-02-26 19:34 158,720 a——- c:\windows\system32\mscorier.dll 2009-02-26 19:34 83,968 a——- c:\windows\system32\mscories.dll 2009-02-26 19:09 827,392 a——- c:\windows\system32\wininet.dll 2009-02-26 19:09 1,383,424 a——- c:\windows\system32\mshtml.tlb 2009-02-26 19:08 428,544 a——- c:\windows\system32\EncDec.dll 2009-02-26 19:08 217,088 a——- c:\windows\system32\psisrndr.ax 2009-02-26 19:08 293,376 a——- c:\windows\system32\psisdecd.dll 2009-02-26 19:08 177,664 a——- c:\windows\system32\mpg2splt.ax 2009-02-26 19:08 80,896 a——- c:\windows\system32\MSNP.ax ==================== Find3M ==================== 2009-03-24 21:34 3,922 a–sh— c:\windows\system32\KGyGaAvL.sys 2009-03-21 19:50 143,360 a——- c:\windows\inf\infstrng.dat 2009-03-21 19:50 86,016 a——- c:\windows\inf\infstor.dat 2009-03-21 19:50 51,200 a——- c:\windows\inf\infpub.dat 2009-01-03 18:41 202,240 a——- c:\windows\system32\UNIQLOCK COLOR_v2.scr 2008-09-20 14:20 174 a–sh— c:\program files\desktop.ini 2008-09-20 14:03 665,600 a——- c:\windows\inf\drvindex.dat 2006-11-02 12:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 12:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 09:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 1999-07-07 00:00 6 —shr– c:\windows\@@desktop.dat 2008-09-16 23:43 16,384 a–sh— c:\windows\temp\cookies\index.dat 2008-09-16 23:58 32,768 a–sh— c:\windows\temp\history\history.ie5\index.dat 2008-09-16 23:43 32,768 a–sh— c:\windows\temp\temporary internet files\content.ie5\index.dat ============= FINISH: 2:16:25.23 ===============
[external image: Posted Image]

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

1. These tools MUST be run from the executable. (.exe)
2. With Admin Rights (Right click, choose "Run as Administrator")


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Right-click ATF-Cleaner.exe and select "Run as administrator" to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Then:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Right-click mbam-setup.exe, select "Run as administrator" and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Also "copy/paste" a new HijackThis log file into this thread.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI