What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Locked out from all programs-Windows AntiVirus Pro

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm on my second computer due to the fast that my other one is totally useless now that a program called Windows AntiVirus Pro is on it. It show a little shield on the bottom right of the task bar and every time I try to run anything it won't let me. Any advice on how to at least get on to Firefox so I can do a scan and send you logs??
Post #2
What operating system do you have Are you able to log into safe mode at all? does your computer still recognize your USB? Will any program run or is everything shut down? are you able to show hidden files and folders?
Post #3 last edited
My operating system is Window XP. It didn't allow me to really run any programs…somehow i was able to get firefox working again and i am now on the infected computer. not sure about the usb or hidden files and folders….. now when i try to run an .exe file it opens a window and asks what I want to use to open it??? i tried to run hijack this and that's what happened too…. i went to www.wiki-security.com/wiki/ov_Parasite/WindowsAntivirusPro and started to manually remove all the files listed. When I went to use regedit, the computer asked me what I wanted to use to open regedit with??? So as of right now the only thing i did is delete the files listed….
Post #4 last edited
OK, It's messed with your registry keys for file associations.

see if you can unhide files and folders.

  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Clear "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Show hidden files and folders."
  • Clear "Hide protected operating system files."
  • Click Apply, and then click OK.


Then do this:


Navigate to your c:\documents and settings\all users\application data folder

Look for a file/folder with a random 8 digit number ie 19285624\19285624.exe (your number will be different)

Drag this file/folder c:\documents and settings\all users\application data\19285624\19285624.exe to the desktop (drag - not delete)

Reboot.

Then run this reg fix to fix your default file association for exe files:

http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip



then try and run these programs


run them in safe mode if you need to - rename them to a .com extension if you need to.

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


NEXT

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive.
  • Open [external image: Posted Image] on your desktop.
  • Click the [external image: Posted Image] tab.
  • Click the [external image: Posted Image] button.
  • Check all seven boxes: [external image: Posted Image]
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.


NEXT

Please run this batch file:

  • Go to Start->Run and type in notepad and hit OK.
  • Then copy and paste the content of the following codebox into Notepad:

    @ECHO OFF
DIR /a/s C:\WINDOWS\scecli.dll C:\WINDOWS\netlogon.dll C:\WINDOWS\ntelogon.dll C:\Windows\eventlog.dll>Log.txt
START Log.txt
DEL %0
  • Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes.
  • Once saved, the icon to click should look like this on your desktop:

    [external image: Posted Image]
  • Double click find.bat. to run it. A small black box should open and close - this is normal.

Post the content of the resulting log.


if one of these steps fail - move on to the next…post what you can
Post #5
Ok Hidden files and folders are unhidden. in c:/documents and settings/all users/application data folder, the only numbered folder i found was {3276BE95_AF08_429F_A64F_CA64CB79BCF6} with an x86 folder inside of that….not sure if that is what we're looking for??? further on, how do you disable script blocking protection?? Would that be in McAfee?
Post #6
Hi,

No that is not the correct folder that I was looking for, it was an 8 digit number.

McAfee must be disabled this way:

Open McAfee Security Centre
  • Under Common Tasks click on Home
  • Click Computer Files
  • Click Configure
  • Make sure the following are disabled by ticking the "Off" button.

    Virus protection
    Spyware protection
    System Guards Protection
    Script Scanning Protection (you may have to scroll down to see it)

  • Next, select never for "When to re-enable real time scanning"
  • and click OK.
Post #7
Here are the two text files from dds: DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 21:04:44.23 on Wed 08/19/2009 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_10 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.475 [GMT -4:00] AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\dlcdcoms.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\Program Files\Dell Photo AIO Printer 944\memcard.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Dell Photo AIO Printer 944\dlcdmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Kevin\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://newyork.yankees.mlb.com/NASApp/mlb/index.jsp?c_id=nyy uInternet Settings,ProxyOverride = *.local mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll mURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - TB: {463DF6D5-BEC1-4D67-B217-59DB692DFC53} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [MemoryCardManager] "c:\program files\dell photo aio printer 944\memcard.exe" mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [dlcdmon.exe] "c:\program files\dell photo aio printer 944\dlcdmon.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [DLCDCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCDtime.dll,_RunDLLEntry@16 mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter dRunOnce: [RunNarrator] Narrator.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe IE: &Search IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://www.activation.rr.com/install/download/tgctlcm.cab DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} - hxxp://fishingchamp.gamescampus.com/luncher/GamesCampus.cab DPF: {0835BC90-6ABC-4F52-A103-4FC3A61F2C33} - hxxp://www.albatross18.com/season2/cabs/A18X.ocx DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/viewers/ipixx.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/3/d/83d1fe15-fe0f-4bdf-b09c-4e3c49808ec7/LegitCheckControl.cab DPF: {27EB254C-C724-43B1-8DD8-F3AC9ED761B2} - hxxp://client2.tvtonic.com/Webservice/Public/WXStageInstall/2.8/TVTStage1.cab DPF: {55027008-315F-4F45-BBC3-8BE119764741} - hxxp://www.slide.com/uploader/SlideImageUploader.cab DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} - hxxp://www.acclaim.com/cabs/acclaim_v5.cab DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} - hxxp://radaol-prod-web-rr.streamops.aol.com/mediaplugin/3.0.84.2/win32/unagi3.0.84.2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} - hxxp://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} - hxxp://download.games.yahoo.com/games/web_games/tikgames/cinematycoon/cinematycoon.cab Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kevin\applic~1\mozilla\firefox\profiles\gilf6kh9.default\ FF - prefs.js: browser.startup.homepage - hxxp://newyork.yankees.mlb.com/index.jsp?c_id=nyy FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-2-7 214024] R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664] R2 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?] R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-2-7 359952] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2007-2-7 144704] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-2-7 79880] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-2-7 35272] S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-2-11 24652] S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-2-7 34216] S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-2-7 40552] S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [2007-2-28 87824] S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [2007-2-28 85696] S4 0270901247178982mcinstcleanup;McAfee Application Installer Cleanup (0270901247178982);c:\windows\temp\027090~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\windows\temp\027090~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?] S4 AntipPro2009_100;AntipyProex;c:\windows\svchast.exe –> c:\windows\svchast.exe [?] S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-9-29 198944] S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2007-2-7 606736] =============== Created Last 30 ================ 2009-08-19 19:56 –d-h— c:\windows\PIF 2009-08-19 10:57 1,382 a——- c:\windows\system32\onhelp.htm 2009-08-19 06:25 88 a——- c:\windows\system32\sonhelp.htm 2009-08-19 06:24 26,624 a——- c:\windows\system32\UACkltoygwtys.dll 2009-08-18 22:53 163,840 a——- c:\windows\winantivirusproshit.exe 2009-08-18 07:06 30,208 a——- c:\windows\system32\uacrem.dll 2009-08-18 07:06 1,110,399 a——- c:\windows\system32\uacmal.db 2009-08-18 07:06 269 a——- c:\windows\system32\uacsr.dat 2009-08-18 07:06 6,580 a——- c:\windows\system32\uacinit.dll 2009-08-18 07:06 74,240 a——- c:\windows\system32\uacbbr.dll 2009-08-18 07:06 54,784 a——- c:\windows\system32\drivers\UACowuvkfgqnr.sys 2009-08-18 07:06 207,364 a——- c:\windows\system32\msxml71.dll 2009-08-16 13:30 102,664 a——- c:\windows\system32\drivers\tmcomm.sys 2009-08-16 13:30 –d—– c:\documents and settings\kevin\.housecall6.6 2009-08-13 18:11 –d—– C:\CrashReport 2009-08-12 11:55 128,512 ——– c:\windows\system32\dllcache\dhtmled.ocx 2009-08-12 11:55 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll 2009-08-05 05:01 204,800 ——– c:\windows\system32\dllcache\mswebdvd.dll 2009-08-02 11:21 –d—– c:\windows\system32\Adobe 2009-08-01 10:13 –d—– c:\program files\HOJY TECH 2009-07-25 10:36 0 a——- c:\windows\popcreg.dat 2009-07-25 10:36 0 a——- c:\windows\popcinfot.dat ==================== Find3M ==================== 2009-08-05 05:01 204,800 a——- c:\windows\system32\mswebdvd.dll 2009-07-19 20:42 5,018 ac-sh— c:\windows\system32\KGyGaAvL.sys 2009-07-19 09:33 3,597,824 a——- c:\windows\system32\dllcache\mshtml.dll 2009-07-19 09:32 6,067,200 ——– c:\windows\system32\dllcache\ieframe.dll 2009-07-17 15:01 58,880 a——- c:\windows\system32\atl.dll 2009-07-17 15:01 58,880 ——– c:\windows\system32\dllcache\atl.dll 2009-07-13 23:43 10,841,088 a——- c:\windows\system32\dllcache\wmp.dll 2009-07-13 23:43 286,208 a——- c:\windows\system32\wmpdxm.dll 2009-07-13 23:43 286,208 ——– c:\windows\system32\dllcache\wmpdxm.dll 2009-06-29 07:07 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe 2009-06-29 07:07 70,656 ——– c:\windows\system32\dllcache\ie4uinit.exe 2009-06-29 04:35 634,632 ——– c:\windows\system32\dllcache\iexplore.exe 2009-06-29 04:33 2,452,872 ——– c:\windows\system32\dllcache\ieapfltr.dat 2009-06-29 04:33 161,792 ——– c:\windows\system32\dllcache\ieakui.dll 2009-06-25 04:25 730,112 a——- c:\windows\system32\lsasrv.dll 2009-06-25 04:25 301,568 a——- c:\windows\system32\kerberos.dll 2009-06-25 04:25 147,456 a——- c:\windows\system32\schannel.dll 2009-06-25 04:25 136,192 a——- c:\windows\system32\msv1_0.dll 2009-06-25 04:25 56,832 a——- c:\windows\system32\secur32.dll 2009-06-25 04:25 54,272 a——- c:\windows\system32\wdigest.dll 2009-06-25 04:25 730,112 ——– c:\windows\system32\dllcache\lsasrv.dll 2009-06-25 04:25 301,568 ——– c:\windows\system32\dllcache\kerberos.dll 2009-06-25 04:25 147,456 ——– c:\windows\system32\dllcache\schannel.dll 2009-06-25 04:25 136,192 ——– c:\windows\system32\dllcache\msv1_0.dll 2009-06-25 04:25 56,832 ——– c:\windows\system32\dllcache\secur32.dll 2009-06-25 04:25 54,272 ——– c:\windows\system32\dllcache\wdigest.dll 2009-06-24 07:18 92,928 a——- c:\windows\system32\drivers\ksecdd.sys 2009-06-24 07:18 92,928 ——– c:\windows\system32\dllcache\ksecdd.sys 2009-06-16 10:36 119,808 a——- c:\windows\system32\t2embed.dll 2009-06-16 10:36 81,920 a——- c:\windows\system32\fontsub.dll 2009-06-16 10:36 119,808 ——– c:\windows\system32\dllcache\t2embed.dll 2009-06-16 10:36 81,920 ——– c:\windows\system32\dllcache\fontsub.dll 2009-06-12 08:31 80,896 a——- c:\windows\system32\tlntsess.exe 2009-06-12 08:31 80,896 ——– c:\windows\system32\dllcache\tlntsess.exe 2009-06-12 08:31 76,288 a——- c:\windows\system32\telnet.exe 2009-06-12 08:31 76,288 ——– c:\windows\system32\dllcache\telnet.exe 2009-06-10 10:13 84,992 a——- c:\windows\system32\avifil32.dll 2009-06-10 10:13 84,992 ——– c:\windows\system32\dllcache\avifil32.dll 2009-06-10 09:19 2,066,432 a——- c:\windows\system32\mstscax.dll 2009-06-10 09:19 2,066,432 ——– c:\windows\system32\dllcache\mstscax.dll 2009-06-10 02:14 132,096 a——- c:\windows\system32\wkssvc.dll 2009-06-10 02:14 132,096 ——– c:\windows\system32\dllcache\wkssvc.dll 2009-06-03 15:09 1,291,264 a——- c:\windows\system32\quartz.dll 2009-06-03 15:09 1,291,264 ——– c:\windows\system32\dllcache\quartz.dll 2008-11-16 10:05 30 a——- c:\documents and settings\kevin\jagex_runescape_preferences.dat 2006-05-25 22:04 774,144 a——- c:\program files\RngInterstitial.dll 2006-04-28 07:32 1 ac—— c:\documents and settings\kevin\SI.bin ============= FINISH: 21:06:35.23 =============== and here is attach.txt as a zip file: 📎Attach.zip i downloaded gmer and extracted the exe file, but it doesn't seem to run…..after clicking on it, nothing happens….i looked in windows task manager and it is listed
Post #8
Hi,

Please run this batch file first then continue on with the other steps in my previous post starting with the GMER scan:

(try the GMER again in safe mode renamed to REMG.com)

Click Start >Run type notepad into the run box click OK
Click Format and make certain that Word Wrap is NOT checked.

Copy all the text inside of the code box, Press Ctrl+C (or right click on the highlighted section and choose 'copy')

@echo off
SC stop AntipPro2009_100
SC delete AntipPro2009_100 
attrib -s -h -r c:\windows\svchast.exe
del /f /q c:\windows\svchast.exe
del %0

Now paste the copied text into the open notepad, press CTRL+V (or right click and choose 'paste')

Now go to File > and click Save As,
From the drop down menu at the top of the box choose Desktop as the location to save this file.
Go down to the File Name box and type in runme.bat as the file name, then choose All Files as the save as file type.
Then click the save button.
Once you have clicked the save button, close Notepad.

You will now have a file on your desktop that looks like this

[external image: Posted Image]

Locate runme.bat on your Desktop and double-click it
A black window will flash up and disappear again, and runme.bat will be deleted.
This is normal.


Now continue on with the other steps
Post #9
Finally some progress!!

Ok, here we go….

gmer.txt file:

GMER 1.0.15.15077 [remg.com] - http://www.gmer.net
Rootkit scan 2009-08-19 22:14:25
Windows 5.1.2600 Service Pack 3


—- System - GMER 1.0.15 —-

Code 86683290 ZwEnumerateKey
Code 86683258 ZwFlushInstructionCache
Code 866832FE ZwSaveKey
Code 866832C6 ZwSaveKeyEx
Code 869B70AE IofCallDriver
Code 869C3C56 IofCompleteRequest
Code 866A72A5 ZwSaveKey
Code 866A726D ZwSaveKeyEx

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \FileSystem\Cdfs \Cdfs F659D400

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\kbiwkmmeuiycmu.sys (*** hidden *** ) [SYSTEM] kbiwkmapqquwkb <– ROOTKIT !!!
Service C:\WINDOWS\system32\drivers\UACowuvkfgqnr.sys (*** hidden *** ) [SYSTEM] UACd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb@imagepath \systemroot\system32\drivers\kbiwkmmeuiycmu.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main@aid 10002
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main@sid 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main@cmddelay 14400
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main\injector@* kbiwkmwsp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\drivers\kbiwkmmeuiycmu.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmpbwuyful.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmkriqltep.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmttitlwes.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmiyvwpnvo.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACowuvkfgqnr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACowuvkfgqnr.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACkltoygwtys.dll
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb@start 1
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb@type 1
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb@group file system
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb@imagepath \systemroot\system32\drivers\kbiwkmmeuiycmu.sys
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main@aid 10002
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main@sid 1
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main\injector@* kbiwkmwsp.dll
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\drivers\kbiwkmmeuiycmu.sys
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmpbwuyful.dll
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmkriqltep.dat
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmttitlwes.dll
Reg HKLM\SYSTEM\ControlSet004\Services\kbiwkmapqquwkb\[removed] \systemroot\system32\kbiwkmiyvwpnvo.dat
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACowuvkfgqnr.sys
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACowuvkfgqnr.sys
Reg HKLM\SYSTEM\ControlSet004\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACkltoygwtys.dll

—- EOF - GMER 1.0.15 —-


________________________________________________________________________________
______________________

RootRepeal.txt :

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/19 22:16
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Drivers
——————-
Name: aujasnkj.sys
Image Path: C:\DOCUME~1\Kevin\LOCALS~1\Temp\aujasnkj.sys
Address: 0xF63B8000 Size: 84352 File Visible: No Signed: -
Status: -

Name: dump_iastor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iastor.sys
Address: 0xF6F4F000 Size: 872448 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF676F000 Size: 49152 File Visible: No Signed: -
Status: -

Stealth Objects
——————-
Object: Hidden Module [Name: UACkltoygwtys.dll]
Process: svchost.exe (PID: 884) Address: 0x00ab0000 Size: 73728

Object: Hidden Module [Name: kbiwkmpbwuyful.dll]
Process: svchost.exe (PID: 884) Address: 0x10000000 Size: 53248

Object: Hidden Module [Name: kbiwkmttitlwes.dll]
Process: Explorer.EXE (PID: 1588) Address: 0x10000000 Size: 28672

Object: Hidden Module [Name: kbiwkmttitlwes.dll]
Process: firefox.exe (PID: 1096) Address: 0x10000000 Size: 28672

Hidden Services
——————-
Service Name: kbiwkmapqquwkb
Image Path: C:\WINDOWS\system32\drivers\kbiwkmmeuiycmu.sys

Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACowuvkfgqnr.sys

==EOF==

________________________________________________________________________________
______________________


Log from "find.bat" file:

Volume in drive C has no label.
Volume Serial Number is EC78-679B

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/10/2004 07:00 AM 180,224 scecli.dll

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/10/2004 07:00 AM 407,040 netlogon.dll

Directory of C:\WINDOWS\$NtServicePackUninstall$

08/10/2004 07:00 AM 55,808 eventlog.dll
3 File(s) 643,072 bytes
Post #10
Hi,

Please do the following:


Note: please make sure McAfee is disabled as described. If you need to run in safemode to get ComboFix to run, please do so. If renaming to Combo-fix.exe doesn't work try Combafix or use the .com extension

Please run it only once, please allow it to finish…it may appear to be stalled, but give it plenty of time, wait till it produces a log before shutting it down.

Download Combofix from either of the links below. You must rename it before saving it.
Save it to your desktop.

**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".


Link 1
Link 2



During the download, rename Combofix to Combo-Fix as follows:

[external image: Posted Image]


[external image: Posted Image]
——————————————————————–
  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.


———————————————————–

  • Double click on Combo-Fix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\Combo-Fix.txt" for further review.
    **Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


    ———————————————————–

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–


NOTE:If ComboFix asks to install the Recovery Console, please ALLOW it to do so.
Post #11
Here is the Combo-Fix.txt file:


ComboFix 09-08-19.06 - Kevin 08/20/2009 6:53.4.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.566 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\kmd.exe
c:\program files\Common
c:\windows\Fonts\WPHV07NB.TTF
c:\windows\Installer\1065ff9.msp
c:\windows\Installer\1065ffa.msp
c:\windows\Installer\1065ffb.msp
c:\windows\Installer\1065ffc.msp
c:\windows\Installer\1065ffd.msp
c:\windows\Installer\1065ffe.msp
c:\windows\Installer\1065fff.msp
c:\windows\Installer\1066000.msp
c:\windows\Installer\1066001.msp
c:\windows\Installer\10e0176.msp
c:\windows\Installer\10e0177.msp
c:\windows\Installer\10e0178.msp
c:\windows\Installer\10e0179.msp
c:\windows\Installer\10e017a.msp
c:\windows\Installer\10e017b.msp
c:\windows\Installer\10e017c.msp
c:\windows\Installer\10e017d.msp
c:\windows\Installer\10e017e.msp
c:\windows\Installer\1a8ee2b.msp
c:\windows\Installer\1a8ee2c.msp
c:\windows\Installer\1a8ee2d.msp
c:\windows\Installer\1a8ee2e.msp
c:\windows\Installer\1a8ee2f.msp
c:\windows\Installer\1a8ee30.msp
c:\windows\Installer\1a8ee31.msp
c:\windows\Installer\1a8ee32.msp
c:\windows\Installer\1a8ee33.msp
c:\windows\Installer\233c15.msp
c:\windows\Installer\233c16.msp
c:\windows\Installer\233c17.msp
c:\windows\Installer\233c18.msp
c:\windows\Installer\233c19.msp
c:\windows\Installer\233c1a.msp
c:\windows\Installer\233c1b.msp
c:\windows\Installer\233c1c.msp
c:\windows\Installer\233c1d.msp
c:\windows\Installer\2b940b.msp
c:\windows\Installer\2b940c.msp
c:\windows\Installer\2b940d.msp
c:\windows\Installer\2b940e.msp
c:\windows\Installer\2b940f.msp
c:\windows\Installer\2b9410.msp
c:\windows\Installer\2b9411.msp
c:\windows\Installer\2b9412.msp
c:\windows\Installer\2b9413.msp
c:\windows\Installer\2e759c.msp
c:\windows\Installer\2e759d.msp
c:\windows\Installer\2e759e.msp
c:\windows\Installer\2e759f.msp
c:\windows\Installer\2e75a0.msp
c:\windows\Installer\2e75a1.msp
c:\windows\Installer\2e75a2.msp
c:\windows\Installer\2e75a3.msp
c:\windows\Installer\2e75a4.msp
c:\windows\Installer\2e75a5.msp
c:\windows\Installer\4dc0380.msi
c:\windows\Installer\53542.msi
c:\windows\Installer\721d42.msp
c:\windows\Installer\721d43.msp
c:\windows\Installer\721d44.msp
c:\windows\Installer\721d45.msp
c:\windows\Installer\721d46.msp
c:\windows\Installer\721d47.msp
c:\windows\Installer\721d48.msp
c:\windows\Installer\721d49.msp
c:\windows\Installer\721d4a.msp
c:\windows\run.log
c:\windows\system32\drivers\kbiwkmmeuiycmu.sys
c:\windows\system32\drivers\UACowuvkfgqnr.sys
c:\windows\system32\kbiwkmiyvwpnvo.dat
c:\windows\system32\kbiwkmkriqltep.dat
c:\windows\system32\kbiwkmpbwuyful.dll
c:\windows\system32\kbiwkmttitlwes.dll
c:\windows\system32\msxml71.dll
c:\windows\system32\sonhelp.htm
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkltoygwtys.dll
c:\windows\system32\UACrmdxyqxmim.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_kbiwkmapqquwkb
——-\Legacy_kbiwkmapqquwkb
——-\Service_UACd.sys
——-\Legacy_UACd.sys
——-\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((( Files Created from 2009-07-20 to 2009-08-20 )))))))))))))))))))))))))))))))
.

2009-08-19 23:56 . 2009-08-19 23:56 ——– d–h–w- c:\windows\PIF
2009-08-19 02:53 . 2009-08-19 02:53 163840 —-a-w- c:\windows\winantivirusproshit.exe
2009-08-18 11:06 . 2009-08-18 11:06 30208 —-a-w- c:\windows\system32\uacrem.dll
2009-08-18 11:06 . 2009-08-18 11:06 269 —-a-w- c:\windows\system32\uacsr.dat
2009-08-16 17:30 . 2009-08-16 17:30 102664 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-08-16 17:30 . 2009-08-16 17:31 ——– d—–w- c:\documents and settings\Kevin\.housecall6.6
2009-08-13 22:11 . 2009-08-13 22:11 ——– d—–w- C:\CrashReport
2009-08-12 15:55 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:01 . 2009-08-05 09:01 204800 ——w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-02 15:21 . 2009-08-02 15:21 ——– d—–w- c:\windows\system32\Adobe
2009-08-01 14:13 . 2009-08-01 14:13 ——– d—–w- c:\program files\HOJY TECH
2009-07-25 14:36 . 2009-07-25 14:36 0 —-a-w- c:\windows\popcreg.dat
2009-07-25 14:36 . 2009-07-25 14:36 0 —-a-w- c:\windows\popcinfot.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-20 00:30 . 2005-12-22 03:53 26 -c–a-w- c:\windows\popcinfo.dat
2009-08-20 00:28 . 2006-02-13 01:16 ——– d—–w- c:\program files\Dl_cats
2009-08-16 17:19 . 2005-12-19 20:29 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-13 07:11 . 2008-01-08 11:56 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2005-08-16 10:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 14:46 . 2009-02-08 16:21 ——– d—–w- c:\program files\PopCap Games
2009-07-25 14:34 . 2006-11-23 14:33 ——– d—–w- c:\program files\Oberon Media
2009-07-24 00:42 . 2007-01-11 01:14 ——– d—a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-20 00:42 . 2005-12-22 03:10 5018 -csha-w- c:\windows\system32\KGyGaAvL.sys
2009-07-20 00:42 . 2005-12-22 03:10 104 -csh–r- c:\windows\system32\E9DA6A2B40.sys
2009-07-17 19:01 . 2005-08-16 10:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2005-08-16 10:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-11 15:58 . 2005-12-19 20:33 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-07-11 15:57 . 2006-12-14 21:49 ——– d—–w- c:\program files\AIM6
2009-07-11 15:57 . 2005-12-25 05:04 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-07-10 01:37 . 2005-12-19 20:41 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\McAfee
2009-07-09 22:36 . 2005-12-19 20:41 ——– d—–w- c:\program files\McAfee
2009-07-08 23:48 . 2008-10-27 23:44 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-06-29 16:12 . 2005-08-16 10:18 827392 —-a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2005-08-16 10:18 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2005-08-16 10:18 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2005-08-16 10:18 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2005-08-16 10:18 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2005-08-16 10:18 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2005-08-16 10:18 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2005-08-16 10:18 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2005-08-16 10:18 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2005-08-16 10:18 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-17 15:27 . 2008-10-27 23:44 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 15:27 . 2008-10-27 23:44 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:36 . 2005-08-16 10:18 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2005-08-16 10:18 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2005-08-16 10:18 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2005-08-16 10:18 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2005-08-16 10:18 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2005-08-16 10:37 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2005-08-16 10:18 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2005-08-16 10:18 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-30 11:18 . 2009-05-30 11:18 1244648 —-a-w- c:\documents and settings\Missy\Application Data\MSNInstaller\msnauins.exe
2006-05-26 02:04 . 2006-05-26 02:04 774144 —-a-w- c:\program files\RngInterstitial.dll
.

——- Sigcheck ——-

[-] 2005-08-04 00:29 25088 B9715B9C18BC6C8F4B66733D208CC9F7 c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2005-08-04 00:29 25088 B9715B9C18BC6C8F4B66733D208CC9F7 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[7] 2004-08-10 11:00 25088 6EAA72FD9EF993EC1FA9A06DE65105DA c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
[-] 2006-10-19 01:47 27136 C51B4A5C05A5475708E3C81C7765B71D c:\windows\system32\mspmsnsv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 316728]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"MemoryCardManager"="c:\program files\Dell Photo AIO Printer 944\memcard.exe" [2005-08-10 286720]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 16384]
"dlcdmon.exe"="c:\program files\Dell Photo AIO Printer 944\dlcdmon.exe" [2005-07-22 430080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"DLCDCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCDtime.dll" [2006-02-24 73728]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2005-05-20 28160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-12-19 24576]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2005-12-21 450560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1135487193\\ee\\AOLSoftware.exe"=
"c:\\WINDOWS\\system32\\dlcdcoms.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/11/2009 8:31 AM 24652]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [2/28/2007 9:01 PM 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [2/28/2007 9:01 PM 85696]
S4 0270901247178982mcinstcleanup;McAfee Application Installer Cleanup (0270901247178982);c:\windows\TEMP\027090~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\027090~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/29/2008 7:26 AM 198944]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://newyork.yankees.mlb.com/NASApp/mlb/index.jsp?c_id=nyy
uInternet Settings,ProxyOverride = *.local
IE: &Search
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
FF - ProfilePath - c:\docume~1\Kevin\APPLIC~1\Mozilla\Firefox\Profiles\gilf6kh9.default\
FF - prefs.js: browser.startup.homepage - hxxp://newyork.yankees.mlb.com/index.jsp?c_id=nyy
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-20 07:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCDCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLCDtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2843575100-1658711411-520792388-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3d,f1,a5,84,47,2b,3b,f5,2f,01,46,08,77,92,a4,14,16,47,b1,2d,02,4a,90,
52,4b,21,ff,67,ed,30,cf,49,e9,0e,a2,20,81,45,22,a6,6d,e6,96,f4,b5,f5,2c,5d,\
"??"=hex:0a,00,90,3d,0d,45,15,e6,a5,06,75,26,06,bc,0b,77
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2836)
c:\windows\system32\WININET.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE
c:\windows\system32\dlcdcoms.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\McAfee\MSK\msksrver.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\dllhost.exe
c:\program files\McAfee\MPF\MpfSrv.exe
.
**************************************************************************
.
Completion time: 2009-08-20 7:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-20 11:09

Pre-Run: 34,706,665,472 bytes free
Post-Run: 34,613,972,992 bytes free

295 — E O F — 2009-08-18 07:00
Post #12
Please do the following:
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Locked_out_all_programs_Windows_AntiVirus_Pro_t106282.html&view=findpost&p=589095#entry589095

Collect::
c:\windows\winantivirusproshit.exe
c:\windows\system32\uacrem.dll
c:\windows\system32\uacsr.dat

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.



NEXT

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
    • c:\windows\system32\mspmsnsv.dll
  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.
Post #13
I ran Combo-Fix again as you instructed, but the second part of your instructions VirScan I can't run using IE…mine doesn't seem to work
Every time I run it, it has an error and has to close. I don't really use it, can I use Firefox or Opera??


Here is the Combo-Fix Log:

ComboFix 09-08-19.0C - Kevin 08/20/2009 18:17.5.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.634 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Kevin\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

file zipped: c:\windows\system32\uacrem.dll
file zipped: c:\windows\system32\uacsr.dat
file zipped: c:\windows\winantivirusproshit.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\uacrem.dll
c:\windows\system32\uacsr.dat
c:\windows\winantivirusproshit.exe

.
((((((((((((((((((((((((( Files Created from 2009-07-20 to 2009-08-20 )))))))))))))))))))))))))))))))
.

2009-08-19 23:56 . 2009-08-19 23:56 ——– d–h–w- c:\windows\PIF
2009-08-16 17:30 . 2009-08-16 17:30 102664 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2009-08-16 17:30 . 2009-08-16 17:31 ——– d—–w- c:\documents and settings\Kevin\.housecall6.6
2009-08-13 22:11 . 2009-08-13 22:11 ——– d—–w- C:\CrashReport
2009-08-12 15:55 . 2009-07-10 13:27 1315328 ——w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:01 . 2009-08-05 09:01 204800 ——w- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-02 15:21 . 2009-08-02 15:21 ——– d—–w- c:\windows\system32\Adobe
2009-08-01 14:13 . 2009-08-01 14:13 ——– d—–w- c:\program files\HOJY TECH
2009-07-25 14:36 . 2009-07-25 14:36 0 —-a-w- c:\windows\popcreg.dat
2009-07-25 14:36 . 2009-07-25 14:36 0 —-a-w- c:\windows\popcinfot.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-20 22:08 . 2006-02-13 01:16 ——– d—–w- c:\program files\Dl_cats
2009-08-20 00:30 . 2005-12-22 03:53 26 -c–a-w- c:\windows\popcinfo.dat
2009-08-16 17:19 . 2005-12-19 20:29 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-13 07:11 . 2008-01-08 11:56 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2005-08-16 10:18 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-07-25 14:46 . 2009-02-08 16:21 ——– d—–w- c:\program files\PopCap Games
2009-07-25 14:34 . 2006-11-23 14:33 ——– d—–w- c:\program files\Oberon Media
2009-07-24 00:42 . 2007-01-11 01:14 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-20 00:42 . 2005-12-22 03:10 5018 -csha-w- c:\windows\system32\KGyGaAvL.sys
2009-07-20 00:42 . 2005-12-22 03:10 104 -csh–r- c:\windows\system32\E9DA6A2B40.sys
2009-07-17 19:01 . 2005-08-16 10:18 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2005-08-16 10:19 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-11 15:58 . 2005-12-19 20:33 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-11 15:57 . 2006-12-14 21:49 ——– d—–w- c:\program files\AIM6
2009-07-11 15:57 . 2005-12-25 05:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-07-10 01:37 . 2005-12-19 20:41 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-07-09 22:36 . 2005-12-19 20:41 ——– d—–w- c:\program files\McAfee
2009-07-08 23:48 . 2008-10-27 23:44 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-08 23:48 . 2008-12-07 13:47 3561743 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-29 16:12 . 2005-08-16 10:18 827392 —-a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2005-08-16 10:18 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2005-08-16 10:18 17408 —-a-w- c:\windows\system32\corpol.dll
2009-06-25 08:25 . 2005-08-16 10:18 54272 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2005-08-16 10:18 56832 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2005-08-16 10:18 147456 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2005-08-16 10:18 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:25 . 2005-08-16 10:18 730112 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2005-08-16 10:18 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2005-08-16 10:18 92928 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-17 15:27 . 2008-10-27 23:44 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 15:27 . 2008-10-27 23:44 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:36 . 2005-08-16 10:18 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2005-08-16 10:18 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2005-08-16 10:18 80896 —-a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2005-08-16 10:18 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2005-08-16 10:18 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2005-08-16 10:37 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2005-08-16 10:18 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2005-08-16 10:18 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-30 11:18 . 2009-05-30 11:18 1244648 —-a-w- c:\documents and settings\Missy\Application Data\MSNInstaller\msnauins.exe
2006-05-26 02:04 . 2006-05-26 02:04 774144 —-a-w- c:\program files\RngInterstitial.dll
.

——- Sigcheck ——-

[-] 2005-08-04 00:29 25088 B9715B9C18BC6C8F4B66733D208CC9F7 c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2005-08-04 00:29 25088 B9715B9C18BC6C8F4B66733D208CC9F7 c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[7] 2004-08-10 11:00 25088 6EAA72FD9EF993EC1FA9A06DE65105DA c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
[-] 2006-10-19 01:47 27136 C51B4A5C05A5475708E3C81C7765B71D c:\windows\system32\mspmsnsv.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-08-20_11.03.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-20 20:50 . 2009-08-20 20:51 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-12-22 01:07 . 2009-08-20 20:51 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2005-12-22 01:07 . 2009-08-20 10:34 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-12-22 01:07 . 2009-08-20 20:51 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2005-12-22 01:07 . 2009-08-20 10:34 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 316728]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"MemoryCardManager"="c:\program files\Dell Photo AIO Printer 944\memcard.exe" [2005-08-10 286720]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 16384]
"dlcdmon.exe"="c:\program files\Dell Photo AIO Printer 944\dlcdmon.exe" [2005-07-22 430080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"DLCDCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCDtime.dll" [2006-02-24 73728]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2005-05-20 28160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-12-19 24576]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2005-12-21 450560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1135487193\\ee\\AOLSoftware.exe"=
"c:\\WINDOWS\\system32\\dlcdcoms.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 dlcd_device;dlcd_device;c:\windows\system32\dlcdcoms.exe -service –> c:\windows\system32\dlcdcoms.exe -service [?]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/11/2009 8:31 AM 24652]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [2/28/2007 9:01 PM 87824]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [2/28/2007 9:01 PM 85696]
S4 0270901247178982mcinstcleanup;McAfee Application Installer Cleanup (0270901247178982);c:\windows\TEMP\027090~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\027090~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/29/2008 7:26 AM 198944]
.
Contents of the 'Scheduled Tasks' folder

2009-08-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-02-07 15:53]

2009-08-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-02-07 15:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://newyork.yankees.mlb.com/NASApp/mlb/index.jsp?c_id=nyy
uInternet Settings,ProxyOverride = *.local
IE: &Search
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://cnn-5.vo.llnwd.net/c1/static/cab_headless/GameTapWebUpdater.cab
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\gilf6kh9.default\
FF - prefs.js: browser.startup.homepage - hxxp://newyork.yankees.mlb.com/index.jsp?c_id=nyy
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-20 18:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCDCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCDtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-2843575100-1658711411-520792388-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3d,f1,a5,84,47,2b,3b,f5,2f,01,46,08,77,92,a4,14,16,47,b1,2d,02,4a,90,
52,4b,21,ff,67,ed,30,cf,49,e9,0e,a2,20,81,45,22,a6,6d,e6,96,f4,b5,f5,2c,5d,\
"??"=hex:0a,00,90,3d,0d,45,15,e6,a5,06,75,26,06,bc,0b,77
.
Completion time: 2009-08-20 18:26
ComboFix-quarantined-files.txt 2009-08-20 22:26
ComboFix2.txt 2009-08-20 11:09

Pre-Run: 34,607,726,592 bytes free
Post-Run: 34,569,940,992 bytes free

190 — E O F — 2009-08-18 07:00
Upload was successful
Post #14
Yes,

Please try using firefox.

If your unable to upload to virscan, try this scanner


  • Use the browse button on that page to navigate to the location of the file to be scanned.
  • In the right hand panel,
  • click on the file c:\windows\system32\mspmsnsv.dll
  • then click the open button.
  • The file will now be displayed in the submit box.
  • Scroll down a bit and click "send file", wait for the results

Make sure you have copied and saved the results before continuing.
Post #15
Here is the scan result for the file c:/WINDOWS/system32/mspmsnsv.dll : i ran it using opera?? a-squared 4.5.0.8 20090820220213 2009-08-20 - 0.332 AhnLab V3 2009.08.21.00 2009.08.21 2009-08-21 - 0.800 AntiVir 8.2.1.3 7.1.5.143 2009-08-20 - 0.252 Antiy 2.0.18 20090819.2718903 2009-08-19 - 0.119 Arcavir 2009 200908201624 2009-08-20 - 0.032 Authentium 5.1.1 200908191809 2009-08-19 - 1.167 AVAST! 4.7.4 090820-0 2009-08-20 - 0.006 AVG 8.5.288 270.13.63/2316 2009-08-21 - 0.328 BitDefender 7.81008.3911234 7.27254 2009-08-21 - 3.372 CA (VET) 9.0.0.143 31.6.6688 2009-08-20 - 7.042 ClamAV 0.95.2 9722 2009-08-20 - 0.012 Comodo 3.10 2039 2009-08-20 - 0.785 CP Secure 1.1.0.715 2009.08.21 2009-08-21 - 12.173 Dr.Web 4.44.0.9170 2009.08.20 2009-08-20 - 5.187 F-Prot 4.4.4.56 20090820 2009-08-20 - 1.136 F-Secure 7.02.73807 2009.08.20.11 2009-08-20 - 7.833 Fortinet 2.81-3.120 10.737 2009-08-20 - 0.239 GData 19.7276/19.446 20090820 2009-08-20 - 4.609 Ikarus T3.1.01.68 2009.08.20.73323 2009-08-20 - 3.503 JiangMin 11.0.800 2009.08.20 2009-08-20 - 3.433 Kaspersky 5.5.10 2009.08.20 2009-08-20 - 0.064 KingSoft 2009.2.5.15 2009.8.20.18 2009-08-20 - 0.495 McAfee 5.3.00 5715 2009-08-20 - 3.057 Microsoft 1.4903 2009.08.20 2009-08-20 - 5.629 Norman 6.01.09 6.01.00 2009-08-17 - 4.005 nProtect 20090818.01 5093763 2009-08-18 - 6.065 Panda 9.05.01 2009.08.20 2009-08-20 - 1.743 Quick Heal 10.00 2009.08.20 2009-08-20 - 1.100 Rising 20.0 21.43.34.00 2009-08-20 - 0.819 Sophos 2.89.1 4.44 2009-08-21 - 3.211 Sunbelt 5346 5346 2009-08-20 - 1.234 Symantec 1.3.0.24 20090820.003 2009-08-20 - 0.048 The Hacker 6.3.4.3 v00384 2009-08-20 - 0.687 Trend Micro 8.700-1004 6.382.01 2009-08-20 - 0.025 VBA32 [removed] 20090819.1841 2009-08-19 - 1.844 ViRobot 20090820 2009.08.20 2009-08-20 - 0.427 VirusBuster 4.5.11.10 10.112.11/1801294 2009-08-21 - 2.196

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI