What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Windows Antivirus Pro on XP 64-bit

130 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Computer details:
Custom built PC running Windows XP Professional 64-bit
Core i7 920 CPU, 12GB RAM (Corsair DDR3-1333)

I'm helping a friend with his computer. It has the dreaded Windows Antivirus Pro. At first, trying to following the steps in the New Members post, it wouldn't let me run any programs – I would get a systray message "WARNING-running of application is impossible. The file F:\Documents and Settings\Administrator\Desktop\erunt_setup.exe is infected. Please activate your antivirus program." I went into the Task Manager and killed the process called "svchast.exe" and was able to run apps again. I then ran ERUNT and backed up the registry. However, DDS.scr does nothing when I double click it (I've disabled McAfee's Access Protection and On-Access Scanner). Finally, it appears that RootRepeal does not run on 64-bit OS's, perhaps this is the problem with DDS as well. HijackThis ran ok, so the log is below.

I'm unsure of where to go from here. Any help is greatly appreciated.

Following is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:48:00 AM, on 8/31/2009
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)
Boot mode: Normal

Running processes:
F:\WINDOWS\SysWOW64\brsvc01a.exe
F:\WINDOWS\SysWOW64\brss01a.exe
F:\WINDOWS\RTHDCPL.EXE
F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
F:\Documents and Settings\Administrator\Desktop\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe tapi.nfo beforeglav
F2 - REG:system.ini: UserInit=userinit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ICQSys (IE PlugIn) - {76DC0B63-1533-4ba9-8BE8-D59EB676FA02} - F:\WINDOWS\SysWow64\dddesot.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - F:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = F:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1247275271781
O23 - Service: AntipyProex (AntipPro2009_100) - Unknown owner - F:\WINDOWS\svchast.exe
O23 - Service: Ati HotKey Poller - Unknown owner - F:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2saag.exe
O23 - Service: Brother BRAdminPro Scheduler (BRA_Scheduler) - Unknown owner - F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - F:\WINDOWS\SysWOW64\brsvc01a.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - F:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - F:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - F:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - F:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - F:\WINDOWS\system32\mfevtps.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - F:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - F:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - F:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - F:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - F:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - F:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - F:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - F:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - F:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - F:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - F:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

–
End of file - 7334 bytes
Post #2
Hi,

Please do the following

Download OTS to your Desktop
  • Close ALL OTHER PROGRAMS.
  • Double-click on OTS.exe to start the program.
  • Check the box that says Scan All Users
  • Check the box that says 64 bit
  • Under Additional Scans check the following:
    • File - Lop Check
    • File - Purity Scan
    • Evnt - EvtViewer (last 10)
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Please attach the log in your next post.
Post #4
One thing I noticed in the log is this: Under the Files/Folders - Created Within 30 Days asdjflkjt.exe -> F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe That seems suspicious at first, but that's ERUNT that I tried to rename to get it to run before I killed the svchast.exe process.
Post #5
Start OTS Copy/Paste the information inside the codebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[Unregister Dlls]
[Win32 Services - Safe List]
YY -> (AntipPro2009_100) AntipyProex [Win32_Own | Auto | Stopped] -> F:\WINDOWS\svchast.exe
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {76DC0B63-1533-4ba9-8BE8-D59EB676FA02} [HKLM] -> F:\WINDOWS\SysWow64\dddesot.dll [ICQSys (IE PlugIn)]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "" -> []
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell
YY -> tapi.nfo -> F:\WINDOWS\SysWow64\tapi.nfo
YN -> beforeglav -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
[Files/Folders - Created Within 30 Days]
NY -> 4 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp
NY -> dds.scr -> F:\Documents and Settings\Administrator\Desktop\dds.scr
NY -> dddesot.dll -> F:\WINDOWS\SysWow64\dddesot.dll
NY -> desot.exe -> F:\WINDOWS\SysWow64\desot.exe
NY -> svchast.exe -> F:\WINDOWS\svchast.exe
NY -> sonhelp.htm -> F:\WINDOWS\SysWow64\sonhelp.htm
NY -> ppp4.dat -> F:\WINDOWS\ppp4.dat
NY -> sysnet.dat -> F:\WINDOWS\SysWow64\sysnet.dat
NY -> bennuar.old -> F:\WINDOWS\SysWow64\bennuar.old
NY -> ppp3.dat -> F:\WINDOWS\ppp3.dat
NY -> Windows Antivirus Pro.lnk -> F:\Documents and Settings\Administrator\Desktop\Windows Antivirus Pro.lnk
NY -> Windows Antivirus Pro -> F:\Program Files (x86)\Windows Antivirus Pro
NY -> tapi.nfo -> F:\WINDOWS\SysWow64\tapi.nfo
NY -> QUARANTINE -> F:\QUARANTINE
[Files/Folders - Modified Within 30 Days]
NY -> desot.exe -> F:\WINDOWS\SysWow64\desot.exe
NY -> ppp4.dat -> F:\WINDOWS\ppp4.dat
NY -> ppp3.dat -> F:\WINDOWS\ppp3.dat
NY -> onhelp.htm -> F:\WINDOWS\SysWow64\onhelp.htm
NY -> dddesot.dll -> F:\WINDOWS\SysWow64\dddesot.dll
NY -> dds.scr -> F:\Documents and Settings\Administrator\Desktop\dds.scr
NY -> svchast.exe -> F:\WINDOWS\svchast.exe
NY -> sonhelp.htm -> F:\WINDOWS\SysWow64\sonhelp.htm
NY -> sysnet.dat -> F:\WINDOWS\SysWow64\sysnet.dat
NY -> bennuar.old -> F:\WINDOWS\SysWow64\bennuar.old
NY -> Windows Antivirus Pro.lnk -> F:\Documents and Settings\Administrator\Desktop\Windows Antivirus Pro.lnk
NY -> tapi.nfo -> F:\WINDOWS\SysWow64\tapi.nfo
[Purity]
[Empty Temp Folders]
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.
Post #6
I copied and pasted the info into OTS as requested and hit run fix. I got a windows error dialog that said "Access violation at address 004FFA32 in module 'OST.exe'. Read of address 00000000." I clicked OK, and then quit out of OTS. I relaunched OST, repasted the fix code and clicked Run Fix. This time it went through the process and prompted me to reboot at the end. I did so. Upon reboot, I'm prompted with a dialog: "Choose the program you want to use to open this file: File: OTS.exe" Double-clicking the OTS icon on the desktop also results in this dialog box. Is the log saved somewhere I can get at without opening OTS?
Post #7
Hi, OTS creates a folder in the C:\ drive c:\_OTS The log should be located there. Please test a number of your programs to see if any other file associations have been disrupted. This infection is known to disrupt file associations….try to open Notepad are you experiencing any other issues.
Post #8
All Processes Killed [Win32 Services - Safe List] No service named AntipPro2009_100 was found to stop! No service named AntipPro2009_100 was found to delete! File F:\WINDOWS\svchast.exe not found. [Registry - Safe List] Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76DC0B63-1533-4ba9-8BE8-D59EB676FA02}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76DC0B63-1533-4ba9-8BE8-D59EB676FA02}\ not found. F:\WINDOWS\SysWow64\dddesot.dll NOT unregistered. F:\WINDOWS\SysWow64\dddesot.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:tapi.nfo deleted successfully. F:\WINDOWS\SysWow64\tapi.nfo moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:beforeglav deleted successfully. [Files/Folders - Created Within 30 Days] F:\WINDOWS\51FB15F4AD2743BCAD4BDD0354FB6BBD.TMP folder deleted successfully. F:\WINDOWS\CCBAA1F7E5E148B29ED9A79C6A37CE78.TMP folder deleted successfully. F:\Documents and Settings\Administrator\Desktop\dds.scr moved successfully. File F:\WINDOWS\SysWow64\dddesot.dll not found! F:\WINDOWS\SysWow64\desot.exe moved successfully. File F:\WINDOWS\svchast.exe not found! F:\WINDOWS\SysWow64\sonhelp.htm moved successfully. F:\WINDOWS\ppp4.dat moved successfully. F:\WINDOWS\SysWow64\sysnet.dat moved successfully. F:\WINDOWS\SysWow64\bennuar.old moved successfully. F:\WINDOWS\ppp3.dat moved successfully. F:\Documents and Settings\Administrator\Desktop\Windows Antivirus Pro.lnk moved successfully. F:\Program Files (x86)\Windows Antivirus Pro\tmp folder moved successfully. F:\Program Files (x86)\Windows Antivirus Pro folder moved successfully. File F:\WINDOWS\SysWow64\tapi.nfo not found! F:\QUARANTINE folder moved successfully. [Files/Folders - Modified Within 30 Days] File F:\WINDOWS\SysWow64\desot.exe not found! File F:\WINDOWS\ppp4.dat not found! File F:\WINDOWS\ppp3.dat not found! F:\WINDOWS\SysWow64\onhelp.htm moved successfully. File F:\WINDOWS\SysWow64\dddesot.dll not found! File F:\Documents and Settings\Administrator\Desktop\dds.scr not found! File F:\WINDOWS\svchast.exe not found! File F:\WINDOWS\SysWow64\sonhelp.htm not found! File F:\WINDOWS\SysWow64\sysnet.dat not found! File F:\WINDOWS\SysWow64\bennuar.old not found! File F:\Documents and Settings\Administrator\Desktop\Windows Antivirus Pro.lnk not found! File F:\WINDOWS\SysWow64\tapi.nfo not found! [Purity] Purity scan complete. [Empty Temp Folders] User: Administrator ->Temp folder emptied: 125378818 bytes File delete failed. F:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 8053784 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 144868 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. F:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 402 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 4265 bytes File delete failed. F:\WINDOWS\temp\WFV1.tmp scheduled to be deleted on reboot. Windows Temp folder emptied: 55730542 bytes RecycleBin emptied: 1143574 bytes Total Files Cleaned = 181.66 mb < End of fix log > OTS by OldTimer - Version 3.0.10.3 fix logfile created on 08312009_134419 ============ It appears that all .exe files are affected. I can double-click on a text (*.txt or *.log) file and Notepad.exe will open that way. Same thing happens with Word and Excel documents - I can double-click WordTestDoc.doc and ExcelTestDoc.xls and they both open in their respective applications, but trying to launch either EXCEL.EXE or WINWORD.EXE directly causes the prompt to choose what program to open the file with. Other files I tested: PDFs are ok (opens with Adobe Acrobat), JPGs are ok (opens with Adobe Photoshop). There appears to be no other issues other than that at this time.
Post #9
Hi, There is a registry fix for exe files but I need to research it a bit more as I want to make certain it is appropriate for a 64bit system. Thank-you
Post #10

Hi,

There is a registry fix for exe files but I need to research it a bit more as I want to make certain it is appropriate for a 64bit system.

Thank-you

Many thanks for your help so far.
Post #11
I'd like you to export this registry key please so I can take a look at it:

Press the Windows Key +R to open a run box > copy and paste the following command into the run box (it's one long command):

regedit /e C:\look.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe"


You won't see anything happen and it will only take a second.

You will find the report it creates at C:\look.txt. Please open it in Notepad and then copy and paste the report here.
Post #14
Hi

Lets see if a batch file will work to get a look at that registry key

Please do the following:

  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as Query.bat
  • Change the Save as Type to All Files
  • and Save it on the desktop
  • Once saved, double click on the Query.bat file.
  • Post the resulting report.

@Echo Off
Reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe" >Log.txt
Start Log.txt

Post #15 last edited
Hi

run the OTS program again

change the extension to .com

under the "extras" pane - scroll down and check off the box for Reg-File Associations

and run a scan

post the resulting log

we should be able to fix the associations through OTS if we can get it to scan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI