Illegal System Dll Relocation

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\system32\win32k.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

Also these:

C:\WINDOWS\dlib.dll
C:\WINDOWS\params.dll
C:\WINDOWS\system32\user32.dll
C:\WINDOWS\system32\mf3216.dll
C:\WINDOWS\system32\gdi32.dll



If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html

I haven't restarted my PC yet, should I keep it on untill you say so? Thanks Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: win32k.sys Status: OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 5b5ad4f40be00f56f51f286be72c0376 Packers detected: - Scanner results Scan taken on 09 Apr 2007 22:13:43 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing ——————————————————————————– Statistics Last file scanned at least one scanner reported something about: Patch.exe (MD5: b2414dbd5b292b935d0137dd2a689a6f, size: 25636 bytes), detected by: Scanner Malware name AntiVir TR/PSW.LdPinch.CL ArcaVir Trojan.Psw.Ldpinch.Bte Avast X AVG Antivirus PSW.Ldpinch.FZK BitDefender X ClamAV X Dr.Web Trojan.PWS.LDPinch.1611 F-Prot Antivirus W32/Trojan.ADED F-Secure Anti-Virus Trojan-PSW.Win32.LdPinch.bte Fortinet PossibleThreat Kaspersky Anti-Virus Trojan-PSW.Win32.LdPinch.bte NOD32 X Norman Virus Control X Panda Antivirus X Rising Antivirus X VirusBuster Packed/FSG VBA32 X Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: dlib.dll Status: OK MD5 bde37f4069c73dbc3338434af3a25270 Packers detected: - Scanner results Scan taken on 09 Apr 2007 22:18:31 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing ——————————————————————————– Statistics Last file scanned at least one scanner reported something about: winrar.3.xx.generic.patch.exe (MD5: 1100c2aac4a56bad2856ae81c19a35c4, size: 137333 bytes), detected by: Scanner Malware name AntiVir APPL/Xema.A ArcaVir Trojan.Ciadoor.13 Avast Win32:Trojan-gen. {Other} AVG Antivirus X BitDefender X ClamAV X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Rising Antivirus Trojan.Xema.ko VirusBuster Packed/MEW VBA32 X Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: params.dll Status: OK MD5 7d068d9fe48ca989015db71c7ac4f154 Packers detected: - Scanner results Scan taken on 09 Apr 2007 22:21:02 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing ——————————————————————————– Statistics Last file scanned at least one scanner reported something about: Keygen_Avast_4.7.892_PRO.zip (MD5: ba6b98180008e09fb0d335293f438e25, size: 138074 bytes), detected by: Scanner Malware name AntiVir X ArcaVir X Avast X AVG Antivirus X BitDefender X ClamAV X Dr.Web X F-Prot Antivirus W32/Backdoor.AJFV F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Rising Antivirus X VirusBuster X VBA32 X Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: user32.dll Status: OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 b409909f6e2e8a7067076ed748abf1e7 Packers detected: - Scanner results Scan taken on 09 Apr 2007 22:23:47 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing ——————————————————————————– Statistics Last file scanned at least one scanner reported something about: vitosoundeditorv1.4.4pocketpckeygentsrh.zip (MD5: e83493504819f2f3c4cb54716c82b3a9, size: 66831 bytes), detected by: Scanner Malware name AntiVir X ArcaVir X Avast X AVG Antivirus X BitDefender X ClamAV X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 X Norman Virus Control Suspicious_F.gen Panda Antivirus X Rising Antivirus X VirusBuster Packed/FSG VBA32 X Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: mf3216.dll Status: OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 7919f5f422de1bf45f5388bb1c2159d7 Packers detected: - Scanner results Scan taken on 09 Apr 2007 22:25:30 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing ——————————————————————————– Statistics Last file scanned at least one scanner reported something about: player.rar (MD5: 1e2053f5b88a4fd18c21b3c376c9c9eb, size: 9104 bytes), detected by: Scanner Malware name AntiVir X ArcaVir X Avast X AVG Antivirus X BitDefender BehavesLike:Win32.VBMalware ClamAV X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Kaspersky Anti-Virus X NOD32 probably unknown NewHeur_PE Norman Virus Control X Panda Antivirus X Rising Antivirus X VirusBuster X VBA32 X Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: gdi32.dll Status: OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 9da47be6d59fd06a922dcba6739bdd2e Packers detected: - Scanner results Scan taken on 09 Apr 2007 22:27:34 (GMT) AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing ——————————————————————————– Statistics Last file scanned at least one scanner reported something about: mirc.exe (MD5: 52f9f2101923e84dd146fd1058d97b60, size: 2076672 bytes), detected by: Scanner Malware name AntiVir X ArcaVir X Avast X AVG Antivirus X BitDefender X ClamAV X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus not-a-virus:Client-IRC.Win32.mIRC.621 (6, 2, 601) Fortinet X Kaspersky Anti-Virus not-a-virus:Client-IRC.Win32.mIRC.621 NOD32 X Norman Virus Control X Panda Antivirus X Rising Antivirus X VirusBuster X VBA32 X

I'm not seeing anything. How's it running?

It's real slow going from one page to another, like it's going somewhere else first. Like I said, I haven't restarted the PC since we started this today, not sure if I should. The download speed has slowed down a lot also, I mean from 200-300k/sec down to 35k/sec.

lets see if this will help speed it up.

Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

NOTE: To be extra safe you can choose to only remove the items in RED.
Some items may come back because of the programs you have running.

I forgot to mention, I don't remember seeing this before. A small black clock in the status bar on the lower left, only when I first log on to IE.

I have a little black speaker, but not a clock Reboot and do my last post.

Something for you to ponder over while I test my PC out. When cleaning the registry, 9 files kept comming back, ran it 20 times. I paid for Ad-Aware so I also have Ad-Watch and the Event Log would alarm two blank CLIDs and one that ended with "mcinfo.exe/insfin" each time. So I looked at the start-up log and first on the list is "cftmon.exe".

NOTE: To be extra safe you can choose to only remove the items in RED.
Some items may come back because of the programs you have running.

ctfmon
http://support.microsoft.com/default.aspx?…b;EN-US;q282599

mcinfo.exe <–Is part of McAfee anti-virus.


Launch Notepad (Start>All Programs>Accessories), and copy/paste all the BOLD REGEDIT below to it. Don't forget to include REGEDIT4.
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"msci"=-

On the desktop, doubleclick fix.reg and allow it to run. Let it merge.

Reboot and let me know how it's running.

Before I do anything, I want to tell you what I found. I have a paid subscription for "Face Time W-Cleaner", and for kicks I ran it twice before it came up clean. But the PC still loads up the same as before. What it showed the 1st time- "WhenU-UControl" on one CLSID and 2 blank htm ones. On the second run it showed- "Spy-Agent.ak". 3rd and 4th run came up clean, and the PC loads the same. I'll wait untill you post to do anything more. Thanks

NOTE: To be extra safe you can choose to only remove the items in RED.
Some items may come back because of the programs you have running.

ctfmon
http://support.microsoft.com/default.aspx?…b;EN-US;q282599

mcinfo.exe <–Is part of McAfee anti-virus.


Launch Notepad (Start>All Programs>Accessories), and copy/paste all the BOLD REGEDIT below to it. Don't forget to include REGEDIT4.
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"msci"=-

On the desktop, doubleclick fix.reg and allow it to run. Let it merge.

Reboot and let me know how it's running.

I ran ERUNT again and the same 9 files kept showing up.

The only one I'd worry about is the fix I posted above.

It seems to run OK now, just slow. Might be my connection or net load. Do you think I can trust this PC for my banking? I use it a lot for that. Thanks

You can change your passwords for you bank's, etc.

You can remove any programs I had you install. Use Add/Remove Programs to remove if listed there:

Log looks good


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.


Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

Only run one Anti-Virus and Firewall program.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware


Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein