WiredWX Hobby Weather ToolsLog in

 


Automatic Update Virus, and then some...

2 posters

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Don't worry, I know, I haven't forgotten you. I was just speaking to colleague, our automatic fix isn't working at the moment, so were having to think outside the box here.

The Google re-direct is caused by one of your Windows files is patched by malware, and the file in question is one of the files needed for your machine to boot, which makes it harder to fix, so our fix here is somewhat advanced.

First though, we need to find a new clean copy of the file.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    Code:


    :filefind
    atapi.sys


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Sorry if I sounded antsy, did not mean to, just did not know how far back to let the posts go! Now that I know you guys have problems to work out for the fixes, I will wait more patiently!

Ran SystemLook with these results:

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 18:18 on 15/12/2009 by z (Administrator - Elevation successful)

========== filefind ==========

Searching for "atapi.sys"
C:\i386\atapi.sys --a--- 95360 bytes [15:21 25/03/2006] [04:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51
C:\WINDOWS\$NtServicePackUninstall$\atapi.sys -----c 95360 bytes [17:19 28/10/2008] [04:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51
C:\WINDOWS\ServicePackFiles\i386\atapi.sys ------ 96512 bytes [19:18 24/08/2008] [18:40 13/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\dllcache\atapi.sys --a--- 96512 bytes [04:59 04/08/2004] [12:35 14/12/2009] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\drivers\atapi.sys --a--- 96512 bytes [04:59 04/08/2004] [12:35 14/12/2009] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys --a--- 95360 bytes [15:12 21/03/2006] [04:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51
C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys --a--- 95360 bytes [15:12 21/03/2006] [04:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51

-=End Of File=-

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Hello.
Nice, a few good copies are on your machine.

Now we can try and repair the file. Go through these instructions slowly and carefully, the file that's patched is a Windows file, so a quick delete/replace is needed.

Warning: the below instructions are specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


  1. Open My Computer.
  2. Go to Tools > Folder Options.
  3. Select the View tab.
  4. Scroll down to hȋdden files and folders.
  5. Select Show hȋdden files and folders.
  6. Uncheck (untick) Hide extensions of known file types.
  7. Uncheck (untick) Hide protected operating system files (Recommended).
  8. Click Yes when prompted.
  9. Click OK.
  10. Close My Computer.

I suggest you copy these instructions into a notepad file, because we need to use safe mode and you won't have internet access to read from here.

See here before enterting safe mode:
http://support.microsoft.com/kb/308421

Copy down the instruction for logging on as an administrator, and how to take ownership of a file, because were gonna need to own that patched file.

Please do the following in Safe Mode: as the computer is booting, start tapping your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode" and press your Enter key.

Note: You may get the XP logon screen with an extra Administrator account, this account is hȋdden by default.

Once in Safe Mode (as an administrator), take ownership of this file:
C:\WINDOWS\system32\drivers\atapi.sys

Next, delete it.

Now, the patched file is gone, but since it's a Windows file, we need a new copy. Go to the following file:
C:\i386\atapi.sys

Right click and COPY it!

Now go back to the system\drivers folder like you did before, and paste the new copy of atapi.sys in there.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Hello, I haven't had the heart to report my results, because I have been bummed out. It seems like my repair efforts keep taking a step backward!

After reading and printing and rereading all the info in your latest instruction, and I was all set to carry them out. To my disappointing surprise, I no longer can boot up in safe mode! I have tried regular and with networking. They both give me the dreaded blue screen of death. This seems to be yet another new problem, as safe mode worked fine as recently as December 2nd.

I was going to run another Malwarewarebytes to see if this might give me a quick fix, but I did not.

I will wait to see what you suggest next.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Figured that might happen, do you have your XP disc? we can try and replace the files via Recovery Console.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Unfortunately not, everything came preinstalled and I don't even recall if any type of system disc was provided, let alone where I would have put it.

Would it help or hinder, or even work if I did a system restore to December 2nd. Or has the malware destroyed that function?

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
It might help if you can do that, then we'll see where we stand.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Ehhhhhhhhhhhhh, I had a feeling, and you probably knew already it was a slim chance [wink] !

Restoring to 12/02/2009 did NOT work.

Still get the blue death screen when trying to boot in safe mode.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Still no way of getting to normal mode either?
Can you try and last known good configuration?

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Oh, I'm fine in normal mode. I can boot up, shut down, all good!

I've been "computering" all the while!

I'm just worried that I may be on "borrowed time". before my malware snowballs and crumbles my whole system!

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Maybe, maybe not...

  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    Link 1
    Link 2
  • Double click DDS.scr to run.
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste BOTH LOGS back here, use more than one post if needed.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Okay, here's the DDS reports! In the meantime, the system restore brought back the programs I/we deleted the other day. I am going to remove them again while I await your next steps.



DDS (Ver_09-12-01.01) - NTFSx86
Run by z at 19:17:55.29 on Thu 12/17/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3710.3053 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRAM FILES\FAXTALK COMMUNICATOR\FTCtrl32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\DOCUME~1\z\LOCALS~1\Temp\clclean.0001
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRAM FILES\FAXTALK COMMUNICATOR\FAPIEXE.EXE
C:\Program Files\McAfee\MSK\MskSrver.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\osk.exe
C:\WINDOWS\system32\MSSWCHX.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\z\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Page_URL = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\smart web printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hp\smart web printing\hpswp_framework.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_11\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No File
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [pltvtgld] c:\documents and settings\z\local settings\application data\cqfqou\mvnwsysguard.exe
mRun: [MBMon] Rundll32 CTMBHA.DLL,MBMon
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [CallControl 4.5] c:\program files\faxtalk communicator\FTCtrl32.exe /autoload
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [pltvtgld] c:\documents and settings\z\local settings\application data\cqfqou\mvnwsysguard.exe
dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_11\bin\npjpi150_11.dll
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hp\smart web printing\hpswp_extensions.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: lasallebank.com\onlinebanking
Trusted Zone: musicmatch.com\online
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
DPF: {7A7BA269-2D21-4B33-B60A-8510A1865D5F} - hxxp://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxp://upload.mediamax.com/Upload/XUpload.ocx
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2007-2-20 214664]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-1 93320]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-2-20 359952]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2007-2-20 144704]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-3-21 24652]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2007-2-20 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2007-2-20 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2007-2-20 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2007-2-20 40552]
S1 5922436;5922436;c:\windows\system32\drivers\5922436.sys [2009-5-24 0]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1028432]
S2 sys;sys;c:\windows\system32\svchost.exe -k sys [2005-8-16 14336]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2007-2-20 34248]

=============== Created Last 30 ================

2009-12-17 22:52:30 0 d-----w- c:\program files\Microsoft Money 2006
2009-12-17 22:52:24 0 d-----w- c:\program files\AIM6
2009-12-17 22:12:45 0 d-----w- c:\windows\system32\wbem\Repository
2009-12-17 22:11:34 0 d-----w- c:\program files\Viewpoint
2009-12-17 08:33:18 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-02 21:13:48 0 d-----w- c:\program files\Trend Micro
2009-11-28 23:53:39 0 d-----w- c:\docume~1\z\applic~1\Malwarebytes
2009-11-28 23:53:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-28 23:53:32 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-28 23:53:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-28 23:53:32 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

==================== Find3M ====================

2009-12-18 00:18:58 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-18 00:18:58 96512 ----a-w- c:\windows\system32\dllcache\atapi.sys
2009-12-17 23:08:57 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-12-17 19:07:46 3874 ----a-w- c:\docume~1\z\applic~1\SAS7_000.DAT
2009-12-04 05:23:38 6216 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-09-22 00:49:33 15688 ----a-w- c:\windows\system32\lsdelete.exe
2008-10-28 17:41:04 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008102820081029\index.dat

============= FINISH: 19:20:32.34 ===============




UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 3/23/2006 3:41:23 PM
System Uptime: 12/17/2009 5:08:20 PM (2 hours ago)

Motherboard: Dell Inc. | | 0WG261
Processor: Intel(R) Pentium(R) 4 CPU 3.20GHz | Microprocessor | 3192/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 144 GiB total, 80.691 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is FIXED (NTFS) - 932 GiB total, 604.396 GiB free.
H: is Removable
K: is FIXED (NTFS) - 466 GiB total, 259.054 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1219: 11/17/2009 1:45:21 PM - System Checkpoint
RP1220: 11/18/2009 11:34:40 PM - System Checkpoint
RP1221: 11/20/2009 11:46:15 AM - System Checkpoint
RP1222: 11/21/2009 6:25:55 PM - System Checkpoint
RP1223: 11/22/2009 10:38:38 PM - System Checkpoint
RP1224: 11/25/2009 5:53:18 PM - System Checkpoint
RP1225: 11/27/2009 6:20:12 PM - System Checkpoint
RP1226: 11/27/2009 10:18:12 PM - AusLogics RegDefrag before defragmentation.
RP1227: 11/28/2009 2:29:52 PM - B4 fystem fix
RP1228: 11/28/2009 7:53:43 PM - Installed Java(TM) 6 Update 17
RP1229: 11/29/2009 5:05:29 PM - Restore Operation
RP1230: 12/1/2009 10:53:06 PM - System Checkpoint
RP1231: 12/3/2009 6:36:52 PM - System Checkpoint
RP1232: 12/3/2009 11:27:26 PM - Removed Corel Paint Shop Pro X
RP1233: 12/5/2009 10:27:49 PM - System Checkpoint
RP1234: 12/6/2009 10:40:24 PM - System Checkpoint
RP1235: 12/7/2009 10:42:20 PM - System Checkpoint
RP1236: 12/8/2009 10:55:53 PM - System Checkpoint
RP1237: 12/10/2009 10:53:42 AM - System Checkpoint
RP1238: 12/11/2009 5:18:09 PM - AusLogics RegDefrag before defragmentation.
RP1239: 12/12/2009 10:55:36 PM - System Checkpoint
RP1240: 12/13/2009 11:41:46 PM - System Checkpoint
RP1241: 12/14/2009 7:58:04 PM - Installed Java(TM) 6 Update 17
RP1242: 12/16/2009 10:35:37 PM - System Checkpoint
RP1243: 12/17/2009 4:10:18 PM - Restore Operation
RP1244: 12/17/2009 4:55:09 PM - Restore Operation

==== Installed Programs ======================

3D Groove Playback Engine
Ad-Aware
Adobe Digital Editions
Adobe Flash Player 10 ActiveX
Adobe Reader 8
Adobe Shockwave Player 11
Advanced WindowsCare Personal 2.6.0
AI RoboForm (All Users)
AIM 6
Amazon MP3 Downloader 1.0.3
Andrea VoiceCenter
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Uninstaller (Choose which Products to Remove)
AOLIcon
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoStudio 5
ATI Control Panel
ATI Display Driver
ATI Parental Control
AusLogics Registry Defrag
Banctec Service Agreement
Big Kahuna Reef 2 (remove only)
Bonjour
BufferChm
BUM
Calendar Creator
Canon CanoScan Toolbox 4.1
CanoScan LiDE20,30 Manual
CCleaner (remove only)
Conexant D850 56K V.9x DFVc Modem
Corel Photo Album 6
Creative MediaSource
Critical Update for Windows Media Player 11 (KB959772)
Crossword Weaver 8.0
CustomerResearchQFolder
D4200
D4200_Help
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Game Console
Dell Support 3.1
Dell System Restore
DeviceDiscovery
DeviceManagementQFolder
Digital Content Portal
Digital Line Detect
dj_sf_ProductContext
dj_sf_software
dj_sf_software_req
Dragon NaturallySpeaking 10
Dragon NaturallySpeaking 9
EducateU
ELIcon
ESPNMotion
eSupportQFolder
Eusing Free Registry Cleaner
FaxTalk Communicator 4.5
GemMaster Mystic
Get High Speed Internet!
Google Earth
Google Toolbar for Internet Explorer
Google Updater
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HouseCall 6.6
HP Customer Participation Program 9.0
hp deskjet 940c series (Remove only)
HP Deskjet Printer Driver Software 9.0
HP Driver Diagnostics
HP Imaging Device Functions 9.0
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Smart Web Printing
HP Solution Center 9.0
HP Update
HPProductAssistant
HPSSupply
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet for Wired Connections
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
Java 2 Runtime Environment, SE v1.4.2_03
KODAK EASYSHARE Gallery Easy Upload, v2.1
Learn2 Player (Uninstall Only)
Logitech Audio Echo Cancellation Component
Logitech QuickCam
Logitech Video Enumerator
Logitech®️ Camera Driver
Malwarebytes' Anti-Malware
MarketResearch
McAfee SecurityCenter
McAfee Uninstaller
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Standard 2006
Microsoft Digital Image Standard 2006 Editor
Microsoft Digital Image Standard 2006 Library
Microsoft Encarta Encyclopedia Standard 2006
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Money 2006
Microsoft Money Plus
Microsoft Money Shared Libraries
Microsoft National Language Support Downlevel APIs
Microsoft Office Live Small Business Image Uploader
Microsoft Office Professional Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Streets & Trips 2006
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Web Publishing Wizard 1.52
Microsoft Works
Microsoft Works Suite 2006 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
Modem Helper
Move Networks Media Player for Internet Explorer
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Musicmatch for Windows Media Player
Musicmatch®️ Jukebox
MVision
NetWaiting
NetZeroInstallers
OfxGen - 0.6
OmniPage SE
Otto
OverDrive Media Console
PanoStandAlone
PSSWCORE
QuickTime
RealPlayer Basic
RollerCoaster Tycoon 3 Platinum
Roxio DLA
Roxio Express Labeler
Roxio MyDVD Plus
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Savings Bond Wizard
Scrabble
Search Assist
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Skype™️ 4.0
SolutionCenter
Sonic Activation Module
Sonic Advanced Decoder
Sonic Encoders
Sonic Update Manager
Sound Blaster Audigy ADVANCED MB
Sound Blaster Audigy ADVANCED MB Product Registration
Spybot - Search & Destroy
SpywareBlaster 4.2
Status
The Print Shop 21
The Print Shop 21 Update
Toolbox
TrayApp
Unity Web Player
UnloadSupport
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update Rollup 2 for Windows XP Media Center Edition 2005
URL Assistant
VideoToolkit01
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Virtools 3D Life Player
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Visual C++ Runtime for Dragon NaturallySpeaking
WebCyberCoach 3.2 Dell
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live OneCare safety scanner
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
Windows Media Player 11
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB925766
Windows XP Service Pack 3
Works Upgrade

==== End Of File ===========================

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Hello, I'm back.
Updated MBAM, scanned, and repaired the 4 issues that it found.
All with no problem!
Here is the log:


Malwarebytes' Anti-Malware 1.42
Database version: 3391
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

12/18/2009 7:53:07 PM
mbam-log-2009-12-18 (19-53-07).txt

Scan type: Quick Scan
Objects scanned: 150165
Time elapsed: 8 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pltvtgld (Trojan.FakeAlert.N) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pltvtgld (Trojan.FakeAlert.N) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
Do them modified services return again?

descriptionAutomatic Update Virus, and then some... - Page 2 EmptyRe: Automatic Update Virus, and then some...

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum