Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

b.exe, msa.exe, Win32.bagel


  • Please log in to reply

#1
AcerNY

AcerNY

    Member

  • Member
  • PipPip
  • 11 posts
Greetings

I am in serious need of help with my laptop. I have some malware which by all appearances seems to be very similar to the Win32.bagel virus - but I have never seen it specifically named as such on my computer. I have seen b.exe, and msa.exe. I searched for both of these and deleted whatever I could find, which either hurt me or did no good at all.

Symptoms: I am unable to double click the vast majority of programs to start them. Itunes, VLC, Lotusnotes, IE, etc. I can't right click and go into properties, or connect to another monitor, or even double click the clock on the bottom right. Each time an error pops up saying "... .exe is not a valid Win32 application."

I am also unable to install any programs, I receive the same error message.

Double-clicking on My Computer works, but also often either opens up firefox and brings me to a website - http://winshield2009...block.php?r=8.1 (the screen shows the page load error message, website not found..whether I am connected properly to the internet or not). The pop-up is not limited to using my computer, going through any system folders or directories seems to have an equal chance of causing the pop-up or new tab created in firefox. Not sure if this is related to the Win32 error, but it's also a problem.

Other error messages I have seen a number of times:
"Not enough quota is available to process this demand" - This has never made sense to me, I have over 2 gigs of free space on my HD, and at the times this msg came up, no other programs even running.
"Insufficient system resources available to complete requested service" - Again, same as above.
I've also seen an error msg about "(Null)" and locations not being seen or available or something. But then the folder will open up anyways once I click okay...

Attempted Fixes:

Malwarebytes - By changing the file extension to .com from .exe I am at least able to install the program. But again, upon installation in order to run the program I copy the .exe within the program directory and then change the copy to a .com extension and then it runs. But a few seconds into running a scan the program disappears and is gone from my taskmgr as well. Also - at this time after running it once I am unable to start it again, I just get an error message.

Gmer - I have tried dl'ing and running this program more than once. Even utilizing the .com file extension the scan does not fully run. No text logs are made, it seems to simply disappear similar to MBAM during or at the end of the scan.

CClean - With .com extension, I was able to use this program to its full extent.

FindyKill - I utilized this via .com file extension and followed the instruction. I have a log of the fixes if you would like. Unfortunately it has not seemed to positively effect my computer in any way.

Spybot S-D - Will not run properly even though I was able to install (again, with .com)

Kaspersky - I was able to do an online scan of my critical areas and can upload that .html log file. Unfortunately the service does not appear to be available currently and the free trial of 2010 I dl'ed won't install at all, so I can not go further with this program.

I have NOT tried combofix. I read too many threads on different forums and know not to touch unless I'm instructed to by someone way more skilled with malware removal than myself.

It may be possible that I screwed myself by deleting some critical files from the registry or from my Windows folder? Sometimes I don't remember to look before I leap.

I also DO NOT have access to safe mode on this computer (it is not mine, and I simply don't have access unfortunately), and can NOT get into msconfig to try and restore to an earlier point. When I try to use the command prompt, any .exe I type in receives the same "... is not a valid Win32 application." Likewise, I can not access the add / remove programs tab from the control panel. The same error occurs.


Apologies on length of this post, wanted to cover everything. Any and all help would be so greatly appreciated!!

Edited by AcerNY, 11 October 2009 - 05:20 PM.

  • 0

Advertisements


#2
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
Hi, AcerNY

Welcome.

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here. Please allow enough time for this application to complete the scan.

"%userprofile%\desktop\win32kdiag.exe" -f -r
  • 0

#3
AcerNY

AcerNY

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Hi J

Thanks for getting back to me. I downloaded the file, it would not install per your instructions.

I changed the file name from .exe to .com in both the file itself, as well as the command you had written for the command prompt.

Here is the log:

Running from: C:\Documents and Settings\a387384.eng-prod\desktop\win32kdiag.com

Log file at : C:\Documents and Settings\a387384.eng-prod\Desktop\Win32kDiag.txt

Removing all found mount points.

Attempting to reset file permissions.

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...



Found mount point : C:\WINDOWS\$hf_mig$\KB919007\KB919007

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB919007\KB919007

Found mount point : C:\WINDOWS\$hf_mig$\KB920213\KB920213

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB920213\KB920213

Found mount point : C:\WINDOWS\$hf_mig$\KB925454\KB925454

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB925454\KB925454

Found mount point : C:\WINDOWS\$hf_mig$\KB928090\KB928090

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB928090\KB928090

Found mount point : C:\WINDOWS\$hf_mig$\KB931784\KB931784

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB931784\KB931784

Found mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168

Found mount point : C:\WINDOWS\$hf_mig$\KB933360\KB933360

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB933360\KB933360

Found mount point : C:\WINDOWS\$hf_mig$\KB933566\KB933566

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB933566\KB933566

Found mount point : C:\WINDOWS\$hf_mig$\KB933729\KB933729

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB933729\KB933729

Found mount point : C:\WINDOWS\$hf_mig$\KB936357\KB936357

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB936357\KB936357

Found mount point : C:\WINDOWS\$hf_mig$\KB941568\KB941568

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB941568\KB941568

Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460

Found mount point : C:\WINDOWS\$hf_mig$\KB948590\KB948590

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\$hf_mig$\KB948590\KB948590

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\addins\addins

Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\Temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\Temp

Found mount point : C:\WINDOWS\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\temp\temp

Found mount point : C:\WINDOWS\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\assembly\tmp\tmp

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Config\Config

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Found mount point : C:\WINDOWS\CSC\d1\d1

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d1\d1

Found mount point : C:\WINDOWS\CSC\d2\d2

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d2\d2

Found mount point : C:\WINDOWS\CSC\d3\d3

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d3\d3

Found mount point : C:\WINDOWS\CSC\d4\d4

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d4\d4

Found mount point : C:\WINDOWS\CSC\d5\d5

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d5\d5

Found mount point : C:\WINDOWS\CSC\d6\d6

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d6\d6

Found mount point : C:\WINDOWS\CSC\d7\d7

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d7\d7

Found mount point : C:\WINDOWS\CSC\d8\d8

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\CSC\d8\d8

Found mount point : C:\WINDOWS\Downloaded Program Files\WebEx\726\One\One

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Downloaded Program Files\WebEx\726\One\One

Found mount point : C:\WINDOWS\i386\WIN9XMIG\MSNEXPLR\MSNEXPLR

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\i386\WIN9XMIG\MSNEXPLR\MSNEXPLR

Found mount point : C:\WINDOWS\ime\chsime\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\chsime\applets\applets

Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imejp\applets\applets

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imejp98\imejp98

Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Found mount point : C:\WINDOWS\ime\shared\res\res

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\ime\shared\res\res

Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0

Found mount point : C:\WINDOWS\Internet Logs\Internet Logs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Internet Logs\Internet Logs

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\java\classes\classes

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\java\trustlib\trustlib

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\9c2788bd\fdfc82a1\assembly\temp\temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\9c2788bd\fdfc82a1\assembly\temp\temp

Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\9c2788bd\fdfc82a1\assembly\tmp\tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\9c2788bd\fdfc82a1\assembly\tmp\tmp

Found mount point : C:\WINDOWS\Minidump\Minidump

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Minidump\Minidump

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\msapps\msinfo\msinfo

Found mount point : C:\WINDOWS\msdownld.tmp\msdownld.tmp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\msdownld.tmp\msdownld.tmp

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint

Found mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Config\News\News

Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles

Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs

Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS

Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM

Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp

Found mount point : C:\WINDOWS\PIF\PIF

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\PIF\PIF

Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Registration\CRMLog\CRMLog

Found mount point : C:\WINDOWS\security\logs\logs

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\security\logs\logs

Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\10\msft\windows\windows

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\10\msft\windows\windows

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\10\policy\msft\windows\windows

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\10\policy\msft\windows\windows

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\51\msft\windows\system\system

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\51\msft\windows\system\system

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\51\policy\msft\windows\system\system

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\51\policy\msft\windows\system\system

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\52\msft\windows\net\net

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\52\msft\windows\net\net

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\52\policy\msft\windows\networking\networking

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\52\policy\msft\windows\networking\networking

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\60\msft\windows\common\common

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\60\msft\windows\common\common

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\60\policy\60\60

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\60\policy\60\60

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\60\policy\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\60\policy\msft\msft

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\70\msft\windows\windows

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\70\msft\windows\windows

Found mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\70\policy\msft\msft

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\backup\asms\70\policy\msft\msft

Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment

Cannot access: C:\WINDOWS\system32\eventlog.dll

Attempting to restore permissions of : C:\WINDOWS\system32\eventlog.dll

[1] 2008-04-13 20:11:53 56320 C:\WINDOWS\SoftwareDistribution\Download\65cb51275f131ad95a646f305f973e3a\eventlog.dll (Microsoft Corporation)

[1] 2004-08-03 20:56:00 55808 C:\WINDOWS\system32\dllcache\eventlog.dll (Microsoft Corporation)

[1] 2004-08-03 20:56:00 61952 C:\WINDOWS\system32\eventlog.dll ()

[2] 2004-08-03 20:56:00 55808 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation)



Cannot access: C:\WINDOWS\system32\wbem\wmiprvse.exe

Attempting to restore permissions of : C:\WINDOWS\system32\wbem\wmiprvse.exe

Found mount point : C:\WINDOWS\Temp\notes782185\notes782185

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Temp\notes782185\notes782185

Found mount point : C:\WINDOWS\Temp\WMFA\WMFA

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\Temp\WMFA\WMFA

Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp

Mount point destination : \Device\__max++>\^

Removing mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp



Finished!
  • 0

#4
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
Hi, AcerNY :)

Download SREng
  • Extract it to Desktop and double click SREngLdr.EXE to run it
  • Select System Repair from the left pane.
  • Click on File Association
  • Select all entries that has an Error status click [Repair]
  • Refer to this image for an example:

    Posted Image
  • Close SREng now.
Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
  • If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".
  • During the download, rename Combofix to Combo-Fix as follows:

    Posted Image

    Posted Image

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    -----------------------------------------------------------

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      -----------------------------------------------------------

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    -----------------------------------------------------------

  • Double click on combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" .
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**


Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.
  • 0

#5
AcerNY

AcerNY

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Hiya J

Well good news and bad news.

I was able to DL and run SREng. So now my .exe files seem to be all fixed (thank you!!) but CF is another story.

Was able to download and install the program. But when I run the program... upon reboot of my machine and after I enter my ID / Password to access - it starts to scan the system but about a minute in or less a message pops up saying:

"ComboFix has detected the presence of rookit activity and needs to reboot the machine." I tried it a total of three times each with the same result. I have a few thoughts...

1) I am not able to remove Symantec Antivirus 10.1.5 from my laptop. It's protected as it's a corporate thing, although I've never utilized it and I don't think it's even fully functional. To remove it, I apparently need a password which I do not have.

2) Before CF starts running, there's two messages that popped up each time. Something along the lines of
-could not find C:\combo-fix\update-cf.cmd
&
-'update-cf.cmd' is not an operable batch something something something.
Could these be indicative of anything? Figured I'd let you know.

Also - I now have Antivirus Pro 2010 pop ups coming once in a while now, as well as an icon for it on my desktop which I previously did not have. I think I'd had it at one time, but deleted it.

Thank you for the continued assistance!
  • 0

#6
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive.
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

  • 0

#7
AcerNY

AcerNY

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
J

Here is the report from RootRepeal

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/10/12 15:29
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xAA9D5000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7AC8000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA993A000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\Documents and Settings\a387384.eng-prod\Recent
Status: Visible to the Windows API, but not on disk.

Path: c:\program files\at&t global network client\diagnostics.txt
Status: Size mismatch (API: 98887, Raw: 98710)

Path: C:\Documents and Settings\a387384.eng-prod\Local Settings\Temp\plugtmp\plugin-fringe_FR204.xml
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\a387384.eng-prod\Local Settings\Temp\plugtmp\plugin-json
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\a387384.eng-prod\Local Settings\Temp\plugtmp\plugin-json-1
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\a387384.eng-prod\Local Settings\Temp\plugtmp\plugin-json-2
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\a387384.eng-prod\Local Settings\Temp\plugtmp\plugin-json-3
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\a387384.eng-prod\Local Settings\Temp\plugtmp\plugin-json-4
Status: Visible to the Windows API, but not on disk.

==EOF==
  • 0

#8
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
That wont help.

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.

  • 0

#9
AcerNY

AcerNY

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
This doesn't look too helpful either...

GMER 1.0.15.15146 - http://www.gmer.net
Rootkit scan 2009-10-12 19:08:16
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\A38738~1.ENG\LOCALS~1\Temp\axtdqpoc.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Tcp drv.sys (drv/drv)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device A9C08C8A

AttachedDevice fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device Cdfs.SYS (CD-ROM File System Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERNestedWindowLimit 100

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR

---- EOF - GMER 1.0.15 ----
  • 0

#10
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
Very strange. There are no detectable rootkits.

  • Please download Junction.zip and save it.
  • Unzip it and put junction.exe in the Windows directory (C:\Windows).
  • Go to Start => Run... => Copy and paste the following command in the run box and click OK:

    cmd /c junction -s c:\ >"%Userprofile%\desktop\Log.txt"

    A report (Log.txt) should be produced on your desktop. Allow this application to run until finished. Copy and paste or attach the content of the repor in a reply.

  • 0

Advertisements


#11
AcerNY

AcerNY

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
The log contains nothing whatsoever, nothing at all to copy paste.

It doesn't even seem to run for a full second. =/
  • 0

#12
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
Download OTS.exe by OldTimer to your Desktop.
  • Close any open browsers.
  • Double-click on OTS.exe to start the program.
  • Leave all settings as they appear as default, except for the following:
    • Under Drivers, select "All".
    • Under Additional Scans, click on the "Extra" button.
  • Now click the Run Scan button on the toolbar.
  • The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Save that notepad file
Use the Reply button and attach the notepad file here (Do not copy and paste in a reply, rather attach it to it).
  • 0

#13
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
Also:

Download the enclosed folder. Save and extract its contents to the desktop. Once extracted, open the folder and double click on the RunMe.bat file. Post the resulting report.
  • 0

#14
AcerNY

AcerNY

    Member

  • Topic Starter
  • Member
  • PipPip
  • 11 posts
Hi J

Here is the attachment for OTS

Attached File  OTS.Txt   285.83KB   475 downloads

Here is the text from FindDrv


----a-w 9,344 2009-07-02 15:29:50 C:\Program Files\drv\drv.sys

Entries: 1 (1)
Directories: 0 Files: 1
Bytes: 9,344 Blocks: 19

Hope this helps, thanks for the continuing help
  • 0

#15
JSntgRvr

JSntgRvr

    Global Moderator

  • Global Moderator
  • 11,579 posts
Start OTS. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.


[Kill Explorer]
[Unregister Dlls]
[Processes - Safe List]
YY -> seres.exe -> C:\Documents and Settings\a387384.eng-prod\Application Data\seres.exe
YY -> svcst.exe -> C:\Documents and Settings\a387384.eng-prod\Application Data\svcst.exe
[Win32 Services - Safe List]
YY -> (AntipPro2009_12) AntipyPro_12 [Win32_Own | Disabled | Stopped] -> C:\WINDOWS\svchast.exe
[Driver Services - All]
YY -> (drvdrv) drvdrv [Kernel | System | Running] -> C:\Program Files\drv\drv.sys
[Registry - Safe List]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "combofix" -> C:\WINDOWS\System32\CF17132.exe ["C:\WINDOWS\system32\CF17132.exe" /c "C:\Combo-Fix\C.bat"]
YN -> "IDDAudit" -> C:\asset\bin\ReAudit.vbs [C:\asset\bin\ReAudit.vbs]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "FixMyRegistryTray" -> C:\Program Files\Smart PC Solutions\Fix My Registry\FixMyRegistryTray.exe [C:\Program Files\Smart PC Solutions\Fix My Registry\FixMyRegistryTray.exe]
YY -> "mserv" -> C:\Documents and Settings\a387384.eng-prod\Application Data\svcst.exe [C:\Documents and Settings\a387384.eng-prod\Application Data\svcst.exe]
YY -> "svchost" -> C:\Documents and Settings\a387384.eng-prod\Application Data\svcst.exe [C:\Documents and Settings\a387384.eng-prod\Application Data\svcst.exe]
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4240 domain(s) found.
YN -> 32 domain(s) and sub-domain(s) not assigned to a zone. ->
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found.
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
*SecurityProviders* -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
YY -> mcenspc.dll -> C:\WINDOWS\System32\mcenspc.dll
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders
[Files/Folders - Modified Within 30 Days]
NY -> At1.job -> C:\WINDOWS\tasks\At1.job
NY -> win32k.sys -> C:\WINDOWS\win32k.sys
NY -> ~.exe -> C:\WINDOWS\System32\~.exe
[Empty Temp Folders]
[Start Explorer]
[Reboot]



The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTS scan.

I will review the information when it comes back in. Attempt to run Combofix after running this fix.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP