http://www.bleepingcomputer.com/forums/ind...p;#entry1409427
and was requested to post a new topic on this thread.
I corrected redirection issues and blocked program updates with trojan remover, but now have some programs that will start, and then get shut down in process. Once they are killed, if I attempt to reopen them, I get an error that states:
"Windows cannot access the specific device, path or file. You may not have the appropriate permissions to access the item."
I can reinstall the program in order to run it again, but this behavior repeats and I cannot finish malware scans, ect. MalwareBytes showed the same behavior and I was unable to produce a lo, as did hijack this and Spybot S&D.
I did get a rootrepeal log from the previous thread suggestion, but only for drive c 'drivers'. I am now unable to run it again, as it shows the same behavior as described above. I was asked there also to try the DDS script, and it produced no output.
Here is the rootrepeal log:
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/09/01 23:25
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB4CBE000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xB864C000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB2AD8000 Size: 49152 File Visible: No Signed: -
Status: -
Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0xB8460000 Size: 20480 File Visible: No Signed: -
Status: -
Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xB4A8E000 Size: 61440 File Visible: No Signed: -
Status: -
==EOF==
Any help would be greatly appreciated.
NOTE!!!: AVG just posted this file as quarantined:
Name: Trojan horse generic14.EY
Path: C:\windows\system32\wingenocx.dll
Edited by Vgolfmaster, 02 September 2009 - 12:43 AM.