Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


can't remove antivirus soft

  • This topic is locked This topic is locked
4 replies to this topic

#1 lilyleespo


  • Members
  • 7 posts
  • Local time:07:55 AM

Posted 10 March 2010 - 04:40 PM

I attempted to remove the Antivirus soft "ransomware" following instructions posted by Grinler, but it was not completely removed (or I did something wrong?)

This virus is not on my computer. I am saving everything on a flashdrive, installing it on infected computer, saving logs back on flash drive, than uploading here. I am only telling you beause when I attempted to follow the instructions in the "Preparation Guide", I was not able to activate the firewall. When I accessed Network settings, there was nothing listed there. I don't know if that is becuase the computer is not connected to the internet, or if this another problem, so the firewall on the infected computer has not been activated. These are the steps I have taken.

Ran rkill. Nothing reported. Ran iExplore. Nothing reported. Ran Malwarebyte's Anti-Malware. Removed 29 or so files. After restarting out of safe mode, still getting infected files. So here is the result from following "preparation Guide for use before using malware removal tools and requesting help"

Following is my DDS log

DDS (Ver_09-12-01.01) - NTFSx86 MINIMAL
Run by Administrator at 16:49:36.46 on Mon 03/08/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.260 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k netsvcs

============== Pseudo HJT Report ===============

uStart Page = hxxp://inside.emmis.com/
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - d:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey
mRun: [HP Software Update] "d:\program files\hp\hp software update\HPWuSchd2.exe"
mRun: [ToolBoxFX] "d:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
mRun: [hoxrlans] c:\documents and settings\hogan\local settings\application data\vyvujl\jtjbsftav.exe
mRun: [LWBMOUSE] d:\program files\tech\wheel mouse\5.0\MOUSE32A.EXE
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - d:\program files\microsoft office\office10\OSA.EXE
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - d:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: d:\docume~1\alluse~1\startm~1\programs\startup\mywebs~1.lnk - c:\program files\mywebsearch\bar\1.bin\MWSOEMON.EXE
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\MSMSGS.EXE
Trusted Zone: aol.com\free
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {3334504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263502225315
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

S2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2004-6-8 98304]
S2 USBBC;USB Bridge Cable (Windows 2000);c:\windows\system32\usbbc20.sys --> c:\windows\system32\USBBC20.sys [?]
S3 USRWDXJS;USRWDXJSMiniPCI Winmodem;c:\windows\system32\drivers\USRWDXJS.sys [2002-4-29 687999]
S3 WDXJBAA;WDXJBAAMiniPCI Winmodem;c:\windows\system32\drivers\WDXJBAA.sys [2001-8-16 693248]
S4 AloPort;AloPort;c:\windows\system32\drivers\AloPort.sys [2002-7-15 3087]

=============== Created Last 30 ================

2010-03-08 21:48:40 0 ----a-w- c:\documents and settings\administrator\defogger_reenable
2010-03-04 20:17:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-04 20:16:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 20:16:54 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-04 19:01:19 0 d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes
2010-03-04 19:01:05 0 d-----w- d:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-04 18:53:13 0 d-sh--w- c:\documents and settings\administrator\PrivacIE
2010-03-04 18:53:06 0 d-sh--w- c:\documents and settings\administrator\IETldCache
2010-03-04 17:57:50 0 d-----w- d:\docume~1\alluse~1\applic~1\Alwil Software
2010-03-04 16:26:33 0 d-----w- c:\windows\system32\CatRoot_bak
2010-02-21 21:33:43 7680 --sha-w- c:\windows\Thumbs.db
2010-02-11 20:25:57 0 d-----w- c:\program files\common files\Hewlett-Packard
2010-02-11 20:23:22 0 d-----w- c:\windows\system32\URTTemp
2010-02-11 20:22:07 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2010-02-11 20:22:07 65536 ----a-w- c:\windows\system32\HPZinw12.exe
2010-02-11 20:22:07 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2010-02-11 20:14:41 53630 ----a-w- c:\windows\hppins02.dat
2010-02-11 20:14:41 2037 ------w- c:\windows\hppmdl02.dat
2010-02-11 19:14:07 928 ----a-w- c:\windows\hpbvspst.hi1
2010-02-11 19:14:07 548 ----a-w- c:\windows\hpbvspst.bu1
2010-02-11 19:13:46 3809 ----a-w- c:\windows\hpbvnstp.hi1
2010-02-11 19:13:46 1301 ----a-w- c:\windows\hpbvnstp.bu1
2010-02-11 19:13:32 508 ----a-w- c:\windows\system32\HPPAPR01.DAT
2010-02-11 19:13:32 208896 ----a-w- c:\windows\system32\HPPAPR01.DLL
2010-02-11 19:13:23 266240 ----a-r- c:\windows\system32\hppasc01.dll
2010-02-11 19:06:56 928 ----a-w- c:\windows\hpbvspst.his
2010-02-11 19:06:56 548 ----a-w- c:\windows\hpbvspst.ini
2010-02-11 19:06:34 3809 ----a-w- c:\windows\hpbvnstp.his
2010-02-11 19:06:34 1301 ----a-w- c:\windows\hpbvnstp.ini
2010-02-11 19:02:09 0 d-----w- c:\windows\system32\NtmsData
2010-02-11 19:01:36 45056 ----a-w- c:\windows\system32\HPPAPTS0.DLL
2010-02-11 19:01:36 36864 ----a-w- c:\windows\system32\HPPASNM0.DLL
2010-02-11 19:01:36 36864 ----a-w- c:\windows\system32\HPPAPML0.DLL
2010-02-11 19:01:36 36864 ----a-w- c:\windows\system32\HPPADT40.DLL
2010-02-11 19:01:36 32768 ----a-w- c:\windows\system32\HPPAMON0.DLL
2010-02-11 19:01:33 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2010-02-11 19:00:41 765952 ----a-r- c:\windows\system32\hpptpml3.dll
2010-02-11 19:00:41 73728 ----a-w- c:\windows\system32\HPZipm12.exe
2010-02-11 19:00:41 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2010-02-11 19:00:41 278528 ----a-r- c:\windows\system32\hpgwiamd.dll
2010-02-11 19:00:41 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2010-02-11 19:00:40 8704 ----a-w- c:\windows\system32\drivers\Dot4Scan.sys
2010-02-11 19:00:36 49920 ----a-r- c:\windows\system32\drivers\HPZid412.sys
2010-02-11 19:00:26 9344 ----a-r- c:\windows\system32\drivers\hpfxbulk.sys
2010-02-11 19:00:26 17024 ----a-r- c:\windows\system32\drivers\hpfxgen.sys
2010-02-11 19:00:26 102400 ----a-r- c:\windows\system32\hpfxbulk.dll
2010-02-11 18:56:41 0 d-----w- c:\program files\HP
2010-02-10 18:43:24 0 d-----w- d:\docume~1\alluse~1\applic~1\AVS4YOU
2010-02-10 18:39:48 0 d-----w- c:\program files\common files\AVSMedia
2010-02-10 18:28:01 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-02-10 18:28:01 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-02-10 18:28:01 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-02-10 18:28:01 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-02-10 18:28:00 24576 ----a-w- c:\windows\system32\msxml3a.dll

==================== Find3M ====================

28962-12-07 10:07:32 3087 -c--a-w- c:\windows\system32\drivers\AloPort.sys
2010-01-23 14:54:46 1386496 ----a-w- c:\windows\system32\msvbvm60.dll
2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 12:58:04 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:35:35 33280 ----a-w- c:\windows\system32\csrsrv.dll

============= FINISH: 16:50:00.26 ===============

Attached Files

Edited by lilyleespo, 10 March 2010 - 04:41 PM.

BC AdBot (Login to Remove)


#2 etavares


    Bleepin' Remover

  • Malware Response Team
  • 15,514 posts
  • Gender:Male
  • Local time:08:55 AM

Posted 13 March 2010 - 09:12 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please also continue to work with me until I give you the all clear. Even if your computer appears to act better, you may still be infected.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.

Once we start working together, please reply back within 3 days or this thread may be closed so we can help others who are waiting.

We need to create an OTL report,
  • Please download OTL from this link.
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under the Custom Scan box paste this in:

    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\*. /mp /s

  • Click the Quick Scan button.
  • The scan should take a few minutes.
  • Please copy and paste both logs in your reply.

In your reply, please post both OTL logs.

If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators

#3 lilyleespo

  • Topic Starter

  • Members
  • 7 posts
  • Local time:07:55 AM

Posted 13 March 2010 - 11:40 AM

It seems that I have removed the malicious software. Now have issues with not being able to run any antivirus software and access the internet. I will search other forums for possible fixes. Thanks for your help!

#4 etavares


    Bleepin' Remover

  • Malware Response Team
  • 15,514 posts
  • Gender:Male
  • Local time:08:55 AM

Posted 14 March 2010 - 09:40 AM

OK, thanks for letting me know. We have Windows XP forums here at Bleeping Computer. If you would like a second opinion too see if your issues are malware related, please follow the steps above. Up to you.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators

#5 etavares


    Bleepin' Remover

  • Malware Response Team
  • 15,514 posts
  • Gender:Male
  • Local time:08:55 AM

Posted 19 March 2010 - 04:16 PM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. smile.gif

If you are the topic starter, and need this topic reopened, please contact me via PM with the address of this thread.

Everyone else please begin a new topic.

If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users