Question

Virus Removal - Cannot delete file or Registry Entries

Asked by: computerhandyman

Here is the situation...I can't remove a virus or its registry entries... INFO:
" Virus = cryptex.dll
" Registry Entry = HKEY_CLASSES_ROOT\CLSID\{12BEC510-8720-4517-A982-74A4D6952FD8}
" Registry Entry = HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSERHELPEROBJECTS\{12BEC510-8720-4517-A982-74A4D6952FD8}
" Ran NIS, with full updates, from desktop & Safe Mode - It recognizes the file exist and a high risk virus... But can't do anything about it.. The best option I get is to "Review" (Symantec's Website)
" So, tried all Symantec's procedures (Disable System Restore, Safe Mode - Admin = ACCESS DENIED)
" Tried MoveOnBoot to remove file = NO GOOD
" Ran regedit & regedt32 (same thing in XP Home SP2) to delete entries = ACCESS DENIED
" Ran regedit & regedt32 (same thing in XP Home SP2) to change entries permissions = ACCESS DENIED
" Ran latest Ad-Aware to remove = NO GOOD
" Ran latest HiJackThis to remove = Comes Back

The list goes on.. I usually read and read and try and try before I giving into posting a question.. And here I am.. COMPLETELY STUMPED!

How, When & What to do/use to get rid of this Virus.. And maybe Why if you have the time..Please & Thank You!!!

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2008-04-09 at 19:19:56ID23310350
Tags: Microsoft
,; Windows XP
,; SP2
,; Virus Removal
Topics: Anti-Virus
,; Windows XP Operating System
Participating Experts: 3
Points: 125
Comments: 26

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: orangutangPosted on 2008-04-09 at 19:25:47ID: 21321192

Run ComboFix (http://download.bleepingcomputer.com/sUBs/ComboFix.exe), send us the log and an updated HijackThis log.

by: DelphineousPosted on 2008-04-09 at 19:26:28ID: 21321196

Have you tried Combofix yet?

Download ComboFix (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) and save on your hard drive.

I found booting into Windows Safe Mode (F8 on startup - before you see the Windows startup screen) ensures limited interference from malicious software and any installed security software.

Run ComboFix and let it finish - do not click outside the window or run any software. ComboFix will restart windows as part of its process then run "Find 3m". Once complete it will display a log in notepad showing what it found and removed, as well as some other information. You are welcome to post the log file as a "Code Snippet" for further analysis by an Expert here.

by: rpggamergirlPosted on 2008-04-09 at 19:28:44ID: 21321206

Can you post the hijackthis log here please so we can see what's going on.

A BHO entries in hijackthis with a matching 020 entry usually can't be removed using hijackthis alone, it usually need a special tool to remove it

What we need to see is your hijackthis log, thanks!

by: rpggamergirlPosted on 2008-04-09 at 19:31:26ID: 21321215

If you download and run Combofix, just run it in normal mode.
Safe mode is only necessary if pc can't boot in normal mode.

by: computerhandymanPosted on 2008-04-09 at 19:50:43ID: 21321286

Well.. Hello folks.. Thanks for all the fast responses.. I was in the process of downloading and running ComboFix. Once that is finished I will post the log.. Hang in there a few minutes and I'll post the HJT log.. Delphineous: - Sorry if I didn't make clear that I was in Safe Mode, as Administrator with the attempts to delete the file, change or delete the registry entries, along with trying from the desktop..

by: computerhandymanPosted on 2008-04-09 at 20:06:12ID: 21321365

Here is the HJT log.. Here is the NIS log.. I've also ran PrevXCSI, which also found the file in question, but I haven't, nor want to, purchase a license, just to get rid of this pesky item... Sorry for the delay of a few minutes.. Had to email it off the laptop, which is running so sloooowwww....

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:00:58 PM, on 4/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\Owner\My Documents\VirusRemovalTools\HiJackThis\HiJackThis_v2.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/comcast.html
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {12BEC510-8720-4517-A982-74A4D6952FD8} - C:\WINDOWS\system32\cryptex.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [mount.exe] C:\Program Files\GiPo@Utilities\FileUtilities.3\mount.exe /z
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\\PrevxCSI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
 
--
End of file - 5890 bytes

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:

Select all Open in new window

by: computerhandymanPosted on 2008-04-09 at 20:16:52ID: 21321415

New to ComboFix.. Will it hang and / or fail on "Attempting to Create a new System Restore Point" if System Restore is disabled?

by: DelphineousPosted on 2008-04-09 at 20:23:56ID: 21321450

No - but the program does take a long time to run sometimes. Especially, if you click with the mouse or keyboard while it is running.

by: rpggamergirlPosted on 2008-04-09 at 20:24:16ID: 21321451

I don't know, it might hang or may just skip that bit. Combofix is a high risk and very powerful tool.

OR: you can remove it with avenger.
Please download The Avenger by Swandog46 to your Desktop.
http://swandog46.geekstogo.com/avenger.zip

*Click on Avenger.zip to open the file
*Extract avenger.exe to your desktop

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, copy,then paste the following text(all text inside the lines below):

-----------------------------------------------------------------------------------------------------------
Files to delete:
C:\WINDOWS\system32\cryptex.dll

Registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{12BEC510-8720-4517-A982-74A4D6952FD8}
------------------------------------------------------------------------------------------------------------

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt when you've done.

by: DelphineousPosted on 2008-04-09 at 20:28:26ID: 21321470

You may want to consider eliminating the duplicate Anti-spyware software - at least from running full time. I see by your hijack log that you are running Ad-Aware and Prevx CSI.
Your log actually looks pretty good. Hopefully ComboFix will fix some of the damage caused by virus/spyware.
I am not too familiar with Prevx - does it have a feature to protect the registry?

by: computerhandymanPosted on 2008-04-09 at 20:28:36ID: 21321471

Well, I'm going to stop ComboFix for now.. We can come back to it, if needed.. But, I'm going to try the advise of rpggamergir now...

by: rpggamergirlPosted on 2008-04-09 at 20:41:13ID: 21321514

Please note, the second reg key that I added there (the one which wasn't showing in your Hijackthis log).

by: computerhandymanPosted on 2008-04-09 at 21:00:56ID: 21321587

Well... I don't believe that worked.. But.. hey, thanks.. keep it coming.. I've attached the avenger log, along with NIS log, that I said I was going to post from earlier.. Oh, I also have tried cmd delete from the Desktop and Safe Mode = NO GOOD!.. Let me ask you.. I'm thinking that NIS has associations to the file and registry entries... and I'm thinking maybe I should uninstall it.. Then try the cycle of deleting the files.. The dialog window from NIS will never perminantly go away everytime the laptop reboots.. I click "OK" and 30 seconds later.. Boom-ya.. Back again.. Now, I really don't want to.. b/c the laptop is owned by my father and I don't want to go through exporting the subscribtion, re-installing it and all that..

What else.. just ask away if needed...

//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////
 
Platform: Windows XP (build 2600, Service Pack 2)
Wed Apr 09 23:46:12 2008
 
23:46:09: Error: Invalid registry syntax in command:
"[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8}]"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line.  (Registry key deletion mode)  
23:46:12: Error: Execution aborted by user!
 
 
//////////////////////////////////////////
 
 
//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////
 
Platform: Windows XP (build 2600, Service Pack 2)
Wed Apr 09 23:46:45 2008
 
23:46:43: Error: Invalid registry syntax in command:
"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8}]"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line.  (Registry key deletion mode)  
23:46:45: Error: Execution aborted by user!
 
 
//////////////////////////////////////////
 
 
//////////////////////////////////////////
  Avenger Pre-Processor log
//////////////////////////////////////////
 
Platform: Windows XP (build 2600, Service Pack 2)
Wed Apr 09 23:47:31 2008
 
23:47:20: Error: Invalid registry syntax in command:
"[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8}]"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line.  (Registry key deletion mode)  
23:47:26: Error: Invalid registry syntax in command:
"[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{12BEC510-8720-4517-A982-74A4D6952FD8}]"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line.  (Registry key deletion mode)  
 
 
//////////////////////////////////////////
 
 
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
 
Platform:  Windows XP
 
*******************
 
Script file opened successfully.
Script file read successfully.
 
Backups directory opened successfully at C:\Avenger
 
*******************
 
Beginning to process script file:
 
Rootkit scan active.
No rootkits found!
 
 
Error:  could not open file "C:\WINDOWS\system32\cryptex.dll"
Deletion of file "C:\WINDOWS\system32\cryptex.dll" failed!
Status: 0xc0000022 (STATUS_ACCESS_DENIED)
 
 
Completed script processing.
 
*******************
 
Finished!  Terminate.
 
 
 
------------------------------NIS LOG--------------------------------
 
Scan results:
--------------------------------------------------------------------------------
Scan Start Time4/8/2008 12:49:27 AM 
 
Scan time: 64 minutes 0 seconds 
 
 
Items Scanned: 201413
Registry Sections: 7888
No action taken: 2
Files: 192147
Repair failed: 1
Processes: 42
Batch Files: 7
INI Files: 1
Services: 954
Startup Programs: 9
COM Type: 53
HOSTS: 90
Layered Service Providers: 3
Unknown Type: 219
No action taken: 1
Threats Remediated: 0
Threats Remaining: 1
Details
Trojan Horse : Repair failed
Manual Scanner 
Risk category: Virus 
Click for more information about this risk : Trojan Horse 
Action taken: Repair failed 
Description: Affected areas:
1 Files:
c:\windows\system32\cryptex.dll - Repair failed
 
2 Registry keys:
HKEY_CLASSES_ROOT\CLSID\{12BEC510-8720-4517-A982-74A4D6952FD8} - No action taken
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8} - No action taken
 
1 Additional areas: 
Unknown - No action taken
 
 
 
-------------------------------------------------------------------------
 
 
 
Source: Manual Scanner 
Risk category: Virus 
Click for more information about this risk : Trojan Horse 
Action taken: Repair failed 
Description: Affected areas:
1 Files:
c:\windows\system32\cryptex.dll - Repair failed
 
2 Registry keys:
HKEY_CLASSES_ROOT\CLSID\{12BEC510-8720-4517-A982-74A4D6952FD8} - No action taken
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8} - No action taken
 
1 Additional areas: 
Unknown - No action taken

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:

Select all Open in new window

by: computerhandymanPosted on 2008-04-09 at 21:07:27ID: 21321625

Looks like I may need to remove the "-" from the beginning of the keys...?

by: orangutangPosted on 2008-04-09 at 21:13:59ID: 21321653

Also, try SUPERAntiSpyware (http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE)

by: computerhandymanPosted on 2008-04-09 at 21:27:49ID: 21321715

Does everyone see here how many applications I've tried.. Don't get me wrong.. I will do one after another, if needed.. But, I would think there must be a way through Windows.. One way or another.. Maybe I'm wrong..or maybe I'm getting frustrated with downloading app after app, posting log after log.. ( AND I KNOW IT HELPS EVERYONE GET A BETTER UNDERSTANDING ), but I've read enough about HJT, ComboFix, AdAware, Norton, McAfee, MoveOnBoot, PrevX, AVG, Avenger, ext.. ext.. ext.. now.. SUPERAntiSpyware.. What happen to finding a way.. (Excuse me as I vent..) I'm always appreciative of assistance through communities and replies from other experts and / or users.. It's just the endless cycle of BS.. Why do they exist in such abundances.. both virus / spyware & apps that fix them..

I will agree.. It may be time to walk away and get some sleep (12:30AM EST and I do work at 7:00AM).. But it was a " - " minus sign...

by: computerhandymanPosted on 2008-04-09 at 21:31:00ID: 21321726

One last evening post.. I will be checking in during the work day tomorrow.. and hopefully will have time to execute proposals and reply back.. AS ALWAYS THOUGH.. Thanks in advanced for everyone's time and considerations..

by: rpggamergirlPosted on 2008-04-09 at 21:31:11ID: 21321727

I'm very sorry...
Yes you need to removed those.....
I've got confused with Combofix CFScript......

Please try Avenger again it should work:

Files to delete:
C:\WINDOWS\system32\cryptex.dll

Registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{12BEC510-8720-4517-A982-74A4D6952FD8}
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{12BEC510-8720-4517-A982-74A4D6952FD8}

by: rpggamergirlPosted on 2008-04-10 at 07:13:04ID: 21324965

computerhandyman,
According to the info I received, it could be a rootkit driver that's protecting the file and reg entries from being removed.

Can you please attach the combofix log? If you stopped combofix before, can you please run it again and show us the logfile?
If it's a rootkit, then combofix should get it, or should show up in the log, then we should be able to remove the file, thanks.

by: computerhandymanPosted on 2008-04-10 at 10:03:14ID: 21326968

I will try to run that today here at work.. People have said it takes a while to complete huh? Also, I ran the avenger again, but to no avail.. Still there.. I'll come back in a few hours.. What about running Spyware Doctor (PCTools.com).. I've read good things about that too... I guess just add it to the list.. haha..

by: computerhandymanPosted on 2008-04-10 at 12:14:01ID: 21328318

Hey ya'll.. Looks like ComboFix might have done the job.. Glanced at the log .. looks like the files are gone and their companions.. I haven't hooked it up here at work through our network to play safe.. But, I will get it off, read it thoroughly and post here for the minds to digest.. Thanks again.. Check back soon..

by: computerhandymanPosted on 2008-04-10 at 13:36:07ID: 21329107

OK.. Here is the ComboFix log.. Have at it.. Looks like from the first few lines.. C:\WINDOWS\system32\cryptex.dll was deleted.. NIS didn't annoy me when I rebooted.. I'm not sure if the registry entries were deleted.. I will double check that too.. {12BEC510-8720-4517-A982-74A4D6952FD8}

ComboFix 08-04-09.8 - Owner 2008-04-10 14:50:24.1 - NTFSx86
Running from: C:\Documents and Settings\Owner\My Documents\VirusRemovalTools\ComboFix\ComboFix.exe
 
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\WINDOWS\system32\cpmrotate.dll
C:\WINDOWS\system32\cryptex.dll
C:\WINDOWS\system32\drivers\lmkcjuoo.dat
C:\WINDOWS\system32\ninjaext.dll
D:\Autorun.inf
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Service_ilcffezs
-------\Legacy_ilcffezs
-------\ilcffezs
 
 
(((((((((((((((((((((((((   Files Created from 2008-03-10 to 2008-04-10  )))))))))))))))))))))))))))))))
.
 
2008-04-10 00:32 . 2008-04-10 00:32	<DIR>	d--------	C:\Program Files\SUPERAntiSpyware
2008-04-10 00:32 . 2008-04-10 00:32	<DIR>	d--------	C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2008-04-10 00:32 . 2008-04-10 00:32	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-09 02:02 . 2008-04-09 02:02	<DIR>	d--------	C:\Program Files\Lavasoft
2008-04-09 02:02 . 2008-04-09 02:02	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-09 02:01 . 2008-04-10 00:32	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard
2008-04-09 01:52 . 2008-04-09 01:52	<DIR>	d--------	C:\Program Files\PrevxCSI
2008-04-09 01:52 . 2008-04-09 01:54	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-04-09 01:52 . 2008-04-09 01:53	10,880	--a------	C:\WINDOWS\system32\drivers\pxark.sys
2008-04-09 00:02 . 2008-04-09 00:02	<DIR>	d--------	C:\Program Files\GiPo@Utilities
2008-04-09 00:02 . 2008-04-09 00:02	<DIR>	d--------	C:\Program Files\Common Files\Gibinsoft Shared
2008-04-08 22:34 . 2004-08-27 05:54	<DIR>	d--------	C:\Documents and Settings\Administrator.LAPTOP\WINDOWS
2008-04-08 22:34 . 2006-04-17 18:26	<DIR>	d--------	C:\Documents and Settings\Administrator.LAPTOP\Application Data\SampleView
2008-03-20 18:57 . 2008-03-20 18:57	268	--a------	C:\ez_log.htm
2008-03-18 22:33 . 2008-03-18 22:36	10,740	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-18 22:33 . 2008-03-18 22:36	805	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-17 20:32 . 2008-04-08 00:38	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2008-03-17 20:32 . 2008-03-17 20:32	1,409	--a------	C:\WINDOWS\QTFont.for
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 18:49	---------	d-----w	C:\Program Files\Common Files\Symantec Shared
2008-04-08 04:55	---------	d-----w	C:\Documents and Settings\Owner\Application Data\Skype
2008-04-08 04:40	---------	d-----w	C:\Documents and Settings\Owner\Application Data\skypePM
2008-04-03 23:58	---------	d-----w	C:\Program Files\Norton Internet Security
2008-04-02 20:06	0	----a-w	C:\WINDOWS\system32\drivers\lvuvc.hs
2008-04-02 20:06	0	----a-w	C:\WINDOWS\system32\drivers\logiflt.iad
2008-04-01 23:10	---------	d-----w	C:\Documents and Settings\Owner\Application Data\U3
2008-03-19 02:36	123,952	----a-w	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-19 02:36	---------	d-----w	C:\Program Files\Symantec
2008-03-07 20:35	---------	d-----w	C:\Documents and Settings\Owner\Application Data\AdobeUM
2008-03-03 23:51	---------	d-----w	C:\Program Files\Avery Wizard 3.1
2008-03-03 23:28	---------	d-----w	C:\Program Files\Google
2008-03-01 20:19	---------	d-----w	C:\Program Files\Common Files\AOL
2008-03-01 20:19	---------	d-----w	C:\Documents and Settings\All Users\Application Data\AOL
2008-03-01 20:16	---------	d-----w	C:\Program Files\AIM
2008-03-01 20:16	---------	d-----w	C:\Documents and Settings\Owner\Application Data\Aim
2008-03-01 03:54	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-03-01 03:52	---------	d-----w	C:\Program Files\Common Files\Avery
2008-02-22 21:11	32	----a-w	C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-02-22 21:05	---------	d-----w	C:\Program Files\Skype
2008-02-22 21:05	---------	d-----w	C:\Program Files\Common Files\Skype
2008-02-22 21:05	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Skype
2008-02-20 20:28	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Logishrd
2008-02-20 20:25	---------	d-----w	C:\Program Files\Common Files\LogiShrd
2008-02-20 20:24	127,034	------r	C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-02-20 20:24	---------	d-----w	C:\Program Files\Logitech
2008-02-20 20:24	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-02-20 20:18	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Logitech
2008-01-29 23:52	737,280	----a-w	C:\WINDOWS\iun6002.exe
2007-09-26 15:53	148	----a-w	C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2007-05-02 13:16	382	----a-w	C:\Documents and Settings\Owner\Application Data\internaldb6334.dat
2007-04-05 22:05	194	----a-w	C:\Documents and Settings\Owner\Application Data\internaldb8467.dat
2007-04-05 22:05	18,432	----a-w	C:\Documents and Settings\Owner\Application Data\internaldb41.dat
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"mount.exe"="C:\Program Files\GiPo@Utilities\FileUtilities.3\mount.exe" [2008-03-22 20:42 374272]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 16:42 212992]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-07-10 07:25 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-07-10 07:13 114688]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-03-26 20:20 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-03-26 20:20 499712]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 17:22 53096]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup
 
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup
 
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
 
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^LifeTimePorn.lnk]
path=C:\Documents and Settings\Owner\Start Menu\Programs\Startup\LifeTimePorn.lnk
backup=C:\WINDOWS\pss\LifeTimePorn.lnkStartup
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart]
C:\WINDOWS\system32\cpmrotate.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CmUsbAudio]
 
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.2]
C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2007-11-15 14:11 267048 C:\Program Files\iTunes\iTunesHelper.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
--a------ 2007-10-25 17:33 563984 C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
--a------ 2007-10-25 17:37 2178832 C:\Program Files\Logitech\QuickCam\Quickcam.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\My Web Search Bar Search Scope Monitor]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 14:50 155648 C:\WINDOWS\system32\NeroCheck.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-11-15 00:43 286720 C:\Program Files\QuickTime\qttask.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
--a------ 2005-03-14 11:13 966656 C:\Windows\Creator\Remind_XP.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 18:22 21898024 C:\Program Files\Skype\Phone\Skype.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKist]
--a------ 2004-05-26 20:57 139264 C:\Program Files\Digital Media Reader\shwicon2k.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-10-18 21:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\_AntiSpyware]
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
 
R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-04-09 01:53]
R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service []
S0 rlmoec;rlmoec;C:\WINDOWS\system32\drivers\toadoe.sys []
S3 cmuda2;C-Media USB Audio Interface;C:\WINDOWS\system32\drivers\cmuda2.sys []
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-04-19 09:52]
 
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-03-12 17:50:14 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2006-07-24 13:59:18 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2200 series#1145453495.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I 
"2006-04-17 22:31:38 C:\WINDOWS\Tasks\ISP signup reminder 2.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
"2008-03-08 04:59:14 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Owner.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2008-03-18 02:06:59 C:\WINDOWS\Tasks\Norton AntiVirus - Run Norton QuickScan - Owner.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeg/TASK:
"2008-04-10 18:59:07 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe
.
**************************************************************************
 
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-10 14:58:09
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ... 
 
scanning hidden autostart entries ...
 
scanning hidden files ... 
 
scan completed successfully 
hidden files: 0 
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
C:\Program Files\Common Files\Symantec Shared\CCPROXY.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\PrevxCSI\PrevxCSI.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-10 15:04:18 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt  2008-04-10 19:03:59
Pre-Run: 34,474,688,512 bytes free
Post-Run: 36,497,260,544 bytes free
.
2008-04-09 05:45:09	--- E O F ---

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:

Select all Open in new window

by: orangutangPosted on 2008-04-10 at 13:49:31ID: 21329242

Well, if cryptex.dll was removed, you should be able to delete the registry key just by using regedit. As long as the file is gone, it shouldn't really matter if the registry key is still there but it's always good to clean up.

by: computerhandymanPosted on 2008-04-10 at 16:46:10ID: 31447591

ComboFix really did the job.. I've awarded across the board because these people were continious in thier support.

by: computerhandymanPosted on 2008-04-10 at 16:51:37ID: 21330394

I've checked the registry.. Everything has been removed. ComboFix really did the job. I appreciate the continuous support and quick responses. Thank you again folks..

Until next time.. So long,

-- The Computer Handyman

PS-- Oops.. I spelled a couple words wrong on the 'Award Points' comment section.. haha..

by: rpggamergirlPosted on 2008-04-10 at 19:10:09ID: 21330976

Yes, a rootkit driver was the culprit there, which was protecting cryptex.dll from being deleted.
Combofix did a great job!
I'm glad you had so much patience trying many tools.

You can also remove some of the unnecessary programs and reg entries showing in the CF log, like MyWeb Search, LifeTimePorn (I would uninstall that program if still present unless you purposely installed it).
The disabled startup entry below can be deleted(the file is already gone)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart]

Thank you.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

Virus Removal - Cannot delete file or Registry Entries

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Microsoft

Windows XP

SP2

Virus Removal

Anti-Virus

Windows XP Operating System

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press