Jump to content

MBAM wont install internet browsers disabled here is hijackthis log.NEED HELP

Recommended Posts


My problem was MBAM was not running. So I downloaded rootrepeal and scanned files. Found 2 .sys files(gxc......................sys very long names) I wiped out those files. Restarted the computer and try to reinstall MBAM but it wont install. The error says liscence.txt is used by some other process and cannot be copied.

Now, I cannot open any browsers anymore. Not even windows explorer. the system just freezes if i open them. Before deleting the .sys files i could run all programs except MBAM.

Here is the log from hijackthis . Please help me

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:20:44 PM, on 5/22/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:













F:\Program Files\Cisco Systems\VPN Client\cvpnd.exe


F:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe


F:\Program Files\Java\jre6\bin\jqs.exe

F:\Softwares\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe

F:\Softwares\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe




F:\Softwares\Microsoft SQL Server\MSSQL.2\Reporting Services\ReportServer\bin\ReportingServicesService.exe

F:\Softwares\Spyware Doctor\pctsAuxs.exe

F:\Softwares\Spyware Doctor\pctsSvc.exe

F:\Softwares\Spyware Doctor\pctsTray.exe

F:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

F:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

F:\Program Files\IDT\WDM\STacSV.exe



F:\Program Files\Synaptics\SynTP\SynTPEnh.exe


F:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

F:\Program Files\Common Files\Real\Update_OB\realsched.exe





F:\Softwares\Trend Micro\HijackThis\HijackThis.exe


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: (no name) - {735DBC19-21DF-4488-B8F6-F5B61F21C807} - (no file)

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - F:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll

O4 - HKLM\..\Run: [synTPEnh] F:\Program Files\Synaptics\SynTP\SynTPEnh.exe


O4 - HKLM\..\Run: [iAAnotif] "F:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [iSTray] "F:\Softwares\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - Winlogon Notify: __c00786DC - F:\WINDOWS\system32\__c00786DC.dat (file missing)

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: DefWatch - Symantec Corporation - F:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - F:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - F:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - F:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

O23 - Service: OracleDBConsoletest - Oracle Corporation - F:\Softwares\oracle\product\11.1.0\db_1\bin\nmesrvc.exe

O23 - Service: OracleOraDb11g_home1TNSListener - Unknown owner - F:\Softwares\oracle\product\11.1.0\db_1\BIN\TNSLSNR.exe

O23 - Service: OracleServiceTEST - Oracle Corporation - f:\softwares\oracle\product\11.1.0\db_1\bin\ORACLE.EXE

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Softwares\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Softwares\Spyware Doctor\pctsSvc.exe

O23 - Service: Audio Service (STacSV) - IDT, Inc. - F:\Program Files\IDT\WDM\STacSV.exe

O23 - Service: Apache Tomcat (Tomcat6) - Apache Software Foundation - F:\Softwares\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe


End of file - 6639 bytes

Link to post
Share on other sites

Welcome to Malwarebytes.org

Download GMER Antirootkit from here, click on Download EXE and Save it to your desktop

  • Disconnect from the internet and disable all active protection so your security program drivers will not conflict with gmer's driver
  • Double-click Gmer.exe to run the program.
  • When the program opens, click the "Rootkit" Tab
  • On the right-side, check all the items to be scanned, but leave "Show All" unchecked
  • Select all drives that are connected to your system to be scanned
  • Click the Scan button
  • When the scan is finished, click Copy to save the scan log to the Windows clipboard
  • Open Notepad or a similar text editor
  • Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
  • Save the gmer scan log and post it in your next reply.
  • Close Gmer
  • Open a command prompt (Start | run |type cmd and hit Enter)
    • Type or paste the following to unload the gmer driver:
    • net stop gmer
    • Hit Enter
    • Exit the command prompt.

    [*]Re-enable all active protection.

Link to post
Share on other sites


here is my gmer scan log

GMER - http://www.gmer.net

Rootkit scan 2009-05-27 09:44:07

Windows 5.1.2600 Service Pack 3

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

---- Services - GMER 1.0.15 ----

Service system32\drivers\gxvxcmkomurthiqujotfqhypiktppyltrnsaw.sys (*** hidden *** ) [sYSTEM] gxvxcserv.sys <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites

Please run another scan with GMER.

After scan has finished the following will be highlighted in Red

Service system32\drivers\gxvxcmkomurthiqujotfqhypiktppyltrnsaw.sys (*** hidden *** ) [sYSTEM] gxvxcserv.sys <-- ROOTKIT !!!

right-click on the hidden service

Click on Delete Service.

You may be asked to reboot, allow the reboot and then try running MBAM.

Link to post
Share on other sites

  • 5 weeks later...
  • Root Admin

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

Link to post
Share on other sites

This topic is now closed to further replies.

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.