coolguy Posted September 19, 2009 ID:129667 Share Posted September 19, 2009 Hi Im also having the exact problem which i pasted below from one of the thread posted on Malwarebytes.org forums...I seem to have picked up really gnarly piece of malware which I have been fighting with and finally decided to ask for help here (thanks for this forum!)My main problem is that if I load windows normally it gets to the login prompt and up comes a system message box telling me it will shutdown in 60 seconds. The message is something like "The system is shutting down... NT Authority/System ... The system process Windows/System32/Services.exe... status code <blah blah>" I'm sure you have heard or seen it many times.To solve this I run in safe mode with networking. At first I could not run any exe's, I found a fix for that online with a registry change. Next I cannot run any anti-malware apps, they run, but when the scan executes the process is killed and a lot of the time the executable is then corrupted and file locked in some way so that it cannot be deleted. Suffice to say both hijack this and malware bytes get killed when I run them.I get some redirects from google, and at one point a fake windows antivirus application ran. I forget the name now, grr, I think it was windows antivirus pro; I killed the process and deleted the folder from program files and it seems to be gone. Apart from this im not able to run any adware or spyware removal softwares. And below is the log file i got using WIN32DiagRunning from: C:\Documents and Settings\Vuyyuru\My Documents\Downloads\Win32kDiag.exeLog file at : C:\Documents and Settings\Vuyyuru\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\WINDOWS'...Found mount point : C:\WINDOWS\addins\addinsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP311.tmp\ZAP311.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3B9.tmp\ZAP3B9.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP469.tmp\ZAP469.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP54E.tmp\ZAP54E.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5A7.tmp\ZAP5A7.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\temp\tempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\assembly\tmp\tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Config\ConfigMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Connection Wizard\Connection WizardMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Debug\UserMode\UserModeMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\chsime\applets\appletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\CHTIME\Applets\AppletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\imejp\applets\appletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\imejp98\imejp98Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\imjp8_1\applets\appletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\imkr6_1\applets\appletsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dictsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ime\shared\res\resMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\inf\IEM\0409\0409Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109411090400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109440090400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109511090400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109711090400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109910090400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109B10090400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109F100A0C00000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109F100C0400000000000F01FEC\12.0.4518\12.0.4518Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\java\classes\classesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\java\trustlib\trustlibMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET FilesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Minidump\MinidumpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\msapps\msinfo\msinfoMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\mui\muiMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLESMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFFMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\helpctr\batch\batchMount point destination : \Device\__max++>\^Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe[1] 2004-08-12 09:57:42 743936 C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe ()[1] 2008-04-13 20:12:21 744448 C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\helpsvc.exe (Microsoft Corporation)[1] 2004-08-12 09:57:42 743936 C:\WINDOWS\system32\dllcache\helpsvc.exe (Microsoft Corporation)Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPointMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFilesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\TempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\PIF\PIFMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLogMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\security\logs\logsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\DownloadedMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\355f788b6de8a3ec79e9aa172e6317f1\backup\backupMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\41de1a081a084b9d6fc0b5c225e4fbe5\backup\backupMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\backup\asms\10\10Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\backup\asms\52\msft\msftMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\backup\asms\60\msft\msftMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\backup\asms\70\70Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SoftwareDistribution\EventCache\EventCacheMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Sun\Java\Deployment\DeploymentMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDelMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1025\1025Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1028\1028Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1031\1031Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1037\1037Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1041\1041Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1042\1042Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\1054\1054Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\2052\2052Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\3076\3076Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmiMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\CatRoot_bak\CatRoot_bakMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media PlayerMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\CertificatesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\TeamViewer\TeamViewerMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\DesktopMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\FavoritesMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\CD Burning\CD BurningMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My DocumentsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHoodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHoodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\RecentMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\dhcp\dhcpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\drivers\disdn\disdnMount point destination : \Device\__max++>\^Cannot access: C:\WINDOWS\system32\eventlog.dll[1] 2008-04-13 20:11:53 56320 C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\eventlog.dll (Microsoft Corporation)[1] 2004-08-12 09:57:17 55808 C:\WINDOWS\system32\dllcache\eventlog.dll (Microsoft Corporation)[1] 2004-08-12 09:57:17 62976 C:\WINDOWS\system32\eventlog.dll ()[2] 2004-08-12 09:57:17 55808 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation)Found mount point : C:\WINDOWS\system32\export\exportMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\IME\CINTLGNT\CINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\IME\PINTLGNT\PINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\IME\TINTLGNT\TINTLGNTMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\inetsrv\inetsrvMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\Microsoft\Crypto\RSA\MachineKeys\MachineKeysMount point destination : \Device\__max++>\^Cannot access: C:\WINDOWS\system32\MRT.exe[1] 2009-08-28 17:38:20 24689600 C:\WINDOWS\system32\MRT.exe ()[2] 2009-06-01 12:51:12 23635392 C:\System Volume Information\_restore{94FD65DA-B845-4AF8-BCCE-C47511319A43}\RP130\A0114647.exe (Microsoft Corporation)[2] 2009-07-07 11:10:56 24539592 C:\System Volume Information\_restore{94FD65DA-B845-4AF8-BCCE-C47511319A43}\RP168\A0145043.exe (Microsoft Corporation)[2] 2009-07-29 20:49:14 24281536 C:\System Volume Information\_restore{94FD65DA-B845-4AF8-BCCE-C47511319A43}\RP212\A0170167.exe (Microsoft Corporation)[2] 2009-02-25 15:55:00 24768960 C:\System Volume Information\_restore{94FD65DA-B845-4AF8-BCCE-C47511319A43}\RP51\A0021121.exe (Microsoft Corporation)[2] 2009-04-06 10:57:24 24921544 C:\System Volume Information\_restore{94FD65DA-B845-4AF8-BCCE-C47511319A43}\RP70\A0032417.exe (Microsoft Corporation)[2] 2009-05-07 03:16:29 24699336 C:\System Volume Information\_restore{94FD65DA-B845-4AF8-BCCE-C47511319A43}\RP96\A0080376.exe (Microsoft Corporation)Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspecMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnupMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcustMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhwMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemregMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\oobe\sample\sampleMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\ShellExt\ShellExtMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\spool\drivers\w32x86\3\temp\tempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\spool\drivers\w32x86\__SKIP_00EA\__SKIP_00EAMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\sysloc\syslocMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\wbem\mof\bad\badMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\wbem\mof\good\goodMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\wbem\snmp\snmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\wins\winsMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\system32\xircom\xircomMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\WBEM\WBEMMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTempMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2Mount point destination : \Device\__max++>\^Finished!This is really really frustating ...Please HELP ME outt....................... Link to post Share on other sites More sharing options...
coolguy Posted September 19, 2009 Author ID:129681 Share Posted September 19, 2009 And also I get the error "Windows cannot access the specified device, path, or file. You may not have appropriate permissions to access the file." when i try to open any spyware or antivirus program. Link to post Share on other sites More sharing options...
lithodora Posted September 19, 2009 ID:129691 Share Posted September 19, 2009 I had the exact same issue and resolved it moments ago.Disable your Anti-Virus: as shown here .And follow the directions to run ComboFix as shown here .It worked for me anyway. Link to post Share on other sites More sharing options...
coolguy Posted September 19, 2009 Author ID:129697 Share Posted September 19, 2009 Hi Lithodora, Thanks alot for quick reply...i did try those..installed unistalled combifix......can you please let me know what are the steps you did for solving this. Please help me out of this..Thanks,coolguyI had the exact same issue and resolved it moments ago.Disable your Anti-Virus: as shown here .And follow the directions to run ComboFix as shown here .It worked for me anyway. Link to post Share on other sites More sharing options...
coolguy Posted September 20, 2009 Author ID:129726 Share Posted September 20, 2009 Hi Lithodora, Woww...it worked..Thanksalott........but i have another small issue.....i have HiJackthis.exe trace on my desktop. I was trying to trash it recycle bin, it wont let me allow to do it. It says "Cannot delete Hijackthis.exe. Access is denied. Make sure disk is blah blah and that the file is not currently in use". Can you please let me know Thanks,CoolguyHi Lithodora, Thanks alot for quick reply...i did try those..installed unistalled combifix......can you please let me know what are the steps you did for solving this. Please help me out of this..Thanks,coolguy Link to post Share on other sites More sharing options...
Recommended Posts