gk1970 Posted January 9, 2010 ID:182108 Share Posted January 9, 2010 OS;Windows Vista Home Premium,AV:McAfeeRecently whenever I boot up,I get 'Cannot find NTLoad.dll' msg.First I used sccanow and tried to access the log file it generates,says 'Access denied'9even thro' cmd). I tried to repair laptop using startup repair,but of no use.Kindly help. Link to post Share on other sites More sharing options...
kahdah Posted January 9, 2010 ID:182112 Share Posted January 9, 2010 Hello gk1970Welcome to Malwarebytes.=====================Download OTL to your desktop.Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Under Custom scan's and fixes section paste in the below in bold%SYSTEMDRIVE%\*.exe/md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dlliaStor.sysnvstor.sysatapi.sysIdeChnDr.sysviasraid.sysAGP440.sysvaxscsi.sysnvatabus.sysviamraid.sysnvata.sysnvgts.sysiastorv.sysViPrt.syseNetHook.dllahcix86.sysKR10N.sysnvstor32.sysahcix86s.sysnvrd32.sys /md5stop%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfilesCheck the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.====================Download the following GMER Rootkit Scanner from HereDownload the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on RunIt may take a minute to load and become available.If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKEDSectionsIAT/EATDrives/Partition other than Systemdrive (typically only C:\ should be checked)Show All (don't miss this one)Then click the Scan button & wait for it to finish.Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.Save it where you can easily find it, such as your desktop**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entriesClick OK and quit the GMER program.Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.Post that log in your next reply. Link to post Share on other sites More sharing options...
gk1970 Posted January 10, 2010 Author ID:182256 Share Posted January 10, 2010 Hello gk1970Welcome to Malwarebytes.=====================Download OTL to your desktop.Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Under Custom scan's and fixes section paste in the below in bold%SYSTEMDRIVE%\*.exe/md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dlliaStor.sysnvstor.sysatapi.sysIdeChnDr.sysviasraid.sysAGP440.sysvaxscsi.sysnvatabus.sysviamraid.sysnvata.sysnvgts.sysiastorv.sysViPrt.syseNetHook.dllahcix86.sysKR10N.sysnvstor32.sysahcix86s.sysnvrd32.sys /md5stop%systemroot%\*. /mp /sCREATERESTOREPOINT%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfilesCheck the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.====================Download the following GMER Rootkit Scanner from HereDownload the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on RunIt may take a minute to load and become available.If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKEDSectionsIAT/EATDrives/Partition other than Systemdrive (typically only C:\ should be checked)Show All (don't miss this one)Then click the Scan button & wait for it to finish.Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.Save it where you can easily find it, such as your desktop**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entriesClick OK and quit the GMER program.Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.Post that log in your next reply.I'm unable to download the same McAfee says its a trojan,blocks & removes. Link to post Share on other sites More sharing options...
kahdah Posted January 10, 2010 ID:182389 Share Posted January 10, 2010 I'm unable to download the same McAfee says its a trojan,blocks & removes. Funny how the only try to stop the good guys but let the bad guys run rampant on your machine.Please disable McAfee in order to do the diagnostic scans please.If you do not know how then please refer to this link:http://www.bleepingcomputer.com/forums/topic114351.html Link to post Share on other sites More sharing options...
gk1970 Posted January 10, 2010 Author ID:182539 Share Posted January 10, 2010 OTL.TxtExtras.Txt Link to post Share on other sites More sharing options...
gk1970 Posted January 10, 2010 Author ID:182556 Share Posted January 10, 2010 Also ran the GMER.Attached is the log file.Please advise next steps. Thanks a million.!gmer.txt Link to post Share on other sites More sharing options...
kahdah Posted January 10, 2010 ID:182562 Share Posted January 10, 2010 Please uninstall this programAsk Toolbar============Right click on OTL and choose "Run as Administrator"Under the Custom Scans/Fixes box at the bottom, paste in the following:OTLO4 - HKCU..\Run: [notepad] C:\Users\girish\ntload.DLL File not foundThen click the Run Fix button at the topLet the program run unhindered,when it is done it will say "Fix Complete press ok to open log"Please post that log in your next reply.================================Follow up scan=================================Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.Let me know if you still get the error upon restart. Link to post Share on other sites More sharing options...
gk1970 Posted January 12, 2010 Author ID:183081 Share Posted January 12, 2010 Yes, I do not get the unable to load dll msg. but after some time I get the McSAcore.exe stopped working msg, and it's there since 2-3 months.Any clues as to what could be the reasons ?Looks like its the Winows Media Center. Again Thanks a Million ! Link to post Share on other sites More sharing options...
kahdah Posted January 12, 2010 ID:183221 Share Posted January 12, 2010 Hi that is a part of McAfee site advisor service.Some updates to the program can cause issues like that.Are you currently up to date with McAfee?I mean subscription payment that is.If not then I would recommend uninstalling it and using a different product.These are free. This is antivirus and antispyware. Microsoft Security EssentialsThis is free antispyware protection and Antivirus protection. AVG free 9.0This is just antivirus protection. Antivir Link to post Share on other sites More sharing options...
Recommended Posts