BF2S Forums MSVCRT.dll errors all of a sudden

Here is my Hijackthis log ...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:13:06, on 08.09.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Programme\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
D:\Programme\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programme\Asus\EeePC ACPI\AsTray.exe
C:\Programme\Asus\EeePC ACPI\AsAcpiSvr.exe
C:\Programme\Elantech\ETDCtrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
D:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\PROGRA~2\SYMANT~1\VPTray.exe
D:\Programme\CA\eTrust PestPatrol\PPActiveDetection.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programme\RocketDock\RocketDock.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Mozilla Firefox\firefox.exe
D:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -

C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -

D:\Programme\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AsusTray] C:\Programme\Asus\EeePC ACPI\AsTray.exe
O4 - HKLM\..\Run: [AsusACPIServer] C:\Programme\Asus\EeePC ACPI\AsAcpiSvr.exe
O4 - HKLM\..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe\Reader

9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [vptray] D:\PROGRA~2\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [eTrustPPAP] "D:\Programme\CA\eTrust PestPatrol\PPActiveDetection.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "D:\Programme\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER

DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutoRun OSCleaner.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/microsoftup … .cab?12453

23540031
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftup … .cab?12453

23528765
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation -

D:\Programme\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Update Service (gupdate1c9f035e9ea689a) (gupdate1c9f035e9ea689a) -

Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: SAVRoam (SavRoam) - symantec - D:\Programme\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - D:\Programme\Symantec

AntiVirus\Rtvscan.exe

--
End of file - 4479 bytes

the hjt log looks clean... but i'm not see the part where it shows your browser settings and other hidden registry startup stuff.  is this the whole output file?

run sysinternals procmon to see what is being sought when you get those errors

http://technet.microsoft.com/en-us/sysi … 96645.aspx

its so very underused imo

burnzz wrote:

jsnipy wrote:

run sysinternals procmon to see what is being sought when you get those errors

i understand why M$ bought out sysinternals. Can't understand why Mark sold it to them . . .

Well, he gets to continue to work on them and he got paid. At least m$ is not charging anything for them and they are continually being improved upon. These tools should have bundled with Windows all along imo. I mention them a quite a bit here from time to time but never get any feedback. They have helped me though some complex issues in the past.

steelie34 wrote:

the hjt log looks clean... but i'm not see the part where it shows your browser settings and other hidden registry startup stuff.  is this the whole output file?

That was the entire thing that HijackThis threw back at me in the log. I copied it straight from the txt file and posted it there.

[TUF]Catbox wrote:

here are a couple of links...
http://support.mozilla.com/tiki-view_fo … entId=2377


http://www.tech-pro.net/howto_016.html

http://support.microsoft.com/kb/192123

None of those will solve the problem of thenewspedia.com opening automatically in Firefox. The dll I can work around and ignore, not that huge. I tried using Windows Recovery Console but to no avail.

jsnipy wrote:

run sysinternals procmon to see what is being sought when you get those errors

http://technet.microsoft.com/en-us/sysi … 96645.aspx

its so very underused imo

I ran that and I haven't a clue what I am supposed to be looking for.

Kmarion wrote:

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

I hope this can remove this Vozacka thing embedded in my external drive ...

You have Symantec and CA?

Anyway,

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

I use it all the time at work, I AM NOT A ROBOT GIVE ME PICKLES OR NEAREST OFFER.

I actually don't think vozacka is some kind of virus. The only reason I didn't recognize it and blocked it with my firewall was because I didn't recognize it. But I went and googled it and didn't find anything about it and it only came up on Serbian and Croatian websites as something non-program related. It only had the word vozacka and not the .exe ending. Turns out vozacka is Serbian for "drivers". It may actually be a driver file of some kind for the HDD enclosure I bought. It's an internal drive I stuck into an enclosure ... weird. I honestly cannot remember it being on my usb stick at all, though. But I have no idea. Nothing is recognizing it as a virus ...

Windows Defender didn't find anything on my Acer. But my ASUS EEE PC I know is still heavily infected. That thing is so fucked right now it isn't crazy.

Last edited by CapnNismo (2009-09-09 11:44:56)

CapnNismo wrote:

I ended up having to format my USB stick that had Vozacka on there. It was a bitch, I had to format it. I haven't formatted my external HDD ... but Malware Bytes hasn't found it on the drive. It seems to have blocked itself. I don't know...

My EEE PC is infected with this horrible rootkit.tdss virus. I can't get rid of it and am working on the Malwarebytes forum and BleepingComputer forums to try and get them to help, but still waiting on answers. The battle continues.

I ain't doing ComboFix, though. The guys on that forum said not to do it without professional help ...

lololol its self run.

www.freedrweb.com