Hello, I am a new member and to be honest the sole purpose of me joining this community was because I suspect I may have gotten an infection in my Computer. I did happen to open a "suspicious" .exe file which I slightly regret now, but I would like your help. I believe I have MSIVXserv.sys problem going on. As I researched on the internet a bit, I found that this was a spyware, so I tried to remove it personally, but did no good as whenever I try to run Norton Antivirus, it stays at 0% and my definitions cannot be bothered to be updated. I am willing to co-operate but would really like some help in this. Please tell me what information should I include in my next post which would help you guys to help me solve my problem...
For starters. I am running Windows Vista Home Premium Edition x86 (32 bit) on my Toshiba Satellite Laptop.
Hello, I am a new member and to be honest the sole purpose of me joining this community was because I suspect I may have gotten an infection in my Computer. I did happen to open a "suspicious" .exe file which I slightly regret now, but I would like your help. I believe I have MSIVXserv.sys problem going on. As I researched on the internet a bit, I found that this was a spyware, so I tried to remove it personally, but did no good as whenever I try to run Norton Antivirus, it stays at 0% and my definitions cannot be bothered to be updated. I am willing to co-operate but would really like some help in this. Please tell me what information should I include in my next post which would help you guys to help me solve my problem...
For starters. I am running Windows Vista Home Premium Edition x86 (32 bit) on my Toshiba Satellite Laptop.
Quads
June 22, 2009, 4:54am
3
Hi
I Need a GMER log, GMER, http://www.gmer.net/ and "Scan" then "Save" the log, Post the log section from "DEVICES" section to the end of the log.
Please do not use GMER for anything else as it could cause a crash / BSOD.
Thanks
Quads
Oh double posting
Hello Quads and dbrisendine,
thankyou for your replies... as requested I have downloaded GMER and RootRepeal but when I tried to run RootRepeal, it gave me a driver error stating "Could not load driver (0xc0000035!)". Therefore, I was not able to include RootRepeal logs with this post, although GMER worked just fine and here are the logs...
GMER 1.0.15.14972 - http://www.gmer.net
SSDT 87F009F8 ZwAlertResumeThread
INT 0x52 ? 86334BF8
Code 87E814C8 ZwEnumerateKey
.text ntoskrnl.exe!IofCallDriver 8247A11B 5 Bytes JMP 87E71E6A
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Internet Explorer\iexplore.exe[564] USER32.dll!CreateDialogParamW 776072A2 5 Bytes JMP 6AFBD660 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[892] USER32.dll!DialogBoxParamA 77648152 5 Bytes JMP 6B0DB698 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 848792D8
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Internet Explorer\iexplore.exe[564] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [6DAA82E6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[564] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW] [6DAB3110] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[564] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateDirectoryW] [6DAB10E1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
Have you got more to come Jaxdacool1?
IAT C:\Program Files\Internet Explorer\iexplore.exe[564] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyExA] [6DAC017D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[564] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHCreateStreamOnFileW] [6DAB7670] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[564] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyW] [6DAB7711] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device 8520F1F8
AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\volmgr \Device\HarddiskVolume1 8487C1F8
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\usbuhci \Device\USBFDO-0 862201F8
---- Services - GMER 1.0.15 ----
Service C:\Windows\system32\drivers\MSIVXvdfvyeqqnnqvoebtirqdlpmwybtnajna.sys (*** hidden *** ) [SYSTEM] MSIVXserv.sys <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys \\?\globalroot\systemroot\system32\drivers\MSIVXvdfvyeqqnnqvoebtirqdlpmwybtnajna.sys \\?\globalroot\systemroot\system32\MSIVXcxqscryjwtbrgngidvgieqbbxsrhxdpq.dll \\?\globalroot\systemroot\system32\MSIVXttvmxcpssrxxrdpvefpifpvlyiwiryso.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys \\?\globalroot\systemroot\system32\drivers\MSIVXvdfvyeqqnnqvoebtirqdlpmwybtnajna.sys \\?\globalroot\systemroot\system32\MSIVXcxqscryjwtbrgngidvgieqbbxsrhxdpq.dll \\?\globalroot\systemroot\system32\MSIVXttvmxcpssrxxrdpvefpifpvlyiwiryso.dll
---- Files - GMER 1.0.15 ----
File C:\Users\owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LCF0LZVS\MSIVXSERV.SYS[1].htm 5516 bytes
---- EOF - GMER 1.0.15 ----
That was the end of the log... sorry for all those posts, but it had to be done.
No problem with the logs Jaxdacool. Very nice job. You do indeed have an MSIVX rootkit infection. Quads will put together a script to enable it to be removed, when he is back online. In the meantime, you can prepare by downloading Avenger. DO NOT do anything with it. Very bad things can happen.
http://swandog46.geekstogo.com/avenger2/avenger2.html
Thank you delphinium and Quads for working my case,
well about the avenger, there is something I failed to say earlier and that is that I while I was researching about MSIVXserv, when I came across the Norton community I read a couple of posts which were very similar and so I chose to download avenger for myself and I ran one of the older scripts which Quads had written for another user. I don't know if that made the case worse or better... but as I did that, the very next second avenger did run the script and asked me to reboot. As I did that, the computer had also erased some vital reg keys, but fortunately the Vista has an automatic startup helper which saved my behind that day by replacing all the missing drivers and reg keys... phew! And here I am using that very same computer again. Sorry that I didnt mention this earlier
That's all right Jaxdacool1:
The problem with rootkits is that they can change file names, save backups of themselves, and have many different variants of the same rootkit. That is why using someone else's script did not work properly. Avenger has to be very carefully told exactly what to take. We are bound to run into the occasional do-it-yourselfer once in a while.
It looks like no harm done, which is a good thing.
Quads should be along shortly. We run into time zone problems on this forum.
