Member Avatar for 20NickC11

I've scanned with a lot of different Anti-Spyware and Anti-Virus software and none of them can detect anymore. I can't get rid of this Virus Alert on my taskbar, as well as when I go into My Computer, my C: Drive doesn't show up, even though it shows up when I Explore the Start Menu.
Here is my HiJackThis LogFile

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:10: VIRUS ALERT!, on 8/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1955684952-2250001309-4197435364-1008\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Natalie')
O4 - HKUS\S-1-5-21-1955684952-2250001309-4197435364-1008\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Natalie')
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O21 - SSODL: eqvwamkl - {F7D30B90-DCFA-4276-BB14-0E550636CB4C} - C:\WINDOWS\eqvwamkl.dll (file missing)
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - Unknown owner - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 2815 bytes

  • 4 Contributors
  • 8 Replies
  • 243 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

The HiJackThis entries point to a classic rogue-AV / “fake security” infection that dropped a local HTML alert and left registry/startup remnants. The Desktop Component O24 (file:///C:\WINDOWS\privacy_danger\index.htm) is the popup you saw as “VIRUS ALERT!” and the missing C: in My Computer is commonly caused by malicious policy keys (or a leftover shell/Explorer tweak) rather than the drive being physically gone. ’s report that Malwarebytes (MBAM) removed the active payload is consistent with that pattern; the remaining O21/O23 entries (eqvwamkl, $sys$DRMServer) look like leftover service/driver stubs.

Practical cleanup checklist (do these in Safe Mode if possible):

  • Run an updated full scan with Malwarebytes Anti-Malware and quarantine everything found.
  • Run a rootkit remover (for example, TDSSKiller) and a second on-demand scanner (ESET/Kaspersky online scanners) to catch rootkits and leftovers.
  • Use Autoruns (Sysinternals) to examine and disable suspicious startup items and services (look specifically for $sys$DRMServer, eqvwamkl, privacy_danger entries). Delete the physical folder C:\WINDOWS\privacy_danger\ only after stopping related processes.
  • Remove the O24 Desktop Component with HijackThis or Autoruns and delete the local index.htm used to show the fake alert. Reboot and re-scan.

Fix for a hidden C: drive (registry policy bitmask):

  • Check these keys:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    Look for NoDrives or NoViewOnDrive. If present, back up the key, then delete the value or set it to 0. The NoDrives mask uses bit values (A=1, B=2, C=4, D=8, ...), so a value of 4 hides C:. A safe .reg approach to remove those values (backup first) looks like:
Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives]

Post-cleanup notes: run chkdsk /f and sfc /scannow (XP requires the install CD) to repair system files if needed. Because remnants like missing/ghost services often indicate deeper compromise, consider imaging user data and performing a clean OS reinstall if unexpected behavior persists. Keep definitions and Windows updated, and keep regular backups on scanned/external storage.

Recommended Answers

All 8 Replies

Member Avatar for 20NickC11

I'm sorry I forgot to mention that my computer has 3 users on it, and this problem only occurs on two of the users.

Member Avatar for jholland1964

Did you scan the entire computer...all users included?
Where are the scan logs and others you may have done? We really need to see, and know, what was found, where it was found and how it was removed.

Member Avatar for 20NickC11

Well, I don't have anymore scan logs. I just scaned with rpograms like AVG and Spyware Doctor. Most of them were found in System32 files. I'm sorry, I don't really know much about computers.

Member Avatar for PhilliePhan

Well, I don't have anymore scan logs. I just scaned with rpograms like AVG and Spyware Doctor. Most of them were found in System32 files. I'm sorry, I don't really know much about computers.

Please run MBA-M and DSS as per the linky below and post those logs for us and we'll go from there.

Read me before posting a request for assistance

Seeing as it's the weekend, it may take a bit longer to get a reply.

PP :)

Member Avatar for 20NickC11

The MBA-M worked!
Thank you guys so much for helping me!
=)

Member Avatar for PhilliePhan

The MBA-M worked!
Thank you guys so much for helping me!
=)

Glad to hear it! We are happy to help!
MBA-M is an excellent tool - you ought to hang on to it.

You really should post the both logs, though. Often there are additional baddies that need to be addressed. Plus, we can often see weaknesses in you compy's defenses and advise you on how to address them to avoid future problems.

PP :)

Member Avatar for steve328

Mba-m worked fine all other scans failed:)

Member Avatar for jholland1964

steve328, you need to begin your OWN thread, rather than posting in another's. Each computer is different, and each problem is different. Make your own thread, give it a title explaining the problem...then in your post be specific about the problem, what scans you have done and the results and post the logs for those scans so maybe we can see why they did and exactly what they removed and for the ones you say didn't work, maybe we can see why they didn't work.
Will be looking for your new thread.
Judy

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.