Msvlmwksn.dll has taken over my laptop

Bamajim,

Thanks for your reply.... I'm just getting back to my problem here.

So I downloaded FileLister.vbe like you said, but nothing seems to happen when I open it.  I do get the same type of message as with opening all files:

WScript.exe - The application failed to run because msvlmwksn.dll cannot be found

and when I say OK, nothing seems to happen (but when this happens to other programs, clicking OK let's other program continue to execute)..  I checked and there is no C:\files.txt created either.

Did I miss a step somwhere?

Thanks for your help.

dmoutner

I ran exefix.reg and it added something to my registry, but FileLister still doesn't run. 

I have two files in the filelister directory filelister.vbe  & scvwhat.dat.     Is there anything missing?

David

Bamajim,

My bad, I mailed this to myself to post from my good computer, and then I forgot to actually post it.  Here are the results from the exehelper run:

RE: Msvlmwksn.dll has taken over my laptop‏

From:	David
Sent:	Mon 10/05/09 1:00 PM
To:	David

David, please edit to remove your email address, so that the moderators do not delete your post. Thanks.

dmoutner

Are you able to run FileLister now?

Bamajim,

It appears to run, but no file is generated.  I can see Filelister running in Task Manager in the application tab, and many proecesses are active for about 10 minutes.  Then process activity drops to virtually zero (excep System Idle) and nothing else happens.

So it may run, but doesn't seem to do anything.

David

Bamajim,

I ran Comboix and it appears to have cleaned the infection from my laptop.  It immediatley found a problem with \system32\imm32.dll.  WHen it rebooted, the error messages no longer appeared.  He is the log file from combofix.  Is there  anything I should be doing to prevent this from happening again?

Thanks again for all your help and great work fixing that problem for me!

David

ComboFix 09-10-26.03 - Dave 10/27/2009  7:49.1.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.510.160 [GMT -4:00]
Running from: c:\documents and settings\Dave\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\system32\imm32.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\imm32.dll

.
(((((((((((((((((((((((((   Files Created from 2009-09-27 to 2009-10-27  )))))))))))))))))))))))))))))))
.

2009-10-27 11:33 . 2009-10-27 11:35 -------- d-----w- c:\windows\LastGood.Tmp
2009-10-23 17:14 . 2009-10-23 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\SecTaskMan
2009-10-23 17:14 . 2009-10-23 17:14 -------- d-----w- c:\program files\Security Task Manager

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-27 11:31 . 2008-05-05 01:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-10-16 20:37 . 2004-01-21 10:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-16 20:23 . 2005-10-25 20:02 -------- d-----w- c:\program files\eProject
2009-09-21 21:33 . 2009-09-21 21:33 -------- d-----w- c:\program files\CCleaner
2009-09-17 19:17 . 2009-09-17 19:17 -------- d-----w- c:\program files\Trend Micro
2009-08-30 23:19 . 2009-06-09 02:02 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-30 23:19 . 2009-06-09 02:02 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-30 23:19 . 2009-06-09 02:02 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-16 17:11 . 2004-02-06 22:06 72600 ----a-w- c:\documents and settings\Dave\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 23:24 . 2004-08-17 12:19 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2004-08-17 12:19 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2002-08-29 11:00 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2002-08-29 11:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 23:23 . 2004-08-17 12:19 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2002-08-29 11:00 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:11 . 2004-11-02 14:18 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 14:00 . 2004-11-02 14:17 2180352 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-11-02 14:17 2057728 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 13:55 1090816 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-05 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2003-06-11 147456]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-07-17 28672]
"igfxtray"="c:\windows\System32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\System32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\System32\igfxpers.exe" [2005-09-20 114688]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-04-03 777424]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-09 29744]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-01-16 181544]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-30 2007832]
"MMReminderService"="c:\program files\Mindjet\MindManager 8\MMReminderService.exe" [2008-12-11 37656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"!CleanupNetMeetingDispDriver"="msconf.dll" - c:\windows\SYSTEM32\msconf.dll [2004-08-04 69632]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-1-21 24576]
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2006-8-4 315392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-30 23:19 11952 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [6/8/2009 10:02 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [6/8/2009 10:02 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/29/2009 2:10 PM 297752]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [1/16/2009 4:31 PM 161064]
R3 Eacfilt;Eacfilt Miniport;c:\windows\SYSTEM32\DRIVERS\eacfilt.sys [11/11/2005 12:55 PM 9433]
S0 black;black;c:\windows\SYSTEM32\DRIVERS\blackdrv.sys [11/23/2005 9:56 AM 227285]
S2 BlackICE;BlackICE;c:\program files\Network ICE\BlackICE\blackd.exe [11/23/2005 9:56 AM 847872]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\SYSTEM32\DRIVERS\ipsecw2k.sys [11/11/2005 12:55 PM 115680]
S3 {E2B953A7-195A-44F9-9BA3-3D5F4E32BB55};AIM 3.0 Part 01 Codec Driver CH-7009-B;c:\windows\SYSTEM32\DRIVERS\wA301b.sys [1/1/1980 2:00 AM 33847]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [10/15/2004 9:41 AM 29744]
S3 RapFile;RapFile;c:\windows\SYSTEM32\DRIVERS\RapFile.sys [3/8/2004 2:13 PM 36676]
S3 RapNet;RapNet;c:\windows\SYSTEM32\DRIVERS\RapNet.sys [3/8/2004 2:13 PM 24344]
S4 WinDefend;Windows Defender Service;c:\program files\Windows Defender\MsMpEng.exe [4/3/2006 6:12 PM 14032]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-05 00:19]

2009-05-16 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-04-03 22:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1244510397&rver=5.5.4177.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&lc=1033&id=64855&mkt=en-US
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {0369528B-3082-11D2-9997-00A0C9B7A242} - hxxps://scpwka.ops.placeware.com/etc/place/KILO/SCKpws-b3s/5.1.7.413/placeware.aud.ieupload/UploadControl.cab
DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} - hxxp://scpwib.ops.placeware.com/etc/place/INDIA/SCIpws-b2/5.1.5.222/lib/quicksilver.cab
DPF: {9B57C630-AA6E-440D-8D44-D34542E5531A} - hxxps://www103.placeware.com/etc/static/CHLrapidweb/2005-09-16-21-24-55/MailObjects.cab
DPF: {E3372C1F-AFE6-4A3B-90F9-83B2E9B42C82} - hxxp://online.appdev.com/inline/ADTCKS.CAB
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Sametime Connect - c:\program files\Lotus\Sametime Client\connect.exe
HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-27 08:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1092)
c:\windows\system32\COMRes.dll

- - - - - - - > 'explorer.exe'(3168)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\combofix\CF981.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Apoint\Apntex.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\System32\mnmsrvc.exe
c:\windows\system32\rundll32.exe
c:\windows\System32\wdfmgr.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-27  8:14 - machine was rebooted
ComboFix-quarantined-files.txt  2009-10-27 12:14

Pre-Run: 9,085,067,264 bytes free
Post-Run: 9,168,564,224 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 7E448889688BEA49A53D730A4DDB1A91

Bamajim,

Hmmmm...I tried running Bitdefender and after pressing Start Scan I got a pop up message saying "BitDefender failed to update virus definitions.  You can still scan but results may not be 100% accurate"  SO I continued anyway like it said, but almost immediately  a Scan Failed message appeared and I couldn't go any further.

Otherwise the laptop appears to be working fine.

David