AV System Care Problems

[tonyrakow]

Hello everyone,

I've been having some problems recently with a box that pops up every now and then that's listed as AV System Care. I tried running AVG AS, but it didn't solve the problem.

My HJT log is below:

Logfile of HijackThis v1.99.1
Scan saved at 11:12:00 AM, on 8/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\AOL\Active Security Monitor\ASMonitor.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HJT\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AOL\Active Security Monitor\ASMPatchManager.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\Program Files\Alwil Software\Avast4\setup\setup.ovr
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
O1 - Hosts: J
(
O1 - Hosts: 8ö€ ¡€c¯


O1 - Hosts: 8öJ@€c¯<
¡8öJ

O1 - Hosts: ô¨ pR€m•PÀQ±€€ )$¨
ˆ
ø[‰
O1 - Hosts: *T
O1 - Hosts: à
O1 - Hosts: 8¨À p)À (à0P€@@Àa R€€PÃ[¥
¡€·J
8B
‡•l p€) B
X0
pۥ
X)
Bp€• X)€B
•T„
O1 - Hosts: °­
O1 - Hosts: 8¼U7Ń51+Q
ã9¥
¡€sJ
\B
Çâ€

[silver]

Hi tonyrakow,

Please download F-Secure Blacklight

• Click I ACCEPT and download the graphical user interface version to your Desktop
• Double click the file to run it, choose I accept the agreement then press Scan
• It will create the fsbl-xxxxxxx.log on your desktop.
• The log will have a list of all items found.
• Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
• Exit Blacklight and post the contents of the log in your next reply.

Now open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager... button, then press Save list...
Save the Uninstall log to your deskop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.

Once complete, please post the Blacklight log, the uninstall log and a new HijackThis log.

[tonyrakow]

08/15/07 18:20:00 [Info]: BlackLight Engine 1.0.64 initialized
08/15/07 18:20:00 [Info]: OS: 5.1 build 2600 (Service Pack 2)
08/15/07 18:20:01 [Note]: 7019 4
08/15/07 18:20:01 [Note]: 7005 0
08/15/07 18:20:04 [Note]: 7006 0
08/15/07 18:20:04 [Note]: 7011 336
08/15/07 18:20:04 [Note]: 7026 0
08/15/07 18:20:05 [Note]: 7026 0
08/15/07 18:20:05 [Note]: 7024 3
08/15/07 18:20:05 [Info]: Hidden process: C:\windows\system32\mkgdsqlxm.exe
08/15/07 18:20:12 [Note]: FSRAW library version 1.7.1022
08/15/07 18:33:20 [Info]: Hidden file: c:\WINDOWS\system32\mkgdsqlxm.dat
08/15/07 18:33:20 [Note]: 10002 1
08/15/07 18:33:20 [Info]: Hidden file: C:\windows\system32\mkgdsqlxm.exe
08/15/07 18:33:20 [Note]: 10002 1
08/15/07 18:33:20 [Info]: Hidden file: c:\WINDOWS\system32\mkgdsqlxm_nav.dat
08/15/07 18:33:20 [Note]: 10002 1
08/15/07 18:33:21 [Info]: Hidden file: c:\WINDOWS\system32\mkgdsqlxm_navps.dat
08/15/07 18:33:21 [Note]: 10002 1

[tonyrakow]

Sorry I wasn't clear, the one above is the Blacklight list, this one is the uninstall_list:
Active Security Monitor 2.0.0.18
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.0
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Deskbar
AOL Toolbar
AOL Uninstaller (Choose which Products to Remove)
AOL You've Got Pictures Screensaver
Apple Software Update
avast! Antivirus
AVG Anti-Spyware 7.5
BCM V.92 56K Modem
BellSouth Application Management
BellSouth Internet Security - Alert Manager 1.5.11
BellSouth Toolbar 1.0
BellSouth® FastAccess® DSL Help Center 4.0
Broadcom 440x Driver Installer
Canon Camera Access Library
Canon Camera Support Core Library
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX (E)
C-Major Audio
Compatibility Pack for the 2007 Office system
Dell Modem-On-Hold
Dell ResourceCD
DellConnect
DellSupport
EXPStudio Audio Editor FREE 3.98
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
HP Memories Disc
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
HP Photo and Imaging 2.0 - hp psc 1200 series
hp psc 1200 series
Intel(R) Extreme Graphics Driver
Internal Network Card Power Management
InterVideo WinDVD
J2SE Runtime Environment 5.0 Update 6
Learn2 Player (Uninstall Only)
LiveUpdate 1.90 (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Encarta Encyclopedia Standard 2004
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mozilla Firefox (2.0.0.6)
MSRedist
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 6.0 Parser
Norton Utilities
QuickSet
QuickTime
RealPlayer
Rhapsody Player Engine
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926247)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Shockwave
SigmaTel AC97 Audio Drivers
Sonic DLA
Sonic Update Manager
StompSoft Registry Repair
Synaptics Pointing Device Driver
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB925876)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB936357)
URGE
Viewpoint Media Player
WebMediaPlayer
Windows Communication Foundation
Windows Defender
Windows Defender Signatures
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Workflow Foundation
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WordPerfect Office 11

[tonyrakow]

Alrite and fianlly this is the new HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 6:51:44 PM, on 8/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\AOL\Active Security Monitor\ASMonitor.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HJT\HijackThis.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
O1 - Hosts: J
(
O1 - Hosts: 8ö€ ¡€c¯


O1 - Hosts: 8öJ@€c¯<
¡8öJ

O1 - Hosts: ô¨ pR€m•PÀQ±€€ )$¨
ˆ
ø[‰
O1 - Hosts: *T
O1 - Hosts: à
O1 - Hosts: 8¨À p)À (à0P€@@Àa R€€PÃ[¥
¡€·J
8B
‡•l p€) B
X0
pۥ
X)
Bp€• X)€B
•T„
O1 - Hosts: °­
O1 - Hosts: 8¼U7Ń51+Q
ã9¥
¡€sJ
\B
Çâ€

[silver]

Hi tonyrakow,

There's quite a bit in this post so please take time to follow the instructions carefully. If you have any problems, please stop and let me know.

• Download BFU.zip from here
• Right click on BFU.zip and click Extract all
• Press Next, change the target folder to C:\BFU, press Next, uncheck Show extracted files and Finish
• Right click here and choose Save Link as to download EGDACCESS.bfu by Metallica
• Save it into C:\BFU as EGDACCESS.bfu

Copy/paste the following quote box into a new Notepad (not wordpad) document. Make sure that Format->Wordwrap is unchecked.

@echo off
If exist temp.reg del /q temp.reg
echo REGEDIT4 > temp.reg
echo.>> temp.reg
echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mkgdsqlxm] >> temp.reg
echo.>> temp.reg
echo [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] >> temp.reg
echo "mkgdsqlxm"=- >> temp.reg
echo.>> temp.reg
regedit /s temp.reg
attrib -r -s -h %windir%\prefetch\mkgdsqlxm.*
attrib -r -s -h %windir%\system32\mkgdsqlxm_navps.*
attrib -r -s -h %windir%\system32\mkgdsqlxm_nav.*
attrib -r -s -h %windir%\system32\mkgdsqlxm.*
attrib -r -s -h %windir%\system32\mkgdsqlxm_m2s.*
attrib -r -s -h %WINDIR%\mkgdsqlxm.exe-*.pf
del /q %windir%\prefetch\mkgdsqlxm.*
del /q %windir%\system32\mkgdsqlxm_navps.*
del /q %windir%\system32\mkgdsqlxm_nav.*
del /q %windir%\system32\mkgdsqlxm.*
del /q %windir%\system32\mkgdsqlxm_m2s.*
del /q %WINDIR%\mkgdsqlxm.exe-*.pf
del /q temp.reg

Save it to your Desktop as "naviclean.bat" (you MUST include the quotes)

It may be a good idea to print the rest of these instructions off as you will be rebooting your computer and will not have internet access while in safe mode

Make sure the Blacklight program is on your Desktop

• Press Start->Run, copy this command into the box and press OK:
  

  Code: Select all

  "%userprofile%\desktop\fsbl.exe" /expert

• This will launch BlackLight
• Select I accept the agreement
• Click Next>
• Click Scan
• Wait for the scan to finish
• Click on Next>
• Now click on the first item listed and click Rename
• Repeat for the rest of the items listed
• Click Next>
• Tick the box next to I understand the warning
• Click OK
• Click Restart now
• Click OK

Your computer will then restart

Reboot your computer in Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8
A menu should appear, use the arrow keys to select Safe Mode and press enter

Once in Safe Mode:

Locate naviclean.bat on your Desktop and double-click it. A DOS window will open briefly and then close, this is normal

• Go to C:\BFU and double click BFU.exe to start the Brute Force Uninstaller (BFU) by Merijn
• Click on the folder icon
• Find and select EGDACCESS.bfu
• Click Open
• Click Execute
• Wait for the script to finish executing
• You will get the message Completed script execution.
• Click OK
• Close BFU

Now, restart your computer normally

Make sure Blacklight is on your Desktop
Press Start->Run, copy this command into the box and press OK:

"%userprofile%\desktop\fsbl.exe" /expert

• Choose I accept the agreement, then Next and Scan
• It will create the fsbl-xxxxxxx.log on your desktop.
• The log will have a list of all items found.
• Do not choose to rename any this time
• Exit Blacklight and post the contents of the log in your next reply.

Once complete, please post the last Blacklight log along with a new HijackThis log.

[NonSuch]

This topic is now closed due to inactivity. If you wish it to be reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.