invalid O/S Priveleges

Welcome to Majorgeeks!

Please do not post any logs inline especially HijackThis. And why would you even start with HJT if you don't know what to do with it. While doing the below, make sure you get HJT installed properly. And di not skip any steps. Make sure you setup Spybot as indicated so it will search for and fix newdot.net issues.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

Re: invalid O/S priveledges

Please remain in one thread. I'm merging you back with your original thread.

 

Re: invalid O/S priveledges

All of the sticky thread applies to you. You must attach the Bitdefender online scan log and a new HJT log now that you have completed the READ ME.

 

You should empty your Recycle Bin, empty ALL Quarantine folders for AV programs, and cleanup cookies first, then your log would probably not be so large.

At anyrate, this is the reason compression programs like WinZip were made. Compress the log into a ZIP and then see if it is small enough to upload. I would bet it is mostly the above kind of info and maybe a bunch from System Restore too. The only other thiing that makes logs so large is when default options are changed and you have the log show all files being scanned rather then just detected problems.

 

What version of DAP are you using (older versions contained malware). And why are you using multiple download accelerator programs. This is more than likely not going to help you and could make things slower.

Did you miss uninstalling Viewpoint Manager in step 0 of the READ ME. Or did you decide to keep it.

Also look for VCClient in Add/Remove programs and uninstall if found.

Downloading and running cracks like the next line can be a reason why you have such a bad infection:
O4 - HKLM\..\Run: [Final Fantasy XI - USA no cd crack] C:\Documents and Settings\alex\Shared\Final Fantasy XI - USA no cd crack.exe

The cleanup will take a few more procedures due to the nature of some of your problems. So lets start with the below and we will figure out what to do afterwards.

Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R3 - URLSearchHook: (no name) - {21C4AA2B-14B8-491D-BA17-1C2314BE9C94} - C:\WINDOWS\system32\heqvcru.dll (file missing)
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\ppiora.exe reg_run
O4 - HKLM\..\Run: [timessquare] c:\windows\timessquare.exe
O4 - HKLM\..\Run: [lspins] "C:\WINDOWS\system32\igps.exe"
O4 - HKLM\..\Run: [hdosqh] c:\windows\system32\xrrscv.exe r
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [0go40948.dll] RUNDLL32.EXE 0go40948.dll,b 29229640
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [Aida] "C:\Program Files\rdso\eetu.exe" -vt yazr
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.3.1.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab
O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://kdx.kontiki.com/kdx/Client403/kdx.cab
O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\guard.tmp (file missing)

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\AWS <--- the whole folder
C:\Program Files\Common Files\VCClient <--- the whole folder
C:\Program Files\rdso <--- the whole folder
C:\Documents and Settings\alex\Application Data\tvmcwrd.dll
C:\Documents and Settings\alex\Application Data\Lycos <--- the whole folder
c:\drsmartloadb.exe
C:\PROGRAM FILES\MediaGateway
C:\WINDOWS\INF\conscorr.inf
C:\WINDOWS\INF\satmat.inf
c:\windows\timessquare.exe
C:\WINDOWS\drsmartload.dat
C:\WINDOWS\NDNuninstall6_38.exe
C:\WINDOWS\satmat.ini
C:\WINDOWS\ss3unstl.exe
C:\WINDOWS\uniq
C:\WINDOWS\SYSTEM32\MYDLL.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\0go40948.dll
C:\WINDOWS\system32\ppiora.exe
C:\WINDOWS\system32\igps.exe
c:\windows\system32\xrrscv.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.