CaptainCHeerios

I got this spyware or virus..........its blocked my add remove hardware, disabledm y sound.........it runs in the background but hides from taskmanager.........its called rlrmvr.exe when ever you start up taskmanager you see it for a split second then it dissapears............its in my system32 folder but i cant see it in the folder, but when i search for it, it shows up there.........never was tehre before......but i got sent to a fake link with loads of spyware i removed the spyware and now after i restarted my comp i got this problem PLEASE HELP........ive tried installing norton but its giving me an error.............................need help................

i would but i dont have the time lately :-( im gonna do it once i get my laptop.....but i cant buy it now because im not 18 untill june and i cant take the funds out of my savings and put into my checking so i can buy it :-( but its gonna be awesome though a sager 7620, 2gigs ram 3.4ghz p4, ati x800, 80gig hd....im getting it for around 2300 hopefully

its called DCDP not DHCP. i think i solved it. I started up in safe mode and deleted DCDP and it hasn't come back yet, but when I tried to delete rlrmvr.exe it came back everytime i left the system32 folder, so i used the security tab download thing, which worked, and then disabled the use of rlrmvr and my computer hasnt cried. But i found the exe and renamed it, so that the computer does not run it. so, if my comp wants to run rlrmvr it wont, and then i will submit my copy of rlrmvr.exe that i renamed to mcafee so they can make look at it, and hopefully get a solution for it.

I deleted code but its still tehre. Deleted file. STILL THERE. Found out its running with nvdia. uninstalled nvidia software STILL THERE. Im gonna reinstall drivers if its still there im gonna be clueless [Edited by CaptainCheerios on 2005-04-05 16:31:40] [Edited by CaptainCheerios on 2005-04-05 16:41:28]

great....now that screwed up my network settings........i can't connect to the internet i have to yuse another computer now to reply and i have no clue whats wrong........PLEASE HELP ANYONE............

OK THIS IS NOT GONNA HELP AT ALL I DONT KNOW WHAT TO DO IT KEEPS TRYING TO ACCESS THE FILE IF WHEN I RESTART IT IT DOESNT HELP IM SCREWED

WTF ITS USING MY GRAPHICS CARD WHAT THE HECK! oMG ITS RUNNING WITH NTVDM WHICH IS PART OF NVIDIAS DRIVERS

OK THIS IS NOT RIGHT........NOW ONLY PREVIOUSLY VISITED PAGES WORK...........I CANT GO TO ANY SITE OTHER THEN Red Vs Blue, Google, here, and zdnet...........no other site works.............i mean 40 sites cant be down........somethings messed up on my comp

yay found the file but i dont seem to have the little security setting.....im using xp home................i dunno........but if you know of a way to lock the file.............like shouldnt encrypting it do the trick.....i mean then it shouldnt be able to be deleted right or anything.........i mean just a thought

oh yah quick question is there way to force quit an app.......cause i cant see the prog because its being used right now..............and its being hidden in taskmanager........how can i kill the processes?

I dont know what is with it...........i dont know what its doing.......but its running with a program called dcdp.exe which is located in my c:/documents and users/all users/startmenu/startup folder...........and they don't show up when u look for them at all........spy bot mcafee stinger, and adaware dont detect them..................im screwed..............its really getting annoying..............................but i fixed the other stuff it was just that the thing turned off plug and play.......if anyone can help please help me im gonna try working on deleting it through safe mode..........wait hijackthis found it Logfile of HijackThis v1.99.1 Scan saved at 3:02:34 PM, on 4/5/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\cisvc.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Mixer.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\system32\rlrmvr.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Spyware Doctor\swdoctor.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\mcafee.com\agent\McDash.exe c:\program files\mcafee.com\shared\mghtml.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Winamp\winamp.exe C:\Documents and Settings\Mike\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.redvsblue.com/ R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rlrmvr.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Mike\My Documents\HijackThis.exe /startupscan O4 - HKCU\..\Run: [spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5...b?1106857067593 O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0F6BB9C4-48D2-4C25-BCD3-CBA6E1057C0B}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F6BB9C4-48D2-4C25-BCD3-CBA6E1057C0B}: NameServer = 192.168.1.1 O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

so far so good except for the gpedit.msc it wont work on my comp says it cant find it.........i got alot of problems....it messed up my hardware....device manager picks up no hardware at all........ive run mcafee,spy doctor, spy bot, adaware...........i think i fixed it the spyware, but my comp wont use sound anymore nor any other hardware.......i need help with this problem.......

oh yeah addin my hijackthis log........keep forgetting stuff Logfile of HijackThis v1.99.1 Scan saved at 8:46:43 PM, on 4/4/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\cisvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Mixer.exe C:\WINDOWS\system32\rlrmvr.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\cidaemon.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe c:\program files\mcafee.com\vso\mcmnhdlr.exe c:\program files\mcafee.com\shared\mghtml.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Mike\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.redvsblue.com/ R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {00000000-DD60-0064-6EC2-6E0100000000} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missing O15 - Trusted Zone: *.morwillsearch.com O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c11.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5...b?1106857067593 O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://morwillsearch.com/mwsearch.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0F6BB9C4-48D2-4C25-BCD3-CBA6E1057C0B}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F6BB9C4-48D2-4C25-BCD3-CBA6E1057C0B}: NameServer = 192.168.1.1 O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

Add onto previous post: Its modifying settings and everything............its working with dcdp.exe and it hides to...........I have set all view file types set but its not there.............NEED HELP.........im installing mcafee right now.........................................please if anyone has any ideas for help please tell me............. The spyware actually is hidding.........ive never had it happen like this before..........you fix it in msconfig it says its right but 10 minutes later it changes it.......................you delete all the files do end process and everything i can think of.........still not helping....HELP ME PLEASE

just a thought but which do you use more your laptop or your pc?

just a thought but which do you use more your laptop or your pc?

heres a thought that just poped into my mind and i can be wrong but it could be that your loading more background programs then you load on the laptop

Im gonna let you in on a little fact....almost every big company like dell is out to just get money....what they do is they get a company like micro star or something like that have them modify one of their mother boards so it is different from a standard motherboard, then you have to buy their outrageously priced mobo,next they modify their ram.....i work with like 3 different dells at my work and found out today that opti-plex 240's ram are different from the opti-plex 260's ram in that one has an extra nich in it so that it fits into the slot....MORE MOENY FOR DELL.....next they dont use regular anything so you have to buy their outrageously priced stuff....my word of advice....either buy another case like me and make ur mobo fit (STUPID MEDION) or just buy new stuff.........dell and those companies just want money so dont bother with them get companies that use parts u can buy from the companies like ASUS and Nvidia themselves instead of through the computers company....or even better and cheaper...make it yourself

Also i am going to college next year at UAT so i am going to be designing video games....so being able to store large files over the internet will help me......anymore questions.......like how many Cisco networking certificates i have?

hrmmmmmmm let me think i am a tech spe[censored]t at a high school.....i am helping people out right now on your forms with things i know.......could that be good......

ignore this didnt realize it was answered my bad [Edited by CaptainCHeerios on 2004-11-15 22:26:40]

Hey i was wondering if you could send me a gmail invite at captaincheerios@hotmail.com please