Strange MSServer - the way out exept crashing it with baseball bat

[Incognito]

There is something absolutely wrong with my system I
noticed some strange thing in my System Configuration. In Startup there is a
strange programm that wasn't there before - MSServer; Manufactorer:- Unnown;
Command -rundll32.exe C:\windows\system32\nnnMfDvw.dll,#1. I tryed to
disable it in System configuration, then cleaned registry key.- NOTHING!
After restart it is again in my Startup with checked box, but with new dll
and in registry too. It's changed from-nnnMfDvw.dll,#1 to -qoMdBTjk.dll,#1.
Every time I tryed to get rid of it,it comes with new name of dll. I tryed
System Restore - It gives error and didn't do anything(( Is there a way out
of this situation exept crashing it with a baseball bat and get a new
computer with WinXP?
Thanks for help

 

[Rick Rogers]

Hi,

Your problem isn't Vista, it's the malware that you allowed to be installed
on the system. Boot to safe mode and run full system scans with updated
antivirus and antispyware programs.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org
My thoughts http://rick-mvp.blogspot.com

 

[Malke]

There is something absolutely wrong with my system
I noticed some strange thing in my System Configuration. In Startup there
is a strange programm that wasn't there before - MSServer; Manufactorer:-
Unnown;
Command -rundll32.exe C:\windows\system32\nnnMfDvw.dll,#1. I tryed to
disable it in System configuration, then cleaned registry key.- NOTHING!
After restart it is again in my Startup with checked box, but with new dll
and in registry too. It's changed from-nnnMfDvw.dll,#1 to
-qoMdBTjk.dll,#1. Every time I tryed to get rid of it,it comes with new
name of dll. I tryed System Restore - It gives error and didn't do
anything(( Is there a way out of this situation exept crashing it with a
baseball bat and get a new computer with WinXP?
Thanks for help

This has nothing to do with Vista. You've installed something or clicked on
something that was malware. So getting a new computer with XP isn't going
to help you unless you change your habits. See the end of this post for
some links on how to not get infected again. In the meantime, you will need
to clean up your computer or take it to a professional to do this for you.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. You will
generally be asked to:

1. Download and execute HiJack This! (HJT) -
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

2. Disable Notepad's word wrap - In Notepad.exe; Format --> uncheck; "Word
wrap"

3. Download/run Deckard's System Scanner -
http://www.techsupportforum.com/sectools/Deckard/dss.exe

4. Save the scan results (Main.txt and Extra.txt)

5. And then post the contents of Main.txt and Extra.txt in your post at the
forum you chose. DO NOT POST LOGS IN THE MS NEWSGROUPS.

Standard disclaimer: I can't see and test your computer myself, so these are
just suggestions based on many years of being a professional computer tech;
suggestions based on what you've written. You should not take my
suggestions as a definitive diagnosis. If you can't do the work yourself
(and there is no shame in admitting this isn't your cup of tea), take the
machine to a professional computer repair shop (not your local equivalent
of BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may be
so infested that Windows will need to be clean-installed. If possible, have
all your data backed up before you take the machine into a shop.

Staying Safe:

http://www.getsafeonline.org/
https://www.mysecurecyberspace.com/
http://www.getnetwise.org/
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://www.claymania.com/safe-hex.html
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://msmvps.com/blogs/harrywaldron/archive/2006/02/05/82584.aspx - MVP
Harry Waldron - The Family PC - How to stay safe on the Internet

Malke

 

[m1ch4L]

Hi,

I had the same problem... not even ESET Smart Security prevented this
malware to get installed. This is what I did to get rid of it:

- write down the names of the infected .dll files, there should be 2 of
them, showing as two MSServer startup processes. One is in
c-windows-system32-, the other one is in c-users-username-AppData-Local-Temp-
- Boot the system in Safe Mode (by pressing F8 during booting)
- delete the files. you need to make sure you are the "owner" of the files,
if not edit this (right-click on the file, properties, Security tab,
Advanced, Owner tab)
- go to System Configuration (type "msconfig" in the Start Menu search box),
go to the startup tab and uncheck MSServer
- restart your system and it should be ok


Mike