Unknown Windows API Function [131129]

[locktech]

Have played AAO for 4 mos. with no problems. After PB update of 19March06 every server I join gives the following message after being accepted by PB initially:

PunkBuster Client: Removing "[WC]LockTech=Pvt=" 0oc7a (0minutes) RESTRICTION: Unknown Windows API Function [131129]

I have uninstalled AAO, run regedit and purged AA references, rebooted, reinstalled AAO, and gone to a server to update PB. This has happened on my home desktop XP Pro Sp2; Dell Dimension 4700; Intel 2.8 Ghz; Radeon x300 series 128Mb. I run Zone Alarm and spybot teatimer.

The really odd thing is the same exact thing is happening on my Dell laptop at work. Windows 2000; Different connection, different account, different email. I had no problems on either prior to PB update. Even balance says it is a corrupt kernel32.dll. I have done a thorough scan of my computer and used recovery console to extract a new copy of dll for Windows XP Professional SP2 disk but still have same problem.

Does anyone have any suggestions to resolve this as I am having withdrawals.

Thanks

[fozzer]

API Kick 131129

 

 

Known cause: Trojan.Horse.BackDoor.Agent.BA

Solution: ID and remove it using AVG or other AV program (AVG recommend, currently only AV detecting this 11/28/05)

 

In NOTEPAD write this:

CODE

@echo off SET FILE=sqll echo y | cacls c:\windows\system32\*FILE*.dll /g Everyone:f attrib -r -s -h C:\Windows\system32\*FILE*.dll ren C:\Windows\system32\*FILE*.dll *FILE*.old del C:\Windows\system32\*FILE*.old

Than change the *FILE* to the filename infected and save this as REMOVE.BAT file. Run it in normal mode and the trojan BackDoor.Agent.BA is OUT.

 

Now, the hard part appears to be finding the name of the dll. The dll is write protected, and is unable to be deleted normally. Try the free version of AGV to tag the DLL.

 

Known cause: Proxy.L Trojan

Solution: Remove with AV or Trojan remover

 

Known cause: Trojan horse Downloader.Agent.AL

Solution: Remove with AV or Trojan remover

 

Known cause: Trojan horse PSW.Delf.2.A

Solution: Remove with AV or Trojan remover

 

ypur pc and laptop appear to be infected and need a thorough clean up m8 ... hope this helps

[Tim]

Hmmm, I wish I wouldv'e asked Fozz the same thing months ago,,,,I had to do a total system retore on my comp to get rid of the Trojan I picked up.....Hope in your case the method shown works for you...It's a pain in the @ss losing months of info on the HD because of a virus....

[Bev967]

Hi, ive got exactly the same problem done the same things reinstalled AA etc...

I have tried to locate the infected file but nothing i have picks it up.

What is an AVG...Anti Virus ..what.?

Ive used Trojan remover and run norton but nothing works i cant play AA and im sick and tired of it all.

 

Some extra guidance would be much welcome.

 

Thanks .

[fozzer]

AVG is a free anti virus prog.

http://free.grisoft.com/

[Bev967]

Duuuhhh yah lol

Bit obvious that one. Im sure i can be forgiven because im into my second day of trying to get past these Trojans and ive tried AVG but also nothing no effect.

[fozzer]

Duuuhhh yah lol

Bit obvious that one. Im sure i can be forgiven because im into my second day of trying to get past these Trojans and ive tried AVG but also nothing no effect.

np Bro :)

trying to get rid of spyware/malaware can be a royal pain in the ass.

Best of luck with it.

[Tim]

system restore brother.... I tried everything on that 1 trojan , 2 weeks later and many many tries at diff spy\virus removal programs {all failed}...system restore... it stinks but it works...

[Bev967]

Im going to pretent to be a nerd and say .."you dont mean format C and complete reinstall of windows do you" ?

Ive just spent the last week getting this damn computer back up to speed after doing that.

 

Please dont tell me thats what you meant........ :unsure:

[fozzer]

Before any talk or thought of format, I would explore all other avenues first :)

Theres a comprehensive list to trawl through dealing with this particular problem via our old friend google;

Google result

 

This was one of the first hits I looked at and is quite comprehensive in explanation and detail;

removal link