SystemDoctor/vacac.dll Manual Removal

SystemDoctor/vacac.dll is another of those pesky parasite/virus programs that is almost impossible to get rid of.

It is also related to the WinFixer virus.

General symptoms

Because no legitimate company would ever go to such extremes to make sure that infected computers can not be cleaned until you pay your protection money

(Funny, I said that same things about WinFixer ... there seems to be a pattern.)

Damage to My System | The Antivirus Crowd | Corporation ID | tracert | Registry Settings
Uninstall | Problem Debug | Related Sites | Notes | References

Damage to the System

The infected system was running Windows XP Home and TeaTimer (supposed to protect the registry ... not this time, but it did popup when the virus tried to infect Internet Explorer).

These are the main files

Since cacav.ini appears to be encrypted, it presumably contains a payload to be sent to the home computer.

This is the main related registry key

I was not able to delete vacac.dll because it was in use - it was being executed via both winlogon.exe and explorer.exe.

Of course, the primary damage is caused by web browser opening adds (in a new tab using Mozilla Firefox).

As with WinFixer, this virus causes every program on YOUR system to run slower.

A search of the internet found no hits for either vacac.dll or cacav.ini (which is the main reason that I wrote this page). searches for SystemDoctor provided no useful information - this infection is significantly different than any that I was able to find.

As a result, I had to figure out all this how to uninstall this virus without any outside help.

The Antivirus Crowd

Don't waste your time, not only was Symantec not able to find anything, it was running on the system when it got infected.

Corporation ID


I use tracert to track the physical locations of web sites (it will not give you a gps location, but it will tell you in which country a site is hosted).

This trace was made 11-09-06

Please notice the similarity to the last 2 entries of the WinFixer trace Please notice that the IP addresses are the same.

Registry Settings

This key executes the parasite when your system boots This registers the dll Additional keys are used to infect IE via Browser Helper Objects, but I don't have those.


The goal here is to simply kill and delete To remove this parasite, you will first need ProcessExplorer (from sysinternals) - it allows you to stop any program or thread.

Make sure that FireFox (the Mozilla web browser) and Internet Explorer are not running.

Execute Process Explorer (procexp.exe) and locate and kill all instances of the virus - there were 2 programs on the system, each with 3 infected threads.

Because Winlogon was infected, you will actually have to stop the vacac.dll threads without actually stopping the Winlogon program.

One at a time, right click each of the 2 programs, select Properties..., and display the Threads tab. Select each of the vacac.dll threads and click the kill button.

Display the Winlogon handles (its a menu selection) and select Close Handle.

After all the threads are killed and the handle is deleted, you will still not be able to delete the file until you reboot the system. However, you will be able to rename it - you MUST rename the file before rebooting the system.

I know that there is additional trash in the registry - but it does not appear to matter.

Problem Debug


vacac.dll   no windows parts - resources
cacav.ini   binary data, current date and time

neither file is found via google

the system is infected with a virus - mozilla firefox links to ........


This starts the program

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vacac

this runs under winlogon.exe and explorer.exe

regsvr32 /u vacac.dll

same date and time
\windows\system32\nqlogvfr.exe   probable installer


Author: Robert Clemenzi
URL: http:// / Parasites / SystemDoctor_parasite.html