My Pc may be infected - please guide.

[kingkox2]

I am using Malwarebytes Anti-Malware 1.51.1.1800 free edition. When I try to update the

database, I get the following error msg,Program_error_updating(11004,0,No address found).

As per instruction on your forum, I have reset my modem. I have also downloaded and run the dds

file. I have included the contents of the attach and dds file.

Please guide.

Content of DDS file...

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_21

Run by ABC123 at 4:37:25 on 2012-01-23

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2029.1428 [GMT 5.5:30]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: ZoneAlarm Firewall *Enabled*

.

============== Running Processes ===============

.

E:\Advanced SystemCare\Advanced SystemCare 5\ASCService.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

E:\Windows® Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

E:\Avast AV 5.0.545.100524\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

E:\SuperAntiSpyware Free Edition 5.0.1108\SASCORE.EXE

E:\JAVA\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\SnoopFreeSvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\RTHDCPL.EXE

E:\Windows® Defender\MSASCui.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\rmctrl.exe

E:\Avast AV 5.0.545.100524\avastUI.exe

E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\SnoopFreeUI.exe

E:\Spybot S & D 1.6.2\Spybot - Search & Destroy\TeaTimer.exe

E:\SuperAntiSpyware Free Edition 5.0.1108\SUPERAntiSpyware.exe

C:\WINDOWS\system32\wuauclt.exe

E:\Orbit Downloader 2.8.1\Orbitdownloader\orbitdm.exe

E:\Orbit Downloader 2.8.1\Orbitdownloader\orbitnet.exe

C:\WINDOWS\system32\NOTEPAD.EXE

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.orbitdownloader.com

uInternet Connection Wizard,ShellNext = iexplore

BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - e:\orbit downloader 2.8.1\orbitdownloader\orbitcth.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - e:\spybot~1.2\spybot~1\SDHelper.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - e:\avast av 5.0.545.100524\aswWebRepIE.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - e:\java\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - e:\java\lib\deploy\jqs\ie\jqs_plugin.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - e:\avast av 5.0.545.100524\aswWebRepIE.dll

uRun: [spybotSD TeaTimer] e:\spybot s & d 1.6.2\spybot - search & destroy\TeaTimer.exe

uRun: [sUPERAntiSpyware] e:\superantispyware free edition 5.0.1108\SUPERAntiSpyware.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [Windows Defender] "e:\windows® defender\MSASCui.exe" -hide

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [RemoteControl] c:\windows\system32\rmctrl.exe

mRun: [avast] "e:\avast av 5.0.545.100524\avastUI.exe" /nogui

mRun: [ZoneAlarm Client] "e:\program files\zone labs\zonealarm\zlclient.exe"

mRun: [snoopFreeUI] SnoopFreeUI.exe

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoru~1\winzip~1.lnk - e:\winzip 8.1\WZQKPICK.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoru~1\wordweb.lnk - e:\word web\wordweb\wweb32.exe

IE: &Download by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - e:\msoffi~1\office11\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - e:\msoffi~1\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\spybot~1.2\spybot~1\SDHelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

TCP: Interfaces\{C6CE96DF-8FEF-48AD-BD34-DDDBCF243477} : NameServer = 59.185.0.50,59.185.0.23,203.94.227.70,203.94.243.70

Notify: !SASWinLogon - e:\superantispyware free edition 5.0.1108\SASWINLO.DLL

Notify: igfxcui - igfxdev.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - e:\window~1\MpShHook.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - e:\superantispyware free edition 5.0.1108\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\abc123\application data\mozilla\firefox\profiles\07s1l9iq.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.in/

FF - plugin: e:\adobe reader 10.0\reader\browser\nppdf32.dll

FF - plugin: e:\adobe reader 6.0\reader\browser\nppdf32.dll

FF - plugin: e:\java\bin\new_plugin\npdeployJava1.dll

FF - plugin: e:\java\bin\new_plugin\npjp2.dll

.

============= SERVICES / DRIVERS ===============

.

R0 SnoopFree;SnoopFree Driver;c:\windows\system32\drivers\SnopFree.sys [2012-1-16 9472]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-3-1 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-30 314456]

R1 SASDIFSV;SASDIFSV;e:\superantispyware free edition 5.0.1108\sasdifsv.sys [2011-7-22 12880]

R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-10-15 532224]

R2 !SASCORE;SAS Core Service;e:\superantispyware free edition 5.0.1108\SASCORE.EXE [2011-7-19 116608]

R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;e:\advanced systemcare\advanced systemcare 5\ASCService.exe [2012-1-11 490840]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-30 20568]

R2 avast! Antivirus;avast! Antivirus;e:\avast av 5.0.545.100524\AvastSvc.exe [2010-9-30 44768]

R2 SnoopFreeSvc;Snoop Free Service;System32\SnoopFreeSvc.exe --> System32\SnoopFreeSvc.exe [?]

R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

R2 WinDefend;Windows Defender;e:\windows® defender\MsMpEng.exe [2006-11-3 13592]

S1 SASKUTIL;SASKUTIL;e:\superantispyware free edition 5.0.1108\SASKUTIL.SYS [2011-7-13 67664]

.

=============== Created Last 30 ================

.

2012-01-22 22:58:37 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{7777dfe9-3af5-4af3-a73e-1a0791e4fab8}\offreg.dll

2012-01-20 12:40:24 6557240 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{7777dfe9-3af5-4af3-a73e-1a0791e4fab8}\mpengine.dll

2012-01-16 02:06:38 9472 ----a-w- c:\windows\system32\drivers\SnopFree.sys

2012-01-16 02:06:38 90112 ----a-w- c:\windows\system32\SnoopFreeSvc.exe

2012-01-16 02:06:38 45056 ----a-w- c:\windows\SnoopFreeDll.dll

2012-01-16 02:06:38 221184 ----a-w- c:\windows\SnoopFreeUI.exe

2012-01-11 11:50:04 20312 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2012-01-11 10:46:31 -------- d-----w- c:\documents and settings\all users\application data\IObit

2012-01-08 17:20:46 -------- d-----w- c:\documents and settings\abc123\local settings\application data\Temp

.

==================== Find3M ====================

.

2011-11-28 18:01:25 41184 ----a-w- c:\windows\avastSS.scr

2011-11-28 17:53:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-15 08:59:56 222080 ------w- c:\windows\system32\MpSigStub.exe

.

============= FINISH: 4:39:36.85 ===============

Content of Attach file...

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume6

Install Date: 9/29/2010 10:42:27 PM

System Uptime: 1/23/2012 4:06:14 AM (0 hours ago)

.

Motherboard: Intel Corporation | | DG33FB

Processor: Intel® Core™2 Duo CPU E6550 @ 2.33GHz | J1PR | 2333/333mhz

Processor: Intel® Core™2 Duo CPU E6550 @ 2.33GHz | J1PR | 2333/333mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 20 GiB total, 11.824 GiB free.

D: is FIXED (FAT32) - 2 GiB total, 1.995 GiB free.

E: is FIXED (NTFS) - 30 GiB total, 10.723 GiB free.

F: is FIXED (NTFS) - 20 GiB total, 3.519 GiB free.

G: is FIXED (NTFS) - 20 GiB total, 3.254 GiB free.

H: is FIXED (NTFS) - 28 GiB total, 3.226 GiB free.

I: is FIXED (NTFS) - 32 GiB total, 6.785 GiB free.

J: is FIXED (FAT32) - 4 GiB total, 3.011 GiB free.

K: is FIXED (FAT32) - 4 GiB total, 1.056 GiB free.

L: is FIXED (FAT32) - 4 GiB total, 1.99 GiB free.

M: is FIXED (FAT32) - 4 GiB total, 3.06 GiB free.

N: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: SASKUTIL

Device ID: ROOT\LEGACY_SASKUTIL\0000

Manufacturer:

Name: SASKUTIL

PNP Device ID: ROOT\LEGACY_SASKUTIL\0000

Service: SASKUTIL

.

==== System Restore Points ===================

.

RP1: 1/11/2012 4:16:04 PM - System Checkpoint

RP2: 1/11/2012 4:34:29 PM - Revo Uninstaller's restore point - Mozilla Firefox 7.0.1 (x86 en-US)

RP3: 1/11/2012 7:31:58 PM - Software Distribution Service 3.0

RP4: 1/13/2012 6:16:19 AM - System Checkpoint

RP5: 1/14/2012 6:47:26 AM - Software Distribution Service 3.0

RP6: 1/17/2012 7:08:57 PM - Software Distribution Service 3.0

RP7: 1/20/2012 6:10:13 PM - Software Distribution Service 3.0

.

==== Installed Programs ======================

.

ACDSee 5.0 Standard

Adobe Flash Player 10 Plugin

Adobe Photoshop 7.0

Adobe Reader X

Advanced SystemCare 5

avast! Free Antivirus

Canon Camera Access Library

Canon Camera Support Core Library

Canon Camera Window DC_DV 5 for ZoomBrowser EX

Canon Camera Window DC_DV 6 for ZoomBrowser EX

Canon Camera Window MC 6 for ZoomBrowser EX

Canon G.726 WMP-Decoder

Canon MovieEdit Task for ZoomBrowser EX

Canon RAW Image Task for ZoomBrowser EX

Canon RemoteCapture Task for ZoomBrowser EX

Canon Utilities EOS Utility

Canon Utilities PhotoStitch

Canon Utilities ZoomBrowser EX

CCleaner

CloneDVD2

DFE-520TX

DFX for Winamp

eMusic - 100 Free MP3 offer

Foxit Reader

Hotfix for Windows XP (KB935448)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB981793)

Intel® Graphics Media Accelerator Driver

Intel® Management Engine Interface

Intel® PRO Network Connections 12.1.12.0

IsoBuster 2.5

Java Auto Updater

Java™ 6 Update 21

magicJack

Malwarebytes' Anti-Malware version 1.51.1.1800

Microsoft Office Professional Edition 2003

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox 8.0.1 (x86 en-US)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

Orbit Downloader

PartitionMagic

Picasa 2

PowerDVD

PowerQuest PartitionMagic 8.0

Random Password Generator

Realtek High Definition Audio Driver

Revo Uninstaller 1.83

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB975467)

Skype Toolbars

Skype™ 4.2

Smart Defrag

SnoopFree Privacy Shield

Spybot - Search & Destroy

SpywareBlaster 4.4

Super DVD Ripper (remove only)

SUPERAntiSpyware

Temp File Cleaner

TypingMaster Pro

Ultra Video Joiner 5.2.0322

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

VeryPDF PDF2Word v2.0

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

Visual C++ 8.0 CRT (x86) WinSXS MSM

Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM

WebFldrs XP

Webshots Desktop

Winamp (remove only)

Windows Defender

WinRAR archiver

WinZip

WordWeb

Xilisoft Video Editor

XviD MPEG-4 Video Codec

ZoneAlarm

.

==== Event Viewer Messages From Past Week ========

.

1/21/2012 1:55:54 AM, error: Service Control Manager [7003] - The Fast User Switching Compatibility service depends on the following nonexistent service: TermService

1/17/2012 3:52:11 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

.

==== End Of File ===========================

I would like to add...even after resetting the router and changing the password, when I try to update Malwarebytes' Anti-Malware 1.51.1.1800, I get the same error.Please guide.

[MrCharlie]

Duplicate post:

http://forums.malwarebytes.org/index.php?showtopic=105130&hl=&fromsearch=1

Please don't start multiple post! MrC