Brilliantly designed virus or just faulty computer?

Aprch · April 13, 2013

Hello everyone, I'm new here. I've been instructed to follow the steps on asking for help here, here's the original post, which explains the problem.

To put it simply, my computer got infected with a nasty virus that would shut down a lot of critical services on startup, preventing me from installing practically any antivirus, not being able to copy/cut folders or even drag them around. It also disabled Avast and the Windows Installer Services, and apparently my soundcard no longer exists and I can only hear the computer bleep.

Oh well, when all of this happened, what I first thought (I will just stop here and I won't go into much detail of what happened afterwards, for reading's sake) is to scan the computer with Malwarebytes. Installation went fairly normal but as I tried to run it, this little fellow showed up:

Quote

Run Time Error '372':

Failed to load control 'vbalGrid' from vbalsgrid6.ocx Your version of vbalsgrid6.ocx may be outdated. Make sure you are using the version of the control that was provided with your application.

I tried several things, but I'd like to know what's your take on this, maybe I got something wrong in the process of fixing it. As I said, I'm pretty sure I can get rid of this guy using Malwarebytes, but it seems as if the virus had made sure to disable all the possible ways of fixing it, so it pretty much feels like a check mate.

So... is any of you guys a good chess player?

Thanks a lot in advance.

Cheers!

I've also been told this could be a Remote Procedure Call problem. I tried several things but none of them seemed to work.

Now that I remember, there were also issues with my taskbar and my quick-start icons/tray icons, they magically dissappeared.

I've followed all the steps I could in the guide, I obviously couldn't get the program to work, therefore not being able to scan anything with it, but I did get DDS.com to work, so here's the log:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2

Run by Usuario at 23:36:02 on 2013-04-12

.

============== Running Processes ================

.

C:\WINDOWS\Explorer.EXE

C:\Archivos de programa\SUPERAntiSpyware\SASCORE.EXE

C:\Archivos de programa\Java\jre7\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe

C:\Archivos de programa\AVAST Software\Avast\avastUI.exe

C:\Archivos de programa\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Archivos de programa\Archivos comunes\Java\Java Update\jucheck.exe

C:\Documents and Settings\Usuario\Configuración local\Datos de programa\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.plusnetwork.com/?sp=hp

uInternet Connection Wizard,ShellNext = hxxp://ad.harrenmedianetwork.com/clk?2,13%3B64368ba5c7ad7b99%3B12b26df4deb,0%3B%3B%3B4288633824,wNtKAM5zCAC5E1AAAAAAAND9FQAAAAAAAABAAAIAAAAAAAUAAQAHFEjJCAAAAAAAlQsGAAAAAACliR0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFcgMAAAAAAAIAAwAAAAAASE3fJisBAAAAAAAAADg2M2MxZTMyLWMzNzAtMTFkZi1iMDg5LTAwMWIyNDkzNjUwYQCUAAAAAAA=,,http%3A%2F%2Fad.harrenmedianetwork.com%2F,

BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\archivos de programa\java\jre7\bin\ssv.dll

BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\archivos de programa\avast software\avast\aswWebRepIE.dll

BHO: Windows Live Aplicación auxiliar de inicio de sesión: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\archivos de programa\archivos comunes\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\archivos de programa\java\jre7\bin\jp2ssv.dll

BHO: Download Accelerator Plus Integration: {FF6C3CF0-4B15-11D1-ABED-709549C10000} - c:\archivos de programa\dap\dapieloader.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\archivos de programa\avast software\avast\aswWebRepIE.dll

uRun: [sUPERAntiSpyware] c:\archivos de programa\superantispyware\SUPERAntiSpyware.exe

mRun: [sunJavaUpdateSched] "c:\archivos de programa\archivos comunes\java\java update\jusched.exe"

mRun: [Adobe ARM] "c:\archivos de programa\archivos comunes\adobe\arm\1.0\AdobeARM.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [GB_UPDATE] c:\archivos de programa\razer\razer game booster\AutoUpdate.exe/AUTORUN

mRun: [avast] "c:\archivos de programa\avast software\avast\avastUI.exe" /nogui

mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoSMHelp = dword:1

uPolicies-Explorer: NoSMConfigurePrograms = dword:1

uPolicies-Explorer: NoSMMyPictures = dword:1

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: ForceClassicControlPanel = dword:1

mPolicies-Explorer: NoSMHelp = dword:1

mPolicies-Explorer: NoSMConfigurePrograms = dword:1

mPolicies-Explorer: NoSMMyPictures = dword:1

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: &Clean Traces - c:\archivos de programa\dap\privacy package\dapcleanerie.htm

IE: &Download with &DAP - c:\archivos de programa\dap\dapextie.htm

IE: Anexar a PDF existente - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir a Adobe PDF - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir destino de vínculo a PDF existente - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir destino de vínculo en archivo Adobe PDF - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir selección a Adobe PDF - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir selección a archivo PDF existente - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir vínculos seleccionados a Adobe PDF - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convertir vínculos seleccionados a PDF existente - c:\archivos de programa\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Download &all with DAP - c:\archivos de programa\dap\dapextie2.htm

IE: E&xportar a Microsoft Excel - c:\archiv~1\micros~2\office11\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\archivos de programa\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\archivos de programa\messenger\msmsgs.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{97E75B61-B11C-4DB4-9EAD-89D9CC306E25} : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\archivos de programa\archivos comunes\skype\Skype4COM.dll

Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\archivos de programa\dap\dapie.dll

Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\archivos de programa\dap\dapie.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\archivos de programa\superantispyware\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\usuario\datos de programa\mozilla\firefox\profiles\9mgzvy12.default\

FF - plugin: c:\archivos de programa\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\archivos de programa\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\archivos de programa\google\update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: c:\archivos de programa\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\archivos de programa\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\archivos de programa\microsoft\office live\npOLW.dll

FF - plugin: c:\archivos de programa\mozilla firefox\plugins\npwachk.dll

FF - plugin: c:\archivos de programa\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\documents and settings\all users\datos de programa\id software\quakelive\npquakezero.dll

FF - plugin: c:\documents and settings\usuario\configuraciã³n local\datos de programa\facebook\video\skype\npFacebookVideoCalling.dll

FF - plugin: c:\documents and settings\usuario\configuraciã³n local\datos de programa\google\update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: c:\windows\system32\adobe\director\np32dsw_1165635.dll

FF - plugin: c:\windows\system32\adobe\director\np32dsw_1168638.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_146.dll

FF - plugin: c:\windows\system32\npDeployJava1.dll

FF - plugin: c:\windows\system32\npptools.dll

FF - plugin: c:\windows\system32\NPSWF32.dll

.

============= SERVICES / DRIVERS ===============

.

R? avast! Antivirus;avast! Antivirus

R? Avgfwfd;AVG network filter service

R? BIOS;BIOS

R? CFG_NT4;CFG_NT4

R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

R? fsssvc;Servicio de Windows Live Protección infantil

R? Hamachi2Svc;LogMeIn Hamachi Tunneling Engine

R? LLRING0;LLRING0

R? mbamchameleon;mbamchameleon

R? MBAMSwissArmy;MBAMSwissArmy

R? SetupNTGLM7X;SetupNTGLM7X

R? SkypeUpdate;Skype Updater

R? SynasUSB;SynasUSB

R? Vsp;Vsp

R? WinRing0_1_2_0;WinRing0_1_2_0

R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0

S? !SASCORE;SAS Core Service

S? aswFsBlk;aswFsBlk

S? aswMonFlt;aswMonFlt

S? aswRvrt;aswRvrt

S? aswSnx;aswSnx

S? aswSP;aswSP

S? aswVmm;aswVmm

S? Avgfwdx;Avgfwdx

S? fssfltr;fssfltr

S? SASDIFSV;SASDIFSV

S? SASKUTIL;SASKUTIL

S? SmartDefragDriver;SmartDefragDriver

S? VBoxDrv;VirtualBox Service

S? VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter

S? VBoxNetFlt;VirtualBox Bridged Networking Service

S? VBoxUSBMon;VirtualBox USB Monitor Driver

.

=============== File Associations ===============

.

FileExt: .vbe: VBEFile=c:\windows\system32\CScript.exe "%1" %* [default=Open2]

FileExt: .vbs: VBSFile=c:\windows\system32\CScript.exe "%1" %* [default=Open2]

FileExt: .js: JSFile=c:\windows\system32\CScript.exe "%1" %* [default=Open2]

FileExt: .jse: JSEFile=c:\windows\system32\CScript.exe "%1" %* [default=Open2]

FileExt: .wsf: WSFFile=c:\windows\system32\CScript.exe "%1" %* [default=Open2]

.

=============== Created Last 30 ================

.

2013-04-10 06:50:30 -------- d-----w- c:\archivos de programa\Glary Utilities

2013-04-07 03:02:55 98816 ----a-w- c:\windows\sed.exe

2013-04-07 03:02:55 256000 ----a-w- c:\windows\PEV.exe

2013-04-07 03:02:55 208896 ----a-w- c:\windows\MBR.exe

2013-03-25 06:58:15 -------- d-----w- c:\documents and settings\usuario\datos de programa\SUPERAntiSpyware.com

2013-03-25 06:57:51 -------- d-----w- c:\documents and settings\all users\datos de programa\SUPERAntiSpyware.com

2013-03-25 06:57:51 -------- d-----w- c:\archivos de programa\SUPERAntiSpyware

2013-03-25 05:56:46 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2013-03-25 05:56:45 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-03-25 05:56:45 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2013-03-25 05:56:44 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2013-03-25 05:55:32 41664 ----a-w- c:\windows\avastSS.scr

2013-03-24 00:33:39 -------- d-----w- c:\archivos de programa\ESET

2013-03-23 23:54:14 -------- d-----w- c:\documents and settings\all users\datos de programa\NortonInstaller

2013-03-23 23:23:00 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2013-03-23 23:16:16 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-03-23 23:16:15 -------- d-----w- c:\documents and settings\usuario\datos de programa\Malwarebytes

2013-03-23 23:16:07 -------- d-----w- c:\documents and settings\all users\datos de programa\Malwarebytes

2013-03-23 23:16:06 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-23 23:16:06 -------- d-----w- c:\archivos de programa\Malwarebytes' Anti-Malware

2013-03-23 21:21:02 -------- d-----w- c:\archivos de programa\HitmanPro

2013-03-23 21:20:19 -------- d-----w- c:\documents and settings\all users\datos de programa\HitmanPro

2013-03-18 20:02:03 -------- d-----w- c:\documents and settings\usuario\datos de programa\Processing

.

==================== Find3M ====================

.

2013-02-19 02:59:57 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-19 02:59:56 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

============= FINISH: 23:36:44,06 ===============

As I said in the first post, I'd like to know what you guys think of this, and if you need any other info, please don't hesitate to ask

Thanks in advance

Aprch

Edited April 13, 2013 by Maurice Naggar

Maurice Naggar · April 13, 2013

Hello Aprch.

Please follow my guidance and do not run any other tools on your own. Also, do not use Quote or Code blocks for any report you post.

Just do a simple Copy & Paste. That way it is cleaner & easier for me to read.

Do not use the attach option for posting your logs, unless a particular report is way too huge to fit.

You may put each report in a separate reply.

Please start with the following, doing as much as you can.

Download aswMBR.exe ( 511KB ) to your desktop.

On Windows 7 / 8 or Vista, RIGHT click on aswMBR.exe and select Run As Administrator to start.

On Windows XP, double click the exe to start.

IF prompted to update Avast definitions, answer NO.

On the following screen:

uncheck trace disk IO calls at the bottom left :excl:

Now, Click the "Scan" button to start scan.

Have patience as it scans.

On completion of the scan (Note if the Fix button is enabled (not the FixMBR button) and tell me)

Now click save log, save it to your desktop and Copy & Paste in your next reply.

Do NOT click any Fix button.

EXIT the tool.

Task 2

Download & SAVE to your Desktop Tigzy's RogueKiller >> from here << or

>> from here <<

Quit all programs that you may have started.
Please disconnect any USB or external storage drives from the computer before you run this scan!
For Vista or Windows 7 / 8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.
For Windows XP, double-click to start.
Wait until Prescan has finished ...
Then Click on Scan button at upper right of screen.
Wait until the Status box shows "Scan Finished"
Click on Report and copy/paste the content of the Notepad into your next reply.
The log should be found in RKreport[1].txt on your Desktop
Do NOT press any Fix button.
Exit/Close RogueKiller

Aprch · April 14, 2013

So aswMBR led me to a bluescreen with the following error message: (I saw 2 locked yellow files and 1 red suspicious before the bluescreen, this has happened with other programs before, as if just before finding the error, the computer crashes)

STOP 0x0000008E (0xC0000005, 0x80544732, 0xBA7BC944, 0x00000000)

I'll try again now, meanwhile here's the RougeKiller report:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Usuario [Admin rights]

Mode : Scan -- Date : 04/13/2013 22:29:21

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤

[services][HJNAME] HKLM\[...]\ControlSet001\Services\SamSs (C:\WINDOWS\cystem32\lsass.exe) [x] -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[RUN][HJNAME] [ON_D:Julián]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\ctfmon.exe) [-] -> FOUND

[RUN][HJNAME] [ON_D:LocalService]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\CTFMON.EXE) [-] -> FOUND

[RUN][HJNAME] [ON_D:NetworkService]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\CTFMON.EXE) [-] -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

-> D:\Documents and Settings\Julián\NTUSER.DAT

-> D:\Documents and Settings\LocalService\NTUSER.DAT

-> D:\Documents and Settings\NetworkService\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] cb39aeb29bc56a25c8a47d79496dd8d0

[bSP] edf0166eb602f792329496bd9e66b382 : Windows XP MBR Code

Partition table:

0 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 16065 | Size: 79995 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 163846935 | Size: 158469 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_04132013_02d2229.txt >>

RKreport[1]_S_04132013_02d2229.txt

Maurice Naggar · April 14, 2013

What you said in your 1st post ....

To put it simply, my computer got infected with a nasty virus that would shut down a lot of critical services on startup, preventing me from installing practically any antivirus, not being able to copy/cut folders or even drag them around. It also disabled Avast and the Windows Installer Services, ....

Let me remark that you should have (at that time) disconnected this computer from the internet and your home network (if any).

The issue with the failing mbam install is only an after-effect of an apparent backdoor trojan.

Please disconnect this system from the internet and from your home network (if any).

Use another system to do any downloads and use a new clean USB-flash-thumb drive to transfer any downloads to your infected system.

IF and ONLY IF this is the only system at your house, then restart the system into Safe Mode with Networking, and keep it in that mode until I advise otherwise.

And do not do any websurfing, or any game play, or any online banking or any online shopping.

Only go to this forum and the sites I guide you to.

Backdoor trojan warning:
This system has some serious backdoor trojans.
This is a point where you need to decide about whether to make a clean start.
According to the information provided in logs, one or more of the identified infections is a backdoor trojan. This allows hackers to remotely control your computer, steal critical system information, and download and execute files.
You are strongly advised to do the following immediately.
1. Contact your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and ask them to put a watch on your accounts or change all your account numbers.
2. From a clean computer, change ALL your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups.
3. Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.These trojans leave a backdoor open on the system that can allow a hacker total and complete access to your computer. (Remote access trojan) Hackers can operate your computer just as if they were sitting in front of it. Hackers can watch everything you are doing on the computer, play tricks, do screenshots, log passwords, start and stop programs.
See this article on creating strong passwords http://www.microsoft.com/security/online-privacy/passwords-create.aspx
* Take any other steps you think appropriate for an attempted identity theft.
You should also understand that once a system has been compromised by a Trojan backdoor, it can never really be trusted again unless you completely reformat the hard drives and reinstall Windows fresh.
While we usually can successfully remove malware like this, we cannot guarantee that it is totally gone, and that your system is completely safe to use for future financial information and/or transactions.
Here is some additional information: What Is A Backdoor Trojan? http://www.geekstogo...backdoor-trojan
Danger: Remote Access Trojans http://www.microsoft...o/virusrat.mspx
Consumers – Identity Theft http://www.ftc.gov/b...mers/index.html
When should I re-format? How should I reinstall? http://www.dslreports.com/faq/10063
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? http://www.dslreports.com/faq/10451
Rootkits: The Obscure Hacker Attack http://www.microsoft...tip/st1005.mspx

Let me know what you decide.

IF you wish to attempt to hunt & remove malware ....and remember there can be no guarantee that all will be found or removed....

then start with the following.

Disable your anti-virus program, How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs
Please disconnect any USB or external storage drives from the computer before you run this scan!
Right-Click RogueKiller and select Run as Administrator.
Wait until Prescan finishes.
On the RogueKiller console, click the Registry tab.
Put a check next to all of these and uncheck the rest: (if found)
[services][HJNAME] HKLM\[...]\ControlSet001\Services\SamSs (C:\WINDOWS\cystem32\lsass.exe) [x] -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[RUN][HJNAME] [ON_D:Julián]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\ctfmon.exe) [-] -> FOUND
[RUN][HJNAME] [ON_D:LocalService]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\CTFMON.EXE) [-] -> FOUND
[RUN][HJNAME] [ON_D:NetworkService]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\CTFMON.EXE) [-] -> FOUND
Then click on Delete on the right hand column under Options.
The log will be found as RKreport
Copy & Paste the contents into next reply.

NEXT:

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Please download Rkill by Grinler and save it to your desktop.

Link 2
Link 3
Link 4
Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7, right-click on it and Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
If your antivirus program gives a prompt message, respond positive to allow RKILL to run.
If a malware-rogue gives a message regarding RKILL, proceed forward to running RKILL

IF you still have a problem running RKILL, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.

When all done, rkill.txt log file will be on your desktop. Copy & Paste contents of Rkill.txt into a reply.

More Information about Rkill can be found at this link: http://www.bleepingcomputer.com/forums/topic308364.html

NEXT:

1. Download Malwarebytes Anti-Rootkit from http://www.malwarebytes.org/products/mbar/

2. Unzip the contents to a folder in a convenient location.

3. Open the folder where the contents were unzipped and run mbar.exe

4. Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5. Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6. Wait while the system shuts down and the cleanup process is performed.

7. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

Aprch · April 15, 2013

I'd like to try and disable it, at least so I can copy my stuff for backup, and then make a clean start.

RougeKiller report:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Usuario [Admin rights]

Mode : Remove -- Date : 04/14/2013 21:13:12

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤

[services][HJNAME] HKLM\[...]\ControlSet001\Services\SamSs (C:\WINDOWS\cystem32\lsass.exe) [x] -> DELETED

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> NOT SELECTED

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> NOT SELECTED

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> NOT SELECTED

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[RUN][HJNAME] [ON_D:Julián]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\ctfmon.exe) [-] -> DELETED

[RUN][HJNAME] [ON_D:LocalService]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\CTFMON.EXE) [-] -> DELETED

[RUN][HJNAME] [ON_D:NetworkService]HKCU[...]\Run : CTFMON.EXE (C:\WINDOWS\system32\CTFMON.EXE) [-] -> DELETED

¤¤¤ Particular Files / Folders: ¤¤¤

[Faked.Drv][FILE] snp2uvc.sys : C:\WINDOWS\system32\drivers\snp2uvc.sys [-] --> CANNOT FIX

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

-> D:\Documents and Settings\Julián\NTUSER.DAT

-> D:\Documents and Settings\LocalService\NTUSER.DAT

-> D:\Documents and Settings\NetworkService\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] cb39aeb29bc56a25c8a47d79496dd8d0

[bSP] edf0166eb602f792329496bd9e66b382 : Windows XP MBR Code

Partition table:

0 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 16065 | Size: 79995 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 163846935 | Size: 158469 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[3]_D_04142013_02d2113.txt >>

RKreport[1]_S_04132013_02d2229.txt ; RKreport[2]_S_04142013_02d2109.txt ; RKreport[3]_D_04142013_02d2113.txt

I deleted the ones you named.

Aprch · April 15, 2013

Rkill report:

Rkill 2.4.7 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Rkill can be found at this link:

http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 04/14/2013 09:27:13 PM in x86 mode.

Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\WINDOWS\system32\nvsvc32.exe (PID: 932) [WD-HEUR]

* C:\WINDOWS\system32\notepad.exe (PID: 924) [WD-HEUR]

2 proccesses terminated!

Possibly Patched Files.

* C:\WINDOWS\system32\services.exe

* C:\WINDOWS\system32\lsass.exe

* C:\WINDOWS\system32\svchost.exe

* C:\WINDOWS\System32\svchost.exe

* C:\WINDOWS\system32\svchost.exe

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* CryptSvc (CryptSvc) is not Running.