PC only boots in safe mode. Cannot run malwarebytes

tallisall · June 27, 2009

Hi,

Helping a friend with his pc. When the machine tries to boot in normal mode and he logs on we get a Bsod with error (page fault in nonpaged area). He said that the problem started after he discovered his Norton Internet Security program had stopped working. He contacted Norton and a rep walked him through uninstalling it. He downloaded the new version, but it would not install. The Norton rep said that my friend must have some type of malware on his machine and it must be removed before he could reinstall the norton.

I can bring the machine up in safe mode and I installed Malwarebytes, but it will not run. Since there is no antivirus software on the machine, I downloaded on my machine the Avira antivirus software, put it on a thumb drive and tried to install it on his machine. It would unpack, but not install. I renamed HJT to my initials and ran it. Here is the log file. Can you help? Thanks

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:18:23 PM, on 6/27/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Search\rdh.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [siS Tray] C:\WINDOWS\System32\sistray.EXE

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Ativa Wireless USB Utility.lnk = C:\Program Files\Ativa\USB AWGUA54\Wireless Utility\Ativawcui.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab

O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://lovefreegames.aavalue.com/LFG/Toolbar/LFG-toolbar.cab

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5556164D-4B4A-458F-81B6-DBDFD44BA4AD}: NameServer = 69.78.96.14 66.174.92.14

O17 - HKLM\System\CCS\Services\Tcpip\..\{E3FD40CE-A0A2-48ED-B6D8-3F5B8D099212}: NameServer = 85.255.112.19,85.255.112.120

O17 - HKLM\System\CCS\Services\Tcpip\..\{F3761965-F4E6-4793-B82D-C542B503E338}: NameServer = 85.255.112.19,85.255.112.120

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.19,85.255.112.120

O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.112.19,85.255.112.120

O17 - HKLM\System\CS5\Services\Tcpip\Parameters: NameServer = 85.255.112.19,85.255.112.120

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.19,85.255.112.120

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: Symantec Eraser Service (EraserSvc10910) - Unknown owner - C:\Program Files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe (file missing)

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 6103 bytes

sjpritch25 · June 28, 2009

Welcome to Malwarebytes

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1

Link 2

Link 3

--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

tallisall · June 28, 2009

Hi,

His machine can only come up in safe mode and cannot get on the internet. Can I download Comebofix on my machine, copy it to his desktop and run in safe mode? Will not be able to install recovery console without internet access.

Thanks,

sjpritch25 · June 28, 2009

Yes of course. just make sure you place it on their desktop. Just skip the part for Recovery Console.

tallisall · June 28, 2009

Hi,

Copied Combo-Fix.exe to friends desktop and ran it. It found a rootkit. Machine now will boot in real mode. Malwarebytes now comes up, but still unable to get on internet for updates. Logs below. Thank you for all your help.

ComboFix 09-06-26.02 - Owner 06/28/2009 12:52.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479.270 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\Combo-Fix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\MSIVXxbnmwqxmnvxvitusppkbmddnbphewxll.sys

c:\windows\system32\MSIVXcount

c:\windows\system32\MSIVXoowfsxwikdbblrpojevpikrwmasplgos.dll

c:\windows\system32\MSIVXruxoteplqvipfqxqkdhbwvigmgrilefm.dll

c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job

c:\windows\wtun.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_MSIVXserv.sys

((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-28 )))))))))))))))))))))))))))))))

.

2009-06-27 16:19 . 2009-06-28 17:45 -------- d-----w- C:\Search

2009-06-27 16:17 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-27 16:17 . 2009-06-27 16:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-27 16:17 . 2009-06-27 16:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-06-27 16:17 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-27 16:15 . 2009-06-27 18:16 -------- d-----w- C:\Downloads

2009-06-17 18:34 . 2009-06-18 16:52 1536 ----a-w- c:\windows\system32\TrueSoft.dat

2009-06-17 18:10 . 2009-06-17 18:10 -------- d-----w- c:\program files\Symantec

2009-06-17 18:10 . 2009-06-17 18:10 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

2009-06-17 18:10 . 2009-06-17 18:10 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2009-06-17 18:09 . 2009-06-17 18:09 -------- d-----w- c:\program files\Windows Sidebar

2009-06-17 16:29 . 2009-06-27 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton VRQ

2009-06-17 16:15 . 2009-06-17 18:46 -------- d-----w- c:\windows\LMIB16.tmp

2009-06-17 15:51 . 2009-06-17 15:51 -------- d-----w- c:\windows\LMIB35.tmp

2009-06-17 14:35 . 2009-06-17 14:35 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-27 16:06 . 2009-03-19 19:40 -------- d-----w- c:\program files\NortonInstaller

2009-06-17 18:12 . 2009-03-19 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2009-06-17 18:12 . 2004-06-06 16:01 -------- d-----w- c:\program files\Common Files\Symantec Shared

2009-06-17 18:11 . 2009-03-19 19:40 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller

2009-06-17 18:10 . 2009-06-17 18:10 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2009-06-17 18:10 . 2009-06-17 18:10 7386 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2009-05-26 11:39 . 2009-05-26 11:39 390664 ----a-w- c:\documents and settings\Owner\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

2009-05-07 15:32 . 2001-08-18 12:00 345600 ----a-w- c:\windows\system32\localspl.dll

2009-04-29 04:56 . 2006-06-23 17:33 827392 ----a-w- c:\windows\system32\wininet.dll

2009-04-29 04:55 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-04-17 12:26 . 2001-08-18 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys

2009-04-15 14:51 . 2004-06-21 00:59 585216 ----a-w- c:\windows\system32\rpcrt4.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]

"SiS Tray"="c:\windows\System32\sistray.EXE" [2003-10-30 667648]

"SiS Windows KeyHook"="c:\windows\System32\keyhook.exe" [2003-10-30 249856]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]

"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2003-09-24 180224]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Ativa Wireless USB Utility.lnk - c:\program files\Ativa\USB AWGUA54\Wireless Utility\Ativawcui.exe [2006-8-29 1556480]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk

backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk

backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk

backup=c:\windows\pss\Office Startup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Shortcut to winvnc.exe.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Shortcut to winvnc.exe.lnk

backup=c:\windows\pss\Shortcut to winvnc.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\uvnc114\\winvnc.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S2 EraserSvc10910;Symantec Eraser Service;"c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe" /h ccCommon --> c:\program files\Norton AntiVirus\Engine\16.5.0.134\ccSvcHst.exe [?]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [9/18/2008 12:47 PM 33752]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [7/16/2008 1:46 PM 29744]

S3 ODWGU(Ativa);Ativa Wireless G USB Network Adapter(Ativa);c:\windows\system32\drivers\ODWGU.sys [1/10/2007 5:45 PM 408064]

S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\PTDMBus.sys [1/18/2008 3:24 PM 29952]

S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\PTDMMdm.sys [1/18/2008 3:24 PM 41856]

S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\PTDMVsp.sys [1/18/2008 3:24 PM 39936]

S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\PTDMWWAN.sys [1/18/2008 3:24 PM 59520]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uInternet Connection Wizard,ShellNext = iexplore

TCP: {5556164D-4B4A-458F-81B6-DBDFD44BA4AD} = 69.78.96.14 66.174.92.14

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-28 12:57

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Ahead\InCD\incdsrv.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-06-28 13:02 - machine was rebooted

ComboFix-quarantined-files.txt 2009-06-28 18:02

Pre-Run: 44,661,202,944 bytes free

Post-Run: 44,634,849,280 bytes free

Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5

134 --- E O F --- 2009-06-11 10:55

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:03:45 PM, on 6/28/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\sistray.EXE

C:\WINDOWS\System32\keyhook.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Ativa\USB AWGUA54\Wireless Utility\Ativawcui.exe

C:\WINDOWS\explorer.exe