MBAM and HijackThis not working

[Janet R]

Iam having trouble getting rid of Police Pro. I have tried both MBAM and HijackThis, and the programs stop without completing. When I try to open the files again, I get the error "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." I have seen on other posts where you request teh Win32kdiag.txt file, and those results are below. Any help you could offer would be greatly appreciated.

Running from: C:\Documents and Settings\Dustin\Desktop\Win32kDiag.exe

Log file at : C:\Documents and Settings\Dustin\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\addins\addins

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Config\Config

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\chsime\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\CHTIME\Applets\Applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imejp98\imejp98

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imjp8_1\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imkr6_1\applets\applets

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\imkr6_1\dicts\dicts

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\ime\shared\res\res

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\classes\classes

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\java\trustlib\trustlib

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\msapps\msinfo\msinfo

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF

Mount point destination : \Device\__max++>\^

Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH

Mount point destination : \Device\__max++>\^

Cannot access: C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe

[1] 2004-08-04 07:00:00 743936 C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe ()

[miekiemoes]

Hi,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

[Janet R]

The log read as follows. I greatley appreciate all the help! Please let me know what to do next.

ComboFix 09-09-28.01 - Dustin 09/29/2009 16:30.1.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2942.2447 [GMT -5:00]

Running from: c:\documents and settings\Dustin\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Dustin\Application Data\seres.exe

c:\documents and settings\Dustin\Application Data\svcst.exe

c:\program files\Windows Police Pro

c:\program files\Windows Police Pro\windows Police Pro.exe

c:\windows\ppp3.dat

c:\windows\ppp4.dat

c:\windows\svchast.exe

c:\windows\system32\~.exe

c:\windows\system32\bennuar.old

c:\windows\system32\bincd32.dat

c:\windows\system32\dddesot.dll

c:\windows\system32\desot.exe

c:\windows\system32\images

c:\windows\system32\images\i1.gif

c:\windows\system32\images\i2.gif

c:\windows\system32\images\i3.gif

c:\windows\system32\images\j1.gif

c:\windows\system32\images\j2.gif

c:\windows\system32\images\j3.gif

c:\windows\system32\images\jj1.gif

c:\windows\system32\images\jj2.gif

c:\windows\system32\images\jj3.gif

c:\windows\system32\images\l1.gif

c:\windows\system32\images\l2.gif

c:\windows\system32\images\l3.gif

c:\windows\system32\images\pix.gif

c:\windows\system32\images\t1.gif

c:\windows\system32\images\t2.gif

c:\windows\system32\images\up1.gif

c:\windows\system32\images\up2.gif

c:\windows\system32\images\w1.gif

c:\windows\system32\images\w11.gif

c:\windows\system32\images\w2.gif

c:\windows\system32\images\w3.gif

c:\windows\system32\images\w3.jpg

c:\windows\system32\images\wt1.gif

c:\windows\system32\images\wt2.gif

c:\windows\system32\images\wt3.gif

c:\windows\system32\logon.exe

c:\windows\system32\sonhelp.htm

c:\windows\system32\sysnet.dat

c:\windows\system32\wbem\proquota.exe

c:\windows\system32\wispex.html

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected

Restored copy from - c:\windows\system32\dllcache\eventlog.dll

c:\windows\system32\proquota.exe was missing

Restored copy from - c:\system volume information\_restore{A1ADA296-B503-48C3-91A6-8C28304AA1E9}\RP77\A0006184.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Legacy_AntipPolice_

-------\Service_AntipPolice_

((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))

.

2009-09-29 21:32 . 2004-08-04 12:00 50176 ----a-w- c:\windows\system32\proquota.exe

2009-09-25 16:48 . 2009-09-25 16:48 -------- d-----w- c:\program files\Trend Micro

2009-09-25 14:38 . 2009-09-25 14:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-25 14:23 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-25 14:23 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-25 13:57 . 2009-09-25 14:14 -------- d--h--w- c:\windows\PIF

2009-09-25 13:36 . 2009-09-25 13:36 -------- d-----w- c:\documents and settings\Dustin\Application Data\Malwarebytes

2009-09-25 13:36 . 2009-09-25 13:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-17 21:28 . 2009-09-21 12:55 -------- d-----w- c:\documents and settings\Dustin\Tracing

2009-09-17 21:27 . 2009-09-17 21:27 -------- d-----w- c:\program files\Microsoft

2009-09-17 21:27 . 2009-09-17 21:27 -------- d-----w- c:\program files\Windows Live SkyDrive

2009-09-17 21:27 . 2009-09-17 21:27 -------- d-----w- c:\program files\Windows Live

2009-09-17 21:26 . 2009-09-17 21:26 -------- d-----w- c:\program files\Common Files\Windows Live

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-21 13:47 . 2009-07-07 13:53 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-08-26 14:31 . 2009-07-07 13:53 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-08-26 14:31 . 2009-07-07 13:53 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-08-26 14:31 . 2009-07-07 13:53 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-07-26 21:44 . 2009-07-26 21:44 48448 ----a-w- c:\windows\system32\sirenacm.dll

2009-07-08 16:54 . 2009-07-08 16:53 102032 ----a-w- c:\windows\hpoins04.dat

2009-07-08 15:59 . 2009-07-06 19:04 70808 ----a-w- c:\documents and settings\Dustin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-08 15:57 . 2009-07-07 13:53 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2009-07-07 13:47 . 2009-07-07 13:47 319488 ----a-w- c:\windows\HideWin.exe

2009-07-07 13:09 . 2009-07-07 13:09 544816 ----a-w- c:\windows\system32\pscl.dll

2009-07-07 13:09 . 2009-07-07 13:09 254002 ----a-w- c:\windows\system32\pscore.dll

2009-07-07 13:09 . 2009-07-07 13:09 43760 ----a-w- c:\windows\system32\nwlocale.dll

2009-07-07 13:09 . 2009-07-07 13:09 146976 ----a-w- c:\windows\system32\mfcoleui.dll

2009-07-06 18:57 . 2009-07-06 18:57 21640 ----a-w- c:\windows\system32\emptyregdb.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-16 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-16 86016]

"MCT5001"="c:\windows\system32\mct5001.exe" [2008-04-08 245760]

"mctudll"="c:\windows\system32\mctudll.exe" [2008-07-08 315392]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-26 2007832]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-16 1657376]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-10-26 17021440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-26 14:31 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/7/2009 8:53 AM 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/7/2009 8:53 AM 108552]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/8/2009 10:57 AM 297752]

R3 TrgExGrp;TrgExGrp;c:\windows\system32\drivers\TrgExGrp.sys [7/7/2009 8:19 AM 19712]

R3 TrgMrGrp;TrgMrGrp;c:\windows\system32\drivers\TrgMrGrp.sys [7/7/2009 8:19 AM 20224]

R3 trgusb;USB 2.0 Graphics Card;c:\windows\system32\drivers\TrgUsb.sys [7/7/2009 8:19 AM 62080]

S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/8/2009 10:57 AM 908056]

.

Contents of the 'Scheduled Tasks' folder

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.foxnews.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {7A19E228-0593-4ED0-B878-057F104A4D86} = 205.152.132.23,209.55.5.11

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-mserv - c:\documents and settings\Dustin\Application Data\svcst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-29 16:53

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1808)

c:\windows\system32\msi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

c:\windows\system32\rundll32.exe

c:\program files\Windows Live\Contacts\wlcomm.exe

.

**************************************************************************

.

Completion time: 2009-09-29 16:55 - machine was rebooted

ComboFix-quarantined-files.txt 2009-09-29 21:55

Pre-Run: 465,782,673,408 bytes free

Post-Run: 471,522,721,792 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

196

[miekiemoes]

Hi,

This looks OK again.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

[Janet R]

It's working great! Thanks so very much for your help. Have a great day!!

[miekiemoes]

Glad I could help.

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!