Can't run MBAM

goodwijl · October 4, 2009

I get runtime errors when I try to run MBAM, tried to download the newest version and still get the errors "0" and "440".

I cannot get to the MBAM log file, but I downloaded the HijackThis and ran the scan to get the logfile:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:47:31 PM, on 10/3/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Windows\system32\ctfmon.exe

C:\Windows\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Windows\system32\spoolsv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Windows\System32\NMSSvc.exe

C:\Windows\system32\nvsvc32.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\spider.exe

C:\Windows\explorer.exe

C:\Windows\SynCor.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\ntvdm.exe

C:\WINDOWS\system32\sol.exe

C:\Windows\system32\wuauclt.exe

c:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\RunOnce: [spybotDeletingA3699] command.com /c del "C:\Windows\SchedLgU.Txt"

O4 - HKLM\..\RunOnce: [spybotDeletingC3640] cmd.exe /c del "C:\Windows\SchedLgU.Txt"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1252108061843

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\Windows\System32\HPZipm12.exe

--

End of file - 5216 bytes

screen317 · October 4, 2009

Hi and welcome to Malwarebytes.

Download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

After that, install the Microsoft Visual Basic Common Controls. After that, restart your computer, and see if MBAM will run now.

-screen317

goodwijl · October 4, 2009

Hi and welcome to Malwarebytes.
Download DDS by sUBs and save it to your Desktop.
Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.
After that, install the Microsoft Visual Basic Common Controls. After that, restart your computer, and see if MBAM will run now.
-screen317

Here is the DDS log:

DDS (Ver_09-09-29.01) - NTFSx86

Run by Administrator at 15:22:45.06 on Sun 10/04/2009

Internet Explorer: 7.0.5730.13

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.136 [GMT -4:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\Windows\system32\svchost -k DcomLaunch

svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Windows\system32\ctfmon.exe

C:\Windows\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Windows\system32\spoolsv.exe

svchost.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Windows\System32\NMSSvc.exe

C:\Windows\system32\nvsvc32.exe

C:\Windows\System32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\spider.exe

C:\Windows\explorer.exe

C:\Windows\SynCor.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\ntvdm.exe

C:\WINDOWS\system32\sol.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Intuit\QuickBooks 2006\qbw32.exe

C:\Program Files\Common Files\Intuit\QuickBooks\axlbridge.exe

C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Administrator\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

mSearch Bar = hxxp://go.compaq.com/1Q00CDT/0409/bl8.asp

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [<NO NAME>]

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [nwiz] nwiz.exe /install

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe

mRunOnce: [spybotDeletingA3699] command.com /c del "c:\windows\SchedLgU.Txt"

mRunOnce: [spybotDeletingC3640] cmd.exe /c del "c:\windows\SchedLgU.Txt"

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1252108061843

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-10-24 34824]

R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]

R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2008-10-24 468224]

S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2009-9-3 26488]

=============== Created Last 30 ================

2009-10-04 15:22 <DIR> --d----- c:\temp\RarSFX0

2009-10-03 19:46 <DIR> --d----- c:\program files\Trend Micro

2009-10-03 19:40 <DIR> --d----- C:\install

2009-09-28 05:15 49 a------- c:\windows\NeroDigital.ini

2009-09-13 18:51 82 a------- c:\windows\wininit.ini

2009-09-04 20:08 <DIR> --d----- c:\program files\Spybot - Search & Destroy

2009-09-04 20:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

2009-09-04 19:36 <DIR> --d----- c:\program files\Nero

2009-09-04 19:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Nero

2009-09-04 19:08 <DIR> --d----- C:\Intel

2009-09-04 18:50 <DIR> --d----- c:\program files\Microsoft MapPoint 2009

2009-09-04 18:48 <DIR> --d----- c:\program files\MSECache

2009-09-04 18:24 <DIR> --d----- c:\windows\system32\XPSViewer

2009-09-04 18:23 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-09-04 18:23 575,488 -------- c:\windows\system32\xpsshhdr.dll

2009-09-04 18:23 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll

2009-09-04 18:23 117,760 -------- c:\windows\system32\prntvpt.dll

2009-09-04 18:23 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-09-04 18:23 <DIR> --d----- C:\aa5a29ad386c5f043eda64

2009-09-04 18:23 1,676,288 -------- c:\windows\system32\xpssvcs.dll

2009-09-04 18:23 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll

2009-09-04 18:15 1,846,632 a------- c:\windows\system32\D3DCompiler_41.dll

2009-09-04 18:15 453,456 a------- c:\windows\system32\d3dx10_41.dll

2009-09-04 18:15 4,178,264 a------- c:\windows\system32\D3DX9_41.dll

2009-09-04 18:15 517,448 a------- c:\windows\system32\XAudio2_4.dll

2009-09-04 18:15 69,448 a------- c:\windows\system32\XAPOFX1_3.dll

2009-09-04 18:13 2,297,552 a------- c:\windows\system32\d3dx9_26.dll

2009-09-04 18:12 <DIR> --d----- c:\windows\Logs

==================== Find3M ====================

2009-10-04 13:36 18,485,248 a------- c:\program files\All States Rail Services, Inc.QBW

2009-10-04 13:16 196,608 a------- c:\program files\All States Rail Services, Inc.QBW.TLG

2009-10-04 13:16 385 a------- c:\program files\All States Rail Services, Inc.QBW.ND

2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys

2009-09-03 20:06 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat

2009-09-02 12:42 26,216 a------- c:\docume~1\admini~1\applic~1\GDIPFONTCACHEV1.DAT

2009-08-06 19:24 53,472 a------- c:\windows\system32\dllcache\wuauclt.exe

2009-08-06 19:24 96,480 a------- c:\windows\system32\dllcache\cdm.dll

2009-08-06 19:23 575,704 a------- c:\windows\system32\dllcache\wuapi.dll

2009-08-05 05:01 204,800 -------- c:\windows\system32\mswebdvd.dll

2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

2009-07-19 09:33 3,597,824 -------- c:\windows\system32\dllcache\mshtml.dll

2009-07-19 09:32 6,067,200 -------- c:\windows\system32\dllcache\ieframe.dll

2009-07-17 15:01 58,880 a------- c:\windows\system32\SET1F21.tmp

2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll

2009-07-17 14:55 58,880 -------- c:\windows\system32\atl.dll

2009-07-13 23:43 10,841,088 -------- c:\windows\system32\dllcache\wmp.dll

2009-07-13 23:43 286,208 -------- c:\windows\system32\wmpdxm.dll

2009-07-13 23:43 286,208 -------- c:\windows\system32\dllcache\wmpdxm.dll

2009-07-10 09:27 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll

============= FINISH: 15:23:49.04 ===============

goodwijl · October 5, 2009

MBAM still will NOT work after installing the Visual Basics file. Still need help! I get the same errors as before.

screen317 · October 6, 2009

Please do the following to see if it fixes the error:

Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):

regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll"
regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll"
regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx"

Once you've done that click on File and select Save As...
In the Save dialogue box click on the drop down menu next to Save as type and select All Files
Name the file MBAM Fix.bat (the .bat extension is very important)
Save the file to your desktop and double click it to run it on XP. For Vista please right click on it and choose Run As Admin
Click OK to each of the 3 dialog boxes that should show a success message for each file registered
If you get an error that REGSVR32 "is not recognized as an internal or external command, operable program or batch file", then ensure that the file REGSVR32.EXE exists in the %WINDIR%\SYSTEM32 folder. If it's not found there you can copy if from another Computer running the same operating system and service pack level.

-screen317

goodwijl · October 7, 2009

I saved that to the desktop, but when i double-click on it to open, i see a black box for a split second, then it disappears and nothing happens. Can't tell what it says, but looks like there is white writing in it. Also cannot locate that file as you typed it, I found system 32 files but don't know what I'm looking for, and how would i copy it??

screen317 · October 8, 2009

Try this instead:

Please open Notepad. Copy and paste the following text (starting with @echo on) into the Notepad document.

Navigate to File --> Save As..., and save the file as Fix.bat (make sure the Save As Type is set to All Files).

Save it to your Desktop.

@echo on
regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll"
regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll"
regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx"
pause

Now navigate to your Desktop, and double click Fix.bat

When it says "Press any key to continue," don't press anything yet. Copy and paste everything on the screen into your reply. Then press any key and the box will close.

-screen317

goodwijl · October 9, 2009

C:\Documents and Settings\Administrator\Desktop\regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll"

'regsvr32' is not recognized as an internal or external command, operable program or batch file.

C:\Documents and Settings\Administrator\Desktop\regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll"

'regsvr32' is not recognized as an internal or external command, operable program or batch file.

C:\Documents and Settings\Administrator\Desktop\regsvr32 "C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx"

'regsvr32' is not recognized as an internal or external command, operable program or batch file.

C:\Documents and Settings\Administrator\Desktop>pause

Press any key to continue . . .

screen317 · October 10, 2009

Hi,

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
REGSVR32.EXE
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

goodwijl · October 14, 2009

Hello, here is the log from the scan:

SystemLook v1.0 by jpshortstuff (29.08.09)

Log created at 15:27 on 14/10/2009 by Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "REGSVR32.EXE"

C:\Compaq\NIC\WINDOWS\NMS\IA32\RegSvr32.EXE ------ 37136 bytes [19:37 04/01/2009] [21:01 24/04/1998] 7B194F51F6B52233C33A7D0D88A91581

C:\WINDOWS\$NtServicePackUninstall$\regsvr32.exe -----c 11776 bytes [23:39 03/09/2009] [07:56 04/08/2004] 9709EAD856A690333138AC40804F914E

C:\WINDOWS\ServicePackFiles\i386\regsvr32.exe ------ 11776 bytes [07:56 04/08/2004] [00:12 14/04/2008] FBDB9D0935B9907B809B381FDDF1627F

-=End Of File=-

screen317 · October 17, 2009

Hi,

Please download Combofix by sUBs. Save it to your Desktop but do not run it yet.

Next, please open Notepad - don't use any other text editor than notepad or the script will fail.

Copy/paste the text in the quotebox below into Notepad:

FCOPY::
C:\WINDOWS\ServicePackFiles\i386\regsvr32.exe | C:\WINDOWS\SYSTEM32\regsvr32.exe

Save this as CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Also try running the .bat file above again.

-screen317

goodwijl · October 18, 2009

Okayy here is the Combofix log:

ComboFix 09-10-17.01 - Administrator 10/18/2009 13:31.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.278 [GMT -4:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFscript.txt

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Start Menu\HP Image Zone .lnk

c:\windows\system32\_000007_.tmp.dll

c:\windows\system32\_006018_.tmp.dll

c:\windows\system32\_006019_.tmp.dll

c:\windows\system32\_006020_.tmp.dll

c:\windows\system32\_006021_.tmp.dll

c:\windows\system32\_006028_.tmp.dll

c:\windows\system32\_006029_.tmp.dll

c:\windows\system32\_006030_.tmp.dll

c:\windows\system32\_006031_.tmp.dll

c:\windows\system32\_006033_.tmp.dll

c:\windows\system32\_006034_.tmp.dll

c:\windows\system32\_006037_.tmp.dll

c:\windows\system32\_006038_.tmp.dll

c:\windows\system32\_006040_.tmp.dll

c:\windows\system32\_006041_.tmp.dll

c:\windows\system32\_006042_.tmp.dll

c:\windows\system32\_006044_.tmp.dll

c:\windows\system32\_006045_.tmp.dll

c:\windows\system32\_006047_.tmp.dll

c:\windows\system32\_006048_.tmp.dll

c:\windows\system32\_006052_.tmp.dll

c:\windows\system32\_006053_.tmp.dll

c:\windows\system32\_006055_.tmp.dll

c:\windows\system32\_006058_.tmp.dll

c:\windows\system32\_006060_.tmp.dll

c:\windows\system32\_006061_.tmp.dll

c:\windows\system32\_006062_.tmp.dll

c:\windows\system32\_006063_.tmp.dll

c:\windows\system32\_006064_.tmp.dll

c:\windows\system32\_006067_.tmp.dll

c:\windows\system32\_006068_.tmp.dll

c:\windows\system32\_006069_.tmp.dll

c:\windows\system32\_006070_.tmp.dll

c:\windows\system32\_006071_.tmp.dll

c:\windows\system32\_006076_.tmp.dll

c:\windows\system32\_006078_.tmp.dll

c:\windows\system32\_006079_.tmp.dll

c:\windows\system32\bszip.dll

.

--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\regsvr32.exe --> c:\windows\SYSTEM32\regsvr32.exe

.

((((((((((((((((((((((((( Files Created from 2009-09-18 to 2009-10-18 )))))))))))))))))))))))))))))))

.

2009-10-18 17:43 . 2009-10-18 17:43 53248 ----a-w- c:\temp\catchme.dll

2009-10-18 17:31 . 2008-04-14 00:12 11776 ----a-w- c:\windows\system32\regsvr32.exe

2009-10-04 20:18 . 2009-10-04 20:18 -------- d-----w- c:\windows\LastGood

2009-10-04 19:29 . 2009-10-04 19:29 -------- d-----w- c:\temp\WPDNSE

2009-10-04 19:22 . 2009-10-04 19:24 -------- d-----w- c:\temp\RarSFX0

2009-10-03 23:46 . 2009-10-03 23:46 -------- d-----w- c:\program files\Trend Micro

2009-10-03 23:40 . 2009-10-03 23:40 -------- d-----w- C:\install

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-10-13 22:43 . 2009-01-18 19:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\Canon

2009-10-05 22:32 . 2009-10-05 22:31 196608 ----a-r- c:\program files\All States Rail Services, Inc.QBW.TLG

2009-10-05 22:32 . 2003-12-09 20:19 18403328 ----a-r- c:\program files\All States Rail Services, Inc.QBW

2009-10-03 23:36 . 2009-09-04 01:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-10-03 23:14 . 2009-09-05 00:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-09-10 18:54 . 2009-09-04 01:20 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-10 18:53 . 2009-09-04 01:20 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-05 14:26 . 2009-01-04 20:46 -------- d-----w- c:\program files\Quicken

2009-09-05 00:14 . 2009-09-05 00:08 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-09-05 00:01 . 2009-09-05 00:01 -------- d-----w- c:\program files\Microsoft Silverlight

2009-09-04 23:43 . 2009-09-04 23:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ahead

2009-09-04 23:38 . 2009-09-04 23:36 -------- d-----w- c:\program files\Common Files\Ahead

2009-09-04 23:36 . 2009-09-04 23:36 -------- d-----w- c:\program files\Nero

2009-09-04 23:36 . 2009-09-04 23:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero

2009-09-04 23:06 . 2009-01-17 18:09 -------- d-----w- c:\program files\Common Files\Adobe

2009-09-04 22:56 . 2009-09-04 22:50 -------- d-----w- c:\program files\Microsoft MapPoint 2009

2009-09-04 22:48 . 2009-09-04 22:48 -------- d-----w- c:\program files\MSECache

2009-09-04 22:24 . 2009-09-04 22:24 -------- d-----w- c:\program files\MSBuild

2009-09-04 22:24 . 2009-09-04 22:24 -------- d-----w- c:\program files\Reference Assemblies

2009-09-04 02:54 . 2009-01-04 20:51 -------- d-----w- c:\program files\HP

2009-09-04 01:20 . 2009-09-04 01:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-04 01:18 . 2009-09-04 01:18 -------- d-----w- c:\program files\CCleaner

2009-09-04 00:39 . 2009-01-04 20:15 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-09-04 00:39 . 2009-01-04 20:15 -------- d-----w- c:\program files\COMPAQ

2009-09-04 00:32 . 2009-01-04 20:16 -------- d-----w- c:\program files\InterVideo

2009-08-05 09:01 . 2009-01-04 20:37 204800 ------w- c:\windows\system32\mswebdvd.dll

2009-08-04 00:09 . 2009-01-04 20:49 26216 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.

------- Sigcheck -------

[7] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll

[-] 2005-09-01 . 648BF0B4DDE4F7A1156DAE7174D36EFA . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll

[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll

[-] 2005-09-01 . A1A688EE56CF3BBD24EDEB815D48E9BA . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll

[7] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

[7] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll

[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll

[-] 2005-08-22 . 36739B39267914BA69AD0610A0299732 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll

[-] 2005-08-22 . 3516D8A18B36784B1005B950B84232E1 . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll

[7] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

[7] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe

[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe

[7] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

[7] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll

[-] 2005-07-08 . 1418A3A6E76E5A2E3F5E43866E793A8B . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll

[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll

[-] 2005-07-08 . FB78839B36025AA286A51289ED28B73E . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll

[7] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

[7] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll

[-] 2005-03-02 . 1800F293BCCC8EDE8A70E12B88D80036 . 577024 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll

[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\$NtServicePackUninstall$\user32.dll

[-] 2005-03-02 . DE2DB164BBB35DB061AF0997E4499054 . 577024 . . [5.1.2600.2622] . . c:\windows\system32\user32.dll

[7] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

[7] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll

[7] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

c:\windows\system32\regsvc.dll ... is missing !!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-10-25 1451264]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-07-28 323584]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-10-26 811008]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [10/24/2008 9:53 PM 34824]

R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [10/24/2008 9:51 PM 468224]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

mSearch Bar = hxxp://go.compaq.com/1Q00CDT/0409/bl8.asp

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-10-18 13:43

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2009-10-18 13:46

ComboFix-quarantined-files.txt 2009-10-18 17:46

Pre-Run: 24,951,128,064 bytes free

Post-Run: 25,107,664,896 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\Windows

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\Windows="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

176 --- E O F --- 2009-10-18 07:00

And HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:23:56 PM, on 10/18/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Windows\system32\ctfmon.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Windows\system32\spoolsv.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Windows\system32\nvsvc32.exe

C:\Windows\System32\svchost.exe

C:\Windows\SynCor.exe

C:\Windows\system32\wscntfy.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE