Can't Get Malwarebytes to Run

strwlf · November 2, 2009

Okay,

I tried to install MB on a PC that's having all sorts of issues. The install runs fine but as soon as I try to start MB something is deleting the mbam.exe file. I installed Symantec and performed a manual update but I still can't get MB to run. Whatever it is is also fouling up my internet connection. I can acquire an IP and ping the router but I can't ping anything outside of the network. I currently have the pc off of my network and am moving files and utilities back and forth via a usb stick. Below is the Hijackthis log. Any help on this would be greatly appreciated. I've helped a lot of friends and family remove garbage from their computer but this one takes the cake.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:13:10 PM, on 11/2/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16915)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

E:\WINDOWS\system32\spoolsv.exe

E:\Program Files\Symantec AntiVirus\DefWatch.exe

E:\Program Files\Java\jre6\bin\jqs.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\nvsvc32.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\Symantec AntiVirus\Rtvscan.exe

E:\Program Files\Viewpoint\Common\ViewpointService.exe

E:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

E:\WINDOWS\Explorer.exe

E:\Program Files\Java\jre6\bin\jusched.exe

E:\Program Files\Common Files\Symantec Shared\ccApp.exe

E:\PROGRA~1\SYMANT~1\VPTray.exe

E:\WINDOWS\system32\ctfmon.exe

E:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe

E:\WINDOWS\system32\NOTEPAD.EXE

E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - Default URLSearchHook is missing

F2 - REG:system.ini: Shell=Explorer.exe logon.exe

O1 - Hosts: ::1 localhost

O1 - Hosts: 94.232.248.66 alarm-security.microsoft.com

O1 - Hosts: 94.232.248.66 inetantivir.com

O1 - Hosts: 94.232.248.66 www.inetantivir.com

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar2.dll

O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - E:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll

O3 - Toolbar: My.Freeze.com Toolbar - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - E:\Program Files\My.Freeze.com Toolbar\freeze_us.dll

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - E:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O4 - HKLM\..\Run: [HPPQVideo] "E:\Program Files\HP\ScheduledLaunch\HP Color LaserJet CM2320 MFP Series\bin\hppschlnch.exe" -r SOFTWARE\Hewlett-Packard\ScheduledLaunch\CLJ_CM2320_MFP_Series -f PQOptimizerVideo.xml -o remindLater

O4 - HKLM\..\Run: [ToolBoxFX] "E:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on /tmcp:on

O4 - HKLM\..\Run: [hpqSRMon] E:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [HP Software Update] E:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [tiwelikif] Rundll32.exe "e:\windows\system32\najibite.dll",a

O4 - HKLM\..\Run: [ccApp] "E:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] E:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [TomcatStartup 2.5] E:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe

O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\RunOnce: [shockwave Updater] E:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" -"http://www.king.com/single_play.jsp?game=magicspinball&altVer=false&gameMode=2"

O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)

O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://download.cnet.com

O15 - Trusted Zone: http://*.download.com

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {1896F800-6EFB-422F-A04B-AA7D44D9A4A9} (ATI Web DVR Control) - http://24.144.169.244:8000/WebClient.cab

O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v63/bjattack/bja.cab

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5A4E1FE6-CF08-444B-930B-5F8DE5D18886}: NameServer = 208.67.222.222,208.67.220.220

O20 - AppInit_DLLs: cru629.dat sojohehu.dll e:\windows\system32\najibite.dll

O20 - Winlogon Notify: dcdeebbcbcac - E:\WINDOWS\system32\dcdeebbcbcac.dll (file missing)

O21 - SSODL: nofegogom - {4999c6be-ec74-4cd1-9fee-5fb04ad0e0bb} - e:\windows\system32\sorujawi.dll (file missing)

O21 - SSODL: sanojivon - {58760d6c-ae0b-46c2-b146-d75b963ce5c8} - e:\windows\system32\najibite.dll

O22 - SharedTaskScheduler: jugezatag - {4999c6be-ec74-4cd1-9fee-5fb04ad0e0bb} - e:\windows\system32\sorujawi.dll (file missing)

O22 - SharedTaskScheduler: tokatiluy - {58760d6c-ae0b-46c2-b146-d75b963ce5c8} - e:\windows\system32\najibite.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - E:\Program Files\Symantec AntiVirus\DefWatch.exe

O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SAVRoam (SavRoam) - symantec - E:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - E:\Program Files\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - E:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 7866 bytes

Rosty · November 3, 2009

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix when you've accomplished that.

strwlf · November 3, 2009

Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post the log from ComboFix when you've accomplished that.

First,

Thanks for trying to help me with this. It's very much appreciated.

During the install of combofix I was alerted that this pc didn't have windows recovery console and asked to be connected to the internet. I plugged in the network cable and came back to my computer to read the instructions again to see what it said about that. When I got back it was scanning so I'm not sure if it was able to get and install recovery console or not (considering I could get a ping for anything but my router when I was checking that earlier). I have it downloaded and sitting on a usb stick waiting for manual install but didn't want to do that without checking with you first.

Now, that said, below is the log file from combo fix.

ComboFix 09-11-02.05 - User 11/03/2009 12:47.1.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1247.763 [GMT -5:00]

Running from: e:\documents and settings\User\Desktop\ComboFix.exe

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

e:\documents and settings\All Users\Application Data\aveniwa.inf

e:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

e:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

e:\documents and settings\User\err.log

e:\documents and settings\User\Local Settings\Temporary Internet Files\ezuvyka.scr

e:\documents and settings\User\Local Settings\Temporary Internet Files\hize.com

e:\documents and settings\User\Local Settings\Temporary Internet Files\imobe.pif

e:\documents and settings\User\Local Settings\Temporary Internet Files\jurymaty.db

e:\documents and settings\User\Local Settings\Temporary Internet Files\lapirabona.db

e:\documents and settings\User\Local Settings\Temporary Internet Files\piwaveb.inf

e:\documents and settings\User\Local Settings\Temporary Internet Files\qoqeho._dl

e:\documents and settings\User\Local Settings\Temporary Internet Files\ubenyxi.scr

e:\documents and settings\User\Local Settings\Temporary Internet Files\ybitutur.reg

e:\program files\Common Files\evopajuhim.reg

e:\program files\Common Files\ypyh.reg

e:\program files\Smart-Shopper

e:\program files\WinPCap

e:\program files\WinPCap\rpcapd.exe

e:\windows\adovehusin.vbs

e:\windows\atotijep.scr

e:\windows\ekisyz.inf

e:\windows\system32\binanuye.dll.tmp

e:\windows\system32\drivers\npf.sys

e:\windows\system32\kukamibi.dll

e:\windows\system32\najibite.dll

e:\windows\system32\Packet.dll

e:\windows\system32\pthreadVC.dll

e:\windows\system32\tahiraga.dll.tmp

e:\windows\system32\vipafiyu.dll

e:\windows\system32\vusuputu.dll

e:\windows\system32\vuzepeta.dll

e:\windows\system32\WanPacket.dll

e:\windows\system32\wpcap.dll

e:\windows\system32\yayosiyi.dll.tmp

e:\windows\system32\yifuyijo.dll

e:\windows\system32\yofolufe.dll

e:\windows\system32\yomabone.dll

e:\windows\system32\zasepago.dll

e:\windows\ufysajyk.inf

e:\windows\uqejydi.scr

----- BITS: Possible infected sites -----

hxxp://77.74.48.111

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MYWEBSEARCHSERVICE

-------\Legacy_NPF

-------\Legacy_PASSWORD

-------\Service_npf

((((((((((((((((((((((((( Files Created from 2009-10-03 to 2009-11-03 )))))))))))))))))))))))))))))))

.

2009-11-02 17:12 . 2009-11-02 17:12 -------- d-----w- e:\program files\Trend Micro

2009-11-02 00:52 . 2009-11-02 00:52 -------- d-----w- e:\documents and settings\User\Local Settings\Application Data\Symantec

2009-11-02 00:51 . 2005-09-17 05:20 87768 ----a-w- e:\windows\system32\S32EVNT1.DLL

2009-11-02 00:51 . 2005-09-17 05:20 108168 ----a-w- e:\windows\system32\drivers\SYMEVENT.SYS

2009-11-02 00:49 . 2009-11-02 02:58 -------- d-----w- e:\program files\Symantec

2009-11-02 00:48 . 2009-11-03 17:58 -------- d-----w- e:\program files\Symantec AntiVirus

2009-10-29 18:43 . 2009-10-30 13:09 342304 --sha-w- e:\windows\system32\drivers\fidbox.dat

2009-10-29 18:43 . 2009-10-30 13:09 22560 --sha-w- e:\windows\system32\drivers\fidbox2.dat

2009-10-29 18:36 . 2009-10-29 19:11 -------- d-----w- e:\program files\Common Files\ParetoLogic

2009-10-29 18:36 . 2009-10-29 19:11 -------- d-----w- e:\documents and settings\All Users\Application Data\ParetoLogic

2009-10-28 20:44 . 2009-10-28 20:44 -------- d-----w- e:\documents and settings\User\Local Settings\Application Data\Threat Expert

2009-10-28 20:29 . 2009-10-08 15:31 1636304 ----a-w- e:\windows\PCTBDCore.dll

2009-10-28 20:24 . 2009-10-29 14:49 -------- d-----w- e:\program files\Spyware Doctor

2009-10-28 20:24 . 2009-10-29 14:49 -------- d-----w- e:\program files\Common Files\PC Tools

2009-10-27 16:56 . 2009-10-29 14:19 -------- d-----w- e:\documents and settings\All Users\Application Data\avg9

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-02 01:48 . 2008-05-29 15:49 -------- d-----w- e:\program files\Common Files\Symantec Shared

2009-11-02 00:49 . 2009-07-24 22:00 -------- d-----w- e:\documents and settings\All Users\Application Data\Symantec

2009-11-02 00:46 . 2009-10-29 19:18 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware

2009-11-02 00:20 . 2009-11-02 00:20 -------- d-----w- e:\program files\Windows Resource Kits

2009-11-02 00:11 . 2009-11-02 00:11 -------- d-----w- e:\program files\Windows Resource Kit

2009-11-01 18:39 . 2006-07-14 18:34 -------- d-----w- e:\program files\Viewpoint

2009-10-30 13:31 . 2009-10-29 19:22 -------- d-----w- e:\documents and settings\User\Application Data\SUPERAntiSpyware.com

2009-10-30 13:09 . 2009-10-29 18:43 5660 --sha-w- e:\windows\system32\drivers\fidbox.idx

2009-10-30 13:09 . 2009-10-29 18:43 3188 --sha-w- e:\windows\system32\drivers\fidbox2.idx

2009-10-29 19:22 . 2009-10-29 19:22 -------- d-----w- e:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-10-29 14:48 . 2008-07-23 17:38 -------- d---a-w- e:\documents and settings\All Users\Application Data\TEMP

2009-10-28 14:53 . 2006-06-14 13:03 -------- d-----w- e:\program files\Common Files\InstallShield

2009-10-28 14:53 . 2007-04-27 14:20 -------- d--h--w- e:\program files\InstallShield Installation Information

2009-10-27 16:56 . 2008-09-17 19:16 -------- d-----w- e:\program files\AVG

2009-09-30 15:06 . 2006-07-19 14:02 -------- d-----w- e:\program files\Java

2009-09-11 14:18 . 2004-08-04 12:00 136192 ----a-w- e:\windows\system32\msv1_0.dll

2009-09-10 19:54 . 2009-11-02 00:46 38224 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys

2009-09-10 19:53 . 2009-11-02 00:46 19160 ----a-w- e:\windows\system32\drivers\mbam.sys

2009-09-04 21:03 . 2004-08-04 12:00 58880 ----a-w- e:\windows\system32\msasn1.dll

2009-08-29 07:36 . 2004-08-04 12:00 832512 ----a-w- e:\windows\system32\wininet.dll

2009-08-29 07:36 . 2004-08-04 12:00 78336 ----a-w- e:\windows\system32\ieencode.dll

2009-08-29 07:36 . 2004-08-04 12:00 17408 ------w- e:\windows\system32\corpol.dll

2009-08-26 08:00 . 2004-08-04 12:00 247326 ----a-w- e:\windows\system32\strmdll.dll

2009-08-18 20:45 . 2006-06-14 15:31 31200 ----a-w- e:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-30 12:39 . 2009-07-30 12:39 16434 ----a-w- e:\program files\Common Files\kijedudo.pif

2009-07-30 12:39 . 2009-07-30 12:39 15968 ----a-w- e:\program files\Common Files\feqinuvoso.sys

2009-07-30 12:39 . 2009-07-30 12:39 14247 ----a-w- e:\program files\Common Files\kovogobydy.pif

2009-07-29 21:06 . 2009-07-29 21:06 10382 ----a-w- e:\program files\Common Files\esyb.lib

2009-07-29 21:06 . 2009-07-29 21:06 14305 ----a-w- e:\program files\Common Files\icyd.dat

2008-04-04 17:31 . 2008-04-04 17:31 12 ---h--w- e:\program files\SyncToyDirectoryId.txt

2006-08-21 17:51 . 2006-08-21 17:51 774144 ----a-w- e:\program files\RngInterstitial.dll

2008-04-07 06:59 . 2008-06-06 18:21 67696 ----a-w- e:\program files\mozilla firefox\components\jar50.dll

2008-04-07 06:59 . 2008-06-06 18:21 54376 ----a-w- e:\program files\mozilla firefox\components\jsd3250.dll

2008-04-07 06:59 . 2008-06-06 18:21 34952 ----a-w- e:\program files\mozilla firefox\components\myspell.dll

2008-04-07 06:59 . 2008-06-06 18:21 46720 ----a-w- e:\program files\mozilla firefox\components\spellchk.dll

2008-04-07 06:59 . 2008-06-06 18:21 172144 ----a-w- e:\program files\mozilla firefox\components\xpinstal.dll

2009-07-30 00:39 . 2009-07-30 00:39 90112 --sha-w- e:\windows\system32\supiyiha.dll

2009-02-27 21:16 . 2009-02-27 15:15 608 --sha-w- e:\windows\system32\winzvprt5.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D0523BB4-21E7-11DD-9AB7-415B56D89593}"= "e:\program files\My.Freeze.com Toolbar\freeze_us.dll" [2008-11-26 1916024]

[HKEY_CLASSES_ROOT\clsid\{d0523bb4-21e7-11dd-9ab7-415b56d89593}]

[HKEY_CLASSES_ROOT\TBSB00001.TBSB00001.3]

[HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]

[HKEY_CLASSES_ROOT\TBSB00001.TBSB00001]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D0523BB4-21E7-11DD-9AB7-415B56D89593}"= "e:\program files\My.Freeze.com Toolbar\freeze_us.dll" [2008-11-26 1916024]

[HKEY_CLASSES_ROOT\clsid\{d0523bb4-21e7-11dd-9ab7-415b56d89593}]

[HKEY_CLASSES_ROOT\TBSB00001.TBSB00001.3]

[HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]

[HKEY_CLASSES_ROOT\TBSB00001.TBSB00001]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPPQVideo"="e:\program files\HP\ScheduledLaunch\HP Color LaserJet CM2320 MFP Series\bin\hppschlnch.exe" [2007-05-07 106496]

"ToolBoxFX"="e:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2008-08-01 53248]

"hpqSRMon"="e:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"HP Software Update"="e:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"SunJavaUpdateSched"="e:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"ccApp"="e:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]

"vptray"="e:\progra~1\SYMANT~1\VPTray.exe" [2005-11-15 85744]

"TomcatStartup 2.5"="e:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ 'autocheck autochk *'

[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=e:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=e:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"e:\\Program Files\\Messenger\\msmsgs.exe"=

"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"e:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=

"e:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=

"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=

"e:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=

"e:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 Viewpoint Manager Service;Viewpoint Manager Service;e:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 1:09 PM 24652]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;e:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/1/2009 8:17 PM 102448]

S3 HPFXFAX;HPFXFAX;e:\windows\system32\drivers\hpfxfax.sys [2/27/2009 4:12 PM 20504]

S3 HPPLSBULK;HPPLSBULK;e:\windows\system32\drivers\hpplsbulk.sys [2/2/2005 6:29 PM 9344]

S3 SavRoam;SAVRoam;e:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 1:27 PM 169200]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR

*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

Contents of the 'Scheduled Tasks' folder

2009-11-03 e:\windows\Tasks\Norton Security Scan for User.job

- e:\program files\Norton Security Scan\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-07-24 23:58]

2009-11-02 e:\windows\Tasks\SyncToy.job

- e:\documents and settings\User\Local Settings\Application Data\SyncToy\SyncToy.exe [2006-10-25 14:04]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = <local>

IE: &Search

IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: cnet.com\download

Trusted Zone: download.com

TCP: {5A4E1FE6-CF08-444B-930B-5F8DE5D18886} = 208.67.222.222,208.67.220.220

DPF: {1896F800-6EFB-422F-A04B-AA7D44D9A4A9} - hxxp://24.144.169.244:8000/WebClient.cab

FF - ProfilePath - e:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\3z0cuiwe.default\

FF - component: e:\program files\Mozilla Firefox\components\xpinstal.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - e:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{472734EA-242A-422B-ADF8-83D1E48CC825} - (no file)

HKLM-Run-tiwelikif - e:\windows\system32\najibite.dll

SharedTaskScheduler-{4999c6be-ec74-4cd1-9fee-5fb04ad0e0bb} - e:\windows\system32\sorujawi.dll

SharedTaskScheduler-{58760d6c-ae0b-46c2-b146-d75b963ce5c8} - e:\windows\system32\najibite.dll

SSODL-nofegogom-{4999c6be-ec74-4cd1-9fee-5fb04ad0e0bb} - e:\windows\system32\sorujawi.dll

SSODL-sanojivon-{58760d6c-ae0b-46c2-b146-d75b963ce5c8} - e:\windows\system32\najibite.dll

Notify-dcdeebbcbcac - e:\windows\system32\dcdeebbcbcac.dll

AddRemove-Smart-Shopper - e:\program files\Smart-Shopper\Uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-03 12:59

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2580)

e:\windows\system32\WININET.dll

e:\windows\system32\IEFRAME.dll

.

------------------------ Other Running Processes ------------------------

.

e:\program files\Common Files\Symantec Shared\ccSetMgr.exe

e:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

e:\program files\Symantec AntiVirus\DefWatch.exe

e:\program files\Java\jre6\bin\jqs.exe

e:\windows\system32\nvsvc32.exe

e:\program files\Symantec AntiVirus\Rtvscan.exe

e:\progra~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE

e:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe

.

**************************************************************************

.

Completion time: 2009-11-03 13:08 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-03 18:08

Pre-Run: 21,237,133,312 bytes free

Post-Run: 25,402,884,096 bytes free

Rosty · November 3, 2009

Recovery Console gives us the ability to recover your computer if such a thing happens.

Nothing is going to change on your computer other than we're going to install Recovery Console.

Download combofix.exe by sUBs to your Desktop (it must be in this location).
Alternate Download
If you already have a previous version, delete it and download a new version.
Do not attempt to run Combofix other than in the method described below.
Go to Microsoft's website
Select the download that's appropriate for your Operating System

Download the file & save it as it's originally named, to your Desktop.

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix.
When prompted, agree to the End-User License Agreement to install Microsoft Recovery Console.
When complete, a log named CF_RC.txt will open.
Please post the contents of that log.

Post a new HijackThis log also please!

Please do not shutdown or reboot your machine until we have reviewed the log.

strwlf · November 3, 2009

Recovery Console gives us the ability to recover your computer if such a thing happens.
Nothing is going to change on your computer other than we're going to install Recovery Console.
Download combofix.exe by sUBs to your Desktop (it must be in this location).
Alternate Download
If you already have a previous version, delete it and download a new version.
Do not attempt to run Combofix other than in the method described below.
Go to Microsoft's website
Select the download that's appropriate for your Operating System
Download the file & save it as it's originally named, to your Desktop.
Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix.
When prompted, agree to the End-User License Agreement to install Microsoft Recovery Console.
When complete, a log named CF_RC.txt will open.
Please post the contents of that log.
Post a new HijackThis log also please!
Please do not shutdown or reboot your machine until we have reviewed the log.

Okay, I did as instructed and manually installed the recovery console (well I dumped it on combofix). It went through everything as your instructions indicated except for the fact that it never gave me a cf_rc.txt file (I even searched for it but to no avail). It did however run another scan after I accepted the ULA for recovery console and below is that log file.

ComboFix 09-11-02.05 - User 11/03/2009 14:22.2.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1247.722 [GMT -5:00]

Running from: e:\documents and settings\User\Desktop\ComboFix.exe

Command switches used :: e:\documents and settings\User\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

.

((((((((((((((((((((((((( Files Created from 2009-10-03 to 2009-11-03 )))))))))))))))))))))))))))))))

.

2009-11-02 17:12 . 2009-11-02 17:12 -------- d-----w- e:\program files\Trend Micro

2009-11-02 00:52 . 2009-11-02 00:52 -------- d-----w- e:\documents and settings\User\Local Settings\Application Data\Symantec

2009-11-02 00:51 . 2005-09-17 05:20 87768 ----a-w- e:\windows\system32\S32EVNT1.DLL

2009-11-02 00:51 . 2005-09-17 05:20 108168 ----a-w- e:\windows\system32\drivers\SYMEVENT.SYS

2009-11-02 00:49 . 2009-11-02 02:58 -------- d-----w- e:\program files\Symantec

2009-11-02 00:48 . 2009-11-03 19:21 -------- d-----w- e:\program files\Symantec AntiVirus