I'm unable to open Mbam after installation. please help.

Fenix44 · January 8, 2010

Hello.

I didn't know that something was wrong with my computer until i tried opening up MBAM and when i tried to open it, it wouldn't open and run, so i uninstalled and reinstalled and nothing happened. It couldn't find the MBAM.exe. I also tried renaming the installation file but that didn't work either. I downloaded OTL and i have the log and extras, can you guys help me please?

OTL.Txt

Extras.Txt

miekiemoes · January 9, 2010

Hi,

To run malwarebytes when you get the error code 2 during install, or mbam.exe gets deleted, please see here:

http://www.malwarebytes.org/forums/index.php?showtopic=29028

Once malwarebytes opens, click the "Update" tab, click "Check for Updates" in order to download the updates.

Then run the scan, let mbam quarantine/delete what it found and reboot afterwards.

After reboot, post the malwarebytes log together with a new HijackThislog.

Fenix44 · January 10, 2010

I did what you asked and Mbam did opened up , i ran a quick scan and there was a lot of infections i clicked remove and it removed it but it says that there are 3 infections that couldn't be removed.. what now? thank you for the help!

miekiemoes · January 10, 2010

Hi,

After reboot, post the malwarebytes log together with a new HijackThislog.

Fenix44 · January 11, 2010

MBAM log

Malwarebytes' Anti-Malware 1.44

Database version: 3533

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

1/10/2010 3:20:08 PM

mbam-log-2010-01-10 (15-20-08).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 284539

Time elapsed: 1 hour(s), 29 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 62

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lekefutah (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe logon.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP789\A0318003.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP790\A0318094.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP790\A0318095.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP790\A0318096.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP791\A0318184.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP791\A0318192.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP792\A0318313.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP792\A0318329.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP792\A0318336.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP792\A0319367.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP793\A0320424.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP793\A0320464.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP793\A0320508.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP793\A0321508.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP794\A0321575.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP794\A0321585.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP795\A0321630.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321783.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321806.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321875.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321876.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321877.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321882.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321946.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321960.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP796\A0321972.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322103.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322126.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322195.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322196.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322197.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322202.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322266.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322280.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP797\A0322292.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP799\A0324399.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324492.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324493.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324494.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324495.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324497.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324498.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324499.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324500.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324501.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324502.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324503.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324504.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324505.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324506.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324508.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324509.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324510.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324511.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324512.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324515.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324516.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CD53596A-5812-49DB-AF84-A72B9BECDE4F}\RP801\A0324517.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GY6YTUN6\default[1].htm (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GY6YTUN6\default[2].htm (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\default[1].htm (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I3FV8CQB\default[2].htm (Trojan.Vundo) -> Quarantined and deleted successfully.

and here's my Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:33:45 PM, on 1/10/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton Internet Security\NISUM.EXE

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Norton Internet Security\ccPxySvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\LTMSG.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Verizon\McciTrayApp.exe

C:\Program Files\Verizon\VSP\VerizonServicepoint.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\WINDOWS\system32\ps2.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\AIM6\aim6.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\program files\steam\steam.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08\hpqtra08.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe

C:\Program Files\Malwarebytes' Anti-Malware\5ax4auZcb.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ViNet Internet

R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll

F2 - REG:system.ini: Shell=Explorer.exe logon.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe

O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7

O4 - HKLM\..\Run: [sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe

O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe

O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe

O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sNM] C:\Program Files\SpyNoMore\SNM.exe /startup

O4 - HKLM\..\Run: [lekefutah] Rundll32.exe "c:\windows\system32\yavaneyu.dll",a

O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU\..\Run: [backupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background

O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [steam] "c:\program files\steam\steam.exe" -silent

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - S-1-5-18 Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: PowerReg Scheduler V3.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (User 'Default user')

O4 - .DEFAULT Startup: PowerReg Scheduler V3.exe (User 'Default user')

O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')

O4 - .DEFAULT Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe (User 'Default user')

O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

O4 - Startup: PowerReg Scheduler V3.exe

O4 - Startup: PowerReg Scheduler.exe

O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll

O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon...DSL/tgctlcm.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo...Plugin11USA.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab

O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://www.arcadetown.com/swf/feedingfrenz...outLauncher.cab

O20 - AppInit_DLLs: c:\windows\system32\dedobufa.dll viberisa.dll c:\windows\system32\lihedayu.dll c:\windows\system32\kapekabo.dll c:\windows\system32\zomejuhe.dll c:\windows\system32\nakizeju.dll c:\windows\system32\lisepeyo.dll c:\windows\system32\yavaneyu.dll c:\windows\system32\yitofoyi.dll c:\windows\system32\jimaneno.dll c:\windows\system32\yetugayu.dll c:\windows\system32\tilepilo.dll

O21 - SSODL: podirezam - {e00ec7d6-0857-4c5e-b3f1-61eac0fc30cf} - c:\windows\system32\dedobufa.dll (file missing)

O21 - SSODL: gubikuyet - {94278e4a-4c8b-4c58-bd8e-9c399f8d50b2} - (no file)

O21 - SSODL: gegiyabam - {bca8c121-8fc7-403b-8ed1-5f2e364ae432} - c:\windows\system32\lihedayu.dll (file missing)

O21 - SSODL: gohodubuf - {de0bd99b-9c00-4225-b85a-281cb5bdb7c8} - c:\windows\system32\zomejuhe.dll (file missing)

O21 - SSODL: wifapuluw - {43ac8109-30f1-4ed8-a6d8-f1865b7f0710} - c:\windows\system32\nakizeju.dll (file missing)

O21 - SSODL: gugabukay - {65b47380-92ee-4041-9486-f3b09315bbcf} - c:\windows\system32\lisepeyo.dll (file missing)

O21 - SSODL: somiyutap - {ab6882a0-b1f5-40f8-81d5-9d5db0e0d78a} - c:\windows\system32\yavaneyu.dll (file missing)

O22 - SharedTaskScheduler: delayingly - {e89fa8e9-5c0b-45f6-a70e-f7b177bcd193} - (no file)

O22 - SharedTaskScheduler: jugezatag - {e00ec7d6-0857-4c5e-b3f1-61eac0fc30cf} - c:\windows\system32\dedobufa.dll (file missing)

O22 - SharedTaskScheduler: mujuzedij - {bca8c121-8fc7-403b-8ed1-5f2e364ae432} - c:\windows\system32\lihedayu.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {875e0d7f-02cd-4219-a3df-5e8d01c0208c} - c:\windows\system32\kapekabo.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {de0bd99b-9c00-4225-b85a-281cb5bdb7c8} - c:\windows\system32\zomejuhe.dll (file missing)

O22 - SharedTaskScheduler: gahurihor - {43ac8109-30f1-4ed8-a6d8-f1865b7f0710} - c:\windows\system32\nakizeju.dll (file missing)

O22 - SharedTaskScheduler: kupuhivus - {65b47380-92ee-4041-9486-f3b09315bbcf} - c:\windows\system32\lisepeyo.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {ab6882a0-b1f5-40f8-81d5-9d5db0e0d78a} - c:\windows\system32\yavaneyu.dll (file missing)

O22 - SharedTaskScheduler: gahurihor - {ce71e4aa-e481-428f-af84-4daf959c70b5} - c:\windows\system32\yitofoyi.dll (file missing)

O22 - SharedTaskScheduler: gahurihor - {1b8b3d1b-0768-4565-ab57-ad86177f2d1d} - c:\windows\system32\jimaneno.dll (file missing)

O22 - SharedTaskScheduler: mujuzedij - {660514c3-07a5-45b4-ab34-267f2b2358ec} - c:\windows\system32\yetugayu.dll (file missing)

O22 - SharedTaskScheduler: kupuhivus - {492f20ab-43a9-461c-8d89-e8d116cdac17} - c:\windows\system32\tilepilo.dll (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 15437 bytes

miekiemoes · January 11, 2010

Hi,

Your teatimer is interfering here..

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.

Then run ResetTeaTimer.exe.

This will only take a few seconds.

Then,

I see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

Viewpoint
Viewpoint Manager
Viewpoint Media Player

Then,

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

F2 - REG:system.ini: Shell=Explorer.exe logon.exe

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [lekefutah] Rundll32.exe "c:\windows\system32\yavaneyu.dll",a

O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe

O4 - S-1-5-18 Startup: PowerReg Scheduler V3.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: PowerReg Scheduler V3.exe (User 'Default user')

O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')

O4 - Startup: PowerReg Scheduler V3.exe

O4 - Startup: PowerReg Scheduler.exe

O20 - AppInit_DLLs: c:\windows\system32\dedobufa.dll viberisa.dll c:\windows\system32\lihedayu.dll c:\windows\system32\kapekabo.dll c:\windows\system32\zomejuhe.dll c:\windows\system32\nakizeju.dll c:\windows\system32\lisepeyo.dll c:\windows\system32\yavaneyu.dll c:\windows\system32\yitofoyi.dll c:\windows\system32\jimaneno.dll c:\windows\system32\yetugayu.dll c:\windows\system32\tilepilo.dll

O21 - SSODL: podirezam - {e00ec7d6-0857-4c5e-b3f1-61eac0fc30cf} - c:\windows\system32\dedobufa.dll (file missing)

O21 - SSODL: gubikuyet - {94278e4a-4c8b-4c58-bd8e-9c399f8d50b2} - (no file)

O21 - SSODL: gegiyabam - {bca8c121-8fc7-403b-8ed1-5f2e364ae432} - c:\windows\system32\lihedayu.dll (file missing)

O21 - SSODL: gohodubuf - {de0bd99b-9c00-4225-b85a-281cb5bdb7c8} - c:\windows\system32\zomejuhe.dll (file missing)

O21 - SSODL: wifapuluw - {43ac8109-30f1-4ed8-a6d8-f1865b7f0710} - c:\windows\system32\nakizeju.dll (file missing)

O21 - SSODL: gugabukay - {65b47380-92ee-4041-9486-f3b09315bbcf} - c:\windows\system32\lisepeyo.dll (file missing)

O21 - SSODL: somiyutap - {ab6882a0-b1f5-40f8-81d5-9d5db0e0d78a} - c:\windows\system32\yavaneyu.dll (file missing)

O22 - SharedTaskScheduler: delayingly - {e89fa8e9-5c0b-45f6-a70e-f7b177bcd193} - (no file)

O22 - SharedTaskScheduler: jugezatag - {e00ec7d6-0857-4c5e-b3f1-61eac0fc30cf} - c:\windows\system32\dedobufa.dll (file missing)

O22 - SharedTaskScheduler: mujuzedij - {bca8c121-8fc7-403b-8ed1-5f2e364ae432} - c:\windows\system32\lihedayu.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {875e0d7f-02cd-4219-a3df-5e8d01c0208c} - c:\windows\system32\kapekabo.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {de0bd99b-9c00-4225-b85a-281cb5bdb7c8} - c:\windows\system32\zomejuhe.dll (file missing)

O22 - SharedTaskScheduler: gahurihor - {43ac8109-30f1-4ed8-a6d8-f1865b7f0710} - c:\windows\system32\nakizeju.dll (file missing)

O22 - SharedTaskScheduler: kupuhivus - {65b47380-92ee-4041-9486-f3b09315bbcf} - c:\windows\system32\lisepeyo.dll (file missing)

O22 - SharedTaskScheduler: jugezatag - {ab6882a0-b1f5-40f8-81d5-9d5db0e0d78a} - c:\windows\system32\yavaneyu.dll (file missing)

O22 - SharedTaskScheduler: gahurihor - {ce71e4aa-e481-428f-af84-4daf959c70b5} - c:\windows\system32\yitofoyi.dll (file missing)

O22 - SharedTaskScheduler: gahurihor - {1b8b3d1b-0768-4565-ab57-ad86177f2d1d} - c:\windows\system32\jimaneno.dll (file missing)

O22 - SharedTaskScheduler: mujuzedij - {660514c3-07a5-45b4-ab34-267f2b2358ec} - c:\windows\system32\yetugayu.dll (file missing)

O22 - SharedTaskScheduler: kupuhivus - {492f20ab-43a9-461c-8d89-e8d116cdac17} - c:\windows\system32\tilepilo.dll (file missing)

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

* Click on Fix Checked when finished and exit HijackThis.

Make sure your Internet Explorer is closed when you click Fix Checked!

Then, scan once again with Malwarebytes and let it remove everything it is finding.

Reboot afterwards.

After reboot, post the new Malwarebyteslog together with a new HijackThislog in your next reply.

Fenix44 · January 12, 2010

alright, i did everything you ask and my computer is getting better!

well here's the mbam log and once again thank you for your help!

Malwarebytes' Anti-Malware 1.44

Database version: 3533

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

1/11/2010 8:03:48 PM

mbam-log-2010-01-11 (20-03-48).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 284140

Time elapsed: 1 hour(s), 27 minute(s), 56 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here is the Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:20:20 PM, on 1/11/2010