MBAM wont install (already read FAQ an no luck)

[FFSchooley]

My computer is infected. I keep getting pop ups and MBAM would not run. Said it could not find its files. I deleted it and tried to re-install. It would not install. I tried re-naming it. Still no luck. Here is the log files from Hi-jack this. Thanks in advance for the help. You guys are great!!!!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:20:39 PM, on 1/8/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\HPQ\SHARED\HPQWMI.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\abcde\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

O4 - HKLM\..\Run: [yarivagob] Rundll32.exe "c:\windows\system32\velumehu.dll",a

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab

O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab

O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab

O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{7F882997-21AA-4434-853A-1A5139287CD5}: NameServer = 193.104.110.38,4.2.2.1,192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{BF540288-8EAF-42C5-830A-D68238BF7A24}: NameServer = 193.104.110.38,4.2.2.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll tohahubu.dll c:\windows\system32\velumehu.dll

O21 - SSODL: runimeduv - {d2aad7f2-f98c-40f8-841e-1202e950c7b1} - c:\windows\system32\velumehu.dll

O22 - SharedTaskScheduler: kupuhivus - {d2aad7f2-f98c-40f8-841e-1202e950c7b1} - c:\windows\system32\velumehu.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 9177 bytes

[kahdah]

Hello FFSchooley

Welcome to Malwarebytes.

=====================

• Download OTL to your desktop.
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Under Custom scan's and fixes section paste in the below in bold
  

  
  

  %SYSTEMDRIVE%\*.exe
  
  
  /md5start
  
  
  eventlog.dll
  
  
  scecli.dll
  
  
  netlogon.dll
  
  
  cngaudit.dll
  
  
  sceclt.dll
  
  
  ntelogon.dll
  
  
  logevent.dll
  
  
  iaStor.sys
  
  
  nvstor.sys
  
  
  atapi.sys
  
  
  IdeChnDr.sys
  
  
  viasraid.sys
  
  
  AGP440.sys
  
  
  vaxscsi.sys
  
  
  nvatabus.sys
  
  
  viamraid.sys
  
  
  nvata.sys
  
  
  nvgts.sys
  
  
  iastorv.sys
  
  
  ViPrt.sys
  
  
  eNetHook.dll
  
  
  ahcix86.sys
  
  
  KR10N.sys
  
  
  nvstor32.sys
  
  
  /md5stop
  
  
  CREATERESTOREPOINT

  
  

• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    

====================

Download the following GMER Rootkit Scanner from Here

• Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
  
• Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
  
• It may take a minute to load and become available.
  
• If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
  
• In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED
  

  
  

• Sections
  
  
• IAT/EAT
  
  
• Drives/Partition other than Systemdrive (typically only C:\ should be checked)
  
  
• Show All (don't miss this one)

  
  

• Then click the Scan button & wait for it to finish.
  
• Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop
  
• **Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
  
• Click OK and quit the GMER program.
  
• Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.
  
• Post that log in your next reply.
  

[FFSchooley]

OTL will not open. I try to run it and nothing happens...

[kahdah]

Try the following.

Please download DDS and save it to your desktop.

• Double click dds.scr to run the tool.
  
• When done, DDS.txt will open as well as attach.txt.
  
• Save both reports to your desktop.
  

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

attach.txt

Also post the gmer log please.

[FFSchooley]

DDS does not work. A blank screen opens with a blinking cursor. Nothing happens. I finally got OTL to open, followed your instructions, and it ran its scan for about 8 hours and was still not done. Is that normal?

[kahdah]

Please do not post in other people's thread's.

You will need to start a new topic to receive assistance.

FFSchooley please try to run OTL in Safe MOde it is not normal for it to take that long you must have some very high cpu usage.

*Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.

[FFSchooley]

OK. I tried to run OTL in safe mode. It starts scanning and then I get an error message saying 'SOFTWARE' is not a valid integer value. The scan then stops.

[kahdah]

Please also try DDS in Safe Mode just let me know what happens.

[FFSchooley]

Thanks for your quick response. DSS worked. Here are the results.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 8/6/2005 12:37:37 PM

System Uptime: 1/11/2010 3:53:47 PM (0 hours ago)

Motherboard: Quanta | | 3093

Processor: AMD Turion 64 Mobile Technology ML-28 | U23 | 1600/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 38.627 GiB free.

D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1199: 11/21/2009 8:45:25 PM - System Checkpoint

RP1200: 11/23/2009 10:42:07 AM - System Checkpoint

RP1201: 11/24/2009 11:31:38 AM - System Checkpoint

RP1202: 11/25/2009 3:34:15 PM - System Checkpoint

RP1203: 11/26/2009 4:09:43 PM - System Checkpoint

RP1204: 11/27/2009 10:37:40 AM - Software Distribution Service 3.0

RP1205: 11/29/2009 9:07:22 AM - System Checkpoint

RP1206: 11/30/2009 11:07:17 AM - System Checkpoint

RP1207: 12/1/2009 5:15:38 PM - System Checkpoint

RP1208: 12/2/2009 5:50:17 PM - System Checkpoint

RP1209: 12/3/2009 6:20:33 PM - System Checkpoint

RP1210: 12/4/2009 9:31:51 PM - System Checkpoint

RP1211: 12/6/2009 9:16:32 AM - System Checkpoint

RP1212: 12/7/2009 9:24:42 AM - System Checkpoint

RP1213: 12/8/2009 9:48:38 AM - System Checkpoint

RP1214: 12/9/2009 4:02:18 PM - System Checkpoint

RP1215: 12/10/2009 9:12:53 PM - System Checkpoint

RP1216: 12/11/2009 9:48:59 PM - System Checkpoint

RP1217: 12/12/2009 9:59:37 AM - Software Distribution Service 3.0

RP1218: 12/13/2009 10:07:17 AM - System Checkpoint

RP1219: 12/14/2009 10:27:16 AM - System Checkpoint

RP1220: 12/15/2009 11:42:25 AM - System Checkpoint

RP1221: 12/16/2009 12:04:02 PM - System Checkpoint

RP1222: 12/17/2009 4:54:38 PM - System Checkpoint

RP1223: 12/18/2009 5:32:04 PM - System Checkpoint

RP1224: 12/19/2009 6:29:20 PM - System Checkpoint

RP1225: 12/20/2009 7:41:51 PM - System Checkpoint

RP1226: 12/21/2009 8:57:18 PM - System Checkpoint

RP1227: 12/22/2009 9:03:52 PM - System Checkpoint

RP1228: 12/24/2009 9:42:08 AM - System Checkpoint

RP1229: 12/26/2009 10:18:13 AM - System Checkpoint

RP1230: 12/27/2009 11:07:25 AM - System Checkpoint

RP1231: 12/30/2009 10:26:08 AM - System Checkpoint

RP1232: 12/31/2009 10:47:24 AM - System Checkpoint

RP1233: 1/1/2010 11:25:07 AM - System Checkpoint

RP1234: 1/2/2010 6:44:00 PM - System Checkpoint

RP1235: 1/3/2010 7:04:25 PM - System Checkpoint

RP1236: 1/4/2010 1:51:44 PM - Installed Panorama Maker

RP1237: 1/4/2010 1:54:25 PM - Installed Microsoft Visual C++ 2005 Redistributable

RP1238: 1/4/2010 1:57:50 PM - Installed Nikon Transfer

RP1239: 1/4/2010 2:02:43 PM - Installed Nikon Message Center

RP1240: 1/5/2010 4:59:34 PM - System Checkpoint

RP1241: 1/6/2010 5:36:23 PM - System Checkpoint

RP1242: 1/7/2010 6:11:28 PM - System Checkpoint

RP1243: 1/8/2010 6:52:30 PM - System Checkpoint

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Flash Player 9 ActiveX

Adobe Reader 7.0.9

Adobe Shockwave Player 11

Adobe

[kahdah]

You are welcome.

==============

1. Please download The Avenger2 by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
  
• Follow the prompts and extract the avenger folder to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
c:\windows\system32\ruhimove.dll
c:\windows\system32\tohahubu.dll
c:\windows\system32\wadelima.dll
c:\windows\system32\wohujona.dll
c:\windows\system32\fiwevoga.dll
c:\windows\system32\halodito.dll
c:\windows\system32\joyefabo.dll
c:\windows\system32\medusuli.dll
c:\windows\system32\velumehu.dll
c:\windows\system32\zehalawu.dll
c:\windows\system32\rigoduga.dll
c:\windows\system32\hanayoku.dll
c:\windows\system32\romarete.dll
c:\windows\system32\biyuhepe.dll
c:\windows\system32\pawajinu.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
  
• You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  
• Click on Execute
  
• Answer "Yes" twice when prompted.
  

4. The Avenger will automatically do the following:

[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)

[*]On reboot, it will briefly open a black command window on your desktop, this is normal.

[*]After the restart, it creates a log file that should open with the results of Avenger

[FFSchooley]

my free trial of win-zip is expired and I can't open it. Now what?

[kahdah]

You don't need win zip to extract it just right click on the folder and choose extract all.

You can remove winzip xp has built in zipping capabilities.

[FFSchooley]

I am trying to download and install the newest win-zip, so we will see what happens

[FFSchooley]

Got it! Here are the results.

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

File "c:\windows\system32\ruhimove.dll" deleted successfully.

File "c:\windows\system32\tohahubu.dll" deleted successfully.

File "c:\windows\system32\wadelima.dll" deleted successfully.

File "c:\windows\system32\wohujona.dll" deleted successfully.

File "c:\windows\system32\fiwevoga.dll" deleted successfully.

File "c:\windows\system32\halodito.dll" deleted successfully.

File "c:\windows\system32\joyefabo.dll" deleted successfully.

File "c:\windows\system32\medusuli.dll" deleted successfully.

File "c:\windows\system32\velumehu.dll" deleted successfully.

File "c:\windows\system32\zehalawu.dll" deleted successfully.

File "c:\windows\system32\rigoduga.dll" deleted successfully.

File "c:\windows\system32\hanayoku.dll" deleted successfully.

File "c:\windows\system32\romarete.dll" deleted successfully.

File "c:\windows\system32\biyuhepe.dll" deleted successfully.

Error: file "c:\windows\system32\pawajinu.dll" not found!

Deletion of file "c:\windows\system32\pawajinu.dll" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

AND

ComboFix 10-01-11.01 - Megan Nelson 01/11/2010 17:25:25.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.382.126 [GMT -8:00]

Running from: c:\documents and settings\Megan Nelson\Desktop\Combo-Fix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\system32\guvegavu.dll

c:\windows\system32\nikarili.dll

c:\windows\system32\wanajiru.dll

c:\windows\Tasks\rffpseso.job

c:\windows\Temp\tmp3.tmp

----- BITS: Possible infected sites -----

hxxp://82.98.235.29

.

((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))

.

2010-01-11 23:57 . 2010-01-11 23:57 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2010-01-08 19:29 . 2010-01-08 19:29 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

2010-01-08 19:29 . 2010-01-08 19:29 -------- d-----w- c:\program files\IObit

2010-01-08 19:21 . 2010-01-08 19:44 -------- d-----w- c:\program files\notagain.com

2010-01-04 22:06 . 2010-01-04 22:06 -------- d-----w- c:\documents and settings\Megan Nelson\Application Data\Nikon

2010-01-04 21:58 . 2010-01-04 21:58 -------- d-----w- c:\program files\Common Files\muvee Technologies

2010-01-04 21:58 . 2010-01-04 22:02 -------- d-----w- c:\program files\Common Files\Nikon

2010-01-04 21:58 . 2010-01-04 21:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Nikon

2010-01-04 21:57 . 2010-01-04 21:57 -------- d-----w- c:\program files\Nikon

2010-01-04 21:56 . 2010-01-04 21:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Ultima_T15

2010-01-04 21:56 . 2010-01-04 21:56 -------- d-----w- c:\documents and settings\All Users\Application Data\EnterNHelp

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-12 01:10 . 2007-01-08 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip

2010-01-12 00:56 . 2007-02-26 23:20 -------- d-----w- c:\documents and settings\Megan Nelson\Application Data\ComcastToolbar

2010-01-06 03:28 . 2009-01-02 19:48 -------- d-----w- c:\documents and settings\Megan Nelson\Application Data\Skype

2010-01-06 00:32 . 2009-01-02 19:51 -------- d-----w- c:\documents and settings\Megan Nelson\Application Data\skypePM

2010-01-04 22:07 . 2010-01-04 21:56 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT

2010-01-04 22:02 . 2010-01-04 22:02 49152 ----a-r- c:\documents and settings\Megan Nelson\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe

2010-01-04 22:01 . 2010-01-04 22:01 335872 ----a-r- c:\documents and settings\Megan Nelson\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe

2010-01-04 21:56 . 2003-03-19 08:05 106496 ----a-w- c:\windows\system32\ATL71.DLL

2010-01-04 21:51 . 2005-10-10 00:42 -------- d-----w- c:\program files\ArcSoft

2010-01-04 21:51 . 2005-04-29 08:37 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-12-21 05:31 . 2009-11-27 18:45 427928 ----a-w- c:\documents and settings\LocalService.NT AUTHORITY.010\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-12-13 00:14 . 2009-12-13 00:03 -------- d-----w- c:\documents and settings\Megan Nelson\Application Data\VirtualStore

2009-12-07 16:29 . 2009-11-01 16:40 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-12-07 15:49 . 2008-04-11 21:43 -------- d--ha-w- c:\documents and settings\All Users\Application Data\GTek

2009-11-27 21:06 . 2009-11-26 02:59 171552 ----a-w- c:\windows\system32\guard32.dll

2009-11-27 21:06 . 2009-11-26 02:59 87104 ----a-w- c:\windows\system32\drivers\inspect.sys

2009-11-27 21:06 . 2009-11-26 02:59 25160 ----a-w- c:\windows\system32\drivers\cmdhlp.sys

2009-11-27 21:06 . 2009-11-26 02:59 133064 ----a-w- c:\windows\system32\drivers\cmdguard.sys

2009-11-26 03:05 . 2009-11-26 02:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Comodo

2009-11-26 02:59 . 2009-11-02 00:43 -------- d-----w- c:\program files\COMODO

2009-11-25 23:08 . 2009-11-25 23:08 131676 ---ha-w- c:\windows\system32\mlfcache.dat

2009-11-15 17:42 . 2005-08-21 23:35 241816 -c--a-w- c:\documents and settings\Megan Nelson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-11-14 05:50 . 2007-11-05 20:30 -------- d-----w- c:\documents and settings\Megan Nelson\Application Data\Intuit

2009-11-14 05:39 . 2007-11-05 20:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Intuit

2009-11-14 05:36 . 2007-11-05 20:29 -------- d-----w- c:\program files\Common Files\Intuit

2009-11-14 05:35 . 2009-11-14 05:35 -------- d-----w- c:\program files\TurboTax

2009-11-14 05:21 . 2009-11-14 05:21 -------- d-----w- c:\program files\MSBuild

2009-11-14 05:21 . 2009-11-14 05:21 -------- d-----w- c:\program files\Reference Assemblies

2009-11-03 19:33 . 2009-11-03 19:33 6 ----a-w- c:\windows\Fonts\wfonts.key

2009-11-01 16:27 . 2009-11-01 01:42 0 ----a-w- c:\documents and settings\Megan Nelson\Local Settings\Application Data\prvlcl.dat

2009-10-29 07:45 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2009-10-21 05:38 . 2004-08-04 08:00 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38 . 2004-08-04 08:00 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 08:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

1601-01-01 00:03 . 1601-01-01 00:03 86016 --sha-w- c:\windows\system32\hejitavo.dll

1601-01-01 00:03 . 1601-01-01 00:03 61952 --sha-w- c:\windows\system32\kazarige.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-04-01 794624]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-02 102492]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-02 692316]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 774168]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-11-27 1800464]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]

"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2008-09-30 485208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-09-09 04:09 305440 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-09-05 08:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2008-04-21 22:09 185896 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"EPSON Stylus CX4800 Series"=c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"

"Cpqset"=c:\program files\HPQ\Default Settings\cpqset.exe

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe"

"LSBWatcher"=c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

"tgcmd"=c:\program files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [11/25/2009 6:59 PM 133064]

R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [11/25/2009 6:59 PM 25160]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/1/2009 8:40 AM 108289]

R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [12/15/2004 7:18 AM 200192]

S2 pciinfo;HP Pci Information;\??\c:\docume~1\MEGANN~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys --> c:\docume~1\MEGANN~1\LOCALS~1\Temp\HPISPz\hpdom\pciinfo.sys [?]

.

Contents of the 'Scheduled Tasks' folder

2010-01-12 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-04-26 c:\windows\Tasks\HubTask 0 {0E7C166E-2D2F-4269-9034-DE1898BF2B1A} 0~0.job

- c:\program files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe [2005-02-11 09:00]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mWindow Title = Microsoft Internet Explorer presented by Comcast

uInternet Connection Wizard,ShellNext = hxxp://www.google.com/

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

Trusted Zone: intuit.com\ttlc

TCP: {7F882997-21AA-4434-853A-1A5139287CD5} = 193.104.110.38,4.2.2.1,192.168.0.1

TCP: {BF540288-8EAF-42C5-830A-D68238BF7A24} = 193.104.110.38,4.2.2.1

FF - ProfilePath - c:\documents and settings\Megan Nelson\Application Data\Mozilla\Firefox\Profiles\nexr8qkk.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo! Search

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.notify.interval - 600000

FF - user.js: content.switch.threshold - 1000000

FF - user.js: nglayout.initialpaint.delay - 600

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\abcde\mbam.exe

HKLM-Run-yarivagob - c:\windows\system32\guvegavu.dll

SharedTaskScheduler-{6c186389-a19b-4320-8275-1b6c11e993ae} - c:\windows\system32\guvegavu.dll

SSODL-yowupudez-{6c186389-a19b-4320-8275-1b6c11e993ae} - c:\windows\system32\guvegavu.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-11 17:42

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f5,4a,35,df,3a,f2,d8,43,82,9e,3f,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f5,4a,35,df,3a,f2,d8,43,82,9e,3f,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(792)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(6368)

c:\windows\system32\WININET.dll

c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\COMODO\COMODO Internet Security\cmdagent.exe

c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wdfmgr.exe

c:\program files\Common Files\LogiShrd\LComMgr\LVComSX.exe

c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe

c:\program files\HPQ\SHARED\HPQWMI.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-01-11 17:51:22 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-12 01:51

ComboFix2.txt 2009-11-19 23:31

Pre-Run: 40,846,381,056 bytes free

Post-Run: 40,817,905,664 bytes free

- - End Of File - - 5FED0496BE97FD23749C7A6159C8B90E

[kahdah]

Update Run Malwarebytes

Please update\run Malwarebytes' Anti-Malware.

Double Click the Malwarebytes Anti-Malware icon to run the application.

• Click on the update tab then click on Check for updates.
  
• If an update is found, it will download and install the latest version.
  
• Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.

=====

* Go here to run an online scannner from ESET.

• Note: You will need to use Internet explorer for this scan
  
• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activex control to install
  
• Click Start
  
• Check next options: Remove found threats and Scan unwanted applications.
  
• Click Scan
  
• Wait for the scan to finish
  
• Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
  
• Copy and paste that log as a reply to this topic
  

[FFSchooley]

I still can't install Malwarebytes. I tried re-naming it. When I try to open the file to install, nothing happens for a while and then I get the error message: Unable to execute file in the temporary directory, setup aborted. Error 5: Access Denied

[kahdah]

This seems to be related to Comodo please uninstall it temporarily.

Let me know if that fixes it.

[FFSchooley]

It worked. Here is the MBAM Log:

Malwarebytes' Anti-Malware 1.44

Database version: 3550

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

1/12/2010 2:26:29 PM

mbam-log-2010-01-12 (14-26-29).txt

Scan type: Full Scan (C:\|)

Objects scanned: 273229

Time elapsed: 1 hour(s), 20 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 20

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7f882997-21aa-4434-853a-1a5139287cd5}\NameServer (Trojan.DNSChanger) -> Data: 193.104.110.38,4.2.2.1,192.168.0.1 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{bf540288-8eaf-42c5-830a-d68238bf7a24}\NameServer (Trojan.DNSChanger) -> Data: 193.104.110.38,4.2.2.1 -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\hejitavo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kazarige.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1243\A0069362.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1243\A0069285.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1243\A0069296.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069401.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069402.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069405.exe (Trojan.Banker) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069423.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069398.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069494.sys (Malware.Trace) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069584.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069585.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069586.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069587.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069588.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069589.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069590.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069591.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1244\A0069674.sys (Malware.Trace) -> Quarantined and deleted successfully.

[kahdah]

Great post the Eset log when you can.

[FFSchooley]

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=977ea91c4490ae4bbbb56f7228c78c1e

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-01-13 05:27:57

# local_time=2010-01-12 09:27:58 (-0800, Pacific Standard Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 5479496 5479496 0 0

# compatibility_mode=1024 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16775141 100 100 0 39675249 0 0

# compatibility_mode=3073 16777213 80 89 289157 3918127 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=86911

# found=0

# cleaned=0

# scan_time=3675

[kahdah]

Great.

• Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.
    

[FFSchooley]

No luck. In both regular and safe mode I get the error: SOFTWARE is an invalid integer value (or something close to that)

[kahdah]

That's ok just run dds instead.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!