Can't get Malwarebytes to complete scanning

steveandbelinda · January 27, 2010

Hi, I installed new version of Malwarebytes 1.44, and started quick scan, but after a few seconds it stops and does not continue. Do a cntrl/alt/del command and shows program is not responding any longer. I have Windows XP Home Edition SP3. Microsoft Security Essentials installed. I did have AVG Free also, but was told on another area of this forum to uninstall it, so I did with Revo Unistaller, to no avail. I used the AVG Removal Tool also. I used to have SpySweeper back about 3-4 months ago, but uninstalled it also. I also added the file/folder exclusions in Microsoft Essentials settings and still no good.

Here is the DDS.txt information and the ARK.txt and Attach.txt that was requested. Since it would not complete a quick scan, there was nothing in the Malwarebytes Log File. Thanks!!!

DDS (Ver_09-12-01.01) - NTFSx86

Run by Steven at 0:58:15.64 on Wed 01/27/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1791.1235 [GMT -5:00]

AV: Webroot AntiVirus with AntiSpyware *On-access scanning enabled* (Updated) {77E10C7F-2CCA-4187-9394-BDBC267AD597}

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: Webroot AntiVirus with AntiSpyware *disabled* {63671000-11A2-46DD-BADD-A084CABCDEAE}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Bonjour\mDNSResponder.exe

svchost.exe

C:\WINDOWS\system32\E_S00RP1.EXE

C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE

C:\Program Files\Airlink101\Airlink101 WLAN Monitor\WLANmon.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\vsnp2uvc.exe

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe

C:\Program Files\Comcast Universal Caller ID\Comcast Universal Caller ID.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Steven\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: ONLINE-TV Toolbar: {a8baaddd-ab98-4cdb-84cc-3c9ed9f38d1e} - c:\program files\online-tv\tbONL1.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll

BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0315.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0315.0\msneshellx.dll

TB: ONLINE-TV Toolbar: {a8baaddd-ab98-4cdb-84cc-3c9ed9f38d1e} - c:\program files\online-tv\tbONL1.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [dxlock]

uRun: [Auto EPSON Stylus Photo R300 Series on VIDEO] "c:\windows\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE" /P44 "Auto EPSON Stylus Photo R300 Series on VIDEO" /M "Stylus Photo R300" /EF "HKCU"

uRun: [EPSON Stylus Photo R300 Series] "c:\windows\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE" /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"

uRun: [\\VIDEO\EPSON Stylus Photo R300 Series] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p38 "\\video\EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [fsm]

mRun: [EPSON Stylus Photo R300 Series] "c:\windows\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE" /P30 "EPSON Stylus Photo R300 Series" /O5 "LPT1:" /M "Stylus Photo R300"

mRun: [NvCplDaemon] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] "c:\windows\system32\nwiz.exe" /install

mRun: [NvMediaCenter] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [soundMan] "c:\windows\SOUNDMAN.EXE"

mRun: [Auto Auto EPSON Stylus Photo R300 Series on STEVE on BELINDA] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p60 "auto auto epson stylus photo r300 series on steve on belinda" /o18 "\\belinda\AutoEPSO" /M "Stylus Photo R300"

mRun: [Auto EPSON Stylus Photo R300 Series on VIDEO] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p44 "auto epson stylus photo r300 series on video" /o16 "\\video\EPSONSty" /M "Stylus Photo R300"

mRun: [\\VIDEO\EPSON Stylus Photo R300 Series] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p38 "\\video\EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

mRun: [Auto Auto Auto EPSON Stylus Photo R300 Series on VIDEO on STEVE on VIDEO] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p72 "auto auto auto epson stylus photo r300 series on video on steve on video" /o16 "\\video\AutoAuto" /M "Stylus Photo R300"

mRun: [Auto Auto Auto Auto EPSON Stylus Photo R300 Series on STEVE on BELINDA on STEVE on VIDEO] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p88 "auto auto auto auto epson stylus photo r300 series on steve on belinda on steve on video" /o18 "\\video\AutoAuto.2" /M "Stylus Photo R300"

mRun: [Auto Auto EPSON Stylus Photo R300 Series on STEVE on VIDEO] "c:\windows\system32\spool\drivers\w32x86\3\e_s4i2f1.exe" /p58 "auto auto epson stylus photo r300 series on steve on video" /o16 "\\video\AutoEPSO" /M "Stylus Photo R300"

mRun: [Airlink101 WLAN Monitor] "c:\program files\airlink101\airlink101 wlan monitor\WLANmon.exe"

mRun: [ANIWZCS2Service] "c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [snp2uvc] "c:\windows\vsnp2uvc.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [Google Updater] "c:\program files\google\google updater\GoogleUpdater.exe" -systray -startup

StartupFolder: c:\docume~1\steven\startm~1\programs\startup\comcas~1.lnk - c:\program files\comcast universal caller id\Comcast Universal Caller ID.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\audiod~1.lnk - c:\program files\via technologies, inc\via audio driver setup program\audiodeck\AudioDeck.exe

uPolicies-explorer: NoViewOnDrive = 0 (0x0)

IE: {3437D640-C91A-458f-89F5-B9095EA4C28B}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1145754593861

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238558858281

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/popcaploader_v10.cab

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 Pnp680;SiI 680 ATA Controller;c:\windows\system32\drivers\pnp680.sys [2006-4-24 37031]

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2008-8-9 29808]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 142832]

R2 BCMNTIO;BCMNTIO;c:\progra~1\checkit\diagno~1\BCMNTIO.sys [2006-4-22 3744]

R2 MAPMEM;MAPMEM;c:\progra~1\checkit\diagno~1\MAPMEM.sys [2006-4-22 3904]

R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-4-22 1119888]

R3 AL101;Airlink101 802.11g PCI Driver;c:\windows\system32\drivers\AL101.sys [2007-9-9 380928]

S2 gupdate1c9cfefdc9d1dec;Google Update Service (gupdate1c9cfefdc9d1dec);c:\program files\google\update\GoogleUpdate.exe [2009-5-8 133104]

S2 mrtRate;mrtRate; [x]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-1-27 38224]

S3 Mscrmdtmast;Mscrmdtmast; [x]

S3 Vsp;Vsp;c:\windows\system32\drivers\vsp.sys [2006-4-23 3351]

=============== Created Last 30 ================

2010-01-27 05:46:05 0 ----a-w- c:\documents and settings\steven\defogger_reenable

2010-01-27 05:25:36 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-27 05:25:33 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-27 05:25:32 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-26 23:22:56 0 d-----w- c:\windows\system32\wbem\Repository

2010-01-25 01:28:43 0 d-----w- c:\docume~1\steven\applic~1\Malwarebytes

2010-01-25 01:28:34 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-01-24 02:38:51 4199784 ----a-w- c:\windows\system32\cdintf400.dll

2010-01-18 16:39:48 0 d-----w- c:\docume~1\alluse~1\applic~1\Citrix

2010-01-18 16:32:30 103784 ----a-w- c:\documents and settings\steven\GoToAssistDownloadHelper.exe

2010-01-13 15:55:49 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2010-01-03 08:18:01 0 d-----w- c:\program files\IObit

2010-01-01 16:55:19 0 d-----w- c:\docume~1\steven\applic~1\TaxCut

2010-01-01 16:54:22 0 d-----w- c:\program files\DeductionPro 2009

2010-01-01 16:51:36 0 d-----w- c:\program files\PDF995

2010-01-01 16:51:36 0 d-----w- c:\program files\HRBlock2009

2010-01-01 16:47:05 0 d-----w- c:\docume~1\alluse~1\applic~1\TaxCut

==================== Find3M ====================

2010-01-14 16:12:06 181120 ------w- c:\windows\system32\MpSigStub.exe

2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll

2005-06-26 20:32:28 616448 --sha-r- c:\windows\system32\cygwin1.dll

2005-06-22 03:37:42 45568 --sha-r- c:\windows\system32\cygz.dll

2004-01-25 05:00:00 70656 --sha-r- c:\windows\system32\i420vfw.dll

2006-04-27 15:24:24 2945024 --sha-r- c:\windows\system32\Smab.dll

2005-02-28 18:16:22 240128 --sha-r- c:\windows\system32\x.264.exe

2004-01-25 05:00:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll

2009-10-14 13:57:50 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

2008-08-23 14:28:27 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082320080824\index.dat

2009-02-23 02:02:27 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009022220090223\index.dat

2009-04-01 05:16:12 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009040120090402\index.dat

============= FINISH: 0:58:55.56 ===============

Attach.zip

extremeboy · January 30, 2010

Hello and welcome to Malwarebytes.

I Apologize for the late response.

If you still require assistance, we would like to see the latest state of your system. So, please take a read in this thread on instructions on running the tools and posting the logs for instructions: http://www.malwarebytes.org/forums/index.php?showtopic=9573

In your reply, I would also like to know any symptoms you may still have and how your computer is running at the moment.

Please note that the forum is very busy and if I don

steveandbelinda · January 31, 2010

Thanks for replying. Can you just go with what I gave you above? I believe the one test took about 15 hours. The computer is still doing the same thing as above. The only thing that I have done is downloaded SuperAntiSpyware, becuase I didn't want to be without anything. Also downloaded last night a program that tells out-of-date patches in software programs, called "Secunia PSI (personal software investigator). The symptoms that I occur trying to run a scan with Malwarebytes, is start scan, runs for about 12-20 seconds and just stops. I then do cntrl/alt/del, and it shows program is not longer responding. Everything else on the computer seems to be running fine. I have the exclusions added to the settings in Micorsoft Security Essentials. I noticed on the printout above that SpySweeper is still in the system. I deleted that program some time ago, but checked last night and noticed that there are still some files and folders.

extremeboy · January 31, 2010

Hello.

I do see infections in the previous logs but I would like to see an update of your system. Are you unable to run those scans again? You may skip GMER for now due to the fact it does take a while.

steveandbelinda · January 31, 2010

I have ran the first 2 programs, the Gmer has been running for the last hour. Do you wish me to stop it? I told my son in law that I was downloading and sending data scans to an unsecure site and he thought that I am nuts.

steveandbelinda · January 31, 2010

I will send all the data as soon as it stops scanning with the GMER program, unless I can send you the first 2 without disturbing the scan. Let me know . It's been scanning for about 6 hours now.

steveandbelinda · January 31, 2010

Here is the DDS file, and the Attach file (zipped). I finally went to bed about 4am, and the GMER scan was still not done. Got up this morn and computer had shut off sometime after I went to bed. So here are the two files that you asked for.

DDS (Ver_09-12-01.01) - NTFSx86

Run by Steven at 20:58:29.12 on Sat 01/30/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1791.1302 [GMT -5:00]