Unable to run MBAM

jpaulr · February 28, 2010

I am unable to run MBAM at all. When I tried to download / reinstall it, I get the following message.

"Unable to execute file mbam.exe

CreateProcess failed; code 2

The system cannot find the file specified."

The desktop icon resembles an open file folder. I'm getting huge amounts of popups. AntiVir is reporting all kinds of infections. Only able to run SuperAntiSpyware which is returning Vundo along with other problems.

Any help is appreciated.

After running SAS I got RUNDLL error "Error loading litinika.dll" After looking that up I guess it's a good thing.

I am still unable to run the setup file and MBAM will not install.

Maurice Naggar · February 28, 2010

Do as much as possible of the steps here http://forums.malwarebytes.org/index.php?showtopic=9573

Skip those you cannot manage to start (such as MBAM). Please get the GMER & DDS logs and put those into the main body of your next reply.

Do NOT use the attach feature to upload your logs.

jpaulr · February 28, 2010

Do as much as possible of the steps here http://forums.malwarebytes.org/index.php?showtopic=9573
Skip those you cannot manage to start (such as MBAM). Please get the GMER & DDS logs and put those into the main body of your next reply.
Do NOT use the attach feature to upload your logs.

the requested URL /defogger.exe was not found on this server.

I have verified on 2 machines - the link is bad. Please advise.

Maurice Naggar · February 28, 2010

Link is good. Just tested & works for me.

Skip forward to next steps. Get what you can from GMER & DDS.

IF you are totally blocked from downloading on this system, use another one to do downloads, burn to CD/DVD or a clean-fresh USB drive, then copy tools to the Desktop.

jpaulr · February 28, 2010

Link is good. Just tested & works for me.
Skip forward to next steps. Get what you can from GMER & DDS.
IF you are totally blocked from downloading on this system, use another one to do downloads, burn to CD/DVD or a clean-fresh USB drive, then copy tools to the Desktop.

I missed the capital D in Defogger - my bad. Have run Avir, DDS and GMER is running now. Waiting for GMER to finish. Will post results when it completes.

jpaulr · February 28, 2010

I missed the capital D in Defogger - my bad. Have run Avir, DDS and GMER is running now. Waiting for GMER to finish. Will post results when it completes.

After 4 attempts at running GMER rootkit scanner I give up. I get the root kit warning, click NO, uncheck the proper boxes, start the scan and it gets to a certain point and reboots the machine automatically. The scan does not complete.

I was able to run DDS. Log is below. Attach file has been zipped and attached as instructed.

DDS (Ver_09-12-01.01) - NTFSx86

Run by Paul1 at 14:06:43.84 on Sun 02/28/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.112 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Documents and Settings\Paul1\Local Settings\Application Data\av.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\iPod\bin\iPodService.exe

c:\program files\AIM6\aolsoftware.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Paul1\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.cnn.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: {f0f64745-2af9-4899-b978-bd1cab84c9eb} - wisahiri.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\googletoolbarnotifier .exe"

uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet

uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [TOY5KNQ8OC] c:\docume~1\paul1\locals~1\temp\hn1 .exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

mRun: [symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"

mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [EnvyHFCPL] c:\program files\audio deck\EnMixCPL.exe 1

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [QuickTime Task] "c:\program files\quicktime\qttask .exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [risakubiza] Rundll32.exe "litinika.dll",s

mRun: [mitomapuw] Rundll32.exe "c:\windows\system32\pegojehe.dll",a

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

uPolicies-system: DisableRegistryTools = 1 (0x1)

dPolicies-system: DisableRegistryTools = 1 (0x1)

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll

IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll

IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll

Trusted Zone: ameritrade.com

Trusted Zone: ameritrade.com\research

Trusted Zone: ameritrade.com\wwws

Trusted Zone: tdameritrade.com

Trusted Zone: tdameritrade.com\www

DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB

DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon%20FiOS%20Installer.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {C946EF6D-296D-4907-A6E1-ED0E8E5AF024} - hxxp://mail.lycos.com/hanmail-ax/AttachMail.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: app_dll.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SSODL: henagakam - {aaa4ca1e-6db4-4d38-a4ac-87509c3dafd5} - c:\windows\system32\pegojehe.dll

STS: mujuzedij: {aaa4ca1e-6db4-4d38-a4ac-87509c3dafd5} - c:\windows\system32\pegojehe.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

LSA: Notification Packages = scecli perowimi.dll

IFEO: MpCmdRun.exe - c:\windows\system32\svchost.exe

IFEO: MSASCui.exe - c:\windows\system32\svchost.exe

IFEO: MsMpEng.exe - c:\windows\system32\svchost.exe

IFEO: msseces.exe - c:\windows\system32\svchost.exe

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\paul1\applic~1\mozilla\firefox\profiles\3x29nyyw.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.cnn.com/

FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-16 11608]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-9-4 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-9-4 74480]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-16 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-16 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-16 56816]

R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2008-10-28 156968]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-6-19 24652]

R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;c:\windows\system32\drivers\Envy24HF.sys [2007-11-30 577664]

R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-9-4 7408]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-28 135664]

S2 SSHNAS;SSHNAS;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\googledesktop.exe [2007-10-2 55808]

S3 membus;membus;c:\windows\system32\membus.sys [2004-8-4 2304]

=============== Created Last 30 ================

2010-02-28 17:14:30 4 ----a-w- c:\program files\2996031.dat

2010-02-28 15:55:21 4 ----a-w- c:\program files\746640.dat

2010-02-28 15:42:20 94208 ----a-w- c:\windows\system32\app_dll.dll

2010-02-28 15:41:23 0 d-----w- c:\windows\_VOIDrtfjwibceg

2010-02-28 15:41:08 55808 ----a-w- c:\documents and settings\paul1\rundll32.exe

2010-02-28 15:41:08 55808 ----a-w- c:\documents and settings\paul1\rundll32 .exe

2010-02-28 15:40:24 189440 ----a-w- c:\windows\system32\sshnas21.dll

2010-02-21 15:42:10 18064 ---ha-w- c:\windows\system32\mlfcache.dat

2010-02-20 23:26:52 0 d-----w- c:\program files\iPod

2010-02-20 23:26:32 0 d-----w- c:\program files\iTunes

==================== Find3M ====================

2010-02-28 18:53:39 55808 ----a-w- c:\windows\system32\igfxpers.exe

2010-02-28 18:53:34 55808 ----a-w- c:\windows\system32\hkcmd.exe

2010-02-28 18:53:32 55808 ----a-w- c:\windows\system32\igfxtray.exe

2010-01-07 21:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 21:07:04 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:26:15 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43:51 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe

1601-01-01 00:03:28 95232 --sha-w- c:\windows\system32\pegojehe.dll

1601-01-01 00:03:52 64000 --sha-w- c:\windows\system32\perowimi.dll

2009-03-08 00:42:23 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009030720090308\index.dat

============= FINISH: 14:07:34.26 ===============

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 5/15/2007 10:36:31 AM

System Uptime: 2/28/2010 1:51:05 PM (1 hours ago)

Motherboard: Dell Computer Corp. | | 0TC666

Processor: Intel® Pentium® 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 116.048 GiB free.

D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP441: 12/22/2009 9:39:41 AM - System Checkpoint

RP442: 12/23/2009 3:00:16 AM - Software Distribution Service 3.0

RP443: 12/24/2009 3:31:48 AM - System Checkpoint

RP444: 12/25/2009 3:39:32 AM - System Checkpoint

RP445: 12/26/2009 4:39:36 AM - System Checkpoint

RP446: 12/27/2009 5:39:33 AM - System Checkpoint

RP447: 12/28/2009 6:41:00 AM - System Checkpoint

RP448: 1/14/2010 8:50:43 AM - Software Distribution Service 3.0

RP449: 1/14/2010 9:19:10 AM - Software Distribution Service 3.0

RP450: 1/15/2010 10:14:12 AM - System Checkpoint

RP451: 1/16/2010 11:14:10 AM - System Checkpoint

RP452: 1/17/2010 12:14:10 PM - System Checkpoint

RP453: 1/18/2010 1:14:10 PM - System Checkpoint

RP454: 1/19/2010 2:14:10 PM - System Checkpoint

RP455: 2/6/2010 1:49:57 PM - System Checkpoint

RP456: 2/7/2010 3:00:15 AM - Software Distribution Service 3.0

RP457: 2/8/2010 3:21:26 AM - System Checkpoint

RP458: 2/9/2010 4:33:21 AM - System Checkpoint

RP459: 2/10/2010 3:00:17 AM - Software Distribution Service 3.0

RP460: 2/11/2010 3:24:18 AM - System Checkpoint

RP461: 2/12/2010 4:24:17 AM - System Checkpoint

RP462: 2/17/2010 7:12:19 PM - System Checkpoint

RP463: 2/18/2010 7:58:54 PM - System Checkpoint

RP464: 2/20/2010 6:44:56 PM - System Checkpoint

RP465: 2/21/2010 7:06:34 PM - System Checkpoint

RP466: 2/28/2010 9:17:53 AM - Software Distribution Service 3.0

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 8.1.4

Adobe Shockwave Player

Advanced Analyzer

AIM 6

AIM Toolbar

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Avira AntiVir Personal - Free Antivirus

Bonjour

Critical Update for Windows Media Player 11 (KB959772)

Disney Pirates of the Caribbean Online

Download Updater (AOL LLC)

Google Desktop

Google Toolbar for Internet Explorer

Google Update Helper

Hotfix for Windows Internet Explorer 7 (KB947864)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Intel® Extreme Graphics 2 Driver

Intel® PRO Network Adapters and Drivers

iTunes

J2SE Runtime Environment 5.0 Update 11

Java 6 Update 15

LiveUpdate 3.2 (Symantec Corporation)

LiveUpdate Notice (Symantec Corporation)

Malwarebytes' Anti-Malware

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office 2000 Premium

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft VC9 runtime libraries

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Mozilla Firefox (3.5.7)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

PDFCreator

QuickTime

Seagate Manager Installer

Security Update for Windows Internet Explorer 7 (KB929969)

Security Update for Windows Internet Explorer 7 (KB931768)

Security Update for Windows Internet Explorer 7 (KB933566)

Security Update for Windows Internet Explorer 7 (KB937143)

Security Update for Windows Internet Explorer 7 (KB938127)

Security Update for Windows Internet Explorer 7 (KB939653)

Security Update for Windows Internet Explorer 7 (KB942615)

Security Update for Windows Internet Explorer 7 (KB944533)

Security Update for Windows Internet Explorer 7 (KB961260)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Internet Explorer 8 (KB969897)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows Media Player 9 (KB917734)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978706)

SoundMAX

SUPERAntiSpyware Free Edition

UnInstall Envy24 Family Audio Device Driver

Uninstall MobWars Bot

Update for Windows Internet Explorer 8 (KB968220)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Verizon FiOS Activation

Verizon Help and Support Tool

Verizon Yahoo! Applications

Viewpoint Media Player

Vz In Home Agent

WebFldrs XP

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 7

Windows Internet Explorer 8

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

Yahoo! Browser Services

Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

2/28/2010 12:15:45 PM, error: Service Control Manager [7023] - The Network Security service terminated with the following error: The system cannot find the file specified.

2/28/2010 12:15:44 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'wisahiri.dll' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.

2/28/2010 11:25:37 AM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.

2/28/2010 10:58:15 AM, information: Windows File Protection [64001] - File replacement was attempted on the protected system file rundll32.exe. This file was restored to the original version to maintain system stability. The file version of the bad file is 4.2.2700.5512, the version of the system file is 5.1.2600.5512.

2/28/2010 10:57:20 AM, error: Service Control Manager [7023] - The SSHNAS service terminated with the following error: Invalid access to memory location.

2/28/2010 10:57:20 AM, error: Service Control Manager [7000] - The Automatic LiveUpdate Scheduler service failed to start due to the following error: The system cannot find the file specified.

2/28/2010 10:44:23 AM, error: Service Control Manager [7034] - The LiveUpdate Notice Service service terminated unexpectedly. It has done this 1 time(s).

2/28/2010 10:41:42 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file atmarpc.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.

2/28/2010 10:41:35 AM, error: Service Control Manager [7000] - The RAS Asynchronous Media Driver service failed to start due to the following error: The system cannot find the file specified.

2/28/2010 10:41:31 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file asyncmac.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.5512.

2/28/2010 10:41:23 AM, error: Service Control Manager [7000] - The Microsoft Kernel Acoustic Echo Canceller service failed to start due to the following error: The system cannot find the file specified.

2/28/2010 10:41:00 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file aec.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2601.3142.

2/28/2010 10:41:00 AM, information: Windows File Protection [64001] - File replacement was attempted on the protected system file ctfmon.exe. This file was restored to the original version to maintain system stability. The file version of the bad file is 4.2.2700.5512, the version of the system file is 5.1.2600.5512.

==== End Of File ===========================

Maurice Naggar · February 28, 2010

Please only use the at bottom of forum window when starting a reply. Do not use quote box replies. Unless you do a very limited quote.

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not jpaulr and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

ALSO, do NOT surf the web. Only go to sites I guide you to and this forum.

Step 1

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

Double-click FixPolicies.exe.
Click the "Install" button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
A black box will briefly appear and then close.
This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.

Step 2

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 3

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 4

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Please double-click OTL.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy all the lines in between the **** stars lines **** below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
*****************************************************************
:files
c:\windows\system32\litinika.dll
c:\windows\system32\wisahiri.dll
c:\windows\system32\pegojehe.dll
c:\windows\system32\app_dll.dll
c:\windows\_VOIDrtfjwibceg
c:\documents and settings\paul1\rundll32.exe
c:\windows\system32\sshnas21.dll
c:\windows\system32\mlfcache.dat
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"risakubiza"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mitomapuw"=-
:Commands
[purity]
[emptytemp]
[CREATERESTOREPOINT]
*****************************************************************
Return to OTL. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
Close any browser(s) windows that may be open.
Using your mouse, click on the red-lettered button Run Fix.
Once you see a message box "Fix complete! Click OK to open the fix log."
Click the OK button
The log will open in Notepad (your default text editor).
Save the log. Post a copy of that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.

If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Step 5

Repeat the steps to disable your real-time AV monitors.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1

Link 2

Link 3

* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop

If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

-------------------------------------------------------

A caution - Do not run Combofix more than once.

Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.

If this occurs, please reboot to restore the desktop.

RE-Enable your AntiVirus and AntiSpyware applications.

Reply with copy of the OTL MovedFiles log and

C:\Combofix.txt

jpaulr · February 28, 2010

I am unable to click on OTL.exe or the icon in your post. I tried it on another machine and it doesn't seem to be executable. I am running on XP.

Maurice Naggar · February 28, 2010

Sorry, I forgot to guide you to get OTL. Download it and save to your Desktop.

Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.exe

Then follow the steps I outlined, in the order that I had listed.

jpaulr · February 28, 2010

OLT log (had to reboot a 2nd time b/c the desktop would not come up.)

All processes killed

========== FILES ==========

File\Folder c:\windows\system32\litinika.dll not found.

File\Folder c:\windows\system32\wisahiri.dll not found.

c:\windows\system32\pegojehe.dll moved successfully.

c:\windows\system32\app_dll.dll moved successfully.

c:\windows\_VOIDrtfjwibceg folder moved successfully.

c:\documents and settings\paul1\rundll32.exe moved successfully.

c:\windows\system32\sshnas21.dll moved successfully.

c:\windows\system32\mlfcache.dat moved successfully.

C:\RECYCLER\S-1-5-21-448539723-616249376-725345543-1005 folder moved successfully.

C:\RECYCLER\S-1-5-21-448539723-616249376-725345543-1004 folder moved successfully.

C:\RECYCLER\S-1-5-18 folder moved successfully.

C:\RECYCLER folder moved successfully.

File\Folder D:\recycler not found.

File\Folder e:\recycler not found.

File\Folder f:\recycler not found.

File\Folder g:\recycler not found.

File\Folder h:\recycler not found.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\risakubiza deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\mitomapuw deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: #1Mom

->Temp folder emptied: 22020876 bytes

->Temporary Internet Files folder emptied: 53711027 bytes

->Java cache emptied: 31545568 bytes

->FireFox cache emptied: 40804577 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 10125536 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 73609168 bytes

User: Paul1

->Temp folder emptied: 744463194 bytes

->Temporary Internet Files folder emptied: 143805308 bytes

->Java cache emptied: 69421157 bytes

->FireFox cache emptied: 36907671 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2162283 bytes

%systemroot%\System32 .tmp files removed: 10156049 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 5354278 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 89156 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,187.00 mb

Restore point Set: OTL Restore Point (64424509440)

OTL by OldTimer - Version 3.1.30.3 log created on 02282010_171047

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Combo Fix Log

ComboFix 10-02-27.04 - Paul1 02/28/2010 17:31:56.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.93 [GMT -5:00]

Running from: c:\documents and settings\Paul1\Desktop\Combo-Fix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Paul1\Local Settings\Application Data\av.exe

c:\documents and settings\Paul1\rundll32 .exe

c:\documents and settings\Paul1\rundll32.exe

c:\program files\Internet Explorer\js.mui

c:\program files\Internet Explorer\wmpscfgs.exe

c:\windows\system32\certstore.dat

c:\windows\system32\ctfmon .exe

c:\windows\system32\hkcmd .exe

c:\windows\system32\igfxpers .exe

c:\windows\system32\igfxtray .exe

c:\windows\system32\perowimi.dll

c:\windows\system32\rundll32 .exe

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Legacy_SSHNAS

-------\Legacy__VOIDrtfjwibceg

-------\Service__VOIDrtfjwibceg

-------\Service_6to4

-------\Service_SSHNAS

((((((((((((((((((((((((( Files Created from 2010-01-28 to 2010-02-28 )))))))))))))))))))))))))))))))

.

2010-02-28 22:10 . 2010-02-28 22:10 -------- d-----w- C:\_OTL

2010-02-28 21:53 . 2010-02-28 21:53 -------- d-----w- c:\program files\ERUNT

2010-02-28 18:33 . 2010-02-28 18:33 -------- d-----w- c:\documents and settings\Paul1\Local Settings\Application Data\Temp

2010-02-28 17:14 . 2010-02-28 17:14 4 ----a-w- c:\program files\2996031.dat

2010-02-28 16:33 . 2010-02-28 16:33 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2010-02-28 16:28 . 2010-02-28 16:28 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2010-02-28 15:59 . 2010-02-28 15:59 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2010-02-28 15:58 . 2010-02-28 15:58 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2010-02-28 15:58 . 2010-02-28 15:58 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!

2010-02-28 15:58 . 2010-02-28 15:58 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\AIM Toolbar

2010-02-28 15:58 . 2010-02-28 17:18 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Google

2010-02-28 15:55 . 2010-02-28 15:55 4 ----a-w- c:\program files\746640.dat

2010-02-20 23:26 . 2010-02-20 23:26 -------- d-----w- c:\program files\iPod

2010-02-20 23:26 . 2010-02-28 22:40 -------- d-----w- c:\program files\iTunes

1601-01-01 00:00 . 1601-01-01 00:00 0 ----a-w- c:\program files\106250.dat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-02-28 22:40 . 2010-01-20 11:33 -------- d-----w- c:\program files\QuickTime

2010-02-28 22:40 . 2009-09-06 00:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-28 22:40 . 2009-07-04 20:43 -------- d-----w- c:\program files\Verizon

2010-02-28 22:40 . 2009-05-02 00:13 -------- d-----w- c:\program files\Audio Deck

2010-02-28 22:40 . 2005-09-20 13:36 55808 ----a-w- c:\windows\system32\igfxpers.exe

2010-02-28 22:40 . 2007-05-15 15:08 55808 ----a-w- c:\windows\system32\hkcmd.exe

2010-02-28 22:40 . 2007-05-15 15:08 55808 ----a-w- c:\windows\system32\igfxtray.exe

2010-02-28 22:23 . 2005-09-20 13:36 55808 ----a-w- c:\windows\system32\igfxpers .exe

2010-02-28 22:23 . 2007-05-15 15:08 55808 ----a-w- c:\windows\system32\hkcmd .exe

2010-02-28 22:23 . 2007-05-15 15:08 55808 ----a-w- c:\windows\system32\igfxtray .exe

2010-02-28 22:23 . 2009-09-05 22:34 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-02-28 22:23 . 2009-06-19 22:47 -------- d-----w- c:\program files\AIM6

2010-02-28 17:44 . 2007-09-22 23:15 -------- d-----w- c:\documents and settings\Paul1\Application Data\U3

2010-02-28 16:28 . 2007-06-02 14:33 -------- d-----w- c:\program files\Google

2010-02-20 23:26 . 2007-10-28 23:32 -------- d-----w- c:\program files\Common Files\Apple

2010-02-20 23:19 . 2010-02-20 23:19 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe

2010-01-12 20:25 . 2010-01-14 23:07 52224 ----a-w- c:\documents and settings\Paul1\Application Data\Mozilla\Firefox\Profiles\3x29nyyw.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

2010-01-12 20:25 . 2010-01-14 23:07 101376 ----a-w- c:\documents and settings\Paul1\Application Data\Mozilla\Firefox\Profiles\3x29nyyw.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

2010-01-07 21:07 . 2009-09-06 00:51 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 21:07 . 2009-09-06 00:51 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-31 16:50 . 2004-08-04 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-25 03:09 . 2009-12-25 03:09 79488 ----a-w- c:\documents and settings\Paul1\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-23 13:43 . 2009-05-16 10:30 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-12-21 19:14 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-16 18:43 . 2007-05-15 14:31 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08 . 2004-08-04 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:26 . 2004-08-04 12:00 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43 . 2004-08-03 22:59 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-04 18:22 . 2004-08-04 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-07 15:01 . 2010-02-07 15:01 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

<pre>
c:\program files\Adobe\Reader 8.0\Reader\reader_sl .exe
c:\program files\AIM6\aim6 .exe
c:\program files\Analog Devices\Core\smax4pnp .exe
c:\program files\Audio Deck\enmixcpl .exe
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\pifsvc .exe
c:\program files\Google\Google Desktop Search\googledesktop .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier  .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\Malwarebytes' Anti-Malware\mbam .exe
c:\program files\QuickTime\qttask			 .exe
c:\program files\QuickTime\qttask			.exe
c:\program files\QuickTime\qttask		   .exe
c:\program files\QuickTime\qttask		  .exe
c:\program files\QuickTime\qttask		 .exe
c:\program files\QuickTime\qttask		.exe
c:\program files\QuickTime\qttask	   .exe
c:\program files\QuickTime\qttask	  .exe
c:\program files\QuickTime\qttask	 .exe
c:\program files\QuickTime\qttask	.exe
c:\program files\QuickTime\qttask   .exe
c:\program files\QuickTime\qttask  .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr .exe
c:\program files\SUPERAntiSpyware\superantispyware .exe
c:\program files\Verizon\mccitrayapp .exe
c:\program files\Yahoo!\Messenger\yahoom~1 .exe
c:\windows\system32\hkcmd .exe
c:\windows\system32\igfxpers .exe
c:\windows\system32\igfxtray .exe
c:\windows\system32\rundll32 .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\google\googletoolbarnotifier\googletoolbarnotifier .exe" [2010-02-28 55808]

"Aim6"="c:\program files\AIM6\aim6.exe" [2010-02-28 55808]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-02-28 55808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\quicktime\qttask .exe -atboottime" [X]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2010-02-28 55808]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2010-02-28 55808]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2010-02-28 55808]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2010-02-28 55808]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-02-28 55808]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2010-02-28 55808]

"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2010-02-28 55808]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-02-28 55808]

"EnvyHFCPL"="c:\program files\Audio Deck\EnMixCPL.exe" [2010-02-28 55808]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-02-28 55808]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-28 55808]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-02-28 55808]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-28 55808]

"mitomapuw"="c:\windows\system32\pegojehe.dll" [N/A]

"risakubiza"="litinika.dll" [N/A]

c:\documents and settings\Paul1\Start Menu\Programs\Startup\

ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/4/2009 1:50 PM 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 1:49 PM 74480]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/16/2009 5:30 AM 108289]

R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [10/28/2008 3:42 PM 156968]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/19/2009 5:48 PM 24652]

R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;c:\windows\system32\drivers\Envy24HF.sys [11/30/2007 9:18 PM 577664]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/4/2009 1:50 PM 7408]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2010 11:28 AM 135664]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\googledesktop.exe [10/2/2007 6:39 AM 55808]

S3 membus;membus;c:\windows\system32\membus.sys [8/4/2004 7:00 AM 2304]

.

Contents of the 'Scheduled Tasks' folder

2010-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2010-02-28 c:\windows\Tasks\At1.job