MalwareBytes won't install, error running Defogger, GMER crashes

david888m · March 17, 2010

HISTORY

i had to connect my 2 hard disks to another motherboard because the previous one stopped recognizing hard disks

i had trouble installing win 2k

alvira rescue boot cd found a boot virus, but could not delete it

i ran many rescue cd's afterward

could install windows 2K despite reformatting the hard disk

finally deleted partitions, reconstructed the MBR, fdisk, and recreated partitions before i could install win2K

tried to install malwarebytes, but got installation error code 318

posted error on on this board and advised to post extensive test results here

TEST RESULTS

couldn't install malwarebytes

didn't run alvira antivir personal because installation requires sp4 and rollup update 1

my sp4 has always run from cd, but now demands huge download, repeated interruptions in download process until internet access stopped, had to reboot to get internet access again repeatedly

error running Defogger:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 23:40 on 16/03/2010 (Administrator)

Checking for autostart values...

Unable to open HKCU\~\Run key (2)

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

DDS (Ver_09-12-01.01) - FAT32x86

Run by Administrator at 23:45:32.64 on Tue 03/16/2010

Internet Explorer: 5.00.2920.0000

Microsoft Windows 2000 Professional 5.0.2195.0.1252.1.1033.18.511.442 [GMT -8:00]

============== Running Processes ===============

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\Explorer.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.msn.com

mDefault_Page_URL = hxxp://www.msn.com

mRun: [synchronization Manager] mobsync.exe /logon

dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop

IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm

DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab

============= SERVICES / DRIVERS ===============

R2 ousbehci;NEC PCI to USB Enhanced Host Controller;c:\winnt\system32\drivers\ousbehci.sys [2010-3-16 41600]

R3 An986n;USB to 10/100M Ethernet Adapter;c:\winnt\system32\drivers\An986n.sys [2010-3-16 28968]

R3 openhci;Microsoft USB Open Host Controller Driver;c:\winnt\system32\drivers\openhci.sys [1999-12-6 24688]

R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\winnt\system32\drivers\ousb2hub.sys [2010-3-16 55552]

R3 UF100;HAWKING UF100 USB 10/100 Network Adapter;c:\winnt\system32\drivers\UF100.sys [2010-3-16 26238]

R3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [2010-3-16 49392]

=============== Created Last 30 ================

2010-03-17 07:43:11 16384 ----a-w- c:\winnt\system32\Perflib_Perfdata_210.dat

2010-03-17 07:39:07 0 ----a-w- c:\documents and settings\administrator\defogger_reenable

2010-03-17 06:03:26 49392 ----a-w- c:\winnt\system32\drivers\usbhub20.sys

2010-03-17 06:03:26 0 d-----w- c:\winnt\USB2

2010-03-17 06:03:24 6912 ----a-w- c:\winnt\system32\drivers\vulfnth.sys

2010-03-17 06:03:24 45056 ----a-w- c:\winnt\system32\vusetup.dll

2010-03-17 06:03:24 10496 ----a-w- c:\winnt\system32\drivers\vulfntr.sys

2010-03-17 06:03:20 0 d-----w- c:\program files\VIA Technologies, Inc

2010-03-17 06:02:35 6416 ----a-w- c:\winnt\system32\hccoin.dll

2010-03-17 06:02:35 306688 ----a-w- c:\winnt\IsUninst.exe

2010-03-17 06:02:35 19216 ----a-w- c:\winnt\system32\drivers\usbehci.sys

2010-03-17 06:02:35 135920 ----a-w- c:\winnt\system32\drivers\usbport.sys

2010-03-17 05:43:46 0 d-----r- C:\MYDOCS

2010-03-17 03:35:47 0 d-----w- c:\documents and settings\administrator\DoctorWeb

2010-03-17 03:04:44 0 d-sh--w- C:\Recycled

2010-03-17 00:49:07 55552 ----a-r- c:\winnt\system32\drivers\ousb2hub.sys

2010-03-17 00:49:07 41600 ----a-r- c:\winnt\system32\drivers\ousbehci.sys

2010-03-17 00:45:07 0 d-----w- c:\program files\WindowsUpdate

2010-03-16 23:28:34 8192 ----a-w- c:\winnt\REGLOCS.OLD

2010-03-16 23:15:17 28968 ----a-r- c:\winnt\system32\drivers\An986n.sys

2010-03-16 22:43:40 19760 ----a-w- c:\winnt\system32\dllcache\usbstor.sys

2010-03-16 22:41:50 32144 ----a-w- c:\winnt\system32\drivers\uhcd.sys

2010-03-16 22:41:50 32144 ----a-w- c:\winnt\system32\dllcache\uhcd.sys

2010-03-16 22:28:49 464014 ---h--w- c:\winnt\ShellIconCache

2010-03-16 22:25:16 26238 ----a-w- c:\winnt\system32\drivers\UF100.sys

2010-03-16 22:23:46 0 d-----w- C:\UNINST

2010-03-16 22:19:59 0 d-----r- C:\UTIL

2010-03-16 22:19:06 0 d-----r- C:\BAT

2010-03-16 21:13:31 0 d-sh--w- c:\documents and settings\all users\DRM

2010-03-16 21:10:26 0 d-----w- c:\program files\Accessories

2010-03-16 21:10:24 0 d-----w- c:\program files\Windows NT

2010-03-16 20:58:45 0 d-----w- c:\program files\common files\ODBC

2010-03-16 20:58:32 0 d-----w- c:\documents and settings\all users\Documents

==================== Find3M ====================

2010-03-16 21:13:20 271 ---h--w- c:\program files\desktop.ini

2010-03-16 21:13:20 21952 ---h--w- c:\program files\folder.htt

2010-03-16 21:12:22 15012 ----a-w- c:\winnt\system32\emptyregdb.dat

1999-12-07 05:00:00 32528 ----a-w- c:\winnt\inf\wbfirdma.sys

============= FINISH: 23:45:38.43 ===============

running GMER gives error message: C:\WINNT\system32\config\system: The process cannot access the file because it is being used by another process. OK?

after I hit scan, get Blue Screen of Death, error message at top of screen ***STOP: 0x00000044 <0x91B9D308, 0x00000CCA, 0x00000000, 0x00000000>

MULTIPLE_IRP_COMPLETE_REQUESTS

reboots by itself,

Attach.zip

david888m · March 17, 2010

CORRECTION:

could not install windows 2K despite reformatting the hard disk

HISTORY
i had to connect my 2 hard disks to another motherboard because the previous one stopped recognizing hard disks
i had trouble installing win 2k
alvira rescue boot cd found a boot virus, but could not delete it
i ran many rescue cd's afterward
could install windows 2K despite reformatting the hard disk
finally deleted partitions, reconstructed the MBR, fdisk, and recreated partitions before i could install win2K
tried to install malwarebytes, but got installation error code 318
posted error on on this board and advised to post extensive test results here
TEST RESULTS
couldn't install malwarebytes
didn't run alvira antivir personal because installation requires sp4 and rollup update 1
my sp4 has always run from cd, but now demands huge download, repeated interruptions in download process until internet access stopped, had to reboot to get internet access again repeatedly
error running Defogger:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:40 on 16/03/2010 (Administrator)
Checking for autostart values...
Unable to open HKCU\~\Run key (2)
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
DDS (Ver_09-12-01.01) - FAT32x86
Run by Administrator at 23:45:32.64 on Tue 03/16/2010
Internet Explorer: 5.00.2920.0000
Microsoft Windows 2000 Professional 5.0.2195.0.1252.1.1033.18.511.442 [GMT -8:00]
============== Running Processes ===============
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.msn.com
mDefault_Page_URL = hxxp://www.msn.com
mRun: [synchronization Manager] mobsync.exe /logon
dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab
============= SERVICES / DRIVERS ===============
R2 ousbehci;NEC PCI to USB Enhanced Host Controller;c:\winnt\system32\drivers\ousbehci.sys [2010-3-16 41600]
R3 An986n;USB to 10/100M Ethernet Adapter;c:\winnt\system32\drivers\An986n.sys [2010-3-16 28968]
R3 openhci;Microsoft USB Open Host Controller Driver;c:\winnt\system32\drivers\openhci.sys [1999-12-6 24688]
R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\winnt\system32\drivers\ousb2hub.sys [2010-3-16 55552]
R3 UF100;HAWKING UF100 USB 10/100 Network Adapter;c:\winnt\system32\drivers\UF100.sys [2010-3-16 26238]
R3 usbhub20;USB 2.0 Root Hub Support;c:\winnt\system32\drivers\usbhub20.sys [2010-3-16 49392]
=============== Created Last 30 ================
2010-03-17 07:43:11 16384 ----a-w- c:\winnt\system32\Perflib_Perfdata_210.dat
2010-03-17 07:39:07 0 ----a-w- c:\documents and settings\administrator\defogger_reenable
2010-03-17 06:03:26 49392 ----a-w- c:\winnt\system32\drivers\usbhub20.sys
2010-03-17 06:03:26 0 d-----w- c:\winnt\USB2
2010-03-17 06:03:24 6912 ----a-w- c:\winnt\system32\drivers\vulfnth.sys
2010-03-17 06:03:24 45056 ----a-w- c:\winnt\system32\vusetup.dll
2010-03-17 06:03:24 10496 ----a-w- c:\winnt\system32\drivers\vulfntr.sys
2010-03-17 06:03:20 0 d-----w- c:\program files\VIA Technologies, Inc
2010-03-17 06:02:35 6416 ----a-w- c:\winnt\system32\hccoin.dll
2010-03-17 06:02:35 306688 ----a-w- c:\winnt\IsUninst.exe
2010-03-17 06:02:35 19216 ----a-w- c:\winnt\system32\drivers\usbehci.sys
2010-03-17 06:02:35 135920 ----a-w- c:\winnt\system32\drivers\usbport.sys
2010-03-17 05:43:46 0 d-----r- C:\MYDOCS
2010-03-17 03:35:47 0 d-----w- c:\documents and settings\administrator\DoctorWeb
2010-03-17 03:04:44 0 d-sh--w- C:\Recycled
2010-03-17 00:49:07 55552 ----a-r- c:\winnt\system32\drivers\ousb2hub.sys
2010-03-17 00:49:07 41600 ----a-r- c:\winnt\system32\drivers\ousbehci.sys
2010-03-17 00:45:07 0 d-----w- c:\program files\WindowsUpdate
2010-03-16 23:28:34 8192 ----a-w- c:\winnt\REGLOCS.OLD
2010-03-16 23:15:17 28968 ----a-r- c:\winnt\system32\drivers\An986n.sys
2010-03-16 22:43:40 19760 ----a-w- c:\winnt\system32\dllcache\usbstor.sys
2010-03-16 22:41:50 32144 ----a-w- c:\winnt\system32\drivers\uhcd.sys
2010-03-16 22:41:50 32144 ----a-w- c:\winnt\system32\dllcache\uhcd.sys
2010-03-16 22:28:49 464014 ---h--w- c:\winnt\ShellIconCache
2010-03-16 22:25:16 26238 ----a-w- c:\winnt\system32\drivers\UF100.sys
2010-03-16 22:23:46 0 d-----w- C:\UNINST
2010-03-16 22:19:59 0 d-----r- C:\UTIL
2010-03-16 22:19:06 0 d-----r- C:\BAT
2010-03-16 21:13:31 0 d-sh--w- c:\documents and settings\all users\DRM
2010-03-16 21:10:26 0 d-----w- c:\program files\Accessories
2010-03-16 21:10:24 0 d-----w- c:\program files\Windows NT
2010-03-16 20:58:45 0 d-----w- c:\program files\common files\ODBC
2010-03-16 20:58:32 0 d-----w- c:\documents and settings\all users\Documents
==================== Find3M ====================
2010-03-16 21:13:20 271 ---h--w- c:\program files\desktop.ini
2010-03-16 21:13:20 21952 ---h--w- c:\program files\folder.htt
2010-03-16 21:12:22 15012 ----a-w- c:\winnt\system32\emptyregdb.dat
1999-12-07 05:00:00 32528 ----a-w- c:\winnt\inf\wbfirdma.sys
============= FINISH: 23:45:38.43 ===============
running GMER gives error message: C:\WINNT\system32\config\system: The process cannot access the file because it is being used by another process. OK?
after I hit scan, get Blue Screen of Death, error message at top of screen ***STOP: 0x00000044 <0x91B9D308, 0x00000CCA, 0x00000000, 0x00000000>
MULTIPLE_IRP_COMPLETE_REQUESTS
reboots by itself,

david888m · March 17, 2010

additional info:

1. error message on attempted installation:

"Error code: 718 (-2146893799, 0)

The keyset is not defined

2. Last weekend, I did scan with Alvira Rescue CD. The only thing it found was a boot virus, but could not remove it. After other procedures, Alvira Rescue CD could not find any malware. However, I was unable to install win 2k as stated earlier.

screen317 · March 20, 2010

How did you get a DDS log if you can't install Windows?

You said you have two hard drives. Have you tried installing Win2k on the other hard drive?

david888m · March 21, 2010

How did you get a DDS log if you can't install Windows?
You said you have two hard drives. Have you tried installing Win2k on the other hard drive?

ANSWERED IN PREVIOUS POST:

(david888m @ Mar 17 2010, 01:53 AM)

"could not install windows 2K despite reformatting the hard disk

finally deleted partitions, reconstructed the MBR, fdisk, and recreated partitions before i could install win2K"

screen317 · March 22, 2010

Missed that, sorry. You kept saying"However, I was unable to install win 2k as stated earlier" so it was a bit confusing. Pressing onward:

Specifically, could you describe the issues you are currently experiencing?

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply along with a fresh HijackThis log.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

-screen317

david888m · March 23, 2010

Specifically, could you describe the issues you are currently experiencing?
[*]Copy and Paste the entire report in your next reply along with a fresh HijackThis log.

BRIEF BACKGROUND

Antivir rescue CD and Malwarebytes detected a boot virus about 2 weeks ago, but nothing else I tried detected anything. Since then, problems continue even though no antimalware solution is able to detect anything. Disabling network access is a primary activity of this virus. It also deletes and corrupts various device drivers or files associated with their functioning, interferes with OS repair and installation, sometimes interferes with antimalware installation, and occasionally hides the d: hard disk. My lans on 4 computers show a red X, saying that "A network cable is unplugged." A total of 7 nics on 4 computers have been affected. I previously got DSL access back for about 24 hours by fdisk/format and by System Restore. I am able to get dialup access back by installing a new OS.

CURRENT ISSUES

After flashing the bios, cleaning the mbr by fdisk /mbr and fdisk/mbr, formatting the whole hard disk, and reinstalling XP on one of the computers, I'm unable to get dsl internet access back. When I tried to format, it aborted twice at 27% with the message "not ready" before it went through all the way. One lan shows a red X, saying that "A network cable is unplugged." Another nic that installed many times before keep getting installation errors. A third nic that installed many times before cannot be detected. Also, I'm not getting audio. Compared to previous fdisking and formatting that brought back dsl for about 24 hours on this same computer, I have a flash drive with some backup data plugged in. Could that be the reason?

LOGS

Malwarebytes' Anti-Malware 1.44

Database version: 3902

Windows 5.1.2600 Service Pack 1

Internet Explorer 6.0.2800.1106

3/23/2010 2:17:12 AM

mbam-log-2010-03-23 (02-17-12).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 114758

Time elapsed: 12 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_09-12-01.01) - FAT32x86

Run by XPUser at 9:40:30.15 on Tue 03/23/2010

Internet Explorer: 6.0.2800.1106

Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.511.361 [GMT -8:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\wpabaln.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Documents and Settings\XPUser\My Documents\Downloads\qby679ys.exe

C:\DOCUME~1\XPUser\LOCALS~1\Temp\RarSFX2\78tr28.exe

C:\DOCUME~1\XPUser\LOCALS~1\Temp\RarSFX2\k6mdsXP.exe

C:\Documents and Settings\XPUser\Desktop\TEMP\dds.scr

============== Pseudo HJT Report ===============

EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\xpuser\applic~1\mozilla\firefox\profiles\u8ap84wl.default\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [2010-3-22 22360]

R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [2010-3-22 45416]

S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2010-3-22 20160]

S3 UF100;HAWKING UF100 USB 10/100 Network Adapter;c:\windows\system32\drivers\UF100.sys [2010-3-22 26238]

=============== Created Last 30 ================

2010-03-23 17:38:34 0 ----a-w- c:\documents and settings\xpuser\defogger_reenable

2010-03-23 15:47:31 0 d-----w- c:\documents and settings\xpuser\DoctorWeb

2010-03-23 07:17:32 0 d-----w- c:\docume~1\xpuser\applic~1\Malwarebytes

2010-03-23 07:17:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-23 07:17:19 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-03-23 07:17:18 18520 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-23 07:17:17 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-03-23 06:18:52 0 d-sh--w- C:\FOUND.001

2010-03-23 06:16:43 0 d-----w- c:\program files\Avira

2010-03-23 06:16:43 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-03-23 05:24:38 0 d-sh--w- c:\documents and settings\all users\DRM

2010-03-23 05:22:49 0 d-----w- c:\program files\common files\MSSoap

2010-03-23 05:20:13 0 d--h--w- c:\program files\WindowsUpdate

2010-03-23 05:20:13 0 d-----w- c:\program files\Online Services

2010-03-23 05:19:51 0 d-----w- c:\program files\Messenger

2010-03-23 05:19:46 0 d-----w- c:\program files\MSN Gaming Zone

2010-03-23 05:19:05 0 d-----w- c:\program files\Windows NT

2010-03-23 04:37:57 0 d-----w- c:\program files\common files\ODBC

2010-03-23 04:37:52 0 d-----w- c:\program files\common files\SpeechEngines

2010-03-23 04:37:20 0 d-----r- c:\documents and settings\all users\Documents

==================== Find3M ====================

2010-03-23 05:21:34 21640 ----a-w- c:\windows\system32\emptyregdb.dat

============= FINISH: 9:43:29.32 ===============

Thank you.

DDS.txt

ark.txt

david888m · March 24, 2010

Can I repair XP SP3 with SP1 CD and follow up with SP3 update? Alternatively, would I have to combine XP SP1 with SP3 update by a "slipstreaming process"? Has anybody done slipstreaming?

I'm thinking of editing track 0 (location of the possible virus and displaced mbr) and repairing with XP's fixboot and fixmbr

david888m · March 25, 2010

Can I repair XP SP3 with SP1 CD and follow up with SP3 update? Alternatively, would I have to combine XP SP1 with SP3 update by a "slipstreaming process"? Has anybody done slipstreaming?
I'm thinking of editing track 0 (location of the possible virus and displaced mbr) and repairing with XP's fixboot and fixmbr

I'm thinking that the virus could have displaced the mbr. I read about a virus that moved the mbr to sector 7 of track 0 and redirected examination of itself to the mbr.

screen317 · March 27, 2010

Hi,

Do you know what this file is:

C:\Documents and Settings\XPUser\My Documents\Downloads\qby679ys.exe

Please go to VirusTotal, and upload the following file for analysis:

C:\Documents and Settings\XPUser\My Documents\Downloads\qby679ys.exe

Post the results in your reply.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

After you post that log, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

david888m · March 30, 2010

Hi,
Do you know what this file is:
C:\Documents and Settings\XPUser\My Documents\Downloads\qby679ys.exe
Please go to VirusTotal, and upload the following file for analysis:
C:\Documents and Settings\XPUser\My Documents\Downloads\qby679ys.exe
Post the results in your reply.
Next, download DDS by sUBs and save it to your Desktop.
Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.
After you post that log, please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.
-screen317

"C:\Documents and Settings\XPUser\My Documents\Downloads\qby679ys.exe:

The above file is Dr. Web Cureit's scanner file. I already deleted it earlier.

DDS (Ver_10-03-17.01) - FAT32x86

Run by Administrator at 0:19:03.78 on Mon 04/05/2010

Internet Explorer: 6.0.2600.0000

Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.254.91 [GMT -4:00]

============== Running Processes ===============

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\Explorer.EXE

C:\Program Files\Canon\MyPrinter\BJMyPrt.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINNT\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\MYDOCS\Downloads\dds.scr

============== Pseudo HJT Report ===============

EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll

mRun: [synchronization Manager] mobsync.exe /logon

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4.0\OpwareSE4.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

dRunOnce: [^SetupICWDesktop] c:\program files\internet explorer\connection wizard\icwconn1.exe /desktop

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm

DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: junomsg - {C4D10830-379D-11d4-9B2D-00C04F1579A5} - c:\program files\juno\bin\jmsgpph.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\ort6yxoa.default\

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll