mutated vma.exe preventing mbam install

dtk3v91 · April 30, 2010

I had vma.exe virus infected on a company laptop running XP SP3. I tried modifying the registry and deleting the vma.exe files but I am still unable to run the mbam installers.

Here is the DDS text:

DDS (Ver_10-03-17.01) - NTFSx86

Run by homeuser at 0:50:28.24 on Fri 04/30/2010

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.360 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\System32\Novell\XTAgent.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

svchost.exe

C:\WINDOWS\System32\svchost.exe -k eapsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\System32\wltrysvc.exe

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Novell\ZENworks\nalntsrv.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe

C:\Program Files\Symantec AntiVirus\SavRoam.exe

C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Novell\ZENworks\wm.exe

C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\dpmw32.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~2\VPTray.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Wireless eSystems\iRespond\BaseService\BaseService.exe

C:\Program Files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\SMART Technologies\SMART Board Drivers\Marker.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\taskmgr.exe

C:\Documents and Settings\homeuser\Desktop\copyover\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.cobbk12.org/

uWindow Title = Windows Internet Explorer provided by Cobb County School District

uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

uInternet Settings,ProxyOverride = <local>

mWinlogon: System=ziswin.exe

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: ALO: {506cd401-5203-4b27-bb5a-03c97758fd02} - c:\windows\system32\lastmon.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: CIEDownload Object: {67bcf957-85fc-4036-8dc4-d4d80e00a77b} - c:\program files\smart technologies\notebook software\NotebookPlugin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll

TB: Veoh Video Compass: {52836eb0-631a-47b1-94a6-61f9d9112dae} - c:\program files\veoh networks\veoh video compass\SearchRecsPlugin.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRunOnce: [<NO NAME>]

mRun: [NDPS] c:\windows\system32\dpmw32.exe

mRun: [NWTRAY] NWTRAY.EXE

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [Dell Wireless Manager UI] c:\windows\system32\WLTRAY

mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

mRun: [sigmatelSysTrayApp] stsystra.exe

mRun: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

mRun: [QuickTime Task] "c:\program files\quicktime\QTTASK.EXE" -atboottime

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [vptray] c:\progra~1\symant~2\VPTray.exe

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"

mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop elements 5.0\apdproxy.exe"

mRun: [ZENRC Tray Icon] c:\windows\system32\zentray.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRunOnce: [<NO NAME>]

dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"

dRunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"

dRunOnce: [<NO NAME>]

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\irespo~1.lnk - c:\windows\installer\{12474163-00c7-46ea-8e6f-285b35b0325e}\IconD3637D1B.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\smartb~1.lnk - c:\program files\smart technologies\smart board drivers\SMARTBoardTools.exe

mPolicies-system: CompatibleRUPSecurity = 1 (0x1)

IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

IE: {C1994287-422F-47aa-8E5E-6323E210A125} - {4B5F7606-8666-4D5A-9780-DB92A9D8812B} - c:\program files\novell\zenworks\AxNalServer.dll

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183630345433

DPF: {65FDEDF3-8ED9-4F5B-825E-18C2D44191A7} - hxxp://d.66.155.171.22.downloads.estara.com./as/OneCCDM.php?template=56012&sessionid=177117519_66.155.171.22_38232&=&req=1212025132695OneCC.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183480607238

DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - file://c:\windows\msxml4.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://www.ritzpix.com/net/Uploader/LPUploader57.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://www.adobe.com/products/acrobat/nos/gp.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe

DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://aolsvc.aol.com/onlinegames/bejeweled2/popcaploader_v10.cab

Notify: aedfffeaefacc - c:\windows\system32\aedfffeaefacc.dll

Notify: AtiExtEvent - Ati2evxx.dll

Notify: igfxcui - igfxdev.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

Notify: NetIdentity Notification - c:\windows\system32\novell\XtNotify.dll

SEH: {b4870b70-f390-11d2-9fb9-f4ed725ea20d} - c:\progra~1\novell\zenworks\NalExpEx.dll

SEH: {763370c4-268e-4308-a60c-d8da0342be32} - c:\program files\novell\zenworks\NalShell.dll

LSA: Authentication Packages = msv1_0 nwv1_0

Hosts: 10.71.1.22 TEALAB1S1

Hosts: 10.1.1.94 CCPSAVS2

Hosts: 10.1.1.18 ADMIN1S1

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\homeuser\applic~1\mozilla\firefox\profiles\h0xvw3cy.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.cobbk12.org/

FF - plugin: c:\documents and settings\homeuser\application data\move networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\veoh networks\veohwebplayer\NPVeohTVPlugin.dll

FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll

FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 deed;deed;c:\windows\system32\deed.sys [2010-4-26 74240]

R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]

R2 BlankScr;HBDevice;c:\windows\system32\drivers\blankscr.sys [2005-5-23 6899]

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-11-21 192104]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-11-21 169576]

R2 cpextender;Check Point SSL Network Extender;c:\program files\checkpoint\ssl network extender\slimsvc.exe [2007-6-10 331870]

R2 Remote Management Agent;Novell ZENworks Remote Management Agent;c:\program files\novell\zenworks\remotemanagement\rmagent\ZenRem32.exe [2006-5-9 167936]

R2 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2007-3-14 116416]

R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2007-3-14 1816768]

R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\novell\xtagent.exe [2007-12-24 61440]

R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [2005-5-23 2773]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-9-8 102448]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100409.039\naveng.sys [2010-4-13 84912]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100409.039\navex15.sys [2010-4-13 1324720]

R3 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]

R3 VNA;Check Point Virtual Network Adapter;c:\windows\system32\drivers\vna.sys [2007-6-10 110160]

S2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys --> c:\windows\system32\drivers\SSPORT.sys [?]

S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2006-1-16 87936]

S3 SMART Web Server;SMART Web Server;c:\program files\smart technologies\smart board drivers\WebServer.exe [2009-7-23 1245184]

=============== Created Last 30 ================

2010-04-30 04:49:11 0 ----a-w- c:\documents and settings\homeuser\defogger_reenable

2010-04-30 03:06:08 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

2010-04-30 03:05:20 0 d-----w- c:\program files\Lavasoft

2010-04-30 02:38:40 46640 ----a-w- c:\windows\system32\msln.exe

2010-04-30 02:37:25 0 d-----w- c:\docume~1\homeuser\applic~1\Malwarebytes

2010-04-30 02:37:20 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-30 02:37:20 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-04-27 00:52:41 0 d-----w- c:\windows\system32\drivers\down

2010-04-26 13:24:53 74240 ----a-w- c:\windows\system32\deed.sys

2010-04-08 18:19:48 0 d-----w- c:\docume~1\alluse~1\applic~1\AIM

2010-04-08 18:19:41 0 d-----w- c:\program files\AIM

2010-04-08 18:19:40 0 d-----w- c:\program files\common files\Software Update Utility

2010-04-08 18:19:38 0 d-----w- c:\program files\common files\AOL

2010-04-08 18:19:22 359 ---ha-w- C:\IPH.PH

==================== Find3M ====================

2010-03-04 17:04:59 126180 ----a-w- c:\windows\fonts\Aquarelle.ttf

2010-03-04 13:03:10 188108 ----a-w- c:\windows\fonts\JFJunRoc.ttf

============= FINISH: 0:51:25.02 ===============

Attach.zip

Maniac · May 1, 2010

Hello dtk3v91! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install any software or hardware, while work on.

Please try this version of malwarebytes: Click the link here

Save it on your desktop. You'll see it will have a random name, and will look similar like this:

Doubleclick on it, so it will extract the files and will start Malwarebytes automatically.

In case the installer (random named file) won't run either, rename it to EXPLORER.EXE and try again.

When Malwarebytes opens, click the "Update" tab FIRST and select to check for updates in order to get the latest

updates.

In case Malwarebytes doesn't open, search for the folder mbam-installer on your desktop, open it and doubleclick

the file winlogon.exe which will be present in there. This should launch Malwarebytes.

Then perform a Quick scan and let it remove what it found. Reboot afterwards (important).

After reboot, post the malwarebytes log.

dtk3v91 · May 2, 2010

Thank you so much for your help. I almost gave up waiting for a reply.

i double-clicked the random installer and it gave the message "the database could not be found. Would you like to download a new copy?" I click yes and it gives the error: "MBAM_ERROR_UPDATING(0,0,SHRegGetPaath)" followed by the error "MBAM_ERROR_LOAD_DATABASE(2,0) The system cannot find the file specified". When i run winlogon.exe it gives the same errors.

Maniac · May 2, 2010

In you archive there no Attach.txt . Please post it in your next reply.

dtk3v91 · May 2, 2010

Sorry about that.

Attach.txt

Maniac · May 2, 2010

Step 1:

Please, uninstall the following applications:

Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.6 - CPSID_49167
Adobe Acrobat 8.1.6 Professional
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader 9

You can read, how to this in:

Step 2:

Please, download exehelper from here save it to your desktop.

1. Run exehelper.

2. Press any key to close a black window which should pop-up.

3. A log named exehelperlog.txt should open.

4. Post the contents of exehelperlog.txt in your next reply.

Step 3:

Your DDS log shows some leftovers from MalwareBytes, so:

Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.

Restart your computer (very important).

Download and run this utility. mbam-clean.exe

It will ask to restart your computer (please allow it to).

After the computer restarts, Temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here

Note: You will need to reactivate the program using the license you were sent

Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.

Restart the computer again and verify that MBAM is in the task tray. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications.

In your next reply, please include these log(s) in this sequence:

MalwareBytes' Anti-Malware log
a new fresh DDS log
exeHelper log

dtk3v91 · May 2, 2010

malware bytes did not show up in the add/remove programs list. mbam-clean.exe failed with the message "SHGetValue failed with error code 0"

I am unable to disable the antivirus because i don't have admin password. When I run mbam-setup-1.46.exe, it asks for the language then disappears without running.

since i could not run mbam i have not included its log. but here are the others:

exeHelper by Raktor

Build 20100414

Run at 16:43:27 on 05/02/10

Now searching...

Checking for numerical processes...

Checking for sysguard processes...

Checking for bad processes...

Checking for bad files...

Checking for bad registry entries...

Resetting filetype association for .exe

Resetting filetype association for .com

Resetting userinit and shell values...

Resetting policies...

--Finished--

Attach_2_.zip

Maniac · May 2, 2010

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

dtk3v91 · May 2, 2010

the link to see script blocking programs is not working. Is there another way to disable symantec antivirus? Is it bad if i run combofix with the antivirus running?

Maniac · May 3, 2010

See here:

http://www.bleepingcomputer.com/forums/topic114351.html

It's working.

dtk3v91 · May 4, 2010

Is there any way to disable symantec antivirus without going through the task bar? That option is disabled for me.

Maniac · May 4, 2010

Open Notepad and copy and paste the text in the code box below into it:

KillAll::

SecCenter::
{FB06448E-52B8-493A-90F3-E43226D3305C}

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

dtk3v91 · May 6, 2010

Sorry it took so long to reply. We have a newborn baby so things take twice as long to get done. Thanks for hanging in there with me.

I ran the CFScript with ComboFix but it did not look like it closed symantec antivirus. I let ComboFix continue anyway and posted the log file below.

ComboFix 10-05-02.01 - homeuser 05/05/2010 22:34:40.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.336 [GMT -4:00]

Running from: c:\documents and settings\homeuser\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\homeuser\Desktop\CFScript.txt

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\12A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\12B.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\12C.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\183.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\184.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\185.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\1BD.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\1BD6.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\1BD7.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\1BD8.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\1BE.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\1BF.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\20C.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\20D.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\20E.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\221.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\222.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\223.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\227.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\228.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\229.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\23.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\24.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\25.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\30F.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\310.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\311.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\318.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\319.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\31A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\325D.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\325E.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\325F.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\3288.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\3289.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\328A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\360.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\361.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\362.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\380.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\381.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\382.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\460.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\461.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\462.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\46A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\46B.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\46C.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\49.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\4A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\4B.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\512.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\513.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\514.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\577.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\578.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\579.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\72E.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\72F.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\730.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\75A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\75B.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\75C.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\764.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\765.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\766.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7A5.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7A6.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7A7.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7B0.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7B1.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7B2.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7E5.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7E6.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7E7.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7F0.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7F1.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\7F2.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\816.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\817.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\818.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\833.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\834.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\835.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\99.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\9A.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\9B.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\9F.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\A0.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\A1.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\DD.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\DE.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\DF.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E0.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E1.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E2.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E3.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E4.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E5.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E6.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E7.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\E8.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\EF.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\F0.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\F1.tmp

c:\documents and settings\homeuser\Local Settings\Temporary Internet Files\SLC_homeuser.prx

c:\program files\Common Files\Real\WeatherBug\MiniBugTransporter.dll

c:\program files\WindowsUpdate

c:\recycler\S-1-5-21-1395694625-3139407411-1062761430-500

c:\recycler\S-1-5-21-1897778993-725919046-3886901626-500

c:\recycler\S-1-5-21-2999562-1970446078-619644213-500

c:\recycler\S-1-5-21-3225737604-2005598268-482527000-500

c:\recycler\S-1-5-21-3619842439-210954378-785416939-1003

c:\recycler\S-1-5-21-3619842439-210954378-785416939-500

c:\recycler\S-1-5-21-3885456966-3634529836-3580987155-500

c:\recycler\S-1-5-21-534741682-960792911-2354410185-1009

c:\recycler\S-1-5-21-534741682-960792911-2354410185-500

c:\recycler\S-1-5-21-842925246-1580818891-854245398-500

c:\windows\Downloaded Program Files\popcaploader.dll

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\system32\aedfffeaefacc.dll

c:\windows\system32\drivers\down

c:\windows\system32\drivers\down\435079010.exe

.

((((((((((((((((((((((((( Files Created from 2010-04-06 to 2010-05-06 )))))))))))))))))))))))))))))))

.

2010-04-30 03:06 . 2010-04-30 03:06 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

2010-04-30 03:05 . 2010-04-30 03:05 -------- d-----w- c:\program files\Lavasoft

2010-04-30 03:05 . 2010-04-30 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-04-30 02:37 . 2010-04-30 02:37 -------- d-----w- c:\documents and settings\homeuser\Application Data\Malwarebytes

2010-04-30 02:37 . 2010-04-30 02:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-30 02:37 . 2010-03-29 21:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-26 13:24 . 2010-04-26 13:24 74240 ----a-w- c:\windows\system32\deed.sys

2010-04-08 18:19 . 2010-04-08 18:19 -------- d-----w- c:\documents and settings\homeuser\Application Data\acccore

2010-04-08 18:19 . 2010-04-08 18:23 -------- d-----w- c:\documents and settings\homeuser\Local Settings\Application Data\AIM

2010-04-08 18:19 . 2010-04-08 18:19 -------- d-----w- c:\documents and settings\homeuser\Local Settings\Application Data\AOL

2010-04-08 18:19 . 2010-04-08 18:19 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM

2010-04-08 18:19 . 2010-04-08 18:19 -------- d-----w- c:\program files\AIM

2010-04-08 18:19 . 2010-04-08 18:19 -------- d-----w- c:\program files\Common Files\Software Update Utility

2010-04-08 18:19 . 2010-04-08 18:19 -------- d-----w- c:\program files\Common Files\AOL

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-06 02:45 . 2008-04-04 13:37 -------- d-----w- c:\program files\Symantec AntiVirus

2010-05-02 20:43 . 2008-02-06 01:42 266816 ----a-w- c:\documents and settings\homeuser\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-04-04 23:57 . 2008-08-23 01:04 -------- d-----w- c:\program files\Microsoft Silverlight

2010-03-01 20:30 . 2010-03-01 20:30 264768 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-05-19 3561720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]

"NDPS"="c:\windows\system32\dpmw32.exe" [2004-05-17 32859]

"NWTRAY"="NWTRAY.EXE" [2002-03-12 28672]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]

"SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 397312]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]

"QuickTime Task"="c:\program files\QUICKTIME\QTTASK.EXE" [2005-12-08 155648]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 52840]

"vptray"="c:\progra~1\SYMANT~2\VPTray.exe" [2007-03-14 125632]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]

"ZENRC Tray Icon"="c:\windows\system32\zentray.exe" [2005-05-18 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]

"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-19 2247]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

iRespond Base Service.lnk - c:\windows\Installer\{12474163-00C7-46EA-8E6F-285B35B0325E}\IconD3637D1B.exe [2010-1-11 6656]

SMART Board Tools.lnk - c:\program files\SMART Technologies\SMART Board Drivers\SMARTBoardTools.exe [2009-7-23 10227712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"CompatibleRUPSecurity"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{763370C4-268E-4308-A60C-D8DA0342BE32}"= "c:\program files\Novell\ZENworks\NalShell.dll" [2008-01-04 458752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NetIdentity Notification]

2007-12-25 03:21 24576 ----a-r- c:\windows\system32\novell\xtnotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\dpmw32.exe"=

"c:\\Novell\\GroupWise\\grpwise.exe"=

"c:\\Novell\\GroupWise\\notify.exe"=

"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\SMART Technologies\\SMART Board Drivers\\UCGui.exe"=

"c:\\Program Files\\SMART Technologies\\SMART Board Drivers\\SMARTSNMPAgent.exe"=

"c:\\Program Files\\SMART Technologies\\SMART Board Drivers\\UCService.exe"=

"c:\\Program Files\\SMART Technologies\\SMART Board Drivers\\WebServer.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1761:TCP"= 1761:TCP:Zen-1761-TCP

"1761:UDP"= 1761:UDP:ZEN-1761-UDP

"1762:TCP"= 1762:TCP:Zen-1762-TCP

"1762:UDP"= 1762:UDP:Zen-1762-UDP

"517:TCP"= 517:TCP:Zen-517-TCP

"517:UDP"= 517:UDP:Zen-517-UDP

"1763:TCP"= 1763:TCP:Zen-1763-TCP

"1763:UDP"= 1763:UDP:Zen-1763-UDP

"21:TCP"= 21:TCP:Zen-21-TCP

"21:UDP"= 21:UDP:Zen-21-UDP

R1 deed;deed;c:\windows\system32\deed.sys [4/26/2010 9:24 AM 74240]

R2 BlankScr;HBDevice;c:\windows\system32\drivers\blankscr.sys [5/23/2005 2:47 PM 6899]

R2 cpextender;Check Point SSL Network Extender;c:\program files\CheckPoint\SSL Network Extender\slimsvc.exe [6/10/2007 4:48 PM 331870]

R2 Remote Management Agent;Novell ZENworks Remote Management Agent;c:\program files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe [5/9/2006 10:59 AM 167936]

R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [3/14/2007 7:48 PM 116416]

R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\novell\xtagent.exe [12/24/2007 11:21 PM 61440]

R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [5/23/2005 2:11 PM 2773]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/8/2009 12:16 PM 102448]

R3 VNA;Check Point Virtual Network Adapter;c:\windows\system32\drivers\vna.sys [6/10/2007 4:48 PM 110160]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [1/16/2006 1:18 PM 87936]

S3 klmd21;klmd21;c:\windows\system32\drivers\klmd.sys --> c:\windows\system32\drivers\klmd.sys [?]

S3 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies\SMART Board Drivers\WebServer.exe [7/23/2009 5:51 PM 1245184]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.cobbk12.org/

uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

uInternet Settings,ProxyOverride = <local>

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

DPF: {65FDEDF3-8ED9-4F5B-825E-18C2D44191A7} - hxxp://d.66.155.171.22.downloads.estara.com./as/OneCCDM.php?template=56012&sessionid=177117519_66.155.171.22_38232&=&req=1212025132695OneCC.cab

DPF: {C7DEDA04-2FFF-4B81-AE66-0A0E0EF4AD2F} - hxxp://www.ritzpix.com/net/Uploader/LPUploader57.cab

FF - ProfilePath - c:\documents and settings\homeuser\Application Data\Mozilla\Firefox\Profiles\h0xvw3cy.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.cobbk12.org/

FF - plugin: c:\documents and settings\homeuser\Application Data\Move Networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll

FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll

FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false.

- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{B4870B70-F390-11d2-9FB9-F4ED725EA20D} - c:\progra~1\Novell\Zenworks\NalExpEx.dll

Notify-ckpNotify - (no file)

SafeBoot-klmd21.sys

SafeBoot-klmdb.sys

AddRemove-Adobe Shockwave Player - c:\windows\system32\adobe\SHOCKW~1\UNWISE.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-05 22:46

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\windows\TEMP\4BE22E38.qsp 1774 bytes

c:\windows\TEMP\4BE22E39.qsp 17664 bytes

c:\windows\TEMP\4BE22E3A.qsp 931 bytes

c:\windows\TEMP\4BE22E3B.qsp 931 bytes

c:\windows\TEMP\4BE22E3C.qsp 1513 bytes

c:\windows\TEMP\4BE22E3D.qsp 1029 bytes

c:\windows\TEMP\4BE22E3E.qsp 919 bytes

c:\windows\TEMP\4BE22E3F.qsp 891 bytes

c:\windows\TEMP\4BE22E40.qsp 891 bytes

c:\windows\TEMP\NSD35.tmp 1343 bytes

c:\windows\TEMP\qsp36.tmp

c:\windows\TEMP\00000149.rma 896 bytes

c:\windows\TEMP\00000149.urm 131558 bytes

c:\windows\TEMP\00000150.rma 896 bytes

c:\windows\TEMP\00000150.urm 838 bytes

c:\windows\TEMP\00000151.rma 896 bytes

c:\windows\TEMP\00000151.urm 838 bytes

c:\windows\TEMP\00000152.rma 896 bytes

scan completed successfully

hidden files: 18

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\h* 2*]

"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1016)

c:\windows\system32\NETWIN32.DLL

c:\program files\Novell\ZENworks\ZENPOL32.DLL

c:\windows\system32\xmlparse.dll

c:\windows\system32\ZenMup.dll

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\NLS\ENGLISH\MAPBASER.DLL

c:\windows\system32\NLS\ENGLISH\NWSHLXNR.DLL

c:\windows\system32\NLS\ENGLISH\NOVNPNTR.DLL

- - - - - - - > 'Explorer.exe'(4064)

c:\windows\system32\WININET.dll

c:\program files\SMART Technologies\SMART Board Drivers\UtahHook.dll

c:\windows\system32\ieframe.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\Intel\Wireless\Bin\WLKeeper.exe

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\windows\System32\wltrysvc.exe

c:\windows\System32\bcmwltry.exe

c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

c:\windows\System32\SCardSvr.exe

c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

c:\program files\Symantec AntiVirus\DefWatch.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Novell\ZENworks\nalntsrv.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\SMART Technologies\SMART Board Drivers\SMARTBoardService.exe

c:\program files\Symantec AntiVirus\Rtvscan.exe

c:\windows\system32\wdfmgr.exe

c:\program files\Novell\ZENworks\wm.exe

c:\program files\Novell\ZENworks\WMRUNDLL.EXE

c:\windows\system32\NWTRAY.EXE

c:\windows\system32\WLTRAY.exe

c:\windows\stsystra.exe

c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe

c:\program files\Wireless eSystems\iRespond\BaseService\BaseService.exe

c:\program files\SMART Technologies\SMART Board Drivers\Aware.exe

c:\program files\SMART Technologies\SMART Board Drivers\Marker.exe

c:\windows\system32\msiexec.exe

.

**************************************************************************

.

Completion time: 2010-05-05 22:58:13 - machine was rebooted

ComboFix-quarantined-files.txt 2010-05-06 02:58

Pre-Run: 55,718,297,600 bytes free

Post-Run: 58,177,859,584 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F40419A80188BE3CB499B4A016960017

Maniac · May 6, 2010

Open Notepad and copy and paste the text in the code box below into it:

KillAll::

Suspect::[8]
c:\windows\TEMP\4BE22E38.qsp
c:\windows\TEMP\4BE22E39.qsp
c:\windows\TEMP\4BE22E3A.qsp
c:\windows\TEMP\4BE22E3B.qsp
c:\windows\TEMP\4BE22E3C.qsp
c:\windows\TEMP\4BE22E3D.qsp
c:\windows\TEMP\4BE22E3E.qsp
c:\windows\TEMP\4BE22E3F.qsp
c:\windows\TEMP\4BE22E40.qsp
c:\windows\TEMP\NSD35.tmp
c:\windows\TEMP\qsp36.tmp
c:\windows\TEMP\00000149.rma
c:\windows\TEMP\00000149.urm
c:\windows\TEMP\00000150.rma
c:\windows\TEMP\00000150.urm
c:\windows\TEMP\00000151.rma
c:\windows\TEMP\00000151.urm
c:\windows\TEMP\00000152.rma

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

dtk3v91 · May 7, 2010

It still did not kill Symantec Antivirus. I have posted the log below.

ComboFix 10-05-02.01 - homeuser 05/06/2010 23:52:56.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.393 [GMT -4:00]

Running from: c:\documents and settings\homeuser\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\homeuser\Desktop\CFScript.txt

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

.

((((((((((((((((((((((((( Files Created from 2010-04-07 to 2010-05-07 )))))))))))))))))))))))))))))))