malwarebytes wont install

[cachuopm]

DDS (Ver_10-03-17.01) - FAT32x86

Run by Benjamin at 10:27:42.50 on Mon 08/23/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1031.18.502.187 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

SVCHOST.EXE

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

SVCHOST.EXE

SVCHOST.EXE

C:\WINDOWS\system32\spoolsv.exe

SVCHOST.EXE

C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe

C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Programme\Bonjour\mDNSResponder.exe

SVCHOST.EXE

C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Programme\Creative\Shared Files\CTDevSrv.exe

C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe

C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe

C:\Programme\Seagate\SeagateManager\Sync\FreeAgentService.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\Programme\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe

C:\Programme\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Acer\Acer Arcade\PCMService.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Acer\Empowering Technology\ePresentation\ePresentation.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Acer\Empowering Technology\ePower\ePower_DMC.exe

C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe

C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Dokumente und Einstellungen\Benjamin\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://glarmls.fnismls.com/Paragon/Login.asp?

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:6522

mSearchAssistant = hxxp://www.google.com/ie

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\programme\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - c:\progra~1\arcsoft\mediac~1\intern~1\ARCURL~1.DLL

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programme\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programme\google\googletoolbarnotifier\5.5.5126.1836\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programme\google\google toolbar\GoogleToolbar_32.dll

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [updateMgr] "c:\programme\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

uRun: [swg] "c:\programme\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [AzMixerSel] c:\programme\realtek\installshield\AzMixerSel.exe

mRun: [synTPEnh] c:\programme\synaptics\syntp\SynTPEnh.exe

mRun: [PCMService] "c:\program files\acer\acer arcade\PCMService.exe"

mRun: [<NO NAME>]

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe 1

mRun: [Acer ePresentation HPD] c:\acer\empowering technology\epresentation\ePresentation.exe

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [ePower_DMC] c:\acer\empowering technology\epower\ePower_DMC.exe

mRun: [boot] c:\acer\empowering technology\epower\Boot.exe

mRun: [eRecoveryService] c:\acer\empowering technology\erecovery\eRAgent.exe

mRun: [QuickTime Task] "c:\programme\quicktime\qttask.exe" -atboottime

mRun: [ArcSoft Connection Service] c:\programme\gemeinsame dateien\arcsoft\connection service\bin\ACDaemon.exe

mRunOnce: [Malwarebytes' Anti-Malware] c:\programme\malwarebytes' anti-malware\mbamgui.exe /install /silent

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\dokume~1\alluse~1\startm~1\progra~1\autost~1\acerem~1.lnk - c:\acer\empowering technology\Acer.Empowering.Framework.Launcher.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Google Sidewiki... - c:\programme\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {62789780-B744-11D0-986B-00609731A21D} - hxxp://mapg.fmd.emory.edu/mgvinstall/mgaxctrl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} - hxxp://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab

DPF: {DCDC28C5-831C-43EA-9C02-78872CCCA409} - hxxp://thesecret.tv/movie/player/vivid_ocx.jpeg

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://libertytax.webex.com/client/T27L/nbr/ieatgpc.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\programme\symantec\liveupdate\AluSchedulerSvc.exe [2006-12-19 100032]

R2 FreeAgentGoNext Service;Seagate Service;c:\programme\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]

R2 MSSQL$ALAMODE;MSSQL$ALAMODE;c:\programme\microsoft sql server\mssql$alamode\binn\sqlservr.exe [2005-5-4 9150464]

S0 nielprt;Nielsen Patch Service;c:\windows\system32\drivers\nielprt.sys --> c:\windows\system32\drivers\nielprt.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\programme\google\update\GoogleUpdate.exe [2010-1-29 135664]

S3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [2006-6-20 1097728]

S3 NielGfx;Nielsen USB GFX;c:\windows\system32\drivers\nielgfx.sys --> c:\windows\system32\drivers\nielgfx.sys [?]

S3 SQLAgent$ALAMODE;SQLAgent$ALAMODE;c:\programme\microsoft sql server\mssql$alamode\binn\sqlagent.EXE [2005-5-3 323584]

S3 VisorUsb;Handspring USB;c:\windows\system32\drivers\VisorUsb.sys [2007-9-29 19968]

=============== Created Last 30 ================

2010-08-23 15:24:33 0 ----a-w- c:\dokumente und einstellungen\benjamin\defogger_reenable

2010-08-19 21:08:51 45177 ----a-w- c:\windows\alaRedun.ini

2010-08-09 20:38:16 0 d-----w- c:\programme\CCleaner

2010-08-09 17:36:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-09 17:36:31 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-09 17:36:30 0 d-----w- c:\programme\Malwarebytes' Anti-Malware

2010-08-09 16:30:51 0 d-----w- c:\dokume~1\benjamin\anwend~1\Malwarebytes

2010-08-09 16:30:44 0 d-----w- c:\dokume~1\alluse~1\anwend~1\Malwarebytes

2010-07-31 01:39:32 0 d-sh--w- C:\FOUND.010

2010-07-30 21:59:52 0 d-----w- C:\!KillBox

2010-07-30 21:31:40 0 d-sh--w- C:\FOUND.009

2010-07-29 21:28:18 0 d-sh--w- C:\FOUND.008

2010-07-28 22:21:26 0 d-sh--w- C:\FOUND.007

==================== Find3M ====================

2010-08-09 02:12:38 59386 ----a-w- c:\windows\system32\perfc007.dat

2010-08-09 02:12:38 382770 ----a-w- c:\windows\system32\perfh007.dat

2010-06-23 16:53:54 2389320 ----a-w- c:\windows\system32\alamapctrl.dll

2010-06-03 02:41:44 3600384 ----a-w- c:\windows\system32\GPhotos.scr

2010-04-13 15:48:24 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

============= FINISH: 10:28:26.74 ===============

ark.zip

Attach.zip

mbam_log_2010_08_23__11_33_22_.zip

[Maniac]

Hello cachuopm! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Step 1

Please, uninstall the following applications:

1. Adobe Reader 7.0.9
   

You can read, how to do this here:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 2

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Windows\Sun
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Step 3

I suggest you to uninstall CCleaner and to do not use registry cleaners as well:

http://miekiemoes.blogspot.com/2008/02/reg...weaking_13.html

Step 4

Going over your logs I noticed that you have BitTorrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  
• They are a security risk which can make your computer susceptible to a smorgasbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
  

It is pretty much certain that if you continue to use P2P programs, you will get infected again.

I would recommend that you uninstall BitTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

Step 5

I also see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

• 
  
• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  

Step 6

Please try this version of malwarebytes: Click the link here

Save it on your desktop. You'll see it will have a random name, and will look similar like this:

Doubleclick on it, so it will extract the files and will start Malwarebytes automatically.

In case the installer (random named file) won't run either, rename it to EXPLORER.EXE and try again.

When Malwarebytes opens, click the "Update" tab FIRST and select to check for updates in order to get the latest

updates.

In case Malwarebytes doesn't open, search for the folder mbam-installer on your desktop, open it and doubleclick

the file winlogon.exe which will be present in there. This should launch Malwarebytes.

Then perform a Quick scan and let it remove what it found. Reboot afterwards (important).

After reboot, post the malwarebytes log.

In your next reply, please include these log(s):

1. JavaRa log
   
2. Malwarebytes' Anti-Malware log
   
3. a new fresh DDS log only
   

[cachuopm]

Thanks for your help!

I have a problem with step 1. When I try to unistall adobe reader, I get an error message. I have a german computer, and my german is a bit rusty, but the message translates something like, windows installer service could not run. This could happen if you are running in safe mode or if windows installer is not correctly installed. I am not running in safe mode, so I am assuming the latter. Suggestions?

Thanks,

bb

[

[Maniac]

It should be done in Regular mode, not in Safe Mode.

[cachuopm]

I am in regular mode.

[Maniac]

See here:

http://support.microsoft.com/kb/319624

http://support.microsoft.com/kb/324516

[cachuopm]

The link to your version of malwarebytes is broken.

[Maniac]

Sorry! Try this one:

http://malwarebytes.org/mbam-download-exe-random.php

[cachuopm]

Ok, I think I am ready for the next steps!

JavaRalog.zip

mbam_log_2010_08_25__09_11_14_.zip

DDS82510.zip

[Maniac]

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[cachuopm]

Here is the Combofix log

log.zip

[Maniac]

Open Notepad and copy and paste the text in the code box below into it:

Folder::
c:\dokumente und einstellungen\Benjamin\Lokale Einstellungen\Anwendungsdaten\elxjcigvf
C:\FOUND.010
C:\FOUND.009
C:\FOUND.008
C:\FOUND.007
c:\dokumente und einstellungen\Benjamin\Lokale Einstellungen\Anwendungsdaten\bxftdqlwn

DDS::
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6522

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

[cachuopm]

Here is the new log

log2.zip

[Maniac]

How are things now?

[cachuopm]

Things seem good. Thanks! I have the full version of malwarebytes installed and protecting my computer.

[Maniac]

Nice!

Last steps:

Step 1

* Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Step 2

To enable CD Emulation programs using DeFogger please perform these steps:

1. Please download DeFogger to your desktop.
   
2. Once downloaded, double-click on the DeFogger icon to start the tool.
   
3. The application window will now appear. You should now click on the Enable button to enable your CD Emulation drivers
   
4. When it prompts you whether or not you want to continue, please click on the Yes button to continue
   
5. When the program has completed you will see a Finished! message. Click on the OK button to exit the program.
   
6. If CD Emulation programs are present and have been enabled, DeFogger will now ask you to reboot the machine. Please allow it to do so by clicking on the OK button.
   

Step 2

Please manually delete Defogger, JavaRa, GMER ana DDS.

Step 3

Please download and install the latest version of Adobe Reader from:

www.adobe.com

About Java:

www.java.com/en

Step 4

Some malware preventions:

http://forums.malwarebytes.org/index.php?showtopic=9365

Safe surfing!