MBAM.EXE WOULD NOT RUN

STEPHNDOUG1 · August 11, 2010

I tried to change the name of the exe file but it still will not work.

Here are my posting logs. Please HELP!!

Here is the logs that I was asked to run and have someone look at....please help with me with getting this off my infected computer....THANK YOU so much!!

DDS (Ver_10-03-17.01) - NTFSx86

Run by HP_Administrator at 22:04:12.04 on Thu 07/22/2010

Internet Explorer: 6.0.2900.5512

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.501 [GMT -5:00]

AV: AV Security Suite *On-access scanning enabled* (Updated) {AE716D16-40FE-4cb9-8FD2-2975088F55B2}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\WINDOWS\arservice.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\ARPWRMSG.EXE

C:\Program Files\DISC\DISCover.exe

C:\Program Files\DISC\DiscUpdateMgr.exe

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe

C:\Documents and Settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D\070700Setup.exe

C:\Program Files\DISC\DiscGui.exe

C:\WINDOWS\system32\rundll32.exe

C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\y7gkls6u.exe

C:\WINDOWS\system32\rundll32.exe

C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\drweb.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Ocucom\PreCast\tmon.exe

C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe

C:\Documents and Settings\HP_Administrator\Application Data\Dropbox\bin\Dropbox.exe

C:\Program Files\TrueAssistant\TrueAssistant.exe

C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe

C:\Program Files\DISC\DiscStreamHub.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\HP\KBD\KBD.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

c:\windows\system\hpsysdrv.exe

C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

G:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:5577

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: c:\windows\system32\wr7a2ig92.dll: {c3ba40a2-75f1-52bd-f413-04b15a2c8953} - c:\windows\system32\wr7a2ig92.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [OM_Monitor] c:\program files\olympus\olympus master\Monitor.exe

uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0

uRun: [070700Setup.exe] c:\documents and settings\hp_administrator\application data\fdce7a7d0972fe534a5eb0596586084d\070700Setup.exe

uRun: [Oqanukuwupomuki] rundll32.exe "c:\windows\tholgt.dll",Startup

uRun: [JDK5SWFMZY] c:\docume~1\hp_adm~1\locals~1\temp\Vcl.exe

uRun: [lxpbrpee] c:\documents and settings\hp_administrator\local settings\application data\gagcpfptv\gofkwcmtssd.exe

uRun: [hsef87ehf3jishfs87fhuishfsgggfdgs4g] c:\docume~1\hp_adm~1\locals~1\temp\y7gkls6u.exe

uRun: [mcexecwin] rundll32.exe c:\docume~1\hp_adm~1\locals~1\temp\r7vptlut.dll, RestoreWindows

uRun: [hsehf98u34i9tjioaugy987iuegdsg] c:\docume~1\hp_adm~1\locals~1\temp\drweb.exe

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE

mRun: [HPHUPD08] c:\program files\hp\digital imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe

mRun: [DISCover] c:\program files\disc\DISCover.exe

mRun: [DiscUpdateManager] c:\program files\disc\DiscUpdateMgr.exe

mRun: [<NO NAME>]

mRun: [PCDrProfiler]

mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run

mRun: [HP Software Update] c:\program files\hp\hp software update\HPwuSchd2.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [OM_Monitor] c:\program files\olympus\olympus master\FirstStart.exe

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [EPSON Stylus CX5400] c:\windows\system32\spool\drivers\w32x86\3\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB002" /M "Stylus CX5400"

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [net] "c:\windows\system32\net.net"

mRun: [lxpbrpee] c:\documents and settings\hp_administrator\local settings\application data\gagcpfptv\gofkwcmtssd.exe

mRun: [Pyunikazubija] rundll32.exe "c:\windows\equzuzeqijiw.dll",Startup

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\hp_administrator\application data\dropbox\bin\Dropbox.exe

StartupFolder: c:\docume~1\hp_adm~1\startm~1\programs\startup\trueas~1.lnk - c:\program files\trueassistant\TrueAssistant.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\at&tse~1.lnk - c:\program files\sbc self support tool\bin\matcli.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\precas~1.lnk - c:\program files\ocucom\precast\tmon.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\9972322\program\Updates from HP.exe

uPolicies-explorer: NoFolderOptions = 1 (0x1)

uPolicies-system: DisableRegistryTools = 1 (0x1)

mPolicies-system: EnableLUA = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_05\bin\npjpi150_05.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

Trusted Zone: ncponline.com\www

Trusted Zone: trymedia.com

DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} - hxxp://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}

DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photo.walgreens.com/WalgreensActivia.cab

DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: NameServer = 93.188.162.224,93.188.166.204

TCP: {16233298-2793-4155-A3D0-5F3280E2075A} = 93.188.162.224,93.188.166.204

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: MDmXzsQF - {7425B19C-DE8F-1B36-1FB6-E9F883A8DBA0} - c:\windows\system32\nrsq.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

STS: c:\windows\system32\wr7a2ig92.dll: {c3ba40a2-75f1-52bd-f413-04b15a2c8953} - c:\windows\system32\wr7a2ig92.dll

============= SERVICES / DRIVERS ===============

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

S0 mvlkof;mvlkof;c:\windows\system32\drivers\mvlkof.sys [2010-7-9 0]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-5 135664]

============== File Associations ===============

regfile=regedit.exe "%1" %*

scrfile="%1" %*

=============== Created Last 30 ================

2010-07-23 03:03:07 0 ----a-w- c:\documents and settings\hp_administrator\defogger_reenable

2010-07-23 02:57:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-23 02:57:28 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-23 01:27:39 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-14 01:37:26 1587 ----a-w- c:\windows\lsrslt.ini

2010-07-14 01:35:12 0 d--h--w- c:\windows\system32\GroupPolicy

2010-07-13 00:50:52 3255 ----a-w- c:\windows\system32\wbem\Outlook_01cb222571b0831e.mof

2010-07-10 00:50:19 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-07-10 00:50:12 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-09 17:09:10 0 d-----w- c:\program files\AV Security Suite Basic

2010-07-09 16:35:09 2716 ----a-w- c:\windows\ucoceweweciqusol.dll

2010-07-09 16:27:26 2716 ----a-w- c:\windows\oyositefesuf.dll

2010-07-09 16:16:55 2716 ----a-w- c:\windows\icujuqumof.dll

2010-07-09 16:01:23 30000 ----a-w- c:\windows\system32\wr7a2ig92.dll

2010-07-09 16:01:02 0 ----a-w- c:\windows\Yjehu.dat

2010-07-09 15:59:16 206336 ----a-w- c:\windows\Vtixea.exe

2010-07-09 15:59:05 0 ----a-w- c:\windows\system32\drivers\mvlkof.sys

2010-07-09 15:57:13 0 d-----w- c:\docume~1\hp_adm~1\applic~1\FDCE7A7D0972FE534A5EB0596586084D

2010-07-09 15:57:04 36819 ----a-w- c:\windows\system32\net.net

==================== Find3M ====================

2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-05-02 05:22:50 1851264 ------w- c:\windows\system32\dllcache\win32k.sys

============= FINISH: 22:05:09.46 ===============

ark.zip

Attach.zip

Elise · August 12, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

STEPHNDOUG1 · August 13, 2010

Okay so I downloaded combofix from bleepingcomputer and put it on my infected computer and all antivirus that I can disable is disabled. When I try to double click on it, it starts to run like 3 bars like it's going to download it and then it disappears. What can I do next?

STEPHNDOUG1 · August 13, 2010

okay nevermind the other one worked for me....running combofix now...will have logs shortly....

STEPHNDOUG1 · August 13, 2010

OKAY HERE IS THE LOG....

ComboFix 10-08-12.02 - HP_Administrator 08/12/2010 20:43:45.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.656 [GMT -5:00]

Running from: G:\ComboFix1.exe

AV: AV Security Suite *On-access scanning enabled* (Updated) {AE716D16-40FE-4cb9-8FD2-2975088F55B2}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\csrss.exe

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\lsass.exe

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\services.exe

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\svchost.exe

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\taskmgr.exe

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\winlogon.exe

c:\documents and settings\HP_Administrator\Application Data\4fbab23a.exe

c:\documents and settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D

c:\documents and settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D\070700Setup.exe

c:\documents and settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D\enemies-names.txt

c:\documents and settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D\local.ini

c:\documents and settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D\lsrslt.ini

c:\documents and settings\HP_Administrator\Local Settings\Application Data\{DC013930-612F-47B4-BDC8-57F0505379DC}

c:\documents and settings\HP_Administrator\Local Settings\Application Data\{DC013930-612F-47B4-BDC8-57F0505379DC}\chrome.manifest

c:\documents and settings\HP_Administrator\Local Settings\Application Data\{DC013930-612F-47B4-BDC8-57F0505379DC}\chrome\content\_cfg.js

c:\documents and settings\HP_Administrator\Local Settings\Application Data\{DC013930-612F-47B4-BDC8-57F0505379DC}\chrome\content\overlay.xul

c:\documents and settings\HP_Administrator\Local Settings\Application Data\{DC013930-612F-47B4-BDC8-57F0505379DC}\install.rdf

c:\documents and settings\HP_Administrator\Local Settings\Application Data\gagcpfptv\gofkwcmtssd.exe

c:\documents and settings\LocalService\Application Data\1007491577.exe

c:\documents and settings\LocalService\Application Data\1057695219.exe

c:\documents and settings\LocalService\Application Data\1059006019.exe

c:\documents and settings\LocalService\Application Data\1059989118.exe

c:\documents and settings\LocalService\Application Data\1061889779.exe

c:\documents and settings\LocalService\Application Data\1072703876.exe

c:\documents and settings\LocalService\Application Data\1137457396.exe

c:\documents and settings\LocalService\Application Data\937953636.exe

c:\program files\AV Security Suite Basic

c:\program files\AV Security Suite Basic\avsuite.exe

c:\program files\Shared

c:\program files\Shared\lib.sig

c:\windows\equzuzeqijiw.dll

c:\windows\icujuqumof.dll

c:\windows\MailSwitch.ocx

c:\windows\oyositefesuf.dll

c:\windows\Readme.txt

c:\windows\system32\driVERs\mvlkof.sys

c:\windows\system32\ernel32.dll

c:\windows\system32\net.net

c:\windows\system32\wr7a2ig92.dll

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

c:\windows\tholgt.dll

c:\windows\ucoceweweciqusol.dll

D:\Autorun.inf

c:\windows\system32\drivers\mvlkof.sys . . . is infected!! . . . Failed to find a valid replacement.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_CBEVTSVC

-------\Legacy_mvlkof

-------\Service_mvlkof

((((((((((((((((((((((((( Files Created from 2010-07-13 to 2010-08-13 )))))))))))))))))))))))))))))))

.

2010-08-11 01:31 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-11 01:31 . 2010-08-11 01:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware1

2010-08-11 01:31 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-23 01:27 . 2010-08-11 01:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-13 02:05 . 2009-06-07 22:37 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Dropbox

2010-07-14 01:08 . 2010-07-10 00:50 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-10 00:50 . 2010-07-10 00:50 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-07-09 22:49 . 2010-07-09 16:01 0 ----a-w- c:\windows\Yjehu.dat

2010-07-09 15:57 . 2010-07-09 15:59 206336 ----a-w- c:\windows\Vtixea.exe

2010-07-09 04:00 . 2005-11-12 15:57 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-06-24 02:06 . 2010-06-24 02:06 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb57.tmp.exe

2010-06-23 01:16 . 2010-06-23 01:16 -------- d-----w- c:\program files\National Consumer Panel

2010-06-20 16:35 . 2005-11-12 16:21 -------- d-----w- c:\program files\Common Files\Adobe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19 94208 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19 94208 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19 94208 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-31 68856]

"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-11-30 57344]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]

"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]

"DISCover"="c:\program files\DISC\DISCover.exe" [2005-09-27 1060864]

"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-09-27 61440]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-09-21 1605740]

"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 49152]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]

"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-11-30 40960]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-11-12 180269]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 221184]

"EPSON Stylus CX5400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE" [2003-05-27 99840]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\Default User\Start Menu\Programs\Startup\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-11-12 27136]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\

Dropbox.lnk - c:\documents and settings\HP_Administrator\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]

TrueAssistant.lnk - c:\program files\TrueAssistant\TrueAssistant.exe [2005-4-2 372224]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2006-1-19 217088]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]

PreCast Monitor.lnk - c:\program files\Ocucom\PreCast\tmon.exe [2008-2-12 1811120]

Updates from HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2005-11-12 36903]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\DISC\\DiscStreamHub.exe"=

"c:\\Program Files\\DISC\\myFTP.exe"=

"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\DISC\\DISCover.exe"=

"c:\\Documents and Settings\\HP_Administrator\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundMaskRequest"= 1 (0x1)

"AllowInboundRouterRequest"= 1 (0x1)

"AllowOutboundDestinationUnreachable"= 1 (0x1)

"AllowOutboundSourceQuench"= 1 (0x1)

"AllowOutboundParameterProblem"= 1 (0x1)

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 12:08 PM 135664]

.

Contents of the 'Scheduled Tasks' folder

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 17:08]

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 17:08]

2010-07-13 c:\windows\Tasks\Norton Security Online - Run Full System Scan - HP_Administrator.job

- c:\progra~1\Symantec\Norton AntiVirus\Navw32.exe [2007-01-14 09:09]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uSearch Page = hxxp://www.google.com

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uSearch Bar = hxxp://www.google.com/ie

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:5577

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

Trusted Zone: ncponline.com\www

Trusted Zone: trymedia.com

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

HKCU-Run-070700Setup.exe - c:\documents and settings\HP_Administrator\Application Data\FDCE7A7D0972FE534A5EB0596586084D\070700Setup.exe

HKCU-Run-Oqanukuwupomuki - c:\windows\tholgt.dll

HKCU-Run-lxpbrpee - c:\documents and settings\HP_Administrator\Local Settings\Application Data\gagcpfptv\gofkwcmtssd.exe

HKLM-Run-PCDrProfiler - (no file)

HKLM-Run-lxpbrpee - c:\documents and settings\HP_Administrator\Local Settings\Application Data\gagcpfptv\gofkwcmtssd.exe

HKLM-Run-Pyunikazubija - c:\windows\equzuzeqijiw.dll

SSODL-MDmXzsQF-{7425B19C-DE8F-1B36-1FB6-E9F883A8DBA0} - c:\windows\system32\nrsq.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-12 21:05

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x860D9EC5]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf74eff28

\Driver\ACPI -> ACPI.sys @ 0xf7362cb8

\Driver\atapi -> atapi.sys @ 0xf721f852

\Driver\iaStor -> iaStor.sys @ 0xf7243b10

IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a

\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a

NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf70e3bd4

PacketIndicateHandler -> NDIS.sys @ 0xf70d1a0d

SendHandler -> NDIS.sys @ 0xf70e5b40

user & kernel MBR OK

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(576)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1928)

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll

c:\documents and settings\HP_Administrator\Application Data\Dropbox\bin\DropboxExt.13.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\windows\arservice.exe

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\Ati2evxx.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\system32\dllhost.exe

c:\windows\ARPWRMSG.EXE

c:\windows\eHome\ehmsas.exe

c:\program files\SBC Self Support Tool\bin\mpbtn.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\windows\system32\HPZipm12.exe

.

**************************************************************************

.

Completion time: 2010-08-12 21:12:35 - machine was rebooted

ComboFix-quarantined-files.txt 2010-08-13 02:12

Pre-Run: 191,901,634,560 bytes free

Post-Run: 192,347,078,656 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - CE8DFC1877A9426B6A6B28FA2D45FE5F

Elise · August 13, 2010

That took already out a lot of stuff, but still some things left. Since it looks like you have also a flash drive infection, make sure to plug in all flashdrives you have.

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Rootkit::
c:\windows\system32\drivers\mvlkof.sys

File::
c:\windows\Yjehu.dat
c:\windows\Vtixea.exe

DDS::
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5577

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

STEPHNDOUG1 · August 15, 2010

Ok so here is the next log on the CFScript. I have another question for you too. When we first started this (with someone else on here), they had me download defogger and turn it off. They said not to turn it back on until the system was cleaned. Do I need to turn this defogger back on and if so please let me know when?? Thank you again for ALL your help!

ComboFix 10-08-12.02 - HP_Administrator 08/15/2010 10:56:02.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.553 [GMT -5:00]

Running from: G:\ComboFix1.exe

Command switches used :: G:\CFScript.txt

AV: AV Security Suite *On-access scanning enabled* (Updated) {AE716D16-40FE-4cb9-8FD2-2975088F55B2}

FILE ::

"c:\windows\Vtixea.eve"

"c:\windows\Yjehu.dat"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll

c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll

c:\windows\Yjehu.dat

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((( Files Created from 2010-07-15 to 2010-08-15 )))))))))))))))))))))))))))))))

.

2010-08-14 13:20 . 2010-08-14 13:20 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Temp

2010-08-11 01:31 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-11 01:31 . 2010-08-11 01:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware1

2010-08-11 01:31 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-23 01:27 . 2010-08-11 01:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-15 16:06 . 2009-06-07 22:37 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Dropbox