Please help! Antivirus 2010 wreaking havoc on my pc

David Bryan · September 25, 2010

My neighbor got the newest Antivirus 2010 virus on his computer and called me to try and fix it. I've been working on it for a couple of days and haven't gotten very far. Originally, I got a red screen and it said something to the effect of "my computer has malfunctioned" and that it needs spyware to be removed before moving forward. The pc was running Windows Security Essentials, but it would not open after the virus infected the computer. AVG was on the computer, so I tried using it. It originally opened and said it found 903 viruses after the scan. It fixed 901, but then had to restart. The problem continued after restart.

I tried on youtube to find some videos that would help, but all of the antivirus 2010 videos were different the the virus I had. They told me to stop the application. The applications were different than the ones shown on the videos. When I would try and end them in tast manager, an error would come up saying something like "The system is shutting down. Please save all work in progress and log off. Initiated by NT Authority\System". It would shut down in 60 seconds. I also noticed that new processes were appearing faster than I could end them. Some of the processes that I suspect are avgcsrvs.exe, avgemc.exe, svchost.exe, avgrsx.exe, avgwdsvc.exe.

The virus allows me to download software, but not to run it. The exceptions are cccleaner, combofix, tdsskiller and avenger. None of these have worked totally, but the red screen no longer pops up. |Also, I am able to now use google and yahoo when on the internet. The virus did not allow this before. I am still unable to stop the processes or use antivirus programs or malwarebytes.

UPDATE: I WAS TOLD TO TRY DEFOGGER, DDS AND GMER. DEFOGGER DID NOT OPEN. I WILL ATTACH MY DDS LOGS TO THIS EMAIL. I LEFT THE GMER SCAN RUNNING WHEN I WENT TO BED LAST NIGHT. WHEN I GOT UP THIS MORNING, THE COMPUTER WAS TRYING OVER AND OVER AGAIN TO BOOT UP. IT GETS AS FAR AS THE LOADING XP SCREEN AND THEN GOES BLACK AND STARTS AGAIN. I CAN GET TO THE ADVANCED OPTIONS MENU TO CHOOSE SAFE MODE, ECT. WHEN I TRY TO OPEN IN SAFE MODE, THE COMPUTER RESTARTS. THIS IS AS FAR AS I CAN GET NOW. ANY HELP WOULD BE MUCH APPRECIATED.

Here is my combofix log:

ComboFix 10-09-24.03 - Compaq_Administrator 09/24/2010 18:49:44.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1982.1498 [GMT -5:00]

Running from: F:\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\COMPAQ~1\LOCALS~1\Temp\IadHide5.dll

c:\documents and settings\All Users\Application Data\FL0821pU.exe

c:\documents and settings\All Users\Application Data\NUBMfm15E.exe

c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\NUBMfm15E.exe

c:\documents and settings\Compaq_Administrator\Local Settings\Temp\IadHide5.dll

c:\documents and settings\Compaq_Administrator\NUBMfm15E.com

c:\documents and settings\NetworkService\Local Settings\Application Data\NUBMfm15E.exe

c:\program files\HP\HP Software Update\HPWuSchd2 .exe

c:\program files\HP\HP Software Update\HPWuSchd2.exe

c:\windows\Fonts\NUBMfm15E.com

c:\windows\system32\config\systemprofile\NUBMfm15E.com

c:\windows\Tasks\At265.job

c:\windows\Tasks\At268.job

c:\windows\Tasks\At270.job

c:\windows\Tasks\At276.job

c:\windows\Tasks\At279.job

c:\windows\Tasks\At285.job

.

((((((((((((((((((((((((( Files Created from 2010-08-24 to 2010-09-24 )))))))))))))))))))))))))))))))

.

2010-09-24 22:22 . 2010-09-24 22:22 -------- d-----w- c:\program files\Mlalwarebytes' Anti-Malware

2010-09-24 22:15 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-24 22:15 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-24 20:44 . 2004-08-04 05:56 21504 ----a-w- c:\windows\system32\hidserv.dll

2010-09-23 17:18 . 2010-09-23 17:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-09-23 16:43 . 2010-09-23 16:43 -------- d-----w- c:\program files\Trend Micro

2010-09-23 14:03 . 2010-09-23 14:03 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\PCHealth

2010-09-23 13:51 . 2004-08-04 03:58 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys

2010-09-23 13:51 . 2004-08-04 03:58 14848 ----a-w- c:\windows\system32\dllcache\kbdhid.sys

2010-09-23 13:51 . 2001-08-17 18:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2010-09-23 13:51 . 2001-08-17 18:48 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys

2010-09-23 13:51 . 2001-08-17 19:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys

2010-09-23 13:51 . 2001-08-17 19:02 9600 ----a-w- c:\windows\system32\dllcache\hidusb.sys

2010-09-23 01:35 . 2010-09-22 20:17 94724 ----a-w- c:\windows\system32\NUBMfm15E.com

2010-09-23 01:28 . 2010-08-12 12:15 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2010-09-23 01:28 . 2010-09-23 01:28 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-09-23 01:25 . 2010-09-23 01:25 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\Sunbelt Software

2010-09-23 01:25 . 2010-09-23 01:25 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}

2010-09-23 01:24 . 2010-09-23 01:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-09-23 01:24 . 2010-09-23 01:24 -------- d-----w- c:\program files\Lavasoft

2010-09-23 00:22 . 2010-09-23 00:22 -------- d-----w- c:\documents and settings\Compaq_Administrator\Logs

2010-09-22 23:42 . 2010-09-24 22:11 -------- d-----w- c:\program files\aMalwarebytes' Anti-Malware

2010-09-22 23:29 . 2010-09-23 00:41 -------- d-----w- c:\program files\sys5

2010-09-22 23:28 . 2010-09-23 00:41 -------- d-----w- c:\program files\sys4

2010-09-22 23:28 . 2010-09-24 21:22 -------- d-----w- c:\program files\Microsoft

2010-09-22 23:13 . 2010-09-22 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2010-09-22 20:04 . 2010-09-22 20:04 -------- d-s---w- c:\documents and settings\NetworkService\UserData

2010-09-22 19:09 . 2010-09-22 19:09 -------- d-----w- c:\documents and settings\LocalService\Application Data\AdobeUM

2010-09-22 19:08 . 2010-09-22 19:09 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe

2010-09-22 11:09 . 2010-09-23 14:06 0 ----a-w- c:\windows\Wsaxageqewipe.bin

2010-09-22 11:09 . 2010-09-23 01:08 120 ----a-w- c:\windows\Dqufini.dat

2010-09-22 11:08 . 2004-08-04 03:59 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-09-22 11:08 . 2004-08-04 03:59 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-09-22 11:07 . 2004-08-04 04:00 8192 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-09-22 11:07 . 2004-08-04 04:00 8192 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys

2010-09-22 11:07 . 2004-08-04 04:00 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-09-22 11:07 . 2004-08-04 04:00 8192 ----a-w- c:\windows\system32\dllcache\changer.sys

2010-09-22 00:51 . 2010-09-23 00:52 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-09-14 23:22 . 2010-09-14 23:22 -------- d-----w- c:\windows\system32\wbem\mof

2010-09-14 23:20 . 2010-09-14 23:20 -------- d-----w- C:\found.000

2010-09-03 23:47 . 2010-09-03 23:51 19521 ----a-w- c:\windows\hpqins13.dat

1601-01-01 00:00 . 1601-01-01 00:00 -------- d-----w- c:\windows\LastGood.Tmp

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-24 23:44 . 2010-09-22 20:19 112 ----a-w- c:\documents and settings\All Users\Application Data\Ahu00A5K.dat

2010-09-24 22:15 . 2009-11-03 16:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-24 21:06 . 2009-11-03 16:32 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-09-23 16:30 . 2010-09-23 13:55 42496 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Microsoft\Windows\shellSrv.exe

2010-09-23 16:19 . 2010-03-02 23:26 -------- d-----w- c:\program files\CCleaner

2010-09-23 14:07 . 2010-08-22 20:29 -------- d-----w- c:\program files\Microsoft Security Essentials

2010-09-23 01:55 . 2010-09-22 23:29 142848 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Microsoft\Windows\shell.exe

2010-09-23 00:40 . 2006-08-26 03:37 -------- d-----w- c:\program files\Rhapsody

2010-09-23 00:39 . 2006-08-26 03:51 -------- d-----w- c:\program files\Quicken

2010-09-23 00:39 . 2006-08-26 04:01 -------- d-----w- c:\program files\PC-Doctor 5 for Windows

2010-09-23 00:20 . 2006-08-26 03:36 -------- d-----w- c:\program files\music_now

2010-09-23 00:20 . 2006-08-26 03:49 -------- d-----w- c:\program files\Microsoft Works

2010-09-23 00:00 . 2006-08-26 03:03 -------- d-----w- c:\program files\GemMaster

2010-09-22 23:59 . 2006-08-26 03:03 -------- d-----w- c:\program files\EnglishOtto

2010-09-22 23:59 . 2006-08-26 03:43 -------- d-----w- c:\program files\DISC

2010-09-22 23:59 . 2006-08-26 03:38 -------- d-----w- c:\program files\Common Files\SureThing Shared

2010-09-22 23:59 . 2006-08-26 03:32 -------- d-----w- c:\program files\Common Files\Sonic Shared

2010-09-22 23:58 . 2006-08-26 03:46 -------- d---a-w- c:\program files\Common Files\LightScribe

2010-08-24 08:01 . 2010-08-24 08:01 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2

2010-08-22 21:11 . 2010-08-22 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

2010-08-22 20:01 . 2010-08-22 20:01 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\IObit

2010-08-22 20:01 . 2010-08-22 20:01 -------- d-----w- c:\program files\IObit

2010-08-12 12:16 . 2010-09-23 01:25 2979848 -c--a-w- c:\documents and settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}\Ad-AwareInstall.exe

2010-07-15 14:04 . 2009-11-03 16:34 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-15 14:04 . 2010-07-15 14:04 12536 ----a-w- c:\windows\system32\avgrsstx.dll

2010-07-15 14:03 . 2009-11-03 16:34 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

.

CODE

<pre>

c:\program files\AVG\AVG9\avgtray .exe

c:\program files\Common Files\Microsoft Shared\DW\dwtrig20 .exe

c:\program files\Common Files\Real\Update_OB\realsched .exe

c:\program files\Internet Explorer\svchost .exe

c:\program files\Microsoft Security Essentials\msseces .exe

c:\windows\ehome\ehtray .exe

c:\windows\SMINST\RECGUARD .exe

c:\windows\system32\rundll32 .exe

</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-10-16 18:12 1119488 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]

"ftutil2"="ftutil2.dll" [2004-06-07 106496]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

"nwiz"="nwiz.exe" [2006-05-09 1519616]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp .exe" [N/A]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [N/A]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Compaq Connections.lnk - c:\program files\Compaq Connections\5577497\Program\Compaq Connections.exe [2006-8-25 36903]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-07-15 14:04 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

c:\program files\Messenger\msmsgs.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost]

c:\documents and settings\Compaq_Administrator\Application Data\Microsoft\svchost.exe [N/A]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\DISC\\DiscStreamHub.exe"=

"c:\\Program Files\\DISC\\myFTP.exe"=

"c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=

"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/22/2010 8:28 PM 64288]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/3/2009 11:34 AM 216400]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/3/2009 11:34 AM 243024]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/15/2010 9:03 AM 921952]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 9:04 AM 308136]

R3 mvb35316;mvb35316;c:\windows\system32\drivers\mvb35316.sys [8/10/2004 6:00 AM 12800]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [8/12/2010 7:15 AM 1355928]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

2010-09-23 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 01:28]

2010-09-23 c:\windows\Tasks\At49.job