blocked access to potentially malicious website

dlp123 · August 30, 2011

Hello,

I am another one of those people with the "Malwarebytes successfully blocked access to potentially malicious website" problem...... here is part of the log file:

MESSAGE Protection started successfully

MESSAGE Scheduled update executed successfully

MESSAGE IP Protection started successfully

MESSAGE IP Protection stopped

MESSAGE Database updated successfully

MESSAGE IP Protection started successfully

IP-BLOCK 62.122.75.230 (Type: outgoing)

IP-BLOCK 208.73.210.29 (Type: outgoing)

IP-BLOCK 67.29.139.153 (Type: outgoing)

IP-BLOCK 208.87.32.69 (Type: outgoing)

.... and so on (there are a lot of them)........

I am running Windows XP Professional on my laptop. I seem to have contracted several viruses at once (I had Microsoft Essentials antivirus on the laptop at that time, but no anti-malware programs.)

I got into this situation after contracting the "XP Home Security 2012" Fake Alert virus. After finding help on forums, I got rid of that.

I then uninstalled Microsoft Essentials and installed Malwarebytes + BitDefender 2010 + Spybot Search & Destroy and did full scans, and fixed all viruses/malware found by those applications.

After that, I still had a "windows update disabled" virus on the machine, where I could not enable the windows automatic update function. I found a fix for that on forums, then updated windows and ran all 3 anti-virus/malware apps again.

Now I still seem to have a virus on the machine that tries to access malicious websites (maybe trying to re-install itself on my machine?)

I have followed your published instructions and attached the requested logs to this post. After 4 days and nights of solid work on this, I am at my wits end.......

(p.s. you will see directory names in the log files in Danish and not English .... I have a Danish version of XP Pro.... i.e. "programmer" = "program files", "hotfix til" = "hotfix to", "Opdatering til windows" = "Update to windows", "Sikkerhedsopdatering" = "security update", etc. If you need any translations, please ask, otherwise Google translate does a pretty good job.)

THANK YOU for any help you can provide!

**************************

DDS log file

**************************

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Johnny Killerup at 23:25:48 on 2011-08-26

Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.3536.1709 [GMT -7:00]

.

AV: BitDefender Antivirus *Enabled/Updated* {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: BitDefender Firewall *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Programmer\Fælles filer\BitDefender\BitDefender Update Service\livesrv.exe

C:\Programmer\BitDefender\BitDefender 2010\vsserv.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Programmer\Intel\WiFi\bin\S24EvMon.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\programmer\idt\dellxpm09b_6159v043\wdm\stacsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programmer\Intel\WiFi\bin\ZCfgSvc.exe

C:\Programmer\Fælles filer\Intel\WirelessCommon\iFrmewrk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programmer\DellTPad\Apoint.exe

C:\Programmer\IDT\WDM\sttray.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\Programmer\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\Programmer\Fælles filer\Java\Java Update\jusched.exe

C:\Programmer\HP\HP Software Update\HPWuSchd2.exe

C:\Programmer\Dell Webcam\Dell Webcam Central\WebcamDell.exe

C:\Programmer\iTunes\iTunesHelper.exe

C:\Programmer\Fælles filer\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Programmer\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe

C:\Programmer\BitDefender\BitDefender 2010\bdagent.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programmer\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programmer\Skype\Phone\Skype.exe

C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe

C:\Programmer\Logitech\SetPoint\SetPoint.exe

C:\Programmer\Personal\bin\Personal.exe

C:\Programmer\Fælles filer\Logishrd\KHAL2\KHALMNPR.EXE

svchost.exe

C:\Programmer\DellTPad\ApMsgFwd.exe

C:\Programmer\DellTPad\HidFind.exe

C:\Programmer\DellTPad\Apntex.exe

C:\Programmer\BitDefender\BitDefender 2010\seccenter.exe

C:\Programmer\Fælles filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Programmer\Bonjour\mDNSResponder.exe

C:\Programmer\Intel\WiFi\bin\EvtEng.exe

C:\Programmer\Java\jre6\bin\jqs.exe

C:\Programmer\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Programmer\Fælles filer\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programmer\Intel\WiFi\bin\WLKeeper.exe

C:\Programmer\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Programmer\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: H - No File

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\programmer\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programmer\fælles filer\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programmer\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\programmer\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programmer\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programmer\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programmer\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\programmer\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programmer\google\google toolbar\GoogleToolbar_32.dll

TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\programmer\bitdefender\bitdefender 2010\IEToolbar.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\programmer\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [skype] "c:\programmer\skype\phone\Skype.exe" /nosplash /minimized

uRun: [spybotSD TeaTimer] c:\programmer\spybot - search & destroy\TeaTimer.exe

mRun: [intelZeroConfig] "c:\programmer\intel\wifi\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\programmer\fælles filer\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless Tray

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [Apoint] c:\programmer\delltpad\Apoint.exe

mRun: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg

mRun: [iAAnotif] c:\programmer\intel\intel matrix storage manager\iaanotif.exe

mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [sunJavaUpdateSched] "c:\programmer\fælles filer\java\java update\jusched.exe"

mRun: [LELA] "c:\programmer\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized

mRun: [HP Software Update] c:\programmer\hp\hp software update\HPWuSchd2.exe

mRun: [<NO NAME>]

mRun: [Dell Webcam Central] "c:\programmer\dell webcam\dell webcam central\WebcamDell.exe" /mode2

mRun: [Adobe Reader Speed Launcher] "c:\programmer\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\programmer\fælles filer\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\programmer\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\programmer\itunes\iTunesHelper.exe"

mRun: [RIMBBLaunchAgent.exe] c:\programmer\fælles filer\research in motion\usb drivers\RIMBBLaunchAgent.exe

mRun: [boingo Wi-Fi] "c:\programmer\boingo\boingo wi-fi\Boingo.lnk"

mRun: [bitDefender Antiphishing Helper] "c:\programmer\bitdefender\bitdefender 2010\IEShow.exe"

mRun: [bDAgent] "c:\programmer\bitdefender\bitdefender 2010\bdagent.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\programmer\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRun: [DWQueuedReporting] "c:\progra~1\fllesf~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\logite~1.lnk - c:\programmer\logitech\setpoint\SetPoint.exe

StartupFolder: c:\docume~1\alluse~1\menuen~1\progra~1\start\personal.lnk - c:\programmer\personal\bin\Personal.exe

IE: E&ksporter til Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki ... - c:\programmer\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programmer\messenger\msmsgs.exe

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\programmer\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\programmer\hp\digital imaging\smart web printing\hpswp_BHO.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

Trusted Zone: webreg.dk

DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.lsb.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {8BBDC81D-81B3-49EE-87E8-47B7A707FAE8} - hxxps://www1.gotomeeting.com/default/applets/g2mdlax.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11

TCP: Interfaces\{C89019B6-361E-430F-8649-273169358A9C} : DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\programmer\skype\toolbars\internet explorer\skypeieplugin.dll

Notify: igfxcui - igfxdev.dll

Notify: LBTWlgn - c:\programmer\fælles filer\logishrd\bluetooth\LBTWlgn.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

R2 BDVEDISK;BDVEDISK;c:\programmer\bitdefender\bitdefender 2010\bdvedisk.sys [2010-1-19 85128]

R2 IAANTMON;Intel® Matrix Storage Event Monitor;c:\programmer\intel\intel matrix storage manager\IAANTmon.exe [2009-7-29 354840]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-7-29 10384]

R2 MBAMService;MBAMService;c:\programmer\malwarebytes' anti-malware\mbamservice.exe [2011-8-24 366640]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-7-29 112512]

R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2010-2-3 153448]

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2010-1-4 111312]

R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2009-7-29 244368]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2009-7-29 109568]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-24 22712]

R3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [2009-7-29 148056]

R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [2009-7-29 133632]

R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [2009-7-29 280096]

S0 cerc6;cerc6; [x]

S1 fgbpsyov;fgbpsyov;\??\c:\windows\system32\drivers\fgbpsyov.sys --> c:\windows\system32\drivers\fgbpsyov.sys [?]

S1 MpKslcbf061bb;MpKslcbf061bb;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9edbfbd6-8bef-486f-ad74-9b490e006bea}\mpkslcbf061bb.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{9edbfbd6-8bef-486f-ad74-9b490e006bea}\MpKslcbf061bb.sys [?]

S1 MpKslef0903a4;MpKslef0903a4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{54e09164-fa3d-48eb-9eab-0770345ecd46}\mpkslef0903a4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{54e09164-fa3d-48eb-9eab-0770345ecd46}\MpKslef0903a4.sys [?]

S2 gupdate1ca1ce7a33a23c0;Tjenesten Google Update (gupdate1ca1ce7a33a23c0);c:\programmer\google\update\GoogleUpdate.exe [2009-8-14 133104]

S2 LMIGuardianSvc;LMIGuardianSvc;c:\programmer\logmein\x86\LMIGuardianSvc.exe [2010-10-6 374152]

S3 Arrakis3;BitDefender Arrakis Server;c:\programmer\fælles filer\bitdefender\bitdefender arrakis server\bin\arrakis3.exe [2009-10-19 183880]

S3 avisfltr;avisfltr;c:\windows\system32\drivers\avisfltr.sys [2011-8-23 327368]

S3 gupdatem;Google Update Tjeneste (gupdatem);c:\programmer\google\update\GoogleUpdate.exe [2009-8-14 133104]

S3 protecter.sys;protecter.sys;\??\c:\documents and settings\johnny killerup\lokale indstillinger\temp\bdremovaltool\protecter.sys --> c:\documents and settings\johnny killerup\lokale indstillinger\temp\bdremovaltool\protecter.sys [?]

.

=============== Created Last 30 ================

.

2011-08-26 05:13:04 184320 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\iuser.dll

2011-08-26 05:13:03 753664 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\iKernel.dll

2011-08-26 05:13:03 69714 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\ctor.dll

2011-08-26 05:13:03 5632 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\DotNetInstaller.exe

2011-08-26 05:13:03 331908 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\setup.dll

2011-08-26 05:13:03 274432 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\iscript.dll

2011-08-26 05:13:03 200836 ----a-w- c:\programmer\fælles filer\installshield\professional\runtime\11\00\intel32\iGdi.dll

2011-08-26 04:41:17 -------- d-----w- c:\documents and settings\johnny killerup\lokale indstillinger\application data\ApplicationHistory

2011-08-24 23:42:45 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-08-24 20:43:21 -------- d-----w- c:\programmer\Spybot - Search & Destroy

2011-08-24 20:43:21 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-08-24 15:39:06 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-08-24 09:38:26 -------- d-----w- c:\documents and settings\johnny killerup\application data\Malwarebytes

2011-08-24 09:38:12 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-24 09:38:11 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-08-24 09:38:07 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-24 09:38:07 -------- d-----w- c:\programmer\Malwarebytes' Anti-Malware

2011-08-24 08:52:28 -------- d-----w- c:\documents and settings\all users\application data\PC Tools

2011-08-24 06:57:49 -------- d-----w- c:\documents and settings\johnny killerup\application data\BitDefender

2011-08-24 06:57:41 -------- d-----w- C:\Binaries

2011-08-24 06:56:54 -------- d-----w- c:\programmer\BitDefender

2011-08-24 06:56:54 -------- d-----w- c:\documents and settings\all users\application data\BitDefender

2011-08-24 06:54:49 -------- d-----w- c:\windows\system32\URTTEMP

2011-08-24 06:41:06 -------- d-----w- c:\programmer\fælles filer\BitDefender

2011-08-23 19:09:11 327368 ----a-w- c:\windows\system32\drivers\avisfltr.sys

2011-08-23 04:35:00 0 ----a-w- c:\documents and settings\all users\application data\xrcw.exe

2011-08-23 04:35:00 0 ----a-w- c:\documents and settings\all users\application data\odko.exe

2011-08-23 04:35:00 0 ----a-w- c:\documents and settings\all users\application data\molh.exe

2011-08-23 04:35:00 0 ----a-w- c:\documents and settings\all users\application data\ccue.exe

.

==================== Find3M ====================

.

2011-08-24 07:13:41 111312 ----a-w- c:\windows\system32\drivers\bdfndisf.sys

2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys

2011-06-24 14:10:39 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:31:31 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:31:30 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:31:30 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05:34 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44:48 293376 ----a-w- c:\windows\system32\winsrv.dll

2011-06-06 11:36:16 1867904 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 23:27:08,79 ===============

mbam-log-2011-08-30 (13-25-36).txt

attach.zip

screen317 · September 3, 2011

Hi and welcome to Malwarebytes.

I notice that you are using more than one antivirus program (BitDefender and Microsoft). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Next, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post its log.

dlp123 · September 3, 2011

Hello,

Thanks for the reply.

After I got the virus (and before I posted on this forum), I used control panel > add/remove programs to remove Microsoft Security Essentials (MSE) . Since MSE did not catch the virus, I decided to install BitDefender to see if it would fix it (it did not). I suppose something went wrong and that all traces of MSE were not removed when I uninstalled it.

After receiveing your post, I could not remove MSE because it did not appear in the list of installed programs in control panel > add/remove programs. I searched the C: drive and the only folders referencing MSE were in the "application data" folder (not removed during the uninstall).

I therefore uninstalled BitDefender and reinstalled MSE from the Microsoft website.

I ran a quick scan and MSE detected a virus: Trojan:DOS/Alureon.A

When I clicked "remove", then MSE crashed and asked me to reboot. After rebooting, I got the same error again ... MSE cannot remove the trojan and crashes every time it tries.

I updated MBAB and ran a quick scan, then I ran DDS again .......

Here are the logs you asked for:

***********************

MBAB log

***********************

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7640

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

03-09-2011 01:14:10

mbam-log-2011-09-03 (01-14-10).txt

Scan type: Quick scan

Objects scanned: 161053

Time elapsed: 1 minute(s), 24 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

***********************

DDS log

***********************

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Johnny Killerup at 1:15:25 on 2011-09-03

Microsoft Windows XP Professional 5.1.2600.3.1252.45.1030.18.3536.2805 [GMT -7:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Programmer\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Programmer\Intel\WiFi\bin\S24EvMon.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\programmer\idt\dellxpm09b_6159v043\wdm\stacsv.exe

svchost.exe

C:\Programmer\Fælles filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Programmer\Bonjour\mDNSResponder.exe

C:\Programmer\Intel\WiFi\bin\EvtEng.exe

C:\Programmer\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Programmer\Fælles filer\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programmer\Intel\WiFi\bin\WLKeeper.exe

C:\Programmer\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\WINDOWS\Explorer.EXE

C:\Programmer\Intel\WiFi\bin\ZCfgSvc.exe

C:\Programmer\Fælles filer\Intel\WirelessCommon\iFrmewrk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programmer\DellTPad\Apoint.exe

C:\Programmer\IDT\WDM\sttray.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\Programmer\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\Programmer\Fælles filer\Java\Java Update\jusched.exe

C:\Programmer\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programmer\Dell Webcam\Dell Webcam Central\WebcamDell.exe

C:\Programmer\iTunes\iTunesHelper.exe

C:\Programmer\Fælles filer\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe

C:\Programmer\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe

C:\Programmer\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe

C:\Programmer\Logitech\SetPoint\SetPoint.exe

C:\Programmer\Personal\bin\Personal.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Programmer\Fælles filer\Logishrd\KHAL2\KHALMNPR.EXE

C:\Programmer\iPod\bin\iPodService.exe

C:\Programmer\DellTPad\ApMsgFwd.exe

C:\Programmer\DellTPad\HidFind.exe

C:\Programmer\DellTPad\Apntex.exe

C:\Programmer\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: H - No File

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\programmer\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programmer\fælles filer\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programmer\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\programmer\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programmer\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programmer\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programmer\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\programmer\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programmer\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\programmer\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [skype] "c:\programmer\skype\phone\Skype.exe" /nosplash /minimized

uRun: [spybotSD TeaTimer] c:\programmer\spybot - search & destroy\TeaTimer.exe

mRun: [intelZeroConfig] "c:\programmer\intel\wifi\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\programmer\fælles filer\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless Tray

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [Apoint] c:\programmer\delltpad\Apoint.exe

mRun: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg

mRun: [iAAnotif] c:\programmer\intel\intel matrix storage manager\iaanotif.exe

mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [sunJavaUpdateSched] "c:\programmer\fælles filer\java\java update\jusched.exe"

mRun: [LELA] "c:\programmer\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized

mRun: [HP Software Update] c:\programmer\hp\hp software update\HPWuSchd2.exe

mRun: [<NO NAME>]

mRun: [Dell Webcam Central] "c:\programmer\dell webcam\dell webcam central\WebcamDell.exe" /mode2

mRun: [Adobe Reader Speed Launcher] "c:\programmer\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\programmer\fælles filer\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\programmer\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\programmer\itunes\iTunesHelper.exe"

mRun: [RIMBBLaunchAgent.exe] c:\programmer\fælles filer\research in motion\usb drivers\RIMBBLaunchAgent.exe

mRun: [boingo Wi-Fi] "c:\programmer\boingo\boingo wi-fi\Boingo.lnk"

mRun: [MSC] "c:\programmer\microsoft security client\msseces.exe" -hide -runkey

mRunOnce: [Malwarebytes' Anti-Malware] c:\programmer\malwarebytes' anti-malware\mbamgui.exe /install /silent