Installed but can't run

bradster · January 14, 2009

I managed to install Malwarebytes but my infection doesn't allow me to run the program. After a few minutes after booting up I get the BSOD and the computer reboots. TIA for your assistance.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:41:18 PM, on 1/13/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Spare Backup\SpareBackup.exe

C:\Program Files\BigFix\bigfix.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\ClamWin\bin\ClamTray.exe

C:\Windows\System32\lgbpd.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Users\roque\Program Files\DNA\btdna.exe

C:\Users\roque\AppData\Roaming\cogad\cogad.exe

C:\Users\roque\AppData\Local\Temp\csrssc.exe

C:\Users\roque\AppData\Roaming\Twain\Twain.exe

C:\Program Files\Palm\Hotsync.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Internet Explorer\IEUser.exe

C:\Users\roque\AppData\Roaming\svchost.exe

C:\Windows\System32\mobsync.exe

C:\Windows\system32\Taskmgr.exe

C:\Windows\system32\SearchFilterHost.exe

K:\HT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...P&M=GT5625E

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...P&M=GT5625E

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch...P&M=GT5625E

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: C:\Windows\system32\rakmdlkd83indfgnbu.dll - {D5BF4552-94F1-42BD-F434-3604812C807D} - C:\Windows\system32\rakmdlkd83indfgnbu.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [spare Backup] "C:\Program Files\Spare Backup\SpareBackup.exe" /silent

O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray

O4 - HKLM\..\Run: [bigFix] c:\program files\Bigfix\bigfix.exe /atstartup

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [HotSync] "C:\Program Files\PalmSource\Desktop\HotSync.exe" -AllUsers

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [*svchostBoot] C:\Users\roque\AppData\Roaming\svchost.exe

O4 - HKLM\..\Run: [Managing Services] C:\Windows\system32\spools.exe

O4 - HKLM\..\Run: [lrijh8s73jhbfgfd] C:\Users\roque\AppData\Local\Temp\winloggn.exe

O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [LGBLiveUpdate] C:\Windows\system32\lgbpd.exe

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKCU\..\Run: [AlarmWiz] C:\Program Files\AlarmWiz\alarmwiz.exe startup

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Users\roque\Program Files\DNA\btdna.exe"

O4 - HKCU\..\Run: [Java Runtime Update] C:\Users\roque\AppData\Local\Temp\file2.exe

O4 - HKCU\..\Run: [lrijh8s73jhbfgfd] C:\Users\roque\AppData\Local\Temp\winloggn.exe

O4 - HKCU\..\Run: [cogad] "C:\Users\roque\AppData\Roaming\cogad\cogad.exe" 61A847B5BBF72813329D31466188719AB689201522886B092CBD44BD8689220221DD3257

O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\Users\roque\AppData\Local\Temp\csrssc.exe

O4 - HKCU\..\Run: [Twain] C:\Users\roque\AppData\Roaming\Twain\Twain.exe

O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\roque\AppData\Local\Temp\kHaywXNE.dll,#1

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: HotSync Manager.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe

O13 - Gopher Prefix:

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {298BFFEE-662D-11D5-ADAF-00E0810232D7} (lgbplay Class) - https://video.manheim.com/lib/LiveSound.dll

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{8E340F40-6D7F-42F8-9735-DC3FE1D5A1C3}: NameServer = 85.255.114.90,85.255.112.92

O17 - HKLM\System\CCS\Services\Tcpip\..\{9A9C3291-86CE-40AB-8D4D-DBFC51E61030}: NameServer = 85.255.114.90,85.255.112.92

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.90,85.255.112.92

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.90,85.255.112.92

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.90,85.255.112.92

O22 - SharedTaskScheduler: erajhsf8743kjrngjnf - {D5BF4552-94F1-42BD-F434-3604812C807D} - C:\Windows\system32\rakmdlkd83indfgnbu.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 7885 bytes

bradster · January 14, 2009

Ran combofix, then malwarebytes. So far so good. Thanks for this kind site!

AdvancedSetup · January 14, 2009

Just a warning, please do not run combofix or similar tools on your own. These tools if not used properly can cause damage to Windows to the point it will never restart again.

Please run the following

Update and Scan with Malwarebytes' Anti-Malware

Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
[*]When the update is complete, select the Scanner tab
[*]Select Perform quick scan, then click Scan.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Be sure that everything is checked, and click Remove Selected.
[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then run the following scan again

Please download the following scanning tool. GMER

Open the zip file and copy the file
gmer.exe
to your Desktop.
Double click on
gmer.exe
and run it.
It may take a minute to load and become available.
Do not make any changes. As soon as it's done and the
COPY
button is available click on the
COPY
button.
DO NOT
Click on the
SCAN
button.
This will place the scan in your clipboard. Paste that into notepad or into your next reply post please.
Click OK and quit the GMER program.

Then run a new HJT scan and save log

bradster · January 14, 2009

Malwarebytes log:

Malwarebytes' Anti-Malware 1.32

Database version: 1649

Windows 6.0.6001 Service Pack 1

1/13/2009 6:56:20 PM

mbam-log-2009-01-13 (18-56-20).txt

Scan type: Full Scan (C:\|D:\|K:\|)

Objects scanned: 182332

Time elapsed: 1 hour(s), 3 minute(s), 45 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 7

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Qoobox\Quarantine\C\Windows\System32\TDSScrrx.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Windows\System32\TDSSntlv.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Windows\System32\TDSSrfpp.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Windows\System32\TDSStmei.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Windows\System32\drivers\TDSSmcmc.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\SystemRestore\FRStaging\Users\roque\AppData\Local\Temp\IXP001.TMP\RQMCBZC.sys (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\roque\AppData\Roaming\_fad39831195ec6bbf82d5fc026c00600\down\4203008.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

GMER log:

GMER 1.0.14.14536 - http://www.gmer.net

Rootkit scan 2009-01-14 09:46:47

Windows 6.0.6001 Service Pack 1

---- Disk sectors - GMER 1.0.14 ----

Disk \Device\Harddisk0\DR0 sector 60: copy of MBR

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.14 ----

AdvancedSetup · January 15, 2009

Please update MBAM again, it's at version 1.33 now and do a Quick Scan not a full scan.

Then run a new HJT scan and post back both logs.

bradster · January 15, 2009

Thank you, the new update did find another Trojan. Here are the last scan results:

Malwarebytes' Anti-Malware 1.33

Database version: 1656

Windows 6.0.6001 Service Pack 1

1/15/2009 10:00:00 AM

mbam-log-2009-01-15 (10-00-00).txt

Scan type: Quick Scan

Objects scanned: 46003

Time elapsed: 2 minute(s), 59 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

C:\Users\roque\AppData\Roaming\cogad\cogad.exe (Trojan.Agent) -> Failed to unload process.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cogad (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\roque\AppData\Roaming\cogad\cogad.exe (Trojan.Agent) -> Delete on reboot.

bradster · January 15, 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:08:19 AM, on 1/15/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Spare Backup\SpareBackup.exe

C:\Program Files\BigFix\bigfix.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\ClamWin\bin\ClamTray.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\System32\lgbpd.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\System32\mobsync.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...P&M=GT5625E

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)