Unable to install Antivirus program

 
0
 

Hi,

I had to recently uninstall my AV and when I try to reinstall it, it does install but when I click on the icon nothing happens. In addition to that, my internet service is gone into super slow motion too. Taking quite a while to open pages etc. I am also not able to run Malware antimalware, HJT and also unable to use online scanner.

Please advice.

Featured Replies in this Discussion

  • Click START then RUN Now type Combofix /u in the runbox and click OK. Note the space between the X and the /, it needs to be there. ... Please download ComboFix by sUBs from ... or ... You must rename combofix BEFORE saving it to your pc. ... You must download it to and run it from your Desktop Physically disconnect from the internet. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields)…
    Post Contains: Links Images
  • Sounds like something within KIS preferences/settings are causing the problem. Unfortunately I am not familiar with KIS and cannot suggest anything.
 
0
 

Which AV. Some, eg, Norton, AVG, require a special uninstaller tool to be run. The slowness is most likely due to a confused AV installation - all file activity, traffic is monitored by the AV.

 
0
 

Hi,

I had to recently uninstall my AV and when I try to reinstall it, it does install but when I click on the icon nothing happens. In addition to that, my internet service is gone into super slow motion too. Taking quite a while to open pages etc. I am also not able to run Malware antimalware, HJT and also unable to use online scanner.

Please advice.

see this thread...
similar problem

i have the same problem, its resolved to some extent but i am going to be doing all this soon....

 
0
 

..or perhaps you installed the AV into an infected system, or perhaps you have become infected with some malware which your AV does not detect.
Tell which AV you uninstalled.

 
0
 

My apologies, I have Kaspersky Internet Security 2009

 
0
 

Good-oh. You might try running the correct removal tool from this site, and then attempt to reinstall KIS.
http://support.kaspersky.com/faq/?qid=208279463
Good luck. And please come back if that does not solve your problem.

 
0
 

Hi,

I ran the uninstaller. But it does not detect that KIS is installed. This is peculiar because my Windows Security Alert tells me that the Antivirus and the firewall are switched off.

So reinstalled and then used the remover to uninstall the software only to get the same description from the Windows Security Alert. Also I noticed that there are no restore points available for System Restore!

 
0
 

Okay. It does look like a few keys in registry are not being cleaned, and Windows Security is picking up on them. More worrying is the inability to run anti-malware scans, loss of restore points. Let's try a couple in safe mode as an initial check:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].

MBAM can still be installed and updated without a connection. Using a flashdrive on another system, download & save the installer file from http://www.majorgeeks.com/Malwarebyt...are_d5756.html, then dl the latest updates file: http://www.gt500.org/malwarebytes/database.jsp , both to a thumbdrive.
Run the installer, when it completes uncheck the Launch and Update boxes to finish. Next, dclick the mbam-rules.exe file, it will install into MBAM.
Start MBAM via the icon and ...

==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe
-CLOSE ALL OTHER APPLICATIONS and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.

 
0
 

Tried the steps, but the application do not execute at all. When I click on the icons to run the application there is no changes at all except for the hourglass appearing for a couple of seconds.

I had the Task Manager up when I was trying to run these applications but on clicking them there is no response in the Task Manager, no sign of a new process at all.

 
0
 

hey
try running dr web as asked in that link i posted once...
may be it'll help
it did help me...

 
0
 

I ran the software and it did find few trojans, four to be exact. One was Killbit, ubi81 in the temp folder, and two dll files with long names in the System32 folder.

Said that, it still hasnt improved the situation. I am still unable to run MBAM n HJT.

 
0
 

@ aashishn86

the reply was in response to your suggestion.

@ gerbil

I was able to run Panda Online Security Scan. I am attaching the log along.

Attachments ActiveScan.txt (8.58 KB)
;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-06-08 03:08:20
PROTECTIONS: 1
MALWARE: 2
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Kaspersky Internet Security                  8.0.0.454                     No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00029434  spyware/virtumonde                 Spyware             No        0         Yes            No           hkey_local_machine\software\microsoft\removerp
01054371  W32/TDSS.BF.worm                   Virus/Worm          Yes       1         No             No           globalroot\systemroot\system32\gxvxcwqvvvdlwruqjxenkclcveptdrumqrmlt.dll
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "
;===================================================================================================================================================================================
  184379  MEDIUM     MS08-001                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  182043  HIGH       MS07-064                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  170907  HIGH       MS07-046                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  170904  HIGH       MS07-043                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  133387  MEDIUM     MS06-065                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  133386  MEDIUM     MS06-064                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  129976  MEDIUM     MS06-052                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  120825  MEDIUM     MS06-032                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
  108743  MEDIUM     MS06-007                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
   93394  HIGH       MS05-050                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   "
;===================================================================================================================================================================================
 
0
 

Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

==

Reboot and try running mba-m again.

 
0
 

The option TDSSserv is not available in DM.

 
0
 

I will assume that under the show hidden devices option, you couldn't find the driver named TDSSserv.

Please download ComboFix by sUBs from HERE or HERE

  • You must download it to and run it from your Desktop
  • Physically disconnect from the internet.
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

 
0
 

Yes, there was no TDSSserv drive in the DM.

I ran the CF tool but nothing happened no windows popped up nothing. I had my internet connection switched off too. To get back online I had to restart the computer.

 
1
 
  • Click START then RUN

  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /, it needs to be there.


  • CF_cleanup.png


Please download ComboFix by sUBs from HERE or HERE You must rename combofix BEFORE saving it to your pc.

CF_download_rename.gif
You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Comments
Super!!
 
0
 

I followed the steps and the results are attached.

--------------------------------------------------------------------

You should be awarded The Nobel Prize!

Attachments CF_LOG.txt (19.84 KB)
The attachment preview is chopped off after the first 10 KB. Please download the entire file.
ComboFix 09-06-07.07 - HP_Owner 2009-06-09  2:57.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.1279.946 [GMT 5.5:30]
Running from: c:\documents and settings\HP_Owner\Desktop\Combo-Fix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\HP_Owner\LOCALS~1\Temp\tmp2.tmp
c:\windows\9g2234wesdf3dfgjf23
c:\windows\IE4 Error Log.txt
c:\windows\system32\ABCD.exe
c:\windows\system32\drivers\gxvxcobbpixdulkbrrpuyavdtomltqfxexwva.sys
c:\windows\system32\EdNWDcfe.ini
c:\windows\system32\EdNWDcfe.ini2
c:\windows\system32\gxvxchtklrsokaxjbgxqtjknsphifppjwyydw.dll
c:\windows\system32\gxvxcwqvvvdlwruqjxenkclcveptdrumqrmlt.dll
c:\windows\system32\nfr.assembly
c:\windows\t55ft2824f44.dat
c:\windows\t55ft2829f44.dat
c:\windows\Tasks\lrnlubnn.job
D:\Desktop.ini

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS


(((((((((((((((((((((((((   Files Created from 2009-05-08 to 2009-06-08  )))))))))))))))))))))))))))))))
.

2009-06-07 20:57 . 2008-06-19 11:54	28544	----a-w-	c:\windows\system32\drivers\pavboot.sys
2009-06-07 20:56 . 2009-06-07 20:56	--------	d-----w-	c:\program files\Panda Security
2009-06-07 17:32 . 2009-06-07 17:32	--------	d-----w-	c:\documents and settings\HP_Owner\DoctorWeb
2009-06-07 16:59 . 2009-06-07 16:59	--------	dc-h--w-	c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-06-07 15:04 . 2009-06-07 15:04	--------	d-----w-	c:\program files\Trend Micro
2009-06-07 14:57 . 2009-01-14 10:41	15504	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-06-07 14:57 . 2009-01-14 10:41	38496	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-07 14:57 . 2009-06-07 14:57	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-06-06 23:03 . 2009-06-07 20:39	--------	d-----w-	c:\program files\Windows Live Safety Center
2009-06-04 11:33 . 2008-12-03 19:55	120832	----a-w-	c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\lalaa3xa.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-06-03 12:06 . 2009-06-03 12:07	--------	d-----w-	c:\documents and settings\HP_Owner\.housecall6.6
2009-05-27 15:35 . 2009-05-27 15:35	--------	d-----w-	c:\program files\DownloadToolz
2009-05-27 13:59 . 2009-05-27 13:59	29352	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll
2009-05-27 13:59 . 2009-05-27 13:59	23720	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll
2009-05-27 13:59 . 2009-05-27 13:59	23056	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll
2009-05-27 13:59 . 2009-05-27 13:59	221208	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll
2009-05-27 13:59 . 2009-05-27 13:59	21160	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll
2009-05-27 13:59 . 2009-05-27 13:59	110248	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll
2009-05-27 13:46 . 2007-11-27 17:26	91328	----a-w-	c:\windows\system32\drivers\msfwdrv.sys
2009-05-27 13:46 . 2007-11-27 17:26	116416	----a-w-	c:\windows\system32\drivers\msfwhlpr.sys
2009-05-27 13:45 . 2008-05-15 10:45	53168	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2009-05-27 13:45 . 2009-05-27 13:45	--------	d-----w-	c:\windows\system32\bits
2009-05-27 13:45 . 2007-03-29 12:56	7168	------w-	c:\windows\system32\dllcache\bitsprx4.dll
2009-05-27 13:45 . 2007-03-29 12:56	7168	------w-	c:\windows\system32\bitsprx4.dll
2009-05-27 13:12 . 2009-06-03 09:25	--------	d-----w-	c:\program files\Microsoft Windows OneCare Live
2009-05-27 11:38 . 2009-05-27 11:38	604416	----a-w-	c:\windows\system32\TUProgSt.exe
2009-05-27 11:38 . 2009-04-27 08:51	28928	----a-w-	c:\windows\system32\uxtuneup.dll
2009-05-27 11:38 . 2009-05-27 11:38	361216	----a-w-	c:\windows\system32\TuneUpDefragService.exe
2009-05-27 11:38 . 2009-05-27 11:38	--------	d-----w-	c:\documents and settings\HP_Owner\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-27 11:37 . 2009-05-27 11:38	--------	d-----w-	c:\program files\TuneUp Utilities 2009
2009-05-27 11:37 . 2009-05-27 11:37	--------	d-sh--w-	c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-27 08:54 . 2009-05-27 09:00	--------	d-----w-	c:\documents and settings\HP_Owner\Local Settings\Application Data\The Weather Channel
2009-05-27 08:46 . 2009-06-05 03:43	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP
2009-05-27 07:29 . 2009-05-27 07:29	--------	d-----w-	c:\program files\MSSOAP
2009-05-27 05:58 . 2009-05-27 05:58	--------	d-----w-	c:\program files\Easy Desk Utilities
2009-05-27 05:58 . 1997-01-20 09:42	71680	----a-w-	c:\windows\ST5UNST.EXE
2009-05-27 05:10 . 2009-06-03 11:21	--------	d-----w-	c:\program files\True Sword 5
2009-05-26 15:18 . 2009-05-26 15:18	--------	d-sh--w-	c:\documents and settings\LocalService\PrivacIE

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 21:34 . 2008-10-13 11:57	--------	d-----w-	c:\documents and settings\HP_Owner\Application Data\uTorrent
2009-06-08 17:24 . 2008-12-10 15:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-06-03 12:02 . 2008-10-24 09:38	410984	----a-w-	c:\windows\system32\deploytk.dll
2009-06-03 08:50 . 2008-10-21 08:30	--------	d-----w-	c:\program files\Bonjour
2009-05-27 14:19 . 2009-05-27 14:19	810152	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch3\HTML\item_templ\common\fixes\TSFix056472.dll
2009-05-27 05:45 . 2008-10-24 07:25	--------	d-----w-	c:\program files\DAEMON Tools Lite
2009-05-26 09:41 . 2009-02-09 20:16	827424	--sha-w-	c:\windows\system32\drivers\fidbox2.dat
2009-05-26 09:41 . 2009-02-09 20:16	4874272	--sha-w-	c:\windows\system32\drivers\fidbox.dat
2009-05-26 09:41 . 2009-02-09 20:16	39160	--sha-w-	c:\windows\system32\drivers\fidbox.idx
2009-05-26 09:41 . 2009-02-09 20:16	3908	--sha-w-	c:\windows\system32\drivers\fidbox2.idx
2009-05-25 16:33 . 2008-10-13 02:18	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-05-25 10:28 . 2009-03-02 06:59	--------	d-----w-	c:\documents and settings\All Users\Application Data\Ubisoft
2009-05-05 15:54 . 2008-11-02 13:15	--------	d-----w-	c:\documents and settings\HP_Owner\Application Data\LogMeIn Rescue
2009-04-22 11:53 . 2009-01-28 19:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\DriverCure
2009-04-19 18:42 . 2008-10-15 09:38	1324	----a-w-	c:\windows\system32\d3d9caps.dat
2009-04-08 10:20 . 2008-10-14 13:17	98304	----a-w-	c:\windows\system32\CmdLineExt.dll
2009-04-08 10:17 . 2009-04-08 10:17	10134	----a-r-	c:\documents and settings\HP_Owner\Application Data\Microsoft\Installer\{89661B04-C646-4412-B6D3-5E19F02F1F37}\ARPPRODUCTICON.exe
2009-03-27 02:44 . 2008-10-13 11:36	453152	----a-w-	c:\windows\system32\NVUNINST.EXE
2009-03-24 13:03 . 2009-03-24 13:03	237264	----a-w-	c:\documents and settings\HP_Owner\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-02-24 18:35 . 2009-02-24 18:35	41161496	----a-w-	c:\program files\PhysX_9.09.0203_SystemSoftware.exe
2009-02-23 21:50 . 2009-02-23 21:50	32376	----a-w-	c:\program files\nv4_disp.cat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-02-10 270128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-03 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\12cfg914-k641-26sf-n31p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\12zfg94-f641-2sf-k31p-5n1er6h6l2
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\13cfg914-k641-26sf-n33p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\autoload
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Home Theater SchSvr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon06
HKEY_LOCAL_MACHI
HJT_Log.txt (6.18 KB)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:11:02, on 2009-06-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: GVDownloader - {ae4df123-9140-4f93-9b32-ff0186389cc3} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 218.248.255.139,218.248.255.212
O17 - HKLM\System\CS1\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 218.248.255.139,218.248.255.212
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OneCare AntiSpyware and AntiVirus (OneCareMP) - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe (file missing)

--
End of file - 6332 bytes
 
0
 

I also did a MBAM scan and the log is attached.

I tried to reinstall the Anti virus software - Kaspersky Internet Security 2009 and was successful, said that I am unable to download updates and access any webpages. Although utorrent downloads the files in queue with our any problem.

I uninstalled KIS 2009 and I was able to browse the internet again. Assuming some problem with the Installation file, I tried to install Windows One Live Care and failed as it could not download the update. I then tried to install AVG and was successful but again I was unable to update the software and lost the browsing functionality. I currently have no security system running.

Attachments MBAM_Log.txt (0.97 KB)
Malwarebytes' Anti-Malware 1.33
Database version: 1654
Windows 5.1.2600 Service Pack 2

2009-06-09 04:03:19
mbam-log-2009-06-09 (04-03-19).txt

Scan type: Full Scan (C:\|D:\|M:\|N:\|)
Objects scanned: 193920
Time elapsed: 37 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
 
0
 

I will go through your combofix log when I get home from work. You need to paste it (and all your logs) into your reply rather than attach them.
MBA-M is about a year out of date. Update it and run it again please.

You
This question has already been solved: Start a new discussion instead
Post:
Start New Discussion
Tags Related to this Article