1 reply to this topic

[obrienaj]

I have a number of malware items that prevent applications from loading and numerous pop-ups and redirects in Firefox, Chrome, and Internet Explorer (not in Seakmonkey). They appear to have disabled Malwarebytes and reinstall attempts for malwarebytes produce an error messages related to the executable file (Create process failed, code 2. System cannot find file). Last year when something similar happened I was able to solve via renaming the mbam.exe file but I no longer have that file to rename. I am running XP HE. I am able to solve most of the problems by running Housecalls in save mode but any subsequent reboot of the PC causes the problem to return. Adaware detects the threats and says it has fixed them but they do not really go away. I'll read more here to see if there is a fix, I'm getting tired of running housecall every few hours and having apps not work . Meanwhile here is my log from hijackthis.


Thanks

Andy


-------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:35:37 PM, on 10/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Nexon\MapleStory\npkcmsvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\microHAM\bin\urouter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\TweetDeck\TweetDeck.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\40744221\40744221.exe
C:\Program Files\D4\D4.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe
C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe
C:\Program Files\Fldigi-3.13AQ\fldigi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: (no name) - {885614f3-3111-4f42-840c-e7e2e123c4dd} - mebasugu.dll (file missing)
O4 - HKLM\..\Run: [72666734] C:\DOCUME~1\ALLUSE~1\APPLIC~1\72666734\72666734.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [55286531] C:\DOCUME~1\ALLUSE~1\APPLIC~1\55286531\55286531.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [48217325] C:\DOCUME~1\ALLUSE~1\APPLIC~1\48217325\48217325.exe
O4 - HKLM\..\Run: [15255927] C:\DOCUME~1\ALLUSE~1\APPLIC~1\15255927\15255927.exe
O4 - HKLM\..\Run: [89554435] C:\DOCUME~1\ALLUSE~1\APPLIC~1\89554435\89554435.exe
O4 - HKLM\..\Run: [vokijeyoh] Rundll32.exe "c:\windows\system32\begajetu.dll",a
O4 - HKLM\..\Run: [vuluhofina] Rundll32.exe "bozilajo.dll",s
O4 - HKLM\..\Run: [12116516] C:\DOCUME~1\ALLUSE~1\APPLIC~1\12116516\12116516.exe
O4 - HKLM\..\Run: [wozopoyev] Rundll32.exe "c:\windows\system32\tadezuzu.dll",a
O4 - HKLM\..\Run: [40744221] C:\DOCUME~1\ALLUSE~1\APPLIC~1\40744221\40744221.exe
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\nehaleti.dll bozilajo.dll c:\windows\system32\tadezuzu.dll
O21 - SSODL: rapekamep - {e8c894ae-61ca-4244-a92f-5252a2536748} - c:\windows\system32\tadezuzu.dll
O22 - SharedTaskScheduler: tokatiluy - {e8c894ae-61ca-4244-a92f-5252a2536748} - c:\windows\system32\tadezuzu.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Ham Radio Deluxe Remote Server (HRD RemoteSvr) - Unknown owner - C:\Program Files\Amateur Radio\Ham Radio Deluxe\HRDRemoteSvr.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\MapleStory\npkcmsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7584 bytes

[obrienaj]

I ran ComboFix and seem to be OK now, will double check.

obrienaj, on Oct 18 2009, 01:56 AM, said:

I have a number of malware items that prevent applications from loading and numerous pop-ups and redirects in Firefox, Chrome, and Internet Explorer (not in Seakmonkey). They appear to have disabled Malwarebytes and reinstall attempts for malwarebytes produce an error messages related to the executable file (Create process failed, code 2. System cannot find file). Last year when something similar happened I was able to solve via renaming the mbam.exe file but I no longer have that file to rename. I am running XP HE. I am able to solve most of the problems by running Housecalls in save mode but any subsequent reboot of the PC causes the problem to return. Adaware detects the threats and says it has fixed them but they do not really go away. I'll read more here to see if there is a fix, I'm getting tired of running housecall every few hours and having apps not work . Meanwhile here is my log from hijackthis.


T
End of file - 7584 bytes