stfrsl Posted February 3, 2013 ID:642804 Share Posted February 3, 2013 (edited) Hello,I have recently posted in the PC help section of the forums regarding my problem with updating malwarebytes, and really any non-microsoft software. Whenever I try to update malwarebytes I get a the PROGRAM_ERROR_UPDATING(0,0,I/O error) message. I know that this computer used to run a Norton Internet Security program and I have tried to delete this program with no success. I have attatched the requested logs/files. Please let me know if you can be of any assistance.Thank you.DDS (Ver_2012-11-20.01) - NTFS_x86Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_29Run by Frank at 14:08:02 on 2013-01-31Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.763 [GMT -6:00].AV: Norton Internet Security *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}FW: Norton Internet Security *Enabled*.============== Running Processes ================.c:\Program Files\Microsoft Security Client\MsMpEng.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Comodo\Dragon\dragon_updater.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\PnkBstrA.exeC:\WINDOWS\system32\java.exeC:\Program Files\TeamViewer\Version8\TeamViewer_Service.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Microsoft Security Client\msseces.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\system32\svchost.exe -k WudfServiceGroupC:\WINDOWS\System32\svchost.exe -k NetworkServiceC:\WINDOWS\System32\svchost.exe -k LocalServiceC:\WINDOWS\System32\svchost.exe -k LocalServiceC:\WINDOWS\System32\svchost.exe -k imgsvcC:\WINDOWS\System32\svchost.exe -k HTTPFilter.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.google.com/uWindow Title = Microsoft Internet Explorer provided by CenturyTeluSearch Bar = hxxp://inboxtoolbar.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%languageuSearch Page = hxxp://www.google.comuDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8mWindow Title = Microsoft Internet Explorer provided by CenturyTeluProxyServer = 192.168.1.1:80uURLSearchHooks: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - <orphaned>BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dllBHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPToolbar.dllBHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dllBHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dllTB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dllTB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPToolbar.dllEB: {32683183-48a0-441b-a342-7c2a440a9478} - <orphaned>uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [Washer] c:\program files\washer\washer.exe /0uRunOnce: [shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~2.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.3; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; yie8)" -"http://www.miniclip.com/games/shooting-cybertrash-xl/en/"uRunServicesOnce: [washindex] c:\program files\washer\washidx.exemRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartupmRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottimemRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /automRunServicesOnce: [washindex] c:\program files\washer\washidx.exe "Frank"dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -tuPolicies-Explorer: NoDriveTypeAutoRun = dword:145mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1mPolicies-Explorer: NoDriveTypeAutoRun = dword:145IE: &Search - <no file>IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.htmlIE: LastPass - c:\documents and settings\frank.frank-vm4yc7dlu\local settings\application data\lastpass\context.html?cmd=lastpassIE: LastPass Fill Forms - c:\documents and settings\frank.frank-vm4yc7dlu\local settings\application data\lastpass\context.html?cmd=fillformsIE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPToolbar.dllIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeDPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cabDPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cabDPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cabDPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} - hxxp://www.symantec.com/techsupp/activedata/nprdtinf.cabDPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} - hxxp://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cabDPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cabDPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1355462224863DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabDPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -TCP: NameServer = 216.114.192.10 216.114.208.186TCP: Interfaces\{166D28F0-0856-428C-9A70-E15CD8DA88A7} : DHCPNameServer = 216.114.192.10 216.114.208.186Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLLmASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\24.0.1312.56\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chromemASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12.================= FIREFOX ===================.FF - ProfilePath - c:\documents and settings\frank.frank-vm4yc7dlu\application data\mozilla\firefox\profiles\ayv8rio8.default\FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=FF - prefs.js: browser.search.selectedEngine - Ask.comFF - prefs.js: browser.startup.homepage - hxxp://www.google.com/FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=FF - prefs.js: network.proxy.type - 0FF - component: c:\documents and settings\all users.windows\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\coffplgn_2011_7_0_8\components\coFFPlgn.dllFF - component: c:\documents and settings\all users.windows\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\ipsffplgn\components\IPSFFPl.dllFF - component: c:\documents and settings\frank.frank-vm4yc7dlu\application data\mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@lplay.com\components\lptlf.dllFF - component: c:\documents and settings\frank.frank-vm4yc7dlu\application data\mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@lplay.com\components\lptlf2.dllFF - component: c:\documents and settings\frank.frank-vm4yc7dlu\application data\mozilla\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@lplay.com\components\lptlf3.dllFF - component: c:\program files\siteranker\firefox\components\siterank.dllFF - plugin: c:\documents and settings\all users.windows\application data\nexonus\ngm\npNxGameUS.dllFF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dllFF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dllFF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dllFF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: c:\program files\livingplay games\nplplaypop.dllFF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dllFF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dllFF - plugin: c:\program files\netscape\communicator\program\plugins\npaudio.dllFF - plugin: c:\program files\netscape\communicator\program\plugins\npavi32.dllFF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dllFF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dllFF - plugin: c:\program files\netscape\communicator\program\plugins\npnul32.dllFF - plugin: c:\program files\netscape\communicator\program\plugins\NPQTW32.DLLFF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dllFF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dllFF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll.---- FIREFOX POLICIES ----FF - user.js: yahoo.homepage.dontask - true.============= SERVICES / DRIVERS ===============.R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 193552]R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1207000.00d\symds.sys [2012-1-30 340088]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1207000.00d\symefa.sys [2012-1-30 744568]R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users.windows\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\bashdefs\20120121.002\BHDrvx86.sys [2012-1-23 820344]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1207000.00d\ironx86.sys [2012-1-30 136312]R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\comodo\dragon\dragon_updater.exe [2012-3-28 407288]R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-11-13 204800]R2 TeamViewer8;TeamViewer 8;c:\program files\teamviewer\version8\TeamViewer_Service.exe [2013-1-24 3467768]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-11-12 106104]R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users.windows\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\ipsdefs\20120131.002\IDSXpx86.sys [2012-1-31 356280]S2 AMPingService;AMPingService; [x]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate1c9d6fc974d8574;Google Update Service (gupdate1c9d6fc974d8574);c:\program files\google\update\GoogleUpdate.exe [2009-5-17 133104]S2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.7.0.13\ccsvchst.exe [2012-1-30 130008]S3 cpuz132;cpuz132; [x]S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\drivers\dc3d.sys [2012-4-5 45288]S3 NAVENG;NAVENG;c:\documents and settings\all users.windows\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\virusdefs\20120131.032\NAVENG.SYS [2012-2-1 86136]S3 NAVEX15;NAVEX15;c:\documents and settings\all users.windows\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.5.0.125\definitions\virusdefs\20120131.032\NAVEX15.SYS [2012-2-1 1576312]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]S4 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2012-7-11 116608].=============== Created Last 30 ================.2013-01-31 04:31:45 60872 ----a-w- c:\documents and settings\all users.windows\application data\microsoft\microsoft antimalware\definition updates\{64dc7101-6107-495f-b511-b773f2e28dd4}\offreg.dll2013-01-31 03:24:15 6991832 ----a-w- c:\documents and settings\all users.windows\application data\microsoft\microsoft antimalware\definition updates\{64dc7101-6107-495f-b511-b773f2e28dd4}\mpengine.dll2013-01-30 03:24:17 6991832 ----a-w- c:\documents and settings\all users.windows\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll2013-01-29 03:03:22 -------- d-----w- c:\documents and settings\frank.frank-vm4yc7dlu\application data\Malwarebytes2013-01-29 03:03:00 -------- d-----w- c:\documents and settings\all users.windows\application data\Malwarebytes2013-01-29 03:02:56 21104 ----a-w- c:\windows\system32\drivers\mbam.sys2013-01-29 03:02:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2013-01-25 02:27:26 -------- d-----w- c:\program files\TeamViewer2013-01-24 05:03:25 -------- dc-h--w- c:\windows\ie82013-01-24 01:18:47 11004488 ----a-w- c:\program files\common files\lpuninstall.exe2013-01-24 01:17:44 -------- d-----w- c:\program files\LastPass2013-01-24 01:17:44 -------- d-----w- c:\documents and settings\frank.frank-vm4yc7dlu\local settings\application data\LastPass2013-01-22 02:43:51 -------- d-----w- c:\documents and settings\frank.frank-vm4yc7dlu\application data\SUPERAntiSpyware.com2013-01-22 02:43:09 -------- d-----w- c:\program files\SUPERAntiSpyware2013-01-22 02:43:09 -------- d-----w- c:\documents and settings\all users.windows\application data\SUPERAntiSpyware.com.==================== Find3M ====================.2013-01-30 10:53:21 232336 ------w- c:\windows\system32\MpSigStub.exe2012-12-16 12:23:59 290560 ----a-w- c:\windows\system32\atmfd.dll2012-11-15 05:41:41 45832 ----a-w- c:\windows\system32\certsentry.dll2012-11-13 01:25:12 1866368 ----a-w- c:\windows\system32\win32k.sys2012-11-06 02:01:39 1371648 ------w- c:\windows\system32\msxml6.dll2005-12-14 15:04:37 0 --sha-w- c:\program files\common files\system32.dll2005-10-09 16:52:04 774144 ----a-w- c:\program files\RngInterstitial.dll.============= FINISH: 14:09:30.17 ===============mbam-log-2013-01-31 (18-15-46).txtark.txtattach.txt Edited February 4, 2013 by Maurice Naggar Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 4, 2013 ID:643542 Share Posted February 4, 2013 (edited) Hello,Don't you see that you have 2 antivirus programs installed, & both active ?AV: Norton Internet Security *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}Also, Ron had mentioned that to you earlier.IF you have no license for Norton, OR it came pre-loaded on this machine, OR you just thought you'd try it out, then Uninstall it and restart the system one time thereafter.This is a link to the Symantec support site https://support.nort...+tool&version=1where you can download, then SAVE the Norton product removal tool.After saving, then run it. If you are on Vista or Windows 7, do a right-click and Run as Administrator to start the tool.Once all done, Logoff and restat anew.ONLY if you have a valid license for Norton and you are very happy, then in that case uninstall MS security Essentials and restart the system one time thereafter.Tell me which you have kept, & which was removed.You must understand that having two {or more} "active" antivirus monitors will lead to less security, not more.And will also lead to conflicts and deadlocks Also, installing MS Security Essentials (or any other A-V ) IF you suspected an infection beforehand is NOT the thing to do.Do the above, report back, and run a new run of DDS & Copy Paste the new DDS.txt in-line Henceforth, do NOT attach a log. Always Paste all contents inside main-body of reply box. Edited February 4, 2013 by Maurice Naggar Link to post Share on other sites More sharing options...
stfrsl Posted February 5, 2013 Author ID:643633 Share Posted February 5, 2013 I have gone to the link in you reply and have tried to download the Norton Removal Tool, but it opens a new tab with a page that says it can not display the webpage even though my connection is fine. I want to get rid of Norton, as I have said before, but again, I haven't been able to. Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 5, 2013 ID:643642 Share Posted February 5, 2013 hummhhTry this link for the Norton Removal tool ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 7, 2013 ID:644597 Share Posted February 7, 2013 How is it going? Please provide status update. Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 10, 2013 ID:645804 Share Posted February 10, 2013 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts