What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] PC Infected

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Recently internet popups have been appearing, as well as the executable for Malawarebyte (MBAM.exe) seems to have gone missing. Repeated attempts to uninstall and then reinstall it result in the error message "[openevent] could not perform desired action. error code 2" at the end of installation and the program is unable to run with the executable still missing. I tried running RootAppeal, as per the forum's recommendation, and that caused the computer to reset every time I tried. Below you will find my logs from DDS and HijackThis. My apologies for any deviations from the rules. I tried to follow them as closely as possible. DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 21:33:09.46 on Sun 10/25/2009 Internet Explorer: 6.0.2600.0000 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.247.68 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ClamWin\bin\ClamTray.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Carlos\Desktop\dds.scr ============== Pseudo HJT Report =============== mSearch Page = BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [ClamWin] "c:\program files\clamwin\bin\ClamTray.exe" –logon mRun: [sikanevik] Rundll32.exe "c:\windows\system32\zopawibu.dll",a mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k StartupFolder: c:\docume~1\carlos\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE StartupFolder: c:\docume~1\carlos\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab AppInit_DLLs: c:\windows\system32\zopawibu.dll,lubujoko.dll SSODL: fohovewig - {50e9c08a-0b3f-47e3-94f1-3986677cd4dc} - c:\windows\system32\zopawibu.dll STS: jugezatag: {50e9c08a-0b3f-47e3-94f1-3986677cd4dc} - c:\windows\system32\zopawibu.dll LSA: Authentication Packages = msv1_0 nwprovau LSA: Notification Packages = scecli dobipimo.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\carlos\applic~1\mozilla\firefox\profiles\incrbqtt.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - www.google.ca FF - plugin: c:\program files\mozilla firefox\plugins\npitunes.dll FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R3 trid3d;trid3d;c:\windows\system32\drivers\trid3dm.sys [2006-10-16 222336] =============== Created Last 30 ================ 2009-10-25 21:29 34,816 a——- c:\windows\system32\drivers\rootrepeal.sys 2009-10-25 21:29 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-25 21:29 18,520 a——- c:\windows\system32\drivers\mbam.sys 2009-10-25 21:29 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-10-25 20:38 –d—– c:\program files\Trend Micro 2009-10-25 20:28 –d—– c:\docume~1\carlos\applic~1\.clamwin 2009-10-25 20:27 –d—– c:\program files\ClamWin 2009-10-25 20:27 –d—– c:\documents and settings\all users.windows\.clamwin 2009-10-24 13:27 –d—– c:\documents and settings\carlos\PARTYPokerDir ==================== Find3M ==================== 2009-10-24 13:27 1,744 a——- c:\windows\system32\d3d9caps.dat 2009-08-06 18:23 274,288 a——- c:\windows\system32\mucltui.dll 2009-08-06 18:23 215,920 a——- c:\windows\system32\muweb.dll 2009-08-04 18:52 1,193,832 a——- c:\windows\system32\FM20.DLL 2006-12-26 02:36 56 —shr– c:\windows\system32\6C33E08EAD.sys 2009-07-25 19:40 51,200 a–sh— c:\windows\system32\dobipimo.dll 2006-12-26 02:36 1,890 a–sh— c:\windows\system32\KGyGaAvL.sys 2009-07-25 19:40 51,200 a–sh— c:\windows\system32\lubujoko.dll 2009-07-25 19:40 51,200 a–sh— c:\windows\system32\temomelo.dll 2009-07-25 19:45 38,400 a–sh— c:\windows\system32\vapiwusa.dll 2009-07-25 19:45 89,600 a–sh— c:\windows\system32\zopawibu.dll ============= FINISH: 21:33:32.85 =============== Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:42:16 PM, on 10/25/2009 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ClamWin\bin\ClamTray.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" –logon O4 - HKLM\..\Run: [sikanevik] Rundll32.exe "c:\windows\system32\zopawibu.dll",a O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O20 - AppInit_DLLs: c:\windows\system32\zopawibu.dll,lubujoko.dll O21 - SSODL: fohovewig - {50e9c08a-0b3f-47e3-94f1-3986677cd4dc} - c:\windows\system32\zopawibu.dll O22 - SharedTaskScheduler: jugezatag - {50e9c08a-0b3f-47e3-94f1-3986677cd4dc} - c:\windows\system32\zopawibu.dll O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe – End of file - 3219 bytes Thank you!

Attachments:

Post #2
Hi there :)

Please delete your existing copy of ComboFix.

Please download ComboFix to your desktop from one of these locations. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]
  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI