BleepingComputer.com: infected with unknown

Not sure about this one. Can't open any browser and internet connection doesnt work. I disconnected the pc from the network in case it tries to phone home. I'm posting from a different computer.

Here's the log. Any help would greatly be appreciated.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:22:19 PM, on 2009-06-29
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\WINDOWS\system32\drivers\smss.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Garmin\gStart.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\brfbaa.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\txaaaar7.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\program Files\Manson\liser.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\yow1a.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\netsh.exe
C:\WINDOWS\system32\netsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\mdm.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\spoolsv.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\win.exe
C:\DOCUME~1\Jose\LOCALS~1\Temp\lsass.exe
C:\WINDOWS\system32\netsh.exe
C:\Tools\HJT\HijackThis.exe
C:\Documents and Settings\Jose\Jose.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\smss.exe
O2 - BHO: C:\WINDOWS\system32\gsf83iujid.dll - {d76ab2a1-00f3-42bd-f434-00bbc39c8953} - C:\WINDOWS\system32\gsf83iujid.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [] C:\DOCUME~1\Jose\LOCALS~1\Temp\yow1a.exe
O4 - HKCU\..\Run: [hsf7husjnfg98gi498aejhiugjkdg4] C:\DOCUME~1\Jose\LOCALS~1\Temp\yow1a.exe
O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\Jose\LOCALS~1\Temp\lsass.exe
O4 - HKCU\..\Run: [kell] C:\program Files\Manson\liser.exe
O4 - HKCU\..\Run: [Jose] C:\Documents and Settings\Jose\Jose.exe /i
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: fmnupd32.exe
O4 - Startup: zqosys32.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\1389368734.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\1389368734.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.4.8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1152131821640
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: unlubi.dll,c:\progra~1\Manson\liser.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\
O20 - Winlogon Notify: __c00bb4d9 - C:\WINDOWS\system32\__c00BB4D9.dat
O21 - SSODL: eytVMNFYSM - {883B8659-2291-2CF3-5106-E7028DB3C5FE} - C:\WINDOWS\system32\txz.dll
O22 - SharedTaskScheduler: rtasgvfu76ew8ndkfno94 - {D76AB2A1-00F3-42BD-F434-00BBC39C8953} - C:\WINDOWS\system32\gsf83iujid.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9c08f9b7a88c8) (gupdate1c9c08f9b7a88c8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 10398 bytes

Hi and welcome to the HijackThis Logs and Virus/Trojan/Spyware/Malware Removal forum,

I am and I am here to help you!

I ask that you refrain from running tools other than those we suggest to you while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Please perform all steps in the order received and do not proceed if you need clarification.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

As I am in the final stages of training an Expert Coach will also oversee your fix. Your benefit will be "four eyes and two brains" but responses may be somewhat delayed so please be patient!!!!

I would also like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please be courteous and appreciative for the assistance provided!

==========

Please download:
OTS
and save it to your desktop:
- Double click and run
If you are running on Vista then right-click the program and choose Run as Administrator.

- Please check &
- Next press

- When the scan is complete Notepad will open with the report file loaded in it.
- Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
- Use the Add Reply button in the forum and Attach the scan back here (do not copy/paste it as it will be too big to fit)
- The log will be located in the OTS folder and named OTS.txt.

==========

With your next post please provide:

* OTS.txt (attached please)

I will review your logs and post instructions forthcoming.
Regards,
t

thanks for your help! the file should be attached.

is this still open?

Hi there.
Indeed it is still open.

I spent the good part of last night reviewing your logs and creating a fix. I am now waiting for an Expert Coach to approve the fix. It is extremely busy around here so I appreciate your patience.
Please stay tuned and I will post back hopefully soon with your instructions.

Let me remind you. And this is particularly important now. Please make no changes to that computer unless I direct you to do so.

Kind regards,
t

ahh ok, just checking . The machine is in standby right now with no internet connection. Awaiting your instructions...


Thanks!


-Jose

Hi,
I am still waiting for an approval to proceed with your fix. Again I apologize for the delay and appreciate your patience.
Kind regards,
t

ok, thanks for the status update.

Again, I am so sorry for the delay. It will hopefully be soon that we can begin the repair.

Hello.
Your computer is severly infected to the point with which it might not be recoverable. If you would like to format the hard drive and reinstall the OS let me know and I will guide you. Otherwise.....
Let's begin.
Please note.............

==========

Until I can get your internet connection reestablished you will need to transfer programs from a clean computer to the sick one. It is very important that you avoid 2 way media like a flash drive for this purpose. You will risk infection in your good computer. Please burn to CD for this reason.

==========

P2P Warning

Your log indicates that you have Limewire/ Bitorrent/ uTorrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.

- They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.

- Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.

- The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Note: It is pretty much certain that if you continue to use P2P programs, then you will get infected again.
I would recommend that you uninstall Limewire/ Bitorrent/ uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel>> Add / Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

==========

We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.

• Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
  
• If prompted with a legal dialog, accept the warning.
  
• Click and then on "Advanced Mode"
  
  
• You may be presented with a warning dialog. If so, press
  
• Click on
  
• Click on
  
• Uncheck this checkbox:
  
  
• Close/Exit Spybot Search and Destroy

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.
Then run ResetTeaTimer.exe.
This will only take a few seconds.

==========

Please download Malwarebytes Anti-Malware

You will likely have to download it from a clean computer and burn it to CD. Then transfer it to the infected computer like you did with OTS.

alternate download link 1
alternate download link 2

NOTE: Before saving MBAM please rename it to thcbytes.exe then save it to your desktop.

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

If MBAM will not install, try renaming it this way.

• Right-click on the mbam-setup.exe file file and rename it to mysetup.exe.
  
• Double-click on mysetup.exe to start the installation.
  
• If that did not work, then try renaming and changing the file extension. <- click this link if you do not see the file extension
  
• Right-click on the mbam-setup.exe file, rename it to mysetup and change the .exe extension to .scr, .com, .pif, or .bat.
  
• Then double-click on mysetup.scr (or whatever extension you renamed it) to begin installation.

If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files.

• Right-click on mbam.exe, rename it to myscan.exe.
  
• Double-click on myscan.exe to launch the program.
  
• If that did not work, then try renaming and change the .exe extension in the same way as noted above.
  
• Double-click on myscan.scr (or whatever extension you renamed it) to launch the program.

If using Windows Vista, refer to How to Change a File Extension in Windows Vista.



==========

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop. You will likely need to burn it to disc from a clean computer 1st.

Link 1
Link 2
Link 3





--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.

• Please post the C:\ComboFix.txt log

==========

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

==========

With your next post please provide:

* MBAM log
* Combofix.txt
* Gmer log
* Are you able to connect to the internet yet?

Kind regards,
t

i ran mbam and it found a bunch of infected objects. I click removed and it said it needed to reboot in order to remove some files. I rebooted... When the computer came back on it automatically launched a "System Security" software that started scanning my pc and it changed my background to something saying I'm in danger and that I need to buy this anti spyware program. I can not run anything because this system security software automatically closes the program. It's pretty much got my system hijacked at this point. I can not boot into safe mode either. Any ideas how I can make this program NOT run at startup? I do have the recovery console installed, I just don't know how to use it.

Again, it seems a program called "system security" which looks like an antispyware scanner is running in the background and its preventing me from running ANY program and anything. I can't even open up a txt file.

Hi there.
No worries.
We will work our way through this.

Few questions.

You were able to run MBAM and that is good. Did you have to rename it?
Did you try the next step? Rename Combofix and try to run it? If not please do so now!
Are you still without an internet connection?

Also....
I would like to see that MBAM log if possible. Please re-open MBAM (or whatever you renamed it) click on the logs tab and copy and paste me the most recent log please.

Thanks,
t

attached is the MBAM log. Like I said, when I clicked on "Remove Selected" it told me it had to reboot to delete a few more infected objects. AFTER it rebooted, it started doing what its doing now so I could not proceed with combofix. Internet is back up and I'm posting this using the laptop. Ironically, internet explorer is the only program it allows me to run.

Hi,
Well done.
Thanks for the log!
What a mess of infections you have there.
Please copy and paste all logs into your reply unless otherwise directed as I have done below.

==========

Before we get started....Reboot again!!!

==========

More clarification please.
Did you try to rename Combofix as I suggested? How did you go about downloading Combofix? Direct download or transfer via CD?

==========

Now that you have an internet connection I would like you to start over.
Do this first............

Please start by running MBAM again. Do not download MBAM again!!! Just open it up and click the update tab 1st. Then run a full scan and reboot!!

==========

Next do this please.....

We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.

• Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
  
• If prompted with a legal dialog, accept the warning.
  
• Click and then on "Advanced Mode"
  
  
• You may be presented with a warning dialog. If so, press
  
• Click on
  
• Click on
  
• Uncheck this checkbox:
  
  
• Close/Exit Spybot Search and Destroy

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.
Then run ResetTeaTimer.exe.
This will only take a few seconds.

==========

Please delete any copies of combofix you have on your desktop!

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3





--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.

• Please post the C:\ComboFix.txt log

==========

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

==========

With your next post please provide:

* Answer to my questions
* New MBAM log
* Combofix.txt
* Gmer log

Kind regards,
t

==========

Your MBAM log:

Malwarebytes' Anti-Malware 1.38
Database version: 2369
Windows 5.1.2600 Service Pack 3

2009-07-03 12:43:50 PM
mbam-log-2009-07-03 (12-43-50).txt

Scan type: Quick Scan
Objects scanned: 111771
Time elapsed: 4 minute(s), 32 second(s)

Memory Processes Infected: 6
Memory Modules Infected: 4
Registry Keys Infected: 14
Registry Values Infected: 9
Registry Data Items Infected: 9
Folders Infected: 1
Files Infected: 101

Memory Processes Infected:
C:\WINDOWS\system32\drivers\smss.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\Documents and Settings\Jose\Local Settings\Temp\yow1a.exe (Trojan.Agent) -> Unloaded process successfully.
C:\program Files\Manson\liser.exe (Trojan.Dropper) -> Unloaded process successfully.
C:\Documents and Settings\Jose\Local Settings\Temp\yow1a.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\Jose\Local Settings\Temp\winlogon.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Documents and Settings\Jose\Jose.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\1389368734.dll (Hijack.LSP) -> Delete on reboot.
C:\WINDOWS\system32\__c00BB4D9.dat (Trojan.Vundo) -> Delete on reboot.
c:\program files\sys\sys.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\gsf83iujid.dll (Trojan.Ertfor) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Zlob.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00bb4d9 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sys (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sys (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sys (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Ertfor) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lich (Spyware.Passwords) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lich (Spyware.Passwords) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lich (Spyware.Passwords) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dailybucks_install.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sysdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sysdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysdrv (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Zlob.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf7husjnfg98gi498aejhiugjkdg4 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kell (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows system recover! (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WINID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\sys (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\drivers\smss.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Agent) -> Data: c:\progra~1\manson\liser.dll -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7998DC37-D3FE-487C-A60A-7701FCC70CC6}\InprocServer32\(default) (Hijack.Repdrvfs) -> Bad: (\\?\globalroot\systemroot\installer\52ceb61e.msi) Good: (repdrvfs.dll) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\smss.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Manson (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\gsf83iujid.dll (Trojan.Zlob.H) -> Delete on reboot.
C:\WINDOWS\system32\1389368734.dll (Hijack.LSP) -> Delete on reboot.
C:\WINDOWS\system32\__c00BB4D9.dat (Trojan.Vundo) -> Delete on reboot.
c:\program files\sys\sys.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\smss.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jose\Local Settings\Temp\yow1a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\program Files\Manson\liser.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jose\Local Settings\Temp\brfbaa.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jose\Local Settings\Temp\winlogon.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\ld11.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lich.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\qgcg84j0en45.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sdjee3inf.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sgcl84j0en45.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ucxqmhk.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\wbem\grpconv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\wbem\proquota.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\giyghshu.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\lrrrcoe.exe (Trojan.Clopack) -> Quarantined and deleted successfully.
c:\mupwjiav.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\3120741024.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\366271558.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\39553362.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\648121014.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\650933514.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\701402264.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\960152264.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\aklm8sv.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\asa7hridf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\dailybucks_install.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\db.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\debug.exe (Trojan.Downloader) -> Delete on reboot.
c:\documents and settings\Jose\local settings\Temp\dqw2oovqln.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\egpu5ows2.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\lht14liew1.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\ms1246233520.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\notepad.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\o9fda.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\ookiap1h.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\q68d92m91.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\qoyt43.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\rsyncini.exe (Trojan.Shutdowner) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\ry7kzf.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\sstw5di3l.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\svchost.exe (Trojan.Downloader) -> Delete on reboot.
c:\documents and settings\Jose\local settings\Temp\system.exe (Trojan.Downloader) -> Delete on reboot.
c:\documents and settings\Jose\local settings\Temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\thz8ec.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\txaaaar7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\win.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\winamp.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\ycc74wo.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\yme36px10.exe (Rogue.AntiVirusBest) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\zjhufhdfe.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\zzzmmvev.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\_A00F52CEB301.exe (Trojan.Clopack) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\~TMA1.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\~TMA7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\~TMB4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\~TMBB.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\Temp\~TMC2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv271245692744.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv651245692744.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\cct.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\Jose.exe (Trojan.Agent) -> Delete on reboot.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\atnaa[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\ccsuper2[1].htm (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\dailybucks_install[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\oheefst[1].txt (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\oheefst[2].txt (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\ouuivaan[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\2OR2KN0P\qjkxpcp[1].htm (Trojan.Clopack) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\HO96S8RY\ccsuper1[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\HO96S8RY\ccsuper3[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\HO96S8RY\karb[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\HO96S8RY\qwtkll[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\QI401WLG\atnaa[2].htm (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\QI401WLG\click[2].jpg (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\QI401WLG\db[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\QI401WLG\lakkl[1].htm (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\QI401WLG\lakkl[2].htm (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\QI401WLG\pdrv[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\V8VZM3C0\agpdd[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\V8VZM3C0\ccsuper0[1].htm (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\local settings\temporary internet files\Content.IE5\V8VZM3C0\installb[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\start menu\Programs\Startup\fmnupd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\start menu\Programs\Startup\zqosys32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\Manson\liser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\Local Settings\Temp\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv341245771011.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\Local Settings\Temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\p2hhr.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\beep.sys (Fake.Beep.sys) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lich.dat (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\Application Data\wiaservg.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Jose\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.
C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Program Files\sys\sys.sys (Trojan.Agent) -> Quarantined and deleted successfully.

I'm not sure you're really understanding what I tried to say. Let me clarify:

1. I downloaded all the programs you told me to download and I burned them onto a cd.
2. I transfered all the programs to the infected computer.
3. I installed MBAM and ran in. I generated the log I posted and after I selected "remove selected" it removed a bunch of stuff and then at the end it said it needed to reboot in order to remove the remaining items. I clicked ok and the computer rebooted. Please note that at that time, I had NOT ran combo fix yet.
4. When the computer came back up from a reboot thats when it started doing what its doing now. Upon startup, when I log in, i see my background and but then it changes to a different background with text written on it saying im infected and that I need to purchase some anti virus software. At that point, a program called "system security" starts up automatically and starts to scan my computer. Please note that even when I try to close this program it just minimizes to my tray and something running in the background closes every single program that I try to run. No matter what program I click on, it auto closes it. The only thing it allows me to run is Internet Explorer.

My guess is that we first gotta some how remove that program(s) from starting up so that I can run other tools. I can't boot into safe mode either, as it loads some drivers, the computer auto reboots.

So to answer your questions:

- Yes I downloaded and burned all software.
- Yes, i renamed combofix to combo-fix.
- I did not have to rename mbam

Unfortunately your instructions are having me run mbam again but like I said, I can not run any program because there seems to be something running in the background that auto terminates anything I try to run.

Awaiting your advice.