BleepingComputer.com: Fake "Blaster Worm" Malware Infection

Hello, and thank you in advance.
My computer seems to have been infected with that fake "Blaster Worm" malware. I've tried to clear it up with the tutorial on here, and have tried multiple (separately) malware detector and removal programs, to no avail. Most of them find no threat or problem, the only one that did find anything was the ESET online scanner. It says it removed it, but when I started back up in normal mode, it was not fixed. I have been running all of these in safe mode with networking, which is also how I am posting this. I have tried Malwarebytes, ESET online scanner, Kaspersky, and Hitman Pro 3.5 free trial.
What should I do next?
Thanks again,
Sabire

Hello and welcome. I am unsut=re as to what you have done so please do these..
Run TFC by OT (Temp File Cleaner)
Please download TFC by Old Timer and save it to your desktop.
alternate download link

Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (2.6.11.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these[/color] instructions. In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer.


Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1
Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware



Finallt...Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
  
• Report IE Proxy Settings
  
• Reset IE Proxy Settings
  
• Report FF Proxy Settings
  
• Reset FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List Winsock Entries
  
• List last 10 Event Viewer log
  
• List Installed Programs
  
• List Users, Partitions and Memory size.
  
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

[color="#008000"] Note: When using "Reset FF Proxy Settings" option Firefox should be closed.

Hi, thank you for replying so soon, I appreciate it.
I was able to follow the first two directions-I ran TFC and TDSSKiller.exe.
When I ran TDSSKiller, the scan turned up nothing. Nothing was found. When I attempted the next step, running Malwarebytes, while in safe mode, I was blocked from doing so. Even after I renamed it. Also while in safe mode, I am now getting the malware pop-ups from "Vista Home Security 2012". I can't run anything in safe mode now. It lets me download, but when I go to run the program nothing happens but the malware popups.
Thanks,
Sabire

I am attempting to post the MiniToolBox report, but keep getting an error message, that says my "connection was reset".
Edited to add-it let me post this just fine. But not the report. I restarted again in safe mode with networking, I'm still getting nowhere with my renamed Malwarebytes, it simply won't run at all, but I was able to run the MiniToolBox.

This post has been edited by sabire148: 03 December 2011 - 09:33 AM

Nevermind, please see log below. This one had posted incomplete.

This post has been edited by sabire148: 03 December 2011 - 05:41 PM

Still couldn't post this in Windows for some reason. I copy and pasted it into an email, mailed it to myself, and then posted it with my ipod. So strange that it wouldn't work here in Windows, in safe mode. Even when I tried to edit the above post, to add this, it wouldn't work.

MiniToolBox by Farbar
Ran by sabire148 (administrator) on 03-12-2011 at 06:08:24
Windows ™ Vista Home Premium Service Pack 2 (X64)

***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"network.proxy.http", "127.0.0.1"
"network.proxy.http_port", 55071
"network.proxy.type", 4

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

Hosts file not detected in the default directory
========================= IP Configuration: ================================

Intel® WiFi Link 5100 AGN = Wireless Network Connection (Connected)
Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller = Local Area Connection (Media disconnected)
The following helper DLL cannot be loaded: IFMON.DLL.
The following command was not found: int ip dump.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : madster-pc
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel® WiFi Link 5100 AGN
   Physical Address. . . . . . . . . : 00-22-FB-3E-23-8E
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::9889:2305:5be5:7ea7%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.2.103(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Saturday, December 03, 2011 6:04:16 AM
   Lease Expires . . . . . . . . . . : Saturday, December 10, 2011 6:04:15 AM
   Default Gateway . . . . . . . . . : 192.168.2.1
   DHCP Server . . . . . . . . . . . : 192.168.2.1
   DHCPv6 IAID . . . . . . . . . . . : 268443997
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-11-89-B2-6B-00-1D-BA-B7-C7-95
   DNS Servers . . . . . . . . . . . : 192.168.2.1
                                       192.168.2.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller
   Physical Address. . . . . . . . . : 00-1D-BA-B7-C7-95
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{A49A13E0-82E9-4164-B3A2-9C15A67C0FD9}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 14:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{CE7A46A1-9FFA-4A3D-A12C-7860E8DAA888}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 13:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 02-00-54-55-4E-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 23:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{A49A13E0-82E9-4164-B3A2-9C15A67C0FD9}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 24:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{4D79E346-693B-42B9-8833-DEB5B9F16498}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes


Pinging google.com [173.194.33.50] with 32 bytes of data:

Reply from 173.194.33.50: bytes=32 time=49ms TTL=50

Reply from 173.194.33.50: bytes=32 time=49ms TTL=50



Ping statistics for 173.194.33.50:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 49ms, Maximum = 49ms, Average = 49ms



Pinging yahoo.com [72.30.2.43] with 32 bytes of data:

Reply from 72.30.2.43: bytes=32 time=51ms TTL=53

Reply from 72.30.2.43: bytes=32 time=50ms TTL=53



Ping statistics for 72.30.2.43:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 50ms, Maximum = 51ms, Average = 50ms



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:

Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
 11 ...00 22 fb 3e 23 8e ...... Intel® WiFi Link 5100 AGN
 10 ...00 1d ba b7 c7 95 ...... Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller
  1 ........................... Software Loopback Interface 1
 29 ...00 00 00 00 00 00 00 e0  isatap.{A49A13E0-82E9-4164-B3A2-9C15A67C0FD9}
 32 ...00 00 00 00 00 00 00 e0  isatap.{CE7A46A1-9FFA-4A3D-A12C-7860E8DAA888}
 16 ...00 00 00 00 00 00 00 e0  Microsoft ISATAP Adapter #3
 14 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
 31 ...00 00 00 00 00 00 00 e0  isatap.{A49A13E0-82E9-4164-B3A2-9C15A67C0FD9}
 30 ...00 00 00 00 00 00 00 e0  isatap.{4D79E346-693B-42B9-8833-DEB5B9F16498}
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1    192.168.2.103     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0    192.168.2.104    192.168.2.103     26
      192.168.2.0    255.255.255.0         On-link     192.168.2.103    281
    192.168.2.103  255.255.255.255         On-link     192.168.2.103    281
    192.168.2.255  255.255.255.255         On-link     192.168.2.103    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.2.103    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.2.103    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
      169.254.0.0      255.255.0.0    192.168.2.104       1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
 11    281 fe80::/64                On-link
 11    281 fe80::9889:2305:5be5:7ea7/128
                                    On-link
  1    306 ff00::/8                 On-link
 11    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 mswsock.dll [File Not found] ()
Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [50176] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [62464] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [62464] (Microsoft Corporation)
Catalog5 05 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Catalog5 06 mswsock.dll [File Not found] ()
Catalog5 07 C:\Windows\SysWOW64\winrnr.dll [19968] (Microsoft Corporation)
Catalog5 08 C:\Windows\SysWOW64\wshbth.dll [34304] (Microsoft Corporation)
Catalog9 01 mswsock.dll [File Not found] ()
Catalog9 02 mswsock.dll [File Not found] ()
Catalog9 03 mswsock.dll [File Not found] ()
Catalog9 04 mswsock.dll [File Not found] ()
Catalog9 05 mswsock.dll [File Not found] ()
Catalog9 06 mswsock.dll [File Not found] ()
Catalog9 07 mswsock.dll [File Not found] ()
Catalog9 08 mswsock.dll [File Not found] ()
Catalog9 09 mswsock.dll [File Not found] ()
Catalog9 10 mswsock.dll [File Not found] ()
Catalog9 11 mswsock.dll [File Not found] ()
x64-Catalog5 01 mswsock.dll [File Not found] ()
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [62976] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [78848] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [78848] (Microsoft Corporation)
x64-Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [193824] (Apple Inc.)
x64-Catalog5 06 mswsock.dll [File Not found] ()
x64-Catalog5 07 C:\Windows\System32\winrnr.dll [27648] (Microsoft Corporation)
x64-Catalog5 08 C:\Windows\System32\wshbth.dll [44032] (Microsoft Corporation)
x64-Catalog9 01 mswsock.dll [File Not found] ()
x64-Catalog9 02 mswsock.dll [File Not found] ()
x64-Catalog9 03 mswsock.dll [File Not found] ()
x64-Catalog9 04 mswsock.dll [File Not found] ()
x64-Catalog9 05 mswsock.dll [File Not found] ()
x64-Catalog9 06 mswsock.dll [File Not found] ()
x64-Catalog9 07 mswsock.dll [File Not found] ()
x64-Catalog9 08 mswsock.dll [File Not found] ()
x64-Catalog9 09 mswsock.dll [File Not found] ()
x64-Catalog9 10 mswsock.dll [File Not found] ()
x64-Catalog9 11 mswsock.dll [File Not found] ()

========================= Event log errors: ===============================

Application errors:
==================
Error: (12/03/2011 06:05:09 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/03/2011 06:04:39 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:39 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:39 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:39 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:38 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:38 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:38 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/03/2011 06:04:30 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabThe data is invalid.

Error: (12/03/2011 06:04:17 AM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c


System errors:
=============
Error: (12/03/2011 06:05:09 AM) (Source: Service Control Manager) (User: )
Description: DMICall
ehdrv
SASDIFSV
SASKUTIL
spldr
Wanarpv6

Error: (12/03/2011 06:05:09 AM) (Source: Service Control Manager) (User: )
Description: IPsec Policy AgentBFE

Error: (12/03/2011 06:05:09 AM) (Source: Service Control Manager) (User: )
Description: IKE and AuthIP IPsec Keying ModulesBFE

Error: (12/03/2011 06:05:09 AM) (Source: Service Control Manager) (User: )
Description: epfwwfpBFE

Error: (12/03/2011 06:05:09 AM) (Source: Service Control Manager) (User: )
Description: Computer BrowserServer%%1068

Error: (12/03/2011 06:04:25 AM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (12/03/2011 06:04:24 AM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (12/03/2011 06:04:20 AM) (Source: DCOM) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}

Error: (12/03/2011 06:04:17 AM) (Source: DCOM) (User: )
Description: 1084EventSystem{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (12/03/2011 06:04:10 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: SYSTEM)
Description: C:\Windows\System32\IWMSSvc.dll21


Microsoft Office Sessions:
=========================

=========================== Installed Programs ============================


 (Version: 1.2.0.20080915.0)
 (Version: 2.1.00.06270)
 Update for Microsoft Office 2007 (KB2508958)
AAC Decoder (Version: 7.1.0)
Adobe AIR (Version: 1.0.4990)
Adobe AIR (Version: 1.0.8.4990)
Adobe Flash Player 10 ActiveX (Version: 10.0.22.87)
Adobe Flash Player 10 Plugin (Version: 10.3.183.7)
Adobe Reader 9 (Version: 9.0.0)
Alps Pointing-device for VAIO
Apple Application Support (Version: 1.4.1)
Apple Mobile Device Support (Version: 3.3.0.69)
Apple Software Update (Version: 2.1.1.116)
ArcSoft Magic-i Visual Effects 2 (Version: 2.0.1.39)
ArcSoft WebCam Companion 2
AutoUpdate (Version: 1.1)
Bonjour (Version: 2.0.3.0)
Canon Easy-PhotoPrint EX
Canon Easy-WebPrint EX
Canon IJ Network Scanner Selector EX
Canon IJ Network Tool
Canon Inkjet Printer/Scanner/Fax Extended Survey Program
Canon MP Navigator EX 4.1
Canon MX410 series MP Drivers
Canon MX410 series User Registration
Canon My Printer
Canon Solution Menu EX
Canon Speed Dial Utility
Click to Disc (Version: 1.2.52.09250)
Click to Disc Editor (Version: 1.2.51)
Compatibility Pack for the 2007 Office system (Version: 12.0.6425.1000)
DivX Codec (Version: 6.9.1)
DivX Converter (Version: 7.1.0)
DivX Player (Version: 7.2.0)
DivX Plus DirectShow Filters
DivX Plus Web Player (Version: 2.0.0)
DivX Version Checker (Version: 7.1.0.9)
Dolby Control Center (Version: 1.2.0702)
EPSON Artisan 810 Series Printer Uninstall
Epson Event Manager (Version: 2.30.01)
Epson FAX Utility (Version: 1.00.01)
Epson PC-FAX Driver
Epson Print CD (Version: 2.00.00)
EPSON Scan
ESET Online Scanner v3
ESET Smart Security (Version: 4.2.71.2)
Eyeball Chat (Version: 52.02.1)
Google Chrome (Version: 15.0.874.121)
Google Earth (Version: 6.1.0.5001)
Google SketchUp 8 (Version: 3.0.4811)
Google Talk Plugin (Version: 2.5.8.4958)
Google Update Helper (Version: 1.3.21.79)
H.264 Decoder (Version: 1.1.0)
HDAUDIO SoftV92 Data Fax Modem with SmartCP
HiJackThis (Version: 1.0.0)
Hitman Pro 3.5 (Version: 3.5.9.131)
Intel PROSet Wireless
Intel® Graphics Media Accelerator Driver
Intel® PROSet/Wireless WiFi Software (Version: 12.01.1000)
iPhone Configuration Utility (Version: 2.1.0.163)
iTunes (Version: 10.1.1.4)
Java Auto Updater (Version: 2.0.5.1)
Java™ 6 Update 26 (Version: 6.0.260)
Java™ SE Runtime Environment 6 (Version: 1.6.0.0)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Home and Student 2007 (Version: 12.0.6425.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6425.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6425.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Suite Activation Assistant (Version: 2.9)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Silverlight (Version: 4.0.60831.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Works (Version: 9.7.0621)
MKV Splitter (Version: 1.0.1)
MobileMe Control Panel (Version: 3.1.5.0)
Mozilla Firefox 8.0 (x86 en-US) (Version: 8.0)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
Music Transfer (Version: 1.2.00.17290)
OpenMG Secure Module 5.1.00 (Version: 5.1.00.05200)
Primo (Version: 1.00.0000)
QuickBooks Simple Start 2009 (Version: 19.0.4001.703)
QuickTime (Version: 7.69.80.9)
RealPlayer
Realtek High Definition Audio Driver (Version: 2.62)
Regi (Version: 1.00.0000)
Roxio Central Audio (Version: 3.7.0)
Roxio Central Copy (Version: 3.7.0)
Roxio Central Core (Version: 3.7.0)
Roxio Central Data (Version: 3.7.0)
Roxio Central Tools (Version: 3.7.0)
Roxio Easy Media Creator 10 LJ (Version: 10.1)
Roxio Easy Media Creator Home (Version: 10.1.296)
Safari (Version: 5.33.17.8)
Setting Utility Series (Version: 4.2.0.10150)
Skype web features (Version: 1.0.3971)
Skype™ 4.1 (Version: 4.1.179)
Sony Picture Utility (Version: 3.3.01.09300)
Sony Video Shared Library (Version: 3.5.00)
SpywareBlaster 4.5 (Version: 4.5.0)
SUPERAntiSpyware (Version: 5.0.1118)
SupportSoft Assisted Service (Version: 15)
trailblazers (Version: 3.0.1.49)
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VAIO Care (Version: 2.01.1031)
VAIO Content Folder Setting (Version: 2.1.0.08260)
VAIO Content Folder Watcher (Version: 1.0.01.09030)
VAIO Content Metadata Intelligent Analyzing Manager (Version: 3.3.0.10012)
VAIO Content Metadata Manager Setting (Version: 3.3.0.09300)
VAIO Content Metadata XML Interface Library (Version: 3.3.0.09182)
VAIO Control Center (Version: 3.2.0.09120)
VAIO Data Restore Tool (Version: 1.0.04.01170)
VAIO DVD Menu Data Basic (Version: 1.0.00.08130)
VAIO Entertainment Platform (Version: 3.2.3.10070)
VAIO Event Service (Version: 4.2.0.10172)
VAIO Help and Support (Version: 7.00.1023.FW)
VAIO Launcher (Version: 2.2.0.09090)
VAIO Media plus (Version: 1.2.0.10230)
VAIO Media plus Opening Movie (Version: 1.2.0.09050)
VAIO Movie Story (Version: 1.3.01.08060)
VAIO Movie Story Template Data (Version: 1.3.00.06120)
VAIO MusicBox (Version: 2.1.1.09160)
VAIO MusicBox Sample Music (Version: 1.1.00.14140)
VAIO My Memory Center (Version: 2.00.1029)
VAIO OOBE and Welcome Center (Version: 7.00.1022.US)
VAIO Original Function Setting (Version: 1.5.00.08150)
VAIO Power Management (Version: 3.2.0.10200)
VAIO Presentation Support (Version: 1.1.0.08250)
VAIO Startup Assistant (Version: 4.00.1030)
VAIO Survey (Version: 6.00.0722)
VAIO Update 4 (Version: 4.0.0.08280)
VAIO Wallpaper Contents (Version: 1.3.0.10310)
VAIO Wireless Wizard (Version: 2.00.1013)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
Veoh Web Player (Version: 1.1.2.0000)
Visual C++ 8.0 Runtime Setup Package (x64) (Version: 8.0.0.35)
WD SmartWare (Version: 1.4.1.1)
WIDCOMM Bluetooth Software 6.2.0.5800 (Version: 6.2.0.5800)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
WinDVD BD for VAIO (Version: 8.0-B9.617)
Yahoo! Messenger

========================= Memory info: ===================================

Percentage of memory in use: 16%
Total physical RAM: 3934.11 MB
Available physical RAM: 3301.41 MB
Total Pagefile: 8047.51 MB
Available Pagefile: 7533.47 MB
Total Virtual: 4095.88 MB
Available Virtual: 3993.3 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:287.59 GB) (Free:214.44 GB) NTFS
4 Drive g: (LEAP_FROG_LETTER_FACTORY) (CDROM) (Total:2.66 GB) (Free:0 GB) UDF

========================= Users: ========================================

User accounts for \\MADSTER-PC

Administrator            Guest                    sabire148               

========================= Minidump Files ==================================

C:\Windows\Minidump\Mini082209-01.dmp
C:\Windows\Minidump\Mini101311-01.dmp
C:\Windows\Minidump\Mini101311-02.dmp
C:\Windows\Minidump\Mini101411-01.dmp

**** End of log ****

Do you know what blocked MBAM ??
It may have been your Antivirus?
Did you het any error message?

What did ESET find?

I unfortunately don't remember what it said the ESET online scan found and removed, and I don't have a log of it. Prior to this infection, Malwarebytes always worked. I am assuming it's the malware blocking it from running? I dont get any error message when I try to open it. At first the malware popups would say "mbam.exe is infected", I changed the name of it again after that, it still won't run. It's now called "iexplore.exe", but it hasn't made a difference, I get no response from that program. This infection appeared a couple days ago-initially, I was able to run Malwarebytes. I ran it a couple times, as a full scan and a quick scan. Both times, absolutely nothing turned up in the scan. According to those Malwarebytes scans I was clean, but that's clearly not the case.

Ok,The ESET Online Scanner saves a log file after running, which can be examined or sent in to ESET for further analysis. The path to the log file is "C:\Program Files\EsetOnlineScanner\log.txt". You can view this file by navigating to the directory and double-clicking it in Windows Explorer, or by copying and pasting the path specification above (including the quotation marks) into the Start >> Run dialog box from the Start Menu on the desktop.



1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
2. Restart your computer (very important).
3. Download and run this utility. Mbam clean
4. It will ask to restart your computer (please allow it to).
5. After the computer restarts, install the latest version from here. http://www.malwarebytes.org/mbam-download.php
Note: You will need to reactivate the program using the license you were sent.
Note: If using Free version, ignore the part about putting in your license key and activating.
Launch the program and set the Protection and Registration.
Then go to the UPDATE tab if not done during installation and check for updates.
Restart the computer again and verify that MBAM is in the task tray and run a Quick Scan and post that log.

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c1976f1ab741454785329d6ddac8d4fe
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-12-02 07:10:29
# local_time=2011-12-01 11:10:29 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=768 16777215 100 0 0 0 0 0
# compatibility_mode=1024 16777215 100 0 77542485 77542485 0 0
# compatibility_mode=5892 16776573 100 56 0 159407403 0 0
# compatibility_mode=8201 39157246 100 66 4060716 27850337 0 0
# scanned=32459
# found=0
# cleaned=0
# scan_time=1131
# nod_component=V3 Build:0x30000000

I uninstalled Malwarebytes and restarted my computer. I then clicked on the Mbam Clean link you gave above, clicked save file, and it downloaded. But when I go to my Downloads menu and click on the download, and then click run, nothing happens. The little Windows spinner shows up, then disappears, and nothing happens. So I've been unable to install anything you instructed me to install up above unfortunately.

This infection changes settings on your computer so that when you launch an executable, a file ending with .exe, it will instead launch the infection rather than the desired program. To fix this we must first download a Registry file that will fix these changes. From a clean computer, please download the following file and save it to a removable media such as a CD/DVD, external Drive, or USB flash drive.

FixNCR.reg

insert the removable device into the infected computer and open the folder the drive letter associated with it. You should now see the FixNCR.reg file that you had downloaded onto it. Double-click on the FixNCR.reg file to fix the Registry on your infected computer.

This Sunday, my computer troubles deepened. Now, when I attempt to startup my computer, I get a message that says "Windows failed to start. A recent hardware or software change might be the cause." Then it gives two options.

Launch Windows Startup Repair (recommended)
Start Windows Normally

Selecting the second option just goes back to the same
message that "Windows failed to start"
The first option, to "Launch Windows Startup Repair" looks
like it's running some sort of scan, and then up pops a
window that says "Windows cannot repair this computer
automatically"
Then there is an option to click to "View Diagnostic and
Repair Details", when I do so, a log pops up, I don't know
how to post it here though, copy and paste not being an option in this mode. At the bottom of the log, it says

Root cause found:
---------------------
Startup repair has tried several times but still cannot determine the cause of the problem.
----------------------------
----------------------------

Ugh. This laptop came with windows vista already installed, so we don't have an installation disk. We had recovery disks, but they were unfortunately lost in a cross country move last year :-(
Startup repair

I am asking about this.