None of the antivirus programs are running, unable to upload Hijack this log to trendmicro

Hi,
I think my system is infected, because whenever I download any anti-virus either it doesn't run and if it runs i am unable to upload the log file (like that of hijackthis) and sometimes the antivirus specific sites dun open.

Pasted below are the logs:


DDS (Ver_09-10-26.01) - FAT32x86
Run by ASAD at 22:33:01.95 on Wed 11/11/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.254.57 [GMT 5:00]

AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAP\DAP.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Windows\system32\Notifiers.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ASAD.KAMRAN-8DE719C2\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://search.speedbit.com
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DownloadAccelerator] "c:\program files\dap\DAP.EXE" /STARTUP
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [MSN] c:\windows\system32\Notifiers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\asad~1.kam\applic~1\mozilla\firefox\profiles\wp1d8qhr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.ask.com/web?&o=13048&l=dis&q=
FF - component: c:\program files\dap\dapfirefox\components\DAPFireFox.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-10-28 108289]
S2 ujzjzjq;Update Time;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S2 vftbmmec;System Security;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
S3 jzxhgfzzx;jzxhgfzzx;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]
S3 PPDrv;Protector Plus Driver (UnRegistered);\??\c:\protector plus\ppdrv.sys --> c:\protector plus\PPDrv.sys [?]
S3 PPEMSCAN;Protector Plus Email Scan Driver;\??\c:\protector plus\ppemscan.sys --> c:\protector plus\PPEMSCAN.sys [?]
S3 ttmnnm;ttmnnm;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]
S3 xjtpj;xjtpj;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]

=============== Created Last 30 ================

2009-11-10 14:26:16 0 d-sh--w- C:\FOUND.022
2009-11-05 13:22:34 0 d-sh--w- C:\FOUND.021
2009-11-03 17:01:08 0 d-----w- c:\program files\Chicken Invaders
2009-11-03 09:08:05 16952 ----a-w- c:\docume~1\asad~1.kam\applic~1\GDIPFONTCACHEV1.DAT
2009-11-02 17:04:46 105716 --sh--r- c:\windows\system32\Notifiers.exe
2009-11-02 17:04:39 0 ----a-w- c:\windows\ud.sys
2009-11-02 12:43:23 10312 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-11-01 14:47:52 0 d-----w- C:\VundoFix Backups
2009-11-01 09:53:58 0 d-----w- c:\docume~1\alluse~1\applic~1\SITEguard
2009-11-01 09:51:33 0 d-----w- c:\program files\common files\iS3
2009-11-01 09:51:30 0 d-----w- c:\docume~1\alluse~1\applic~1\STOPzilla!
2009-10-31 10:52:46 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-10-31 10:52:46 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
2009-10-28 17:07:46 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-28 17:07:37 0 d-----w- c:\program files\Avira
2009-10-28 17:07:37 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2009-10-27 14:49:49 0 d-sha-r- C:\cmdcons
2009-10-27 14:45:39 98816 ----a-w- c:\windows\sed.exe
2009-10-27 14:23:47 124688 ----a-w- c:\windows\system32\MSWINSCK.OCX
2009-10-27 14:23:46 53248 ----a-w- c:\windows\system32\SpamItBack Screensaver.scr
2009-10-27 14:23:46 260880 ----a-w- c:\windows\system32\MSFLXGRD.OCX
2009-10-27 14:23:46 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-10-27 14:23:36 0 d-----w- c:\program files\spamitback
2009-10-26 11:11:45 29360 ----a-w- c:\windows\_SETUPD_.EXE
2009-10-26 11:11:44 0 d-----w- C:\Protector Plus
2009-10-21 17:05:47 0 d--h--w- c:\windows\system32\GroupPolicy
2009-10-21 10:46:00 0 d-----w- c:\docume~1\asad~1.kam\applic~1\Uniblue
2009-10-21 08:40:44 0 d-----w- c:\program files\Trend Micro
2009-10-20 16:21:23 0 d-----w- c:\docume~1\alluse~1\applic~1\WEBREG
2009-10-20 16:14:05 271704 ----a-r- c:\windows\system32\hpzids01.dll
2009-10-20 16:14:00 117760 ----a-w- c:\windows\system32\hpzll5mu.dll
2009-10-20 16:01:04 0 d-----w- c:\program files\HP
2009-10-20 16:00:56 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-10-20 16:00:56 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2009-10-20 16:00:52 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-10-20 16:00:52 31616 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-10-18 08:47:30 0 d-----w- C:\FOUND.020
2009-10-16 15:28:34 376 ----a-w- c:\windows\ODBC.INI
2009-10-16 15:27:40 0 d-----w- c:\program files\Microsoft ActiveSync
2009-10-16 15:27:00 0 d-----w- c:\windows\ShellNew
2009-10-16 15:18:30 0 d-----w- C:\FOUND.019

==================== Find3M ====================

2009-09-01 15:31:34 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-09-01 15:31:34 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-08-22 22:45:04 756736 ------w- c:\windows\system32\ir41_32.dll
2009-08-22 22:45:04 64308 ------w- c:\windows\fonts\Gilbi___.ttf
2009-08-22 22:45:04 62224 ------w- c:\windows\fonts\Gili____.ttf
2009-08-22 22:45:04 60952 ------w- c:\windows\fonts\Gilb____.ttf
2009-08-22 22:45:04 56832 ------w- c:\windows\system32\iyvu9_32.dll
2009-08-22 22:45:04 143872 ------w- c:\windows\system32\iacenc.dll
2009-08-22 22:45:02 60160 ------w- c:\windows\fonts\Gil_____.ttf
2009-06-03 18:05:48 105716 --sh--r- c:\windows\system32\Notifiers.exe
2004-08-03 19:56:44 2711552 --sh--r- c:\windows\system32\zarwxcz.dll

============= FINISH: 22:33:40.58 ===============

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Its alright ... DDS log uploaded

Hi and welcome to the HijackThis Logs and Virus/Trojan/Spyware/Malware Removal forum,

I am and I am here to help you!

I ask that you refrain from running tools other than those I suggest to you while I am cleaning up your computer. The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Please perform all steps in the order received and do not proceed if you need clarification.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

I would also like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please be courteous and appreciative for the assistance provided!

==========

RKill by Grinler

Link #1
Link #2
Link #3
Link #4

• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
• Download Link #1.
• Save it to your Desktop.
• Double click the RKill desktop icon.
  If you are using Vista please right click and run as Admin!
• A black screen will briefly flash indicating a successful run.
• If this does not occur please delete that application and download Link #2.
• Continue process until the tool runs.
• If the tool does not run from any of the links tell me about it.

==========

Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

==========

Download and Run ComboFix (by sUBs)

You must rename it before saving it.





Please download ComboFix from one of these locations:

Link 1
Link 2

Save thcbytes.exe to your Desktop <-- Important!!!

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Please refer to this link for instructions.
  
  
• Double click on thcbytes.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

==========

Again I would like to remind you to make no further changes to your computer unless I direct you to do so. Your computer fix will be based on the current condition of your computer! Any changes might delay my ability to help you.

==========

With your next post please provide:

* Exehelper log
* Combofix.txt
* Please copy and paste all logs unless directed otherwise.

Kind regards,
~t