After Antimalware Doctor and Antivirus 2010 . . . trouble?

Honored sirs:

Late last night, while watching a youtube video, I was assaulted most grievously by Antimalware Doctor. Did a System Restore, which seemed to remove it, followed by an Avast 4.8 scan to be on the safe side (Avast found a whole host of Dropper.Gen trojans in my Temp directory, some of which seemed to be detected as they were trying to activate themselves, not as part of Avast's system scan). Then, this morning, I was greeted by Antivirus 2010 (black screen of death--"Your Computer is Infected"--followed by that stupid scareware popup)--which needed Rkill, Malwarebytes, TDSS Killer, and the "Remove Fake Antivirus" utility to be expunged (System Restore was hosed by now). So far, so good, right? My system is stable again, I have fast internet connectivity, everything seems more or less normal. ALMOST. There are still 5 wrinkles:

1. My Avast is [partially?] disabled, with the little grey ball stationary and a "nil-set" red-and-white logo over it. Scanner will not launch--I get "The AAVM subsystem detected a RPC error--The Operation could not be completed." I've tried uninstalling and installing both 4.8 and then installing 5.0--no luck.

2. In Firefox (my primary browser), searching in the little search-box in the upper right corner of the screen redirects me to this website: hxxp://search.fast-find.net/index.php?cx=!partner-pub-8451664467457009%3Avpv5w14ohtj&cof=FORID%3A10&ie=utf-8&q=&siteurl=search.fast-find.net%2F%3Fs%3D%2522bleeping%2Bcomputer%2522%26sid%3D10101062100 which gives the same links the real Google page does. I am NOT redirected by any search on google's main page, the news and video subsidiaries, or any other upper-right hand corner search-box engine other that the Google (no trouble with Yahoo, Amazon, or anything else). Ran Gooredfix with no effect.

3. Sometimes, my computer seems to have difficulty shutting down, and I've had to remove the cord and battery to do it the Stone Age way.

4. Twice, immediately upon restart, I have had to "repair" my wireless connection (after it said it couldn't find any networks), after which everything was quite fine, but this has _never_ happened before with this computer.

5. To run rkill, malwarebytes, and, even after the removal of AV2010, hijackthis and gmer, I had to rename each of the exe files "explorer." They all executed without any difficulty this way, but it indicates there is still something on my system, no?

Everything else seems roughly normal in terms of stability, speed, access, etc. BTW, I'm running XP SP2 on a Dell Latitude D520.

And now, for what you have been waiting for--my logs. Read them and sleep, maestros:


DDS (Ver_10-10-05.01) - NTFSx86
Run by Landulph at 18:18:28.48 on Thu 10/07/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.238 [GMT -4:00]

AV: avast! antivirus 4.8.1368 [VPS 101007-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
"\\.\globalroot\Device\svchost.exe\svchost.exe"
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Vuze\Azureus.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Trend Micro\HiJackThis\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Landulph\Desktop\Rapidshare\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = 127.0.0.1:8080
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe"
uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe
uRun: [Gjejuzupijafero] rundll32.exe "c:\windows\sasdadt.dll",Startup
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Jbuqu] rundll32.exe "c:\windows\inudoxiyetuk.dll",Startup
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
uPolicies-explorer: DisallowRun = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\landulph\applic~1\mozilla\firefox\profiles\c4e97zyq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.telegraph.co.uk
FF - prefs.js: keyword.URL - hxxp://search.fast-find.net/?sid=10101062100&s=
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\landulph\application data\move networks\plugins\npqmp071701000002.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npaudio.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npavi32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npnul32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPOFFICE.DLL
FF - plugin: c:\program files\netscape\communicator\program\plugins\nppl3260.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin3.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin4.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin5.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin6.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npqtplugin7.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPQTW32.DLL
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprfxins.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\NPSWF32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XULRunner: {5003A4D9-C21E-4AA1-8F05-238E5FA588F5} - c:\documents and settings\landulph\local settings\application data\{5003A4D9-C21E-4AA1-8F05-238E5FA588F5}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.search.order.1 - Google
FF - user.js: keyword.URL - hxxp://search.fast-find.net/?sid=10101062100&s=
============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-10-7 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-10-7 20560]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-10-7 138680]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-10-7 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-10-7 352920]
S3 DFBCFDBA;DFBCFDBA; [x]

=============== Created Last 30 ================

2010-10-07 21:18:12 -------- d-----w- c:\program files\Trend Micro
2010-10-07 21:03:19 -------- d-----w- C:\_OTM
2010-10-07 20:35:40 -------- d-----w- c:\docume~1\landulph\locals~1\applic~1\{5003A4D9-C21E-4AA1-8F05-238E5FA588F5}
2010-10-07 20:09:57 38848 ----a-w- c:\windows\avastSS.scr
2010-10-07 20:09:51 -------- d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software
2010-10-07 18:30:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-07 17:48:42 -------- d-----w- c:\program files\Loaris
2010-10-07 17:31:34 -------- d-----w- c:\docume~1\alluse~1\applic~1\Update
2010-10-07 16:40:25 1148 ----a-w- c:\docume~1\alluse~1\applic~1\.wtav
2010-10-07 14:04:46 -------- d-----w- c:\docume~1\landulph\applic~1\Malwarebytes
2010-10-07 14:04:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-10-07 13:31:51 2256 ----a-w- c:\docume~1\landulph\applic~1\444.bat
2010-10-07 13:31:50 143 ----a-w- c:\docume~1\landulph\applic~1\asdsada.bat
2010-10-07 06:03:23 -------- d-----w- c:\windows\system32\wbem\repository\FS
2010-10-07 06:03:23 -------- d-----w- c:\windows\system32\wbem\Repository
2010-10-07 05:37:47 -------- d-----w- c:\docume~1\landulph\applic~1\Genieo
2010-10-02 15:22:53 -------- d-----w- C:\Identity Cloaker
2010-10-02 14:36:43 -------- d-----w- c:\program files\LeahScape
2010-09-29 15:54:53 -------- d-----w- c:\program files\URUSoft
2010-09-18 07:08:29 -------- d-----w- c:\windows\system32\XPSViewer
2010-09-18 07:07:29 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-09-18 07:07:29 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-09-18 07:07:29 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-09-18 07:07:29 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-09-18 07:07:29 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-09-18 07:07:29 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-09-18 07:07:29 117760 ------w- c:\windows\system32\prntvpt.dll
2010-09-18 07:07:28 -------- d-----w- C:\e1419554022769268ea8
2010-09-18 07:01:34 -------- d-----w- c:\program files\MSXML 6.0
2010-09-17 18:31:47 -------- d-----w- c:\docume~1\landulph\applic~1\Binverse
2010-09-17 18:31:27 -------- d-----w- c:\program files\Binverse

==================== Find3M ====================

2010-10-07 17:07:24 35840 ----a-w- c:\windows\system32\drivers\isapnp.sys
2007-02-23 02:08:08 925696 ----a-w- c:\program files\GSpot.exe

============= FINISH: 18:19:24.12 ===============




Any thoughts, honorable sirs? It seems like I was hit with multiple infections at the same time, but I've no idea what could still be on there.

PS: Just to be on the safe side, I've attached my Hijackthis log as well.

Edited by Orange Blossom, 14 October 2010 - 06:50 PM.
Deactivate link. ~ OB

Welcome to Bleeping computer.

Sorry about the delay


We'll start with ComboFix.



Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 2
Link 3





--------------------------------------------------------------------

Double click on explorer.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt .

Edited by heir, 15 October 2010 - 04:49 PM.

Hi heir, actually on 10/13 the computer started blue-screening on startup (in normal and safe modes), so I decided to have it professional de-malwared before the system was hosed beyond repair. The techies found 118 separate infections, and I am now running Panda Antivirus Pro, which seems to be working fine. You can close this thread!
Thanks anyway,
Landulph

Thanks for the update!

Sorry we weren't here earlier, as this new infection would have been curable.

heir