Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


All attempts to scan for malware produce program crashes + google redirects

  • This topic is locked This topic is locked
2 replies to this topic

#1 ieatbabies


  • Members
  • 1 posts
  • Local time:04:02 PM

Posted 25 September 2011 - 09:56 PM

I started to suspect something was off when my browser became increasingly sluggish. I've noticed the URL "raresearchsystem.com" as a redirect url when I click any google search results. I immediately attempted to run malwarebytes only to have the program close while it was scanning. Trying to run it again yields error "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item.". I tried renaming the .exe but was not allowed. I reinstalled malwarebytes under a different name and was able to run it but again, the program closed during scan. I tried all applicable troubleshooting on the malwarebytes forum to try and get the program to run but with the same results.

I attempted to run avast! but it is immediately disabled.

I was unable to scan with gmer as it too was closed when I begun the scan.

DDS log.

DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_21
Run by Aaron Funk at 21:23:04 on 2011-09-25
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.982 [GMT -5:00]
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\trainwreck\mbamservice.exe
C:\Program Files\Mozilla Firefox\firefox.exe
============== Pseudo HJT Report ===============
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}

uSearch Bar = hxxp://www.google.com
uStart Page = hxxp://www.sony.com/vaiopeople
mSearch Bar = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aol\aol

search enhancement\AOLSearch.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aol\aol search

BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - No File
TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [Google Update] "c:\documents and settings\aaron funk\local settings\application

data\google\update\GoogleUpdate.exe" /c
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [WebcamMaxAutoRun] "c:\program files\webcammax\WebcamMax.exe" -a
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [AdobeBridge]
mRun: [Mouse Suite 98 Daemon] ICO.EXE
mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [RelevantKnowledge] c:\program files\relevantknowledge\rlvknlg.exe -boot
mRun: [VAIO Update 4] "c:\program files\sony\vaio update 4\VAIOUpdt.exe" /Stationary
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common

mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common

files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Alcmtr] ALCMTR.EXE
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [Malwarebytes' Anti-Malware] "c:\program files\trainwreck\mbamgui.exe" /starttray
dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10i_ActiveX.exe -update

dRunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe
StartupFolder: c:\docume~1\aaronf~1\startm~1\programs\startup\openof~1.lnk - c:\program

files\openoffice.org 3\program\quickstart.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: Transfer by Image Converter 2 Plus - c:\program files\sony\image converter 2\menu.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\pokerstars.net\PokerStarsUpdate.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: mswsock.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -


DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-

TCP: DhcpNameServer =
TCP: Interfaces\{DCF94676-2FDC-443B-842E-DF9F146FFD63} : DhcpNameServer =
Notify: cryptnet32 - cryptnet32.dll
Notify: igfxcui - igfxdev.dll
Notify: VESWinlogon - VESWinlogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32

LSA: Authentication Packages = msv1_0 nwprovau
Hosts: www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\documents and settings\aaron funk\application

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.pixeljoint.com/
FF - component: c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}

FF - plugin: c:\documents and settings\aaron funk\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\aaron funk\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\aaron funk\local settings\application data\google\update\

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
============= SERVICES / DRIVERS ===============
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [2006-8-5 11264]
R2 MBAMService;MBAMService;c:\program files\trainwreck\mbamservice.exe [2011-9-25 366152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-25 22216]
R3 motubus;MOTU Audio MIDI Extension;c:\windows\system32\drivers\motubus.sys [2007-1-4 22024]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2005-12-5

R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-9-25 41272]
S0 41970447;41970447;c:\windows\system32\drivers\23122013.sys --> c:\windows\system32

\drivers\23122013.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-2

S2 HitmanPro35CrusaderBoot;Hitman Pro 3.5 Crusader (Boot);c:\program files\hitman pro 3.5

\HitmanPro35.exe [2010-10-1 6394688]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-2

S3 IO;IO;\??\g:\smap\tools32\io.sys --> g:\smap\tools32\IO.SYS [?]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);c:\windows\system32\drivers\mausb.sys -->

c:\windows\system32\drivers\mausb.sys [?]
S3 MotuMidi;MOTU MIDI Device;c:\windows\system32\drivers\motumidi.sys [2007-1-4 35336]
S3 MotuUsb;MotuUsb;c:\windows\system32\drivers\MotuUsb.sys [2007-1-4 48648]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19

S3 UKS11LDR;M-Audio USB Keystation Loader;c:\windows\system32\drivers\uks11ldr.sys [2006-8-5 13504]
S3 US122;US122 Driver;c:\windows\system32\drivers\US122.sys [2004-7-30 217472]
S3 US122DL;US122 Firmware Downloader;c:\windows\system32\drivers\US122DL.sys [2004-7-30 17277]
S3 Us122WdmService;US122 Wdm Audio;c:\windows\system32\drivers\US122Wdm.sys [2004-7-30 86648]
S3 USBKT1X1;M-Audio USB Keystation;c:\windows\system32\drivers\usbkt1x1.sys [2006-8-5 22304]
=============== Created Last 30 ================
2011-09-26 02:02:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-25 23:23:54 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-09-25 23:23:25 41184 ----a-w- c:\windows\avastSS.scr
2011-09-25 23:23:07 -------- d-----w- c:\program files\AVAST Software
2011-09-25 23:23:07 -------- d-----w- c:\documents and settings\all users\application data\AVAST

2011-09-25 23:16:12 162304 ----a-w- c:\windows\system32\wuaucpl.cpl
2011-09-25 23:15:46 -------- d-----w- c:\windows\LastGood.Tmp
2011-09-25 23:13:14 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-09-25 22:46:58 -------- d-----w- c:\program files\Online Services
2011-09-25 22:46:38 16384 ----a-w- c:\program files\internet explorer\connection wizard\isignup.exe
2011-09-25 22:45:29 32768 ----a-w- c:\program files\internet explorer\connection wizard\icwdl.dll
2011-09-25 22:45:27 86016 ----a-w- c:\program files\internet explorer\connection wizard\icwconn2.exe
2011-09-25 22:45:27 214528 ----a-w- c:\program files\internet explorer\connection wizard\icwconn1.exe
2011-09-25 22:45:27 20480 ----a-w- c:\program files\internet explorer\connection wizard\inetwiz.exe
2011-09-25 22:16:21 24661 ----a-w- c:\windows\system32\spxcoins.dll
2011-09-25 22:16:21 13312 ----a-w- c:\windows\system32\irclass.dll
2011-09-25 22:15:40 14573 ----a-r- c:\windows\SET17B.tmp
2011-09-25 22:15:24 13753 ----a-r- c:\windows\SET140.tmp
2011-09-25 22:15:16 1086058 ----a-r- c:\windows\SET134.tmp
2011-09-25 22:15:12 1056254 ----a-r- c:\windows\SET131.tmp
2011-09-25 20:25:13 48016 --sha-w- c:\windows\system32\c_46315.nl_
2011-09-25 20:20:48 -------- d-----w- C:\TDSSKiller_Quarantine
2011-09-25 20:05:49 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-25 20:04:06 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-25 19:48:45 -------- d-----w- c:\program files\trainwreck
2011-09-25 19:27:42 -------- d--h--w- c:\windows\PIF
2011-09-21 23:09:13 -------- d-----w- c:\program files\GraphicsGale
2011-09-21 22:57:30 -------- d-----w- c:\documents and settings\aaron funk\application data\Jasc
2011-09-21 22:51:59 -------- d-----w- c:\program files\Jasc Software Inc
2011-09-20 12:08:47 -------- d-----w- c:\documents and settings\aaron funk\application data\GrafX2
2011-09-20 12:07:07 -------- d-----w- c:\program files\Grafx2
2011-09-18 09:40:09 -------- d-----w- c:\program files\Qubicle Constructor Basic
2011-09-17 20:41:16 -------- d-----w- c:\documents and settings\aaron funk\local settings\application

2011-09-17 20:41:11 -------- d-----w- c:\program files\GraphicsGale FreeEdition
2011-09-16 21:28:00 -------- d-----w- c:\documents and settings\aaron funk\application

2011-09-16 17:24:34 -------- d-----w- c:\documents and settings\aaron funk\local settings\application

2011-09-16 17:15:53 -------- d-----w- c:\program files\Enterbrain
2011-09-16 17:12:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll
2011-09-16 17:11:58 255848 ----a-w- c:\windows\system32\xactengine2_6.dll
2011-09-16 12:22:06 -------- d-----w- c:\program files\Cognitive Dissonance
2011-09-10 07:06:06 -------- d-----w- c:\documents and settings\aaron funk\application

2011-09-07 06:02:46 -------- d-----w- C:\OLD DESKTOP STUFF
2011-09-05 17:24:10 -------- d-----w- c:\documents and settings\aaron funk\application data\Mobipocket
2011-09-04 00:53:15 -------- d-----w- c:\documents and settings\aaron funk\application data\Mumble
2011-09-04 00:51:50 -------- d-----w- c:\program files\Mumble
2011-09-04 00:16:12 -------- d-----w- c:\documents and settings\aaron funk\riotsGamesLogs
2011-09-03 23:57:29 -------- d-----w- c:\documents and settings\aaron funk\application data\LolClient
2011-09-03 23:50:59 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2011-09-03 23:50:59 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2011-09-03 23:50:51 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2011-09-03 23:50:51 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2011-09-03 23:50:45 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
==================== Find3M ====================
2011-09-06 23:14:15 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
============= FINISH: 21:26:06.15 ===============

BC AdBot (Login to Remove)


#2 HelpBot


    Bleepin' Binary Bot

  • Bots
  • 12,740 posts
  • Gender:Male
  • Local time:05:02 PM

Posted 30 September 2011 - 10:00 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:


Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/420489 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.


Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.


We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 HelpBot


    Bleepin' Binary Bot

  • Bots
  • 12,740 posts
  • Gender:Male
  • Local time:05:02 PM

Posted 05 October 2011 - 10:05 PM

Hello again!

I haven't heard from you in 5 days. Therefore, I am going to assume that you no longer need our help, and close this topic.

If you do still need help, please send a Private Message to any Moderator within the next five days. Be sure to include a link to your topic in your Private Message.

Thank you for using Bleeping Computer, and have a great day!

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users