spybot will not open

[jason4p8c10]

I have something that is redirecting my web pages in both Firefox and IE.
I tried to run spybot and it would not open. It will show up in the task manager for a second or so then closes out. I tried uninstalling Spybot and the browsers with no effect.
I have Win XP and it would not run in safe mode either.
Here is my DDS log

DDS (Ver_10-10-10.03) - NTFSx86
Run by JASON at 1:54:58.37 on Sat 10/16/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.114 [GMT -5:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\JASON\Desktop\Rambooster\Rambooster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\JASON\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1280990419953
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.164.249,93.188.160.249
TCP: {FB645D55-A423-46BE-AE48-38B318D3482D} = 93.188.164.249,93.188.160.249
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-10-14 64288]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-2-6 93336]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-2-6 727720]
R3 3dfxvs;3dfxvs;c:\windows\system32\drivers\3dfxvsm.sys [2010-8-3 148352]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15008]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2002-8-29 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 XDva358;XDva358;\??\c:\windows\system32\xdva358.sys --> c:\windows\system32\XDva358.sys [?]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 1355416]

=============== Created Last 30 ================

2010-10-16 06:28:50 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-16 06:28:48 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-10-16 06:28:47 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-16 06:28:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-15 09:27:11 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-15 07:22:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-10-15 07:14:17 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-10-14 22:57:16 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-10-14 22:31:00 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{ECC164E0-3133-4C70-A831-F08DB2940F70}
2010-10-14 22:29:05 -------- d-----w- c:\program files\Lavasoft
2010-10-14 21:41:30 161296 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-10-13 17:47:43 -------- d-----w- c:\program files\Gameforge4D
2010-10-13 03:38:07 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-10-12 23:06:27 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-12 23:06:26 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-10-12 23:06:11 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-10-11 05:19:08 2078344 ----a-w- c:\program files\mozilla firefox\plugins\NPSWF32.dll
2010-10-11 05:19:08 128648 ----a-w- c:\program files\mozilla firefox\plugins\GetFlash.exe
2010-10-09 23:08:37 303616 ----a-w- c:\windows\IsUninst.exe
2010-10-09 22:47:01 -------- d-----w- c:\program files\WinISO
2010-10-09 22:18:19 -------- d-----w- c:\program files\Universal Extractor
2010-10-02 13:53:23 839680 ----a-w- c:\windows\system32\lameACM.acm
2010-10-02 13:53:23 39936 ----a-w- c:\windows\system32\huffyuv.dll
2010-10-02 13:53:23 151552 ----a-w- c:\windows\system32\ac3acm.acm
2010-10-02 13:53:22 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-10-02 13:53:22 630784 ----a-w- c:\windows\system32\vp7vfw.dll
2010-10-02 13:53:22 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-10-02 13:53:22 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-10-02 13:53:21 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-10-02 11:47:29 987136 ----a-w- c:\windows\system32\NCTVideoCoreM.dll
2010-10-02 11:47:29 90112 ----a-w- c:\windows\system32\NCTAudioFormatSettings3.dll
2010-10-02 11:47:29 290816 ----a-w- c:\windows\system32\NCTAVIFile.dll
2010-10-02 11:47:29 2183168 ----a-w- c:\windows\system32\NCTVideoCompress.dll
2010-10-02 11:47:29 196608 ----a-w- c:\windows\system32\NCTWMVFile.dll
2010-10-02 11:47:29 139264 ----a-w- c:\windows\system32\NCTVideoFile.dll
2010-10-02 11:47:28 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-10-02 11:47:28 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2010-10-02 11:47:28 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-10-02 11:47:28 2469888 ----a-w- c:\windows\system32\NCTAudioCompress3.dll
2010-10-02 11:47:28 1810432 ----a-w- c:\windows\system32\NCTAudioCompress2.dll
2010-10-02 11:47:24 -------- d-----w- c:\program files\Free WMV to AVI MPEG Converter
2010-09-26 23:22:24 -------- d-----w- c:\docume~1\alluse~1\applic~1\Toolbar4
2010-09-26 23:13:40 -------- d-----w- c:\program files\DivX
2010-09-26 23:10:23 -------- d-----w- c:\docume~1\alluse~1\applic~1\DivX
2010-09-26 10:13:47 -------- d-----w- c:\program files\Cat Daddy Games
2010-09-23 16:53:00 850200 ----a-w- c:\docume~1\jason\applic~1\DivXInstaller.exe
2010-09-20 22:39:58 -------- d-----w- c:\docume~1\jason\locals~1\applic~1\Identities
2010-09-18 17:23:26 974848 -c----w- c:\windows\system32\dllcache\mfc42u.dll

==================== Find3M ====================

2010-10-15 09:26:07 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-18 17:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58:06 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-08-10 08:51:35 196608 ----a-w- c:\windows\system32\HMIPCore.dll
2010-08-05 09:04:03 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-08-04 11:26:18 202240 ----a-w- c:\windows\system32\Dr Pepper Go For More 23.scr
2010-08-04 11:26:03 202240 ----a-w- c:\windows\system32\Dr Pepper Go For More.scr

============= FINISH: 1:57:34.79 ===============

[km2357]

Hello and welcome to Safer Networking.

My name is km2357 and I will be helping you to remove any infection(s) that you may have.

I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.

Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.

Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:


Step # 1 Download and run DDS

Download DDS and save it to your desktop from here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.com)
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to your topic.



Step # 2: Download and Run Gmer

Please download gmer.zip (http://www.gmer.net/gmer.zip) from Gmer and save it to your desktop.

***Please close any open programs ***

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure that the 'Sections' button is ticked and the 'Show All' button is unticked. Click the Scan button and let the program do its work. GMER will produce a log.

Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.

GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

Please post the results from the GMER scan in your reply.


In your next post/reply, I need to see the following:

1. The two DDS Logs (DDS and Attach.txt)
2. The GMER Log

Use multiple posts if you can't fit everything into one post

[km2357]

jason4p8c10? Do you still need help?

[km2357]

This topic has been archived due to inactivity.

If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a new HijackThis log with a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

Applies only to the original poster, anyone else with similar problems please start a new topic.