Help - Virus Programs Not Running

I have Windows XP Home SP3. I have Malwarebytes Anti-Malware (Free Edition) and Super Antispyware (free edition) I do not run them in the backround. I rune them about once a week. When I click to open the Malwarebytes it will not open. With Super Antispyware the same thing happens. Both of these have worked before. I have un-installed both programs and went to the websites and downloaded both again. Malwarebytes was re-installed ok but still will not run. Super Antispyware will not even install. I get a message similar to IE8 that says there is a problem and must shut down. There is a debug button and when clicking on that is does nothing.
Does anyone have an idea why this is happening?

Thanks in advance for your help.

Guessing that you need to find a cd-bootable AV app to scan your system.

I have AVG which I ran and no virus was found. I also went to trendmicro.com and ran that also and it found nothing. I also have Spydoctor and that cam up with a couple of mild thing came up and were deleted.

I had that problem and looked and super antispyware forum and found a file called runsas.exe and downloaded it and it ran after I clicked that exe file. I would google for it..

The problem I am having with Super Antivirus Spyware is that I cannot even install it. I got the runsas.exe. When I go to open that it says it cannot find the Super Antivirus program, that would be correct because it is not installed.

Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

==

Reboot and try running MBA-M again.

I was able to get both programs up and running. I got a small program called Trojan Remover (trial) and after running that I was able to install and run the programs.
Actually under Device Mgr there is no TDSSserv.

I am in the process of running everything to get rid of the Trojan I appear to have.

COACH 17. Go to start-->run then type services.msc. Find all instances of your anti-virus & anti-Spyware programs and stop the service. Then uninstall the programs. If not, then you have a dirty registry. Go and download the freeware program called CCcleaner and clean out your registry. Do it 2-3 times. Reboot and re-install your software. I have run AVG's both Anti-Virus & Anti-Spyware for many years without major issues and I am a contractor that constantly logs on to foreign networks and large network environments. maybe time to move away form that software? Also, I would do a daily scan not weekly. Set it to run in the back round without taking too many resources from you. Better off catching the virus quickly and eliminating it. And your machine slows down a bit at login. It is worth the temporary slowdown. The If that does not work, let me know, I would love to remote your PC and check it out for you.

I don't think it is advisable to clean out the registry like that. I agree that Ccleaner is good, but I always disable that option.
How did you go after running those programs?

After Cleaning the Registry on my VISTA Business O/S, there were no issues. Removed allot of uninstalled junk, bad pointers, etc. No speed increase, noticeably anyway, but overall that program is very good and I know Crunchie does not advise using it but this one is actually safe. I have used the corporate licensed windows reg cleaners and YES, if you did not make a backup of your reg, you are in trouble! I recommend and install it for home users for some time now and show them how to run it. They have not reported any issues.

Coach17
As advised, do NOT play with the registry.
Inability to run security programs is most likely caused by an infection.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   
   
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

I have ran Combo Fix and the HJT Here are the results.
If both logs will not fit in this post I will put the HJT in a new post.

I appears that the Combo Fix is to big to post in here. I will attemt to add it as an attachment.

Here is the HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:52:23 AM, on 5/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Zinio\ZinioReader.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [EPSON Stylus Photo RX580 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBPA.EXE /FU "C:\WINDOWS\TEMP\E_SED.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioReader.exe /autostart
O4 - HKCU\..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoshopElementsSyncAgent] C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsSyncAgent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/fios_se...zTCPConfig.CAB
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD7/JSCDL/j...javadl.sun.com
O16 - DPF: {C237A80A-4C55-4C68-BAA9-CBE4408D12B2} (F-Secure Online Scanner 4.0 Launcher) - http://download.sp.f-secure.com/ols/...fslauncher.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe

--
End of file - 8011 bytes

*** Combofix indicates, that your version of Spyware Doctor includes antivirus. If that's the case, you're running two AV programs (Avira).
One of them has to go.

*** Please, upload following files: pctplsg.sys, pctgntdi.sys, located at c:\windows\system32\drivers to: http://www.virustotal.com/ for security check.
Post the results.


1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Quote:

---

File::
c:\windows\system32\drivers\pavboot.sys
c:\windows\system32\drivers\gxvxclruigsnsowvvcrjkptftewqoowbpjshw.sys.vir
c:\windows\system32\spmsg2.dll
c:\windows\system32\ezsidmv.dat
c:\windows\bwUnin-6.1.4.36-8876480L.exe


Folder::
C:\$AVG8.VAULT$

Driver::
pavboot.sys
gxvxclruigsnsowvvcrjkptftewqoowbpjshw.sys.vir


Registry::

---

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

Here are the 1st results

Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.04.07 -
AhnLab-V3 5.0.0.2 2009.04.07 -
AntiVir 7.9.0.138 2009.04.07 -
Antiy-AVL 2.0.3.1 2009.04.07 -
Authentium 5.1.2.4 2009.04.07 -
Avast 4.8.1335.0 2009.04.06 -
AVG 8.5.0.285 2009.04.07 -
BitDefender 7.2 2009.04.07 -
CAT-QuickHeal 10.00 2009.04.07 -
ClamAV 0.94.1 2009.04.07 -
Comodo 1101 2009.04.06 -
DrWeb 4.44.0.09170 2009.04.07 -
eSafe 7.0.17.0 2009.04.06 -
eTrust-Vet 31.6.6440 2009.04.07 -
F-Prot 4.4.4.56 2009.04.07 -
F-Secure 8.0.14470.0 2009.04.07 -
Fortinet 3.117.0.0 2009.04.07 -
GData 19 2009.04.07 -
Ikarus T3.1.1.49.0 2009.04.07 -
K7AntiVirus 7.10.694 2009.04.06 -
Kaspersky 7.0.0.125 2009.04.07 -
McAfee 5576 2009.04.06 -
McAfee+Artemis 5576 2009.04.06 -
McAfee-GW-Edition 6.7.6 2009.04.07 -
Microsoft 1.4502 2009.04.07 -
NOD32 3991 2009.04.07 -
Norman 6.00.06 2009.04.06 -
nProtect 2009.1.8.0 2009.04.07 -
Panda 10.0.0.14 2009.04.06 -
PCTools 4.4.2.0 2009.04.06 -
Prevx1 V2 2009.04.07 -
Rising 21.24.12.00 2009.04.07 -
Sophos 4.40.0 2009.04.07 -
Sunbelt 3.2.1858.2 2009.04.06 -
Symantec 1.4.4.12 2009.04.07 -
TheHacker 6.3.4.0.303 2009.04.07 -
TrendMicro 8.700.0.1004 2009.04.07 -
VBA32 3.12.10.2 2009.04.07 -
ViRobot 2009.4.7.1681 2009.04.07 -
VirusBuster 4.6.5.0 2009.04.06 -
Additional information
File size: 159600 bytes
MD5...: bf770a5817fa8fba1402b2286a7f394c
SHA1..: a5254a552fdba460d6656f22859a4e1d162d422c
SHA256: 323f5d4c93e977048480207af81a805fc877ea4a53f52a82faa94abbc7f69332
SHA512: 9a6cefecbbba396c48db0f385da073eb896a0d8ae1e4185d0bacb85739717a6c
4e780acf9d2c8e01a2c86852e20b5f20df033cacedf5db6f909f8c17b81c5e68
ssdeep: 3072:7VLXLNSNmd/s1p3tZKvmBXhfd/i3OsMpKBAFUGxpFO:NNS8u3tokXriehpK
BA62n

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (58.4%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
VXD Driver (0.2%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x23685
timedatestamp.....: 0x49400f00 (Wed Dec 10 18:48:32 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x218ac 0x21900 6.50 c0cec0ad40079bfcc48091deafe71208
.rdata 0x21d80 0x78c 0x800 5.68 d87c67f49df817994f723fe677f4e3d7
.data 0x22580 0x1008 0x1080 0.07 514cd814bd2ca70210bfd01128b8f7d1
.edata 0x23600 0x75 0x80 4.00 bde76f2d41a191ad8c2d169fdd0e7004
INIT 0x23680 0x986 0xa00 5.48 bb3f6135be8b9fd19961b67ec6b45e38
.rsrc 0x24080 0x360 0x380 3.13 c59c303d29b9496bfe5bcbc1bebbaf19
.reloc 0x24400 0x1382 0x1400 6.17 3bfd271c3524df2eb2d428f19155bbd7

( 3 imports )
> ntoskrnl.exe: KeSetEvent, KeQuerySystemTime, KeInitializeEvent, PsGetCurrentProcessId, IofCompleteRequest, IoReleaseCancelSpinLock, IoAcquireCancelSpinLock, PsTerminateSystemThread, KeWaitForSingleObject, memcpy, ExInitializeNPagedLookasideList, ExDeleteNPagedLookasideList, MmIsAddressValid, IoDeleteDevice, IoCreateSymbolicLink, IoCreateDevice, RtlInitUnicodeString, IoStartTimer, IoStopTimer, IoInitializeTimer, IofCallDriver, RtlQueryRegistryValues, DbgPrint, PsGetCurrentThreadId, IoAttachDeviceToDeviceStack, IoGetDeviceObjectPointer, IoDetachDevice, IoGetAttachedDeviceReference, IoBuildDeviceIoControlRequest, ProbeForRead, NtBuildNumber, IoFreeMdl, MmMapLockedPagesSpecifyCache, KeResetEvent, IoAllocateIrp, MmBuildMdlForNonPagedPool, IoAllocateMdl, IoFreeIrp, IoCancelIrp, ExAcquireResourceExclusiveLite, KeEnterCriticalRegion, KeLeaveCriticalRegion, ExReleaseResourceLite, ZwUnloadDriver, ExInitializeResourceLite, ExDeleteResourceLite, MmGetSystemRoutineAddress, ZwClose, ZwQuerySymbolicLinkObject, ZwOpenSymbolicLinkObject, ZwCreateFile, towlower, MmUnlockPages, MmProbeAndLockPages, ZwReadFile, ZwQueryInformationFile, IoFreeWorkItem, IoQueueWorkItem, IoAllocateWorkItem, PsSetLoadImageNotifyRoutine, PsSetCreateProcessNotifyRoutine, KeReadStateEvent, ExFreePoolWithTag, ExAllocatePoolWithTag, KeClearEvent, KeTickCount, KeBugCheckEx, ObReferenceObjectByHandle, ObfDereferenceObject, memset, memmove, ExInterlockedPushEntrySList, KeGetCurrentThread, ExInterlockedPopEntrySList, RtlUnwind, RtlFreeUnicodeString, PsCreateSystemThread, _wcsnicmp, RtlAnsiStringToUnicodeString, RtlInitAnsiString, _wcsicmp, wcsncpy, MmUnmapLockedPages, strstr, _strlwr
> HAL.dll: KfAcquireSpinLock, KeGetCurrentIrql, KfReleaseSpinLock
> TDI.SYS: TdiReturnChainedReceives, TdiMapUserRequest

( 2 exports )
PctTdiRegisterPlugin, PctTdiUnRegisterPlugin

RDS...: NSRL Reference Data Set