This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Unable to run SpyBot and cannot open Anti-Malware sites

3 min read

This thread's last reply is from April 21, 2009, 7:53 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Hi I hope you all can help me. I seem to have picked up some sort of malware that blocks programs such as Spybot Search and Destroy and Malwarebytes-AntiMalware. When I try to run the program I get a "wait" curser and then nothing. I have checked the processes list and found Sbybot on that list, but it is not running. I thought reinstalling Spybot might fix that but it did not.

I cannot open sites such as http://www.safer-networking.org, and http://www.malwarebytes.org. The browser just gets redirected to either a search page or I get a "Page Cannot be Found" error.

I also am not able to run the McAfee Virtual Technitian.

I have spent hours on the phone with tech suppoert from AT&T and McAfee.

Any assistance you can ofer will be greatly appreciated.

Here is the HiJack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:36:18 PM, on 4/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
H:\Program Files\Java\jre6\bin\jqs.exe
H:\Program Files\Common Files\LightScribe\LSSrvc.exe
H:\Program Files\Common Files\Symantec

Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
H:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
H:\Program Files\Common Files\Motive\McciCMService.exe
H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
H:\Program Files\McAfee.com\Agent\mcagent.exe
H:\Program Files\Logitech\QuickCam\Quickcam.exe
H:\Program Files\Microsoft IntelliPoint\ipoint.exe
h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
H:\Program Files\ATT-SST\McciTrayApp.exe
H:\Program Files\McAfee\VirusScan\McShield.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
H:\Program Files\McAfee\MPF\MPFSrv.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
H:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
H:\Program Files\Yahoo!\browser\ybrowser.exe
H:\PROGRA~1\Yahoo!\browser\ycommon.exe
H:\Program Files\Yahoo!\browser\ybrwicon.exe
H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
H:\Documents and Settings\Bill\Local Settings\Temporary Internet

Files\Content.IE5\EL8FSS3L\mvtapp[1].exe
H:\WINDOWS\system32\taskmgr.exe
h:\PROGRA~1\mcafee\msc\mcshell.exe
H:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
h:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
H:\WINDOWS\system32\wuauclt.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/searc

h/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/searc

h/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =

127.0.0.1
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Program

Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - H:\Program

Files\Yahoo!\SearchSuggest\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} -

H:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program

Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - H:\Program

Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program

Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -

h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -

H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program

Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - H:\Program

Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} -

h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [mcagent_exe] H:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [McENUI] H:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "H:\Program Files\Logitech\QuickCam\Quickcam.exe"

/hide
O4 - HKLM\..\Run: [IntelliPoint] "H:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader

9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ATT-SST_McciTrayApp] "H:\Program Files\ATT-SST\McciTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "H:\Program

Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] H:\Program Files\MySpace\IM\MySpaceIM.exe (User

'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] H:\Program Files\MySpace\IM\MySpaceIM.exe (User

'Default user')
O8 - Extra context menu item: &ieSpell Options - res://H:\Program

Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://H:\Program

Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://H:\Program

Files\ieSpell\Merriam Webster.HTM
This has been resolved.
Thank you for letting us know your issues have been resolved.

As this issue appears to be resolved, this topic is now closed.

You can help support this site from this link :
Donations For Malware Removal