blinken
-
Posts
4 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by blinken
-
-
the laptop seems better, haven't seen websites asking for credit card verification last 2 days.
Combofix log below.
thanks.
ComboFix 12-07-02.01 - TBC MB 02 04/07/2012 10:31:35.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.2975.1822 [GMT 9.5:30]
Running from: c:\users\TBC MB 02\Desktop\ComboFix.exe
AV: McAfee® Total Protection™ Service *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee® Security-as-a-Service *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: McAfee® Total Protection™ Service *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\windows
c:\programdata\windows\msxx.dat
c:\programdata\Windows\vvve.dat
c:\users\TBC MB 02\AppData\Local\assembly\tmp
c:\users\TBC MB 02\AppData\Roaming\.#
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1064@1692770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1064@16927A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1160@1322770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1160@13227A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1258@372770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1258@3727A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@160@1592770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@160@15927A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1F0@232770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@1F0@2327A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@98C@1622770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@98C@16227A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@B44@1752770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@B44@17527A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C2C@1732770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C2C@17327A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C48@14F2770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C48@14F27A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C94@1802770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@C94@18027A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@CA0@19C2770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@CA0@19C27A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D20@1542770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D20@15427A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D5C@14F2770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@D5C@14F27A0.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@FD8@16D2770.###
c:\users\TBC MB 02\AppData\Roaming\.#\MBX@FD8@16D27A0.###
c:\users\TBC MB 02\g2mdlhlpx.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-04 to 2012-07-04 )))))))))))))))))))))))))))))))
.
.
2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\Ctx_StreamingSvc\AppData\Local\temp
2012-07-04 01:15 . 2012-07-04 01:15 -------- d-----w- c:\users\McAfeeMVSUser\AppData\Local\temp
2012-07-04 00:03 . 2012-07-04 00:03 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\HPAppData
2012-07-02 02:36 . 2012-07-02 02:36 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-07-02 02:36 . 2012-07-02 02:36 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-07-02 00:59 . 2012-04-04 06:26 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-02 00:58 . 2012-07-02 00:58 -------- d-----w- c:\program files\iPod
2012-07-02 00:58 . 2012-07-02 01:01 -------- d-----w- c:\program files\iTunes
2012-07-02 00:39 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-07-02 00:39 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-07-02 00:39 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-07-02 00:39 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-07-02 00:38 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-07-02 00:38 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-07-02 00:38 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-07-02 00:38 . 2012-06-02 05:49 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-07-02 00:38 . 2012-06-02 05:42 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-30 06:03 . 2012-06-30 06:03 -------- d-----w- c:\program files\Trend Micro
2012-06-29 05:41 . 2012-06-29 05:41 -------- d-----w- c:\program files\NoVirusThanks
2012-06-29 00:54 . 2012-06-29 00:54 -------- d-----w- c:\users\TBC MB 02\AppData\Local\Macromedia
2012-06-29 00:40 . 2012-06-29 00:40 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Malwarebytes
2012-06-29 00:39 . 2012-06-29 00:39 -------- d-----w- c:\programdata\Malwarebytes
2012-06-29 00:39 . 2012-07-02 00:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-06-26 00:57 . 2012-06-26 02:34 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Foxit Software
2012-06-26 00:53 . 2012-06-26 00:53 -------- d-----w- c:\program files\Foxit Software
2012-06-22 07:25 . 2012-07-02 00:32 -------- d-----w- c:\program files\MediaInfo
2012-06-13 23:43 . 2012-05-15 01:12 2342400 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 23:43 . 2012-04-28 03:19 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-13 23:43 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-13 23:43 . 2012-04-26 04:48 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 23:43 . 2012-04-26 04:48 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 23:42 . 2012-04-26 04:43 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 23:42 . 2012-05-02 04:52 163328 ----a-w- c:\windows\system32\profsvc.dll
2012-06-13 23:41 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-06-13 23:41 . 2012-04-24 04:47 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-13 23:41 . 2012-04-24 04:47 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-13 02:04 . 2012-06-13 02:04 -------- d-----w- c:\users\TBC MB 02\AppData\Roaming\Canon
2012-06-13 00:35 . 2012-06-13 00:35 -------- d--h--w- c:\windows\system32\CanonMF Uninstaller Information
2012-06-13 00:35 . 2012-06-13 02:04 -------- d-----w- c:\program files\Canon
2012-06-13 00:35 . 2010-07-20 23:49 102400 ----a-w- c:\windows\system32\CNCLSI38b.DLL
2012-06-13 00:35 . 2010-07-20 23:49 135168 ----a-w- c:\windows\system32\CNCLSD38b.DLL
2012-06-13 00:35 . 2010-07-20 23:49 94208 ----a-w- c:\windows\system32\CNCLSC38b.DLL
2012-06-13 00:35 . 2010-07-20 23:49 102400 ----a-w- c:\windows\system32\CNCLST38b.DLL
2012-06-13 00:35 . 2010-07-20 23:49 188416 ----a-w- c:\windows\system32\CNCLSU38b.DLL
2012-06-13 00:35 . 2010-07-20 23:49 53248 ----a-w- c:\windows\system32\CNCLSO38b.dll
2012-06-13 00:35 . 2010-07-20 23:48 86016 ----a-w- c:\windows\system32\CNCI4400.DLL
2012-06-13 00:35 . 2010-07-20 23:47 122880 ----a-w- c:\windows\system32\CNCL4400.DLL
2012-06-13 00:34 . 2010-07-20 23:49 143360 ----a-w- c:\windows\system32\CNCE4400.DLL
2012-06-13 00:34 . 2010-07-20 23:48 303104 ----a-w- c:\windows\system32\CNCC4400.DLL
2012-06-13 00:34 . 2010-07-08 23:08 679936 ----a-w- c:\windows\system32\CNAS0MOK.DLL
2012-06-13 00:34 . 2009-06-18 09:43 204800 ----a-w- c:\windows\system32\CNCENPR.dll
2012-06-13 00:34 . 2009-06-18 09:43 110592 ----a-w- c:\windows\system32\CNCENPU.dll
2012-06-13 00:34 . 2010-07-07 05:06 139264 ----a-w- c:\windows\system32\CNCENPM.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-30 12:26 . 2012-05-30 12:26 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-30 12:26 . 2010-05-24 03:55 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-02 02:36 . 2011-05-30 04:12 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"TrustedNet Connect 2.x"="c:\program files\TrustedNet Connect 2.1\TNCTray.exe" [2003-07-29 86936]
"Telstra Connection Manager"="c:\program files\NetComm\Connection Manager\ConnectionManager.exe" [2010-01-29 145408]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-12-21 1483264]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-08-27 1191432]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-18 1537320]
"ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2009-09-04 186912]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-08-19 487424]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-09-04 261888]
"NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648]
"BigPond News Ticker"="c:\program files\BigPond News Ticker\BigPond__News_Ticker.exe" [2009-02-10 759728]
"PLD_FrameworkRun"="c:\windows\System32\oem\RunCMD.exe" [2009-08-11 229376]
"VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-08-05 3567616]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-30 200704]
"SignIn"="c:\program files\Microsoft Online Services\Sign In\SignIn.exe" [2010-03-09 1734512]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-08-25 476480]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-05 59240]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 167424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 144384]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-09 49208]
"NSU_agent"="c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2011-12-13 190768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"BigPondWirelessBroadbandCM"="c:\program files\Telstra\Mobile Broadband Manager\TelstraUCM.exe" [2011-08-11 6198168]
"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-01 634880]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"MFNetworkScanUtility"="c:\program files\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE" [2009-12-15 484760]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-9-16 708608]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-18 795936]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
My Place.lnk - c:\program files\Next G Connection Manager\Telstra\welcome_best.exe [2010-1-13 4594096]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Citrix\system32\mfaphook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ c:\program files\Acer Bio Protection\PwdFilter
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.exe [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 IERA;IERA;c:\program files\Sierra Wireless Inc\IERA\IERA.exe [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [x]
R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [x]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [x]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [x]
R3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\swg3kser00.sys [x]
R3 swiwdmbus;Sierra Wireless USB Composite Bus;c:\windows\system32\DRIVERS\swiwdmbus.sys [x]
R3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\DRIVERS\swiwdmbx.sys [x]
R3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\DRIVERS\swnc8ua3.sys [x]
R3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\DRIVERS\swumxa3.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\DRIVERS\zghsdiag.sys [x]
R3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\DRIVERS\zghsmdm.sys [x]
R3 zghsnmea;ZTE General Handset NMEA Port;c:\windows\system32\DRIVERS\zghsnmea.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 cdfdrv;cdfdrv;c:\windows\system32\DRIVERS\cdfdrv.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [x]
S2 ctxpidmn;ctxpidmn;c:\windows\system32\DRIVERS\ctxpidmn.sys [x]
S2 CtxSbx;CtxSbx;c:\windows\system32\DRIVERS\CtxSbx.sys [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [x]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [x]
S2 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [x]
S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [x]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 MotoHelper;MotoHelper Service;c:\program files\Motorola\MotoHelper\MotoHelperService.exe [x]
S2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 RadeSvc;Citrix Streaming Service;c:\program files\Citrix\Streaming Client\RadeSvc.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [x]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [x]
S2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [x]
S2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\Sierra Wireless Inc\Common\SwiCardDetect.exe [x]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [x]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [x]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.exe [x]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
S3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 TrustedNet Connect 2;TrustedNet Connect 2;c:\program files\TrustedNet Connect 2.1\tncservice.exe [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 23:28]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 23:28]
.
2012-06-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-679698490-3428004711-1132884799-1003Core.job
- c:\users\TBC MB 02\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 04:27]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-679698490-3428004711-1132884799-1003UA.job
- c:\users\TBC MB 02\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 04:27]
.
.
------- Supplementary Scan -------
.
uStart Page = https://mail.tlsmb.com.au:4437/CitrixAccess/auth/silentDetection.aspx
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956
uInternet Settings,ProxyOverride = 192.168.*.*;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: localhost
Trusted Zone: telstra.com
Trusted Zone: telstra.com\prm
Trusted Zone: telstra.com.au
Trusted Zone: tlsmb.com.au\mail
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.0.0.138
TCP: Interfaces\{3D0DDC28-CE16-4B92-8B22-32394D0142E0}: NameServer = 10.4.81.103 10.4.182.20
DPF: {01CA5FD4-E4AC-45E6-A248-270088CE3E63} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Calendar.cab
DPF: {01D03D5F-99F7-48AF-97CE-410126176AAA} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Test_Automation.cab
DPF: {02B7146F-723A-4B80-A597-F0AA74B40520} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_UInbox.cab
DPF: {150C4895-B693-4FB4-9D3D-09A39066957C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Calendar.cab
DPF: {1F6E6D7A-7475-4BFF-B445-7EDBA31F580B} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_CTI_Toolbar.cab
DPF: {1FCEC0C6-D57E-4071-9D0B-B0BF7582DE33} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_iHelp.cab
DPF: {276BD137-696E-4276-843A-1EEE3C661469} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Configurator.cab
DPF: {286C321B-38CF-4683-A182-FFFAA7067CBA} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_HTML_Editor.cab
DPF: {318FF898-4226-40F5-B8D7-5CECE2DEC393} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Allocation.cab
DPF: {41861299-EAB2-4DCC-986C-802AE12AC499} - hxxps://svr87.clickpos.net/login/Reserved.ReportViewerWebControl.axd?ReportSession=3xc3ce45tyc130ejm2o2ry55&ControlID=5911c40ee3f54553b3c78626ad53de93&Culture=3081&UICulture=3081&ReportStack=1&OpType=PrintCab
DPF: {4387A5D0-6276-4603-AA29-6EBD09BCEED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Prodselection.cab
DPF: {4A8EC16B-829E-4D6E-8171-41890F6BC1D0} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Hospitality_Gantt.cab
DPF: {6620834B-40F3-4500-BECE-5EFB9A844864} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Prodselection.cab
DPF: {6BACBCAB-3332-4CE6-9BCB-F7808E820F15} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Test_Automation.cab
DPF: {70695156-30ED-4E39-BDEC-CFA9017373FA} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Container_Control.cab
DPF: {72A59E9E-4475-4343-B82E-93EF73F2A104} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_HTML_Editor.cab
DPF: {79006115-9A97-459D-B7F3-0D07308122BD} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Gantt_Chart.cab
DPF: {82C7A6B1-2ACA-4CE9-8BA1-3645A040029C} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Container_Control.cab
DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Desktop_Integration.cab
DPF: {8F623BE4-2C55-4095-B1E0-A41B631A49BD} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_HI_Client.cab
DPF: {91BBD15D-A065-4BC6-967C-244B6D1EBA2C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Catalog_Navigator.cab
DPF: {97D6A566-D701-467F-A7B5-19B1F1C35896} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_CTI_Toolbar.cab
DPF: {A312B321-B071-4EEA-A721-C132BCDDCBEF} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Gantt_Chart.cab
DPF: {A351F0E7-DB33-4506-BF0A-622BCF5633E8} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Smartscript.cab
DPF: {AD014B5C-9DBD-4488-9745-09BBA7E35D10} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Calendar.cab
DPF: {B2F2E66A-242C-446C-B20D-A52B54CACF3A} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Allocation.cab
DPF: {B8FB9292-09D5-4EBF-8FAE-293857B3791F} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Configurator.cab
DPF: {BF2ABB32-37CC-40DB-A8CD-97070A338E2B} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Catalog_Navigator.cab
DPF: {BF88D489-C9C4-4BDD-9F73-09DE058A3D7D} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_OutBound_mail.cab
DPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_OutBound_mail.cab
DPF: {D113F990-B556-4930-8B9D-7A45A8C5DED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Microsite_Layout.cab
DPF: {D142D7F2-200E-461D-BBC2-D97AE3632FFF} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_iHelp.cab
DPF: {D1CAF963-A066-4814-9AA7-AC80B0916BF6} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Calendar.cab
DPF: {E05B64F1-24F4-4AD2-B076-B9E6FC424A9F} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_UInbox.cab
DPF: {E709FE80-04E4-4CF9-84AD-7999D449675D} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_HI_Client.cab
DPF: {EA437685-75B5-4910-A6FA-8A5982128186} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Smartscript.cab
DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file://d:\siebel crm and prm components source files\19251\applets\iTools.cab
DPF: {FD83D8B6-1C5A-441D-9FC1-B0E3804B5394} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Hospitality_Gantt.cab
DPF: {FDD8003B-AF25-41A0-8C90-DB2519831D12} - file://d:\temp\Siebel ActiveX Controls - update 21-05-2009\19241\applets\SiebelAx_Microsite_Layout.cab
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-MVS - c:\progra~1\McAfee\MANAGE~1\Agent\myinx
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(784)
c:\program files\Citrix\system32\CtxSbxHook.DLL
.
- - - - - - - > 'lsass.exe'(620)
c:\program files\Citrix\system32\CtxSbxHook.DLL
c:\program files\Acer Bio Protection\PwdFilter.DLL
.
Completion time: 2012-07-04 10:49:26
ComboFix-quarantined-files.txt 2012-07-04 01:19
.
Pre-Run: 385,954,033,664 bytes free
Post-Run: 388,331,110,400 bytes free
.
- - End Of File - - D84609834EB4CF95582933CF364FAE40
-
Thanks for the asistance
Laptop is still behaving a bit sluggish, Ie seems to crash unexpectedly, MBAM scan results below.
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.07.02.06
Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
TBC MB 02 :: TBCMB02-PC [administrator]
Protection: Enabled
3/07/2012 9:15:12 AM
mbam-log-2012-07-03 (09-15-12).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 423662
Time elapsed: 5 hour(s), 14 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
-
One of my staff came to me saying his laptop was asking for credit card details from websites that dont usually require verification and that Internet explorer and frefox were both unresponsive in general. DDS logs attached. please help
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32
Run by TBC MB 02 at 16:12:27 on 2012-06-30
Microsoft Windows 7 Professional 6.1.7600.0.1252.61.1033.18.2975.1811 [GMT 9.5:30]
.
AV: McAfee® Total Protection™ Service *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee® Total Protection™ Service *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee® Security-as-a-Service *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Acer Bio Protection\CompPtcVUI.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Common Files\Citrix\System32\CdfSvc.exe
C:\Program Files\Launch Manager\dsiwmis.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
C:\Program Files\Acer\Registration\GregHSRW.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Acer Bio Protection\BASVC.exe
C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Citrix\Streaming Client\RadeSvc.exe
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Sierra Wireless Inc\Common\SwiCardDetect.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfeann.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\PrintIsolationHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files\BigPond News Ticker\BigPond__News_Ticker.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\OEM\RunCmd.exe
C:\Program Files\Acer Bio Protection\PdtWzd.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Microsoft Online Services\Sign In\SignIn.exe
C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
c:\windows\system32\oem\setEvent.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Telstra\Mobile Broadband Manager\TelstraUCM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT.EXE
C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\TrustedNet Connect 2.1\TNCTray.exe
C:\Program Files\NetComm\Connection Manager\ConnectionManager.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
C:\Program Files\TrustedNet Connect 2.1\tncservice.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
C:\Windows\system32\DllHost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.exe
C:\Windows\system32\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://mail.tlsmb.com.au:4437/CitrixAccess/auth/silentDetection.aspx
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&m=aspire_4810t&r=27360909b006l03e8zq05t47l1s14p
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=travelmate_8571&r=27050110f306l0321z285x49k1k956
uInternet Settings,ProxyOverride = 192.168.*.*;*.local
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110926074541.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\7.1.361.0\BingExt.dll"
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [Google Update] "c:\users\tbc mb 02\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [TrustedNet Connect 2.x] "c:\program files\trustednet connect 2.1\TNCTray.exe"
uRun: [Telstra Connection Manager] c:\program files\netcomm\connection manager\ConnectionManager.exe
uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray
uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [ODDPwr] "c:\program files\acer\optical drive power management\ODDPwr.exe"
mRun: [Acer ePower Management] c:\program files\acer\acer powersmart manager\ePowerTrayLauncher.exe
mRun: [backupManagerTray] "c:\program files\newtech infosystems\acer backup manager\BackupManagerTray.exe" -h -k
mRun: [NortonOnlineBackupReminder] "c:\program files\symantec\norton online backup\activation\NobuActivation.exe" UNATTENDED
mRun: [bigPond News Ticker] "c:\program files\bigpond news ticker\BigPond__News_Ticker.exe"
mRun: [PLD_FrameworkRun] c:\windows\system32\oem\runcmd.exe c:\windows\system32\oem\OKTOLaunch_PLD_Framework.cmd
mRun: [VitaKeyPdtWzd] "c:\program files\acer bio protection\PdtWzd.exe"
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [signIn] "c:\program files\microsoft online services\sign in\SignIn.exe" /autorun
mRun: [MVS Splash] "c:\program files\mcafee\managed virusscan\desktopui\XTray.exe"
mRun: [XeroxRegistation] "c:\users\tbcmb0~1\appdata\local\temp\xerox\ereg\EReg.exe" /Startup
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [gemstrmw] c:\windows\system32\gemstrmw.exe /r
mRun: [igfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [NSU_agent] "c:\program files\nokia\nokia software updater\nsu3ui_agent.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [bigPondWirelessBroadbandCM] "c:\program files\telstra\mobile broadband manager\TelstraUCM.exe" -tsr
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MFNetworkScanUtility] c:\program files\canon\canon mf network scan utility\CNMFSUT.EXE
mRun: [HTC Sync Loader] "c:\program files\htc\htc sync 3.0\htcUPCTLoader.exe" -startup
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\myplac~1.lnk - c:\program files\next g connection manager\telstra\welcome_best.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer bio protection\PwdBank.exe
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: localhost
Trusted Zone: telstra.com
Trusted Zone: telstra.com\prm
Trusted Zone: telstra.com.au
Trusted Zone: tlsmb.com.au\mail
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //FWEvent.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
DPF: {01CA5FD4-E4AC-45E6-A248-270088CE3E63} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Calendar.cab
DPF: {01D03D5F-99F7-48AF-97CE-410126176AAA} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Test_Automation.cab
DPF: {02B7146F-723A-4B80-A597-F0AA74B40520} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_UInbox.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {150C4895-B693-4FB4-9D3D-09A39066957C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Calendar.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {1F6E6D7A-7475-4BFF-B445-7EDBA31F580B} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_CTI_Toolbar.cab
DPF: {1FCEC0C6-D57E-4071-9D0B-B0BF7582DE33} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_iHelp.cab
DPF: {276BD137-696E-4276-843A-1EEE3C661469} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Configurator.cab
DPF: {286C321B-38CF-4683-A182-FFFAA7067CBA} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_HTML_Editor.cab
DPF: {318FF898-4226-40F5-B8D7-5CECE2DEC393} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Allocation.cab
DPF: {41861299-EAB2-4DCC-986C-802AE12AC499} - hxxps://svr87.clickpos.net/login/Reserved.ReportViewerWebControl.axd?ReportSession=3xc3ce45tyc130ejm2o2ry55&ControlID=5911c40ee3f54553b3c78626ad53de93&Culture=3081&UICulture=3081&ReportStack=1&OpType=PrintCab
DPF: {4387A5D0-6276-4603-AA29-6EBD09BCEED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Prodselection.cab
DPF: {4A8EC16B-829E-4D6E-8171-41890F6BC1D0} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Hospitality_Gantt.cab
DPF: {6620834B-40F3-4500-BECE-5EFB9A844864} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Prodselection.cab
DPF: {6BACBCAB-3332-4CE6-9BCB-F7808E820F15} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Test_Automation.cab
DPF: {70695156-30ED-4E39-BDEC-CFA9017373FA} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Container_Control.cab
DPF: {72A59E9E-4475-4343-B82E-93EF73F2A104} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_HTML_Editor.cab
DPF: {79006115-9A97-459D-B7F3-0D07308122BD} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Gantt_Chart.cab
DPF: {82C7A6B1-2ACA-4CE9-8BA1-3645A040029C} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Container_Control.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab
DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Desktop_Integration.cab
DPF: {8F623BE4-2C55-4095-B1E0-A41B631A49BD} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_HI_Client.cab
DPF: {91BBD15D-A065-4BC6-967C-244B6D1EBA2C} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Catalog_Navigator.cab
DPF: {97D6A566-D701-467F-A7B5-19B1F1C35896} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_CTI_Toolbar.cab
DPF: {A312B321-B071-4EEA-A721-C132BCDDCBEF} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Gantt_Chart.cab
DPF: {A351F0E7-DB33-4506-BF0A-622BCF5633E8} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Smartscript.cab
DPF: {AD014B5C-9DBD-4488-9745-09BBA7E35D10} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Marketing_Calendar.cab
DPF: {B2F2E66A-242C-446C-B20D-A52B54CACF3A} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Marketing_Allocation.cab
DPF: {B8FB9292-09D5-4EBF-8FAE-293857B3791F} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Configurator.cab
DPF: {BF2ABB32-37CC-40DB-A8CD-97070A338E2B} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Catalog_Navigator.cab
DPF: {BF88D489-C9C4-4BDD-9F73-09DE058A3D7D} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_OutBound_mail.cab
DPF: {C1FC96DA-81BE-4836-B3A5-958F55E56E8E} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_OutBound_mail.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab
DPF: {D113F990-B556-4930-8B9D-7A45A8C5DED1} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Microsite_Layout.cab
DPF: {D142D7F2-200E-461D-BBC2-D97AE3632FFF} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_iHelp.cab
DPF: {D1CAF963-A066-4814-9AA7-AC80B0916BF6} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Calendar.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
DPF: {E05B64F1-24F4-4AD2-B076-B9E6FC424A9F} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_UInbox.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://teamtelstra.webex.com/client/T27L10NSP21EP3/webex/ieatgpc1.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E709FE80-04E4-4CF9-84AD-7999D449675D} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_HI_Client.cab
DPF: {EA437685-75B5-4910-A6FA-8A5982128186} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Smartscript.cab
DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file://d:\siebel crm and prm components source files\19251\applets\iTools.cab
DPF: {FD83D8B6-1C5A-441D-9FC1-B0E3804B5394} - file://d:\siebel crm and prm components source files\19251\applets\SiebelAx_Hospitality_Gantt.cab
DPF: {FDD8003B-AF25-41A0-8C90-DB2519831D12} - file://d:\temp\siebel activex controls - update 21-05-2009\19241\applets\SiebelAx_Microsite_Layout.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\24967605F6E64603432303 : DhcpNameServer = 10.0.0.138
TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\24967605F6E64603934303 : DhcpNameServer = 10.0.0.138
TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\36C61627B602E6564777F627B6 : DhcpNameServer = 192.168.20.1
TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\452434 : DhcpNameServer = 192.168.5.254
TCP: Interfaces\{0DF2A7C7-18E4-40CC-9200-E1C0B376D21E}\8445340205F627471626C6560284F6473707F647 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{3D0DDC28-CE16-4B92-8B22-32394D0142E0} : NameServer = 10.4.81.103 10.4.182.20
TCP: Interfaces\{56F3F92A-E39A-409D-BAB7-7D2DF4926FDE} : DhcpNameServer = 10.4.85.135 10.4.176.231
TCP: Interfaces\{A076241E-F287-4440-A75C-6FF8FC204DF6} : DhcpNameServer = 192.168.1.254
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll
Handler: myrm - {4D034FC3-013F-4b95-B544-44D49ABE3E76} - c:\program files\mcafee\managed virusscan\agent\MyRmProt5.0.0.811.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\citrix\system32\mfaphook.dll
LSA: Notification Packages = c:\program files\acer bio protection\PwdFilter
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-16 461864]
R1 cdfdrv;cdfdrv;c:\windows\system32\drivers\cdfdrv.sys [2008-7-27 27672]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-8-12 64712]
R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-8-12 164776]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-9-3 20328]
R2 ctxpidmn;ctxpidmn;c:\windows\system32\drivers\ctxpidmn.sys [2008-8-16 22808]
R2 CtxSbx;CtxSbx;c:\windows\system32\drivers\CtxSbx.sys [2008-8-16 185880]
R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2009-9-16 107016]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2009-9-16 688128]
R2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [2010-1-13 22528]
R2 Greg_Service;GRegService;c:\program files\acer\registration\GregHSRW.exe [2009-8-28 1150496]
R2 IGBASVC;EgisTec Service;c:\program files\acer bio protection\BASVC.exe [2009-8-5 3450368]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-6-29 654408]
R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\mcafee\siteadvisor enterprise\McSACore.exe [2011-5-12 324928]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-1-7 166024]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2011-1-12 160344]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-1-7 148520]
R2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-12-7 214896]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-4-16 291064]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-9-4 62720]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2009-6-18 144640]
R2 ODDPwrSvc;Acer ODD Power Service;c:\program files\acer\optical drive power management\ODDPWRSvc.exe [2009-9-16 125472]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\htc\internet pass-through\PassThruSvr.exe [2011-9-15 88576]
R2 RadeSvc;Citrix Streaming Service;c:\program files\citrix\streaming client\RadeSvc.exe [2008-8-16 398656]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-9-16 253952]
R2 RumorServer;McAfee Peer Distribution Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2010-4-16 291064]
R2 SwiCardDetectSvc;Sierra Wireless Card Detection Service;c:\program files\sierra wireless inc\common\SwiCardDetect.exe [2011-6-24 238960]
R2 TeamViewer5;TeamViewer 5;c:\program files\teamviewer\version5\TeamViewer_Service.exe [2010-6-28 173352]
R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-6-1 2337144]
R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-1-19 3027840]
R2 Updater Service;Updater Service;c:\program files\acer\acer updater\UpdaterService.exe [2009-9-16 240160]
R3 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\7.1.361.0\SeaPort.EXE [2012-2-10 240408]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2009-9-16 180736]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-6-29 22344]
R3 MfeAVFK;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-4-16 180008]
R3 MfeBOPK;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-4-16 59288]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-8-12 338040]
R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-16 6114816]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-6-23 275048]
R3 TrustedNet Connect 2;TrustedNet Connect 2;c:\program files\trustednet connect 2.1\TNCService.exe [2010-7-22 320408]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 BBSvc;BingBar Service;c:\program files\microsoft\bingbar\7.1.361.0\BBSvc.EXE [2012-2-10 193816]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-19 136176]
S2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-9-16 359952]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-6-28 250056]
S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [2011-12-16 32408]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-9-16 43944]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-1-13 29472]
S3 GemCCID;GemCCID;c:\windows\system32\drivers\GemCCID.sys [2009-8-10 89600]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-19 136176]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\androidusb.sys [2011-12-16 32408]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [2010-6-23 23040]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2009-9-16 101248]
S3 IERA;IERA;c:\program files\sierra wireless inc\iera\IERA.exe [2010-8-11 152432]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-7-10 7168]
S3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [2011-12-16 15896]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-6-29 40776]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-12 87808]
S3 MfeRKDK;McAfee Inc. MfeRKDK;c:\windows\system32\drivers\mferkdk.sys [2010-4-16 34248]
S3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [2009-7-10 25856]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-4-4 20480]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-1-29 8320]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-9-16 4231680]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-5-18 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-5-18 8576]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2009-6-18 50432]
S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2012-5-31 16472]
S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2012-5-31 11104]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\drivers\RTL2832U_IRHID.sys [2009-10-5 31872]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2010-7-1 188392]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [2010-7-1 32872]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 swg3kser00;Sierra Wireless QMI USB Device for Legacy Serial Communication;c:\windows\system32\drivers\swg3kser00.sys [2012-3-20 215552]
S3 swiwdmbus;Sierra Wireless USB Composite Bus;c:\windows\system32\drivers\swiwdmbus.sys [2010-6-21 78720]
S3 swiwdmbx;Sierra Wireless USB Bus Service;c:\windows\system32\drivers\swiwdmbx.sys [2012-3-20 83968]
S3 SWNC8UA3;Sierra Wireless MUX NDIS Driver (UMTSA3);c:\windows\system32\drivers\swnc8ua3.sys [2012-3-20 208128]
S3 SWUMXA3;Sierra Wireless USB MUX Driver (UMTSA3);c:\windows\system32\drivers\swumxa3.sys [2010-6-21 156544]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-6 1343400]
S3 zghsdiag;ZTE General Handset Diagnostic Port;c:\windows\system32\drivers\zghsdiag.sys [2011-12-16 113688]
S3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\drivers\zghsmdm.sys [2011-12-16 113688]
S3 zghsnmea;ZTE General Handset NMEA Port;c:\windows\system32\drivers\zghsnmea.sys [2011-12-16 113688]
.
=============== Created Last 30 ================
.
2012-06-30 06:03:43 -------- d-----w- c:\program files\Trend Micro
2012-06-30 03:50:25 -------- d-----w- c:\program files\CCleaner
2012-06-29 05:41:11 -------- d-----w- c:\program files\NoVirusThanks
2012-06-29 00:54:22 -------- d-----w- c:\users\tbc mb 02\appdata\local\Macromedia
2012-06-29 00:40:47 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-06-29 00:40:47 -------- d-----w- c:\users\tbc mb 02\appdata\roaming\Malwarebytes
2012-06-29 00:39:47 -------- d-----w- c:\programdata\Malwarebytes
2012-06-29 00:39:43 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-29 00:39:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-06-27 23:30:36 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-26 00:57:32 -------- d-----w- c:\users\tbc mb 02\appdata\roaming\Foxit Software
2012-06-26 00:53:23 -------- d-----w- c:\program files\Foxit Software
2012-06-22 07:25:29 -------- d-----w- c:\program files\MediaInfo
2012-06-21 23:24:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-21 23:23:48 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-21 23:23:34 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-21 23:23:34 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-19 03:22:39 -------- d-----w- c:\programdata\Windows
2012-06-13 23:43:37 2342400 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 23:43:13 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-13 23:43:07 2342400 ----a-w- c:\windows\system32\msi.dll
2012-06-13 23:43:03 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 23:43:00 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 23:42:59 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 23:42:50 163328 ----a-w- c:\windows\system32\profsvc.dll
2012-06-13 23:41:29 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-06-13 23:41:27 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-13 23:41:24 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-13 00:35:37 -------- d--h--w- c:\windows\system32\CanonMF Uninstaller Information
2012-06-13 00:35:33 -------- d-----w- c:\program files\Canon
2012-06-13 00:35:05 94208 ----a-w- c:\windows\system32\CNCLSC38b.DLL
2012-06-13 00:35:05 188416 ----a-w- c:\windows\system32\CNCLSU38b.DLL
2012-06-13 00:35:05 135168 ----a-w- c:\windows\system32\CNCLSD38b.DLL
2012-06-13 00:35:05 102400 ----a-w- c:\windows\system32\CNCLST38b.DLL
2012-06-13 00:35:05 102400 ----a-w- c:\windows\system32\CNCLSI38b.DLL
2012-06-13 00:35:00 86016 ----a-w- c:\windows\system32\CNCI4400.DLL
2012-06-13 00:35:00 53248 ----a-w- c:\windows\system32\CNCLSO38b.dll
2012-06-13 00:35:00 122880 ----a-w- c:\windows\system32\CNCL4400.DLL
2012-06-13 00:34:58 303104 ----a-w- c:\windows\system32\CNCC4400.DLL
2012-06-13 00:34:58 143360 ----a-w- c:\windows\system32\CNCE4400.DLL
2012-06-13 00:34:27 679936 ----a-w- c:\windows\system32\CNAS0MOK.DLL
2012-06-13 00:34:19 204800 ----a-w- c:\windows\system32\CNCENPR.dll
2012-06-13 00:34:19 110592 ----a-w- c:\windows\system32\CNCENPU.dll
2012-06-13 00:34:18 139264 ----a-w- c:\windows\system32\CNCENPM.dll
.
==================== Find3M ====================
.
2012-06-28 00:19:08 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-30 12:26:10 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-30 12:26:10 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-05-17 22:45:37 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-05-17 22:35:47 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-05-17 22:35:39 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 22:29:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-05-17 22:24:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-04-02 04:46:44 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-02 04:46:44 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
.
============= FINISH: 16:14:08.62 ===============
computer slowing, IE not responding
in Resolved Malware Removal Logs
Posted
ComboFix uninstalled as requested and the password suggestion is a good one too. Thanks a lot for the assistance.