Jump to content

cwalk5334

Members
 View Profile  See their activity

  • Posts

    8

  • Joined

  • Last visited

 Content Type 

Posts posted by cwalk5334

    svchost virus in computer

    in Resolved Malware Removal Logs

    Posted

    Results of screen317's Security Check version 0.99.49

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 9

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    Norton Internet Security

    WMI entry may not exist for antivirus; attempting automatic update.

    `````````Anti-malware/Other Utilities Check:`````````

    Malwarebytes Anti-Malware version 1.62.0.1300

    JavaFX 2.1.0

    Java 7 Update 4

    Java version out of Date!

    Adobe Flash Player 10 Flash Player out of Date!

    Adobe Flash Player 11.3.300.257 Flash Player out of Date!

    Adobe Reader X 10.1.3 Adobe Reader out of Date!

    Mozilla Firefox (14.0.1)

    ````````Process Check: objlist.exe by Laurent````````

    Norton ccSvcHst.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 5%

    ````````````````````End of Log``````````````````````

    svchost virus in computer

    in Resolved Malware Removal Logs

    Posted

    RogueKiller V8.0.2 [08/31/2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : CJ [Admin rights]

    Mode : Scan -- Date : 09/02/2012 22:10:56

    ¤¤¤ Bad processes : 1 ¤¤¤

    [sUSP PATH] Runservice.exe -- C:\Windows\runservice.exe -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 2 ¤¤¤

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    127.0.0.1 localhost

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD25 00BEVT-60A23T0 SATA Disk Device +++++

    --- User ---

    [MBR] f0919cf143eb9e51bd35b8748dcf5e0f

    [bSP] 017252dd18bd5396ca289836acd8de44 : Windows 7 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 224176 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 459522048 | Size: 13995 Mo

    3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 488183808 | Size: 103 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[6].txt >>

    RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;

    RKreport[6].txt

    svchost virus in computer

    in Resolved Malware Removal Logs

    Posted

    everything seems to be running smoothly.

    Malwarebytes Anti-Malware 1.62.0.1300

    www.malwarebytes.org

    Database version: v2012.09.02.03

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    CJ :: CJ-HP [administrator]

    9/2/2012 9:36:26 PM

    mbam-log-2012-09-02 (21-36-26).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 219311

    Time elapsed: 7 minute(s), 5 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    svchost virus in computer

    in Resolved Malware Removal Logs

    Posted

    RogueKiller V8.0.2 [08/31/2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : CJ [Admin rights]

    Mode : Scan -- Date : 09/02/2012 15:26:27

    ¤¤¤ Bad processes : 2 ¤¤¤

    [sUSP PATH] Runservice.exe -- C:\Windows\runservice.exe -> KILLED [TermProc]

    [sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 5 ¤¤¤

    [HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FOUND

    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

    [HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ Infection : Root.MBR ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    127.0.0.1 localhost

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD25 00BEVT-60A23T0 SATA Disk Device +++++

    --- User ---

    [MBR] f0919cf143eb9e51bd35b8748dcf5e0f

    [bSP] 017252dd18bd5396ca289836acd8de44 : Windows 7 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 224176 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 459522048 | Size: 13995 Mo

    3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 488183808 | Size: 103 Mo

    User = LL1 ... OK!

    User != LL2 ... KO!

    --- LL2 ---

    [MBR] 9e58ea3e404e605b6b6d687b7f4af3e6

    [bSP] 017252dd18bd5396ca289836acd8de44 : Windows 7 MBR Code

    Partition table:

    1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 224176 Mo

    3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 459522048 | Size: 13995 Mo

    Finished : << RKreport[1].txt >>

    RKreport[1].txt

    svchost virus in computer

    in Resolved Malware Removal Logs

    Posted

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2011-08-26.01)

    .

    Microsoft Windows 7 Home Premium

    Boot Device: \Device\HarddiskVolume1

    Install Date: 12/25/2011 9:29:04 AM

    System Uptime: 9/2/2012 11:40:50 AM (4 hours ago)

    .

    Motherboard: Hewlett-Packard | | 3577

    Processor: AMD C-50 Processor | Socket FT1 | 1000/100mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 219 GiB total, 109.919 GiB free.

    D: is FIXED (NTFS) - 14 GiB total, 1.702 GiB free.

    E: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    ==== System Restore Points ===================

    .

    .

    ==== Installed Programs ======================

    .

    Adobe Flash Player 10 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Reader X (10.1.3) MUI

    Adobe Shockwave Player 11.5

    Agatha Christie - Peril at End House

    Apple Application Support

    Apple Software Update

    Bejeweled 2 Deluxe

    Bing Bar

    Blackhawk Striker 2

    Blasterball 3

    Blio

    Bounce Symphony

    Build-a-lot 2

    Cake Mania

    Catalyst Control Center - Branding

    Catalyst Control Center Graphics Previews Common

    Catalyst Control Center InstallProxy

    Catalyst Control Center Localization All

    ccc-core-static

    CCC Help Chinese Standard

    CCC Help Chinese Traditional

    CCC Help Czech

    CCC Help Danish

    CCC Help Dutch

    CCC Help English

    CCC Help Finnish

    CCC Help French

    CCC Help German

    CCC Help Greek

    CCC Help Hungarian

    CCC Help Italian

    CCC Help Japanese

    CCC Help Korean

    CCC Help Norwegian

    CCC Help Polish

    CCC Help Portuguese

    CCC Help Russian

    CCC Help Spanish

    CCC Help Swedish

    CCC Help Thai

    CCC Help Turkish

    Chuzzle Deluxe

    Cisco EAP-FAST Module

    Cisco LEAP Module

    Cisco PEAP Module

    Compaq Setup Manager

    CyberLink YouCam

    D3DX10

    Diner Dash 2 Restaurant Rescue

    Dora's World Adventure

    EA SPORTS Game Face Browser Plugin 1.5.3.0

    Energy Star Digital Logo

    Escape Rosecliff Island

    ESU for Microsoft Windows 7

    Farm Frenzy

    FATE

    Final Drive Nitro

    Heroes of Hellas 2 - Olympia

    Hewlett-Packard ACLM.NET v1.1.2.0

    HP CloudDrive

    HP Customer Experience Enhancements

    HP Documentation

    HP Game Console

    HP Games

    HP MovieStore

    HP On Screen Display

    HP Power Manager

    HP Quick Launch

    HP Setup

    HP Software Framework

    HP Support Assistant

    Java Auto Updater

    Java 7 Update 4

    JavaFX 2.1.0

    Jewel Quest Solitaire 2

    Junk Mail filter update

    Malwarebytes Anti-Malware version 1.62.0.1300

    Mesh Runtime

    Microsoft Office 2010

    Microsoft Office Click-to-Run 2010

    Microsoft Office Starter 2010 - English

    Microsoft PowerPoint Viewer

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Microsoft WSE 3.0 Runtime

    Mozilla Firefox 14.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSVCRT

    MSVCRT_amd64

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    Mystery P.I. - The London Caper

    Norton Internet Security

    Opera 11.60

    Penguins!

    Plants vs. Zombies

    PlayReady PC Runtime x86

    Poker Superstars III

    Polar Bowler

    Polar Golfer

    Realtek Ethernet Controller Driver

    Realtek High Definition Audio Driver

    Realtek PCIE Card Reader

    REALTEK Wireless LAN Driver

    Recovery Manager

    RoxioNow Player

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Skype™ 5.5

    Unity Web Player

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Virtual Families

    Virtual Villagers 4 - The Tree of Life

    Vizzed Retro Game Room

    Wheel of Fortune 2

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live Installer

    Windows Live Mail

    Windows Live Mesh

    Windows Live Mesh ActiveX Control for Remote Connections

    Windows Live Messenger

    Windows Live Movie Maker

    Windows Live Photo Common

    Windows Live Photo Gallery

    Windows Live PIMT Platform

    Windows Live SOXE

    Windows Live SOXE Definitions

    Windows Live UX Platform

    Windows Live UX Platform Language Pack

    Windows Live Writer

    Windows Live Writer Resources

    Zuma Deluxe

    .

    ==== Event Viewer Messages From Past Week ========

    .

    9/2/2012 9:48:49 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the FontCache3.0.0.0 service.

    9/2/2012 11:07:35 AM, Error: Service Control Manager [7034] - The HP Auto service terminated unexpectedly. It has done this 1 time(s).

    9/2/2012 10:40:47 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

    9/2/2012 10:37:54 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.

    9/2/2012 10:29:55 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000019 (0x0000000000000020, 0xfffffa8001831d90, 0xfffffa8001831e50, 0x00000000040c000c). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 090212-56051-01.

    9/1/2012 8:28:48 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NIS service.

    8/30/2012 10:40:51 PM, Error: NetBT [4321] - The name "CJ-HP :20" could not be registered on the interface with IP address 143.206.193.63. The computer with the IP address 143.206.192.61 did not allow the name to be claimed by this computer.

    8/30/2012 10:40:51 PM, Error: NetBT [4321] - The name "CJ-HP :0" could not be registered on the interface with IP address 143.206.193.63. The computer with the IP address 143.206.192.61 did not allow the name to be claimed by this computer.

    8/30/2012 10:40:50 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{DBCF4C8A-8786-4C74-A1B2-C201C041E12D} because another computer on the network has the same name. The server could not start.

    8/29/2012 8:06:09 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

    8/29/2012 1:22:27 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AMD FUEL Service service.

    8/27/2012 2:14:46 PM, Error: NetBT [4321] - The name "CJ-HP :20" could not be registered on the interface with IP address 143.206.252.80. The computer with the IP address 143.206.253.196 did not allow the name to be claimed by this computer.

    8/27/2012 2:14:46 PM, Error: NetBT [4321] - The name "CJ-HP :0" could not be registered on the interface with IP address 143.206.252.80. The computer with the IP address 143.206.253.196 did not allow the name to be claimed by this computer.

    8/26/2012 9:32:12 PM, Error: NetBT [4321] - The name "CJ-HP :20" could not be registered on the interface with IP address 143.206.252.255. The computer with the IP address 143.206.253.10 did not allow the name to be claimed by this computer.

    8/26/2012 9:32:12 PM, Error: NetBT [4321] - The name "CJ-HP :0" could not be registered on the interface with IP address 143.206.252.255. The computer with the IP address 143.206.253.10 did not allow the name to be claimed by this computer.

    .

    ==== End Of File ===========================

    .

    DDS (Ver_2011-08-26.01) - NTFSAMD64

    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.1

    Run by CJ at 15:13:10 on 2012-09-02

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1643.381 [GMT -4:00]

    .

    AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\wininit.exe

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\system32\atiesrxx.exe

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\atieclxx.exe

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

    C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe

    C:\Windows\system32\taskhost.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

    C:\Windows\runservice.exe

    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe

    C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    C:\Windows\System32\svchost.exe -k secsvcs

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

    C:\Windows\system32\SearchIndexer.exe

    C:\Windows\System32\rundll32.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe

    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe

    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    C:\Windows\system32\wuauclt.exe

    C:\Windows\notepad.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_257.exe

    -netsvcs

    C:\Windows\system32\conhost.exe

    C:\Windows\SysWOW64\cmd.exe

    C:\Windows\system32\conhost.exe

    C:\Windows\SysWOW64\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://www.search.yahoo.com/?fr=w3i&type=W3i_SP,204,0_0,StartPage,20111253,16897,0,6,0

    uInternet Settings,ProxyOverride = *.local

    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll

    BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL

    BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

    TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll

    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

    mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    Trusted Zone: vizzed.com\www

    TCP: DhcpNameServer = 8.8.8.8 8.8.4.4

    TCP: Interfaces\{88719904-F2B4-4C31-901C-7FF3D4508A68} : DhcpNameServer = 192.168.40.2

    TCP: Interfaces\{DBCF4C8A-8786-4C74-A1B2-C201C041E12D} : DhcpNameServer = 8.8.8.8 8.8.4.4

    TCP: Interfaces\{DBCF4C8A-8786-4C74-A1B2-C201C041E12D}\2375942554539363 : DhcpNameServer = 192.168.1.254

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

    BHO-X64: 0x1 - No File

    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO-X64: AcroIEHelperStub - No File

    BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll

    BHO-X64: Symantec NCO BHO - No File

    BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL

    BHO-X64: Symantec Intrusion Prevention - No File

    BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

    BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

    TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll

    TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

    mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

    mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRunOnce-x64: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\CJ\AppData\Roaming\Mozilla\Firefox\Profiles\84nb5o6o.default\

    FF - prefs.js: browser.startup.homepage - hxxp://mail.aol.com/36472-111/aol-6/en-us/Suite.aspx

    FF - prefs.js: network.proxy.type - 0

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

    FF - plugin: C:\Program Files (x86)\Vizzed\Vizzed Retro Game Room\NpVizzedRgr.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Users\CJ\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

    FF - plugin: C:\Users\CJ\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll

    FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]

    R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]

    R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1207020.003\SYMDS64.SYS [?]

    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1207020.003\SYMEFA64.SYS [?]

    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120215.001\BHDrvx64.sys [2012-2-17 1157240]

    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120223.002\IDSviA64.sys [2012-2-23 488568]

    R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [?]

    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1207020.003\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1207020.003\SYMNETS.SYS [?]

    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

    R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]

    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

    R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]

    R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]

    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

    R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\system32\DRIVERS\rtl8192Ce.sys --> C:\Windows\system32\DRIVERS\rtl8192Ce.sys [?]

    R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]

    R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]

    R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]

    R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]

    R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]

    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]

    S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]

    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

    .

    =============== Created Last 30 ================

    .

    2012-09-02 15:08:50 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{007D0E5E-C206-470C-8A21-AB9CC761F6AF}\offreg.dll

    2012-09-02 15:07:57 20480 ----a-w- C:\Windows\svchost.exe

    2012-08-31 17:32:27 9310152 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{007D0E5E-C206-470C-8A21-AB9CC761F6AF}\mpengine.dll

    2012-08-15 01:46:43 503808 ----a-w- C:\Windows\System32\srcore.dll

    2012-08-15 01:46:43 43008 ----a-w- C:\Windows\SysWow64\srclient.dll

    2012-08-15 01:46:40 751104 ----a-w- C:\Windows\System32\win32spl.dll

    2012-08-15 01:46:39 67072 ----a-w- C:\Windows\splwow64.exe

    2012-08-15 01:46:39 559104 ----a-w- C:\Windows\System32\spoolsv.exe

    2012-08-15 01:46:39 492032 ----a-w- C:\Windows\SysWow64\win32spl.dll

    2012-08-15 01:46:37 59392 ----a-w- C:\Windows\System32\browcli.dll

    2012-08-15 01:46:37 136704 ----a-w- C:\Windows\System32\browser.dll

    2012-08-15 01:46:36 41984 ----a-w- C:\Windows\SysWow64\browcli.dll

    2012-08-15 01:46:32 3148800 ----a-w- C:\Windows\System32\win32k.sys

    2012-08-15 01:46:30 956928 ----a-w- C:\Windows\System32\localspl.dll

    2012-08-08 20:07:39 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\4CA7.tmp

    2012-08-08 20:07:39 5120 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\4BDC.tmp

    .

    ==================== Find3M ====================

    .

    2012-09-02 15:07:18 1457 --sha-w- C:\Windows\SysWow64\mmf.sys

    2012-07-03 17:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2012-06-29 03:56:34 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2012-06-29 03:49:11 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2012-06-29 03:48:07 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-06-29 03:43:49 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2012-06-29 03:39:48 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-06-29 00:16:58 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-06-29 00:09:01 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-06-29 00:08:59 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-06-29 00:04:43 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2012-06-29 00:00:45 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-06-09 22:24:34 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-06-09 22:24:34 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll

    2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll

    2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll

    2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll

    2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll

    2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll

    .

    ============= FINISH: 15:20:43.86 ===============

    svchost virus in computer

    in Resolved Malware Removal Logs

    Posted

    It would be appreciated if someone could help me out.

    Malwarebytes Anti-Malware 1.62.0.1300

    www.malwarebytes.org

    Database version: v2012.09.02.03

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    CJ :: CJ-HP [administrator]

    9/2/2012 11:12:32 AM

    mbam-log-2012-09-02 (11-12-32).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 219231

    Time elapsed: 15 minute(s), 41 second(s)

    Memory Processes Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> 4580 -> Delete on reboot.

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

    (end)

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.