Jump to content

sciguy

Members
 View Profile  See their activity

  • Posts

    5

  • Joined

  • Last visited

Reputation

0 Neutral
  1. sciguy
    Here is the attached file. Sorry about the delay. ComboFix.txt
  2. sciguy
    <p>Here is combofix txt.</p> <p> </p> <p> </p> <div>ComboFix 12-11-19.02 - Coston Family 11/19/2012 18:58:03.1.2 - x86</div> <div>Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1279 [GMT -5:00]</div> <div>Running from: c:\users\Coston Family\Desktop\ComboFix.exe</div> <div>AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}</div> <div>FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}</div> <div>SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}</div> <div>SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}</div> <div>.</div> <div>.</div> <div>((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))</div> <div>.</div> <div>.</div> <div>c:\program files\alotappbar</div> <div>c:\program files\alotappbar\alotUninst.exe</div> <div>c:\program files\alotappbar\bin\alotappbar.dll</div> <div>c:\program files\alotappbar\bin\alothelper.dll</div> <div>c:\program files\alotappbar\bin\alotsettings.exe</div> <div>c:\program files\alotappbar\bin\alotwidgets.exe</div> <div>c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll</div> <div>c:\programdata\0tbpw.pad</div> <div>c:\users\Coston Family\AppData\Local\jetmp3\ie\jeTMp3.dll</div> <div>c:\users\Coston Family\AppData\Local\Temp\dssagent.exe</div> <div>c:\users\Coston Family\AppData\Roaming\Cayz</div> <div>c:\users\Coston Family\AppData\Roaming\Cayz\fyci.zuq</div> <div>c:\users\Coston Family\AppData\Roaming\Duochu</div> <div>c:\users\Coston Family\AppData\Roaming\Duochu\evom.too</div> <div>c:\users\Coston Family\AppData\Roaming\Ohrena</div> <div>c:\users\Coston Family\AppData\Roaming\Ohrena\afule.afn</div> <div>c:\users\Coston Family\AppData\Roaming\Ucsyos</div> <div>c:\users\Coston Family\AppData\Roaming\Ucsyos\awde.zol</div> <div>c:\users\COSTON~1\AppData\Local\Temp\dssagent.exe</div> <div>c:\windows\COUPon~1.ocx</div> <div>c:\windows\system32\pt</div> <div>c:\windows\system32\pt\smartfacevcp.dll.mui</div> <div>c:\windows\system32\pt\toscdspd.cpl.mui</div> <div>.</div> <div>.</div> <div>((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))</div> <div>.</div> <div>.</div> <div>-------\Service_AlotService</div> <div>.</div> <div>.</div> <div>((((((((((((((((((((((((( Files Created from 2012-10-20 to 2012-11-20 )))))))))))))))))))))))))))))))</div> <div>.</div> <div>.</div> <div>2012-11-20 00:59 . 2012-11-20 01:04<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Local\temp</div> <div>2012-11-20 00:59 . 2012-11-20 00:59<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Default\AppData\Local\temp</div> <div>2012-11-19 19:53 . 2012-11-19 19:53<span class="Apple-tab-span" style="white-space:pre"> </span>14336<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\TrueSight.sys</div> <div>2012-11-19 10:23 . 2012-11-19 10:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Inyv</div> <div>2012-11-19 10:23 . 2012-11-19 10:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Avzuga</div> <div>2012-11-19 02:22 . 2012-11-19 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Zaneub</div> <div>2012-11-19 02:22 . 2012-11-19 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Uxoqur</div> <div>2012-11-18 14:36 . 2012-11-18 14:36<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Reviif</div> <div>2012-11-18 14:36 . 2012-11-18 14:36<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Akdezy</div> <div>2012-11-15 19:44 . 2012-11-19 17:50<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Ricyge</div> <div>2012-11-15 19:44 . 2012-11-15 19:44<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Ifug</div> <div>2012-10-25 01:32 . 2012-11-17 01:05<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-s---w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Local\Arthur's Math Games</div> <div>.</div> <div>.</div> <div>.</div> <div>(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))</div> <div>.</div> <div>2012-10-11 02:40 . 2012-07-30 14:26<span class="Apple-tab-span" style="white-space:pre"> </span>696760<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\FlashPlayerApp.exe</div> <div>2012-10-11 02:40 . 2011-06-08 13:40<span class="Apple-tab-span" style="white-space:pre"> </span>73656<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\FlashPlayerCPLApp.cpl</div> <div>2012-09-30 00:54 . 2011-12-29 00:43<span class="Apple-tab-span" style="white-space:pre"> </span>22856<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\mbam.sys</div> <div>2012-08-29 00:24 . 2012-07-18 17:40<span class="Apple-tab-span" style="white-space:pre"> </span>477168<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\npdeployJava1.dll</div> <div>2012-08-29 00:24 . 2010-10-30 05:44<span class="Apple-tab-span" style="white-space:pre"> </span>473072<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\deployJava1.dll</div> <div>2009-11-13 01:32 . 2012-11-05 02:38<span class="Apple-tab-span" style="white-space:pre"> </span>119808<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll</div> <div>.</div> <div>.</div> <div>((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))</div> <div>.</div> <div>.</div> <div>*Note* empty entries & legit default entries are not shown </div> <div>REGEDIT4</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{553318DA-D010-469E-84B1-496563CAE1BF}]</div> <div>2012-06-23 05:40<span class="Apple-tab-span" style="white-space:pre"> </span>136192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\HTTO Group, Ltd\FBDownloader IE Add-on\FBDownloader.dll</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]</div> <div>2012-01-03 21:31<span class="Apple-tab-span" style="white-space:pre"> </span>1514152<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Ask.com\GenericAskToolbar.dll</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]</div> <div>"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]</div> <div>.</div> <div>[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]</div> <div>[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]</div> <div>[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]</div> <div>[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]</div> <div>.</div> <div>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div> <div>"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]</div> <div>"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-24 39408]</div> <div>"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]</div> <div>"Facebook Update"="c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]</div> <div>"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]</div> <div>"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]</div> <div>"Raakiflybi"="c:\users\Coston Family\AppData\Roaming\Ifug\yrose.exe" [2012-03-25 423424]</div> <div>"GoogleChromeAutoLaunch_15197D526E95D11EC6E3FD9BCFC6D540"="c:\program files\Google\Chrome\Application\chrome.exe" [2012-10-31 1242136]</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div> <div>"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]</div> <div>"Skytel"="Skytel.exe" [2007-11-21 1826816]</div> <div>"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2011-06-06 251744]</div> <div>"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]</div> <div>"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]</div> <div>.</div> <div>c:\users\Coston Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\</div> <div>OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]</div> <div>.</div> <div>c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\</div> <div>McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]</div> <div>"EnableUIADesktopToggle"= 0 (0x0)</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]</div> <div>"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]</div> <div>BootExecute<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ <span class="Apple-tab-span" style="white-space:pre"> </span>autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart</div> <div>.</div> <div>[HKLM\~\startupfolder\C:^Users^Coston Family^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]</div> <div>path=c:\users\Coston Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk</div> <div>backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup</div> <div>backupExtension=.Startup</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]</div> <div>2008-05-09 18:49<span class="Apple-tab-span" style="white-space:pre"> </span>716800<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\FlashCards\TCrdMain.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]</div> <div>2008-04-29 17:33<span class="Apple-tab-span" style="white-space:pre"> </span>417792<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Camera Assistant Software for Toshiba\traybar.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]</div> <div>2008-10-17 19:52<span class="Apple-tab-span" style="white-space:pre"> </span>51048<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Common Files\Symantec Shared\CCAPP.EXE</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]</div> <div>2008-01-21 02:25<span class="Apple-tab-span" style="white-space:pre"> </span>125952<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\ehome\ehtray.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]</div> <div>2009-11-13 01:32<span class="Apple-tab-span" style="white-space:pre"> </span>30192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Google\Google Desktop Search\GoogleDesktop.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]</div> <div>2008-06-25 22:05<span class="Apple-tab-span" style="white-space:pre"> </span>170520<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\hkcmd.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]</div> <div>2008-04-16 00:54<span class="Apple-tab-span" style="white-space:pre"> </span>178712<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]</div> <div>2008-06-25 22:06<span class="Apple-tab-span" style="white-space:pre"> </span>150040<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\igfxtray.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]</div> <div>2008-02-26 07:50<span class="Apple-tab-span" style="white-space:pre"> </span>988512<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Norton 360\osCheck.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]</div> <div>2008-06-25 22:06<span class="Apple-tab-span" style="white-space:pre"> </span>145944<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\igfxpers.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]</div> <div>2008-04-08 22:14<span class="Apple-tab-span" style="white-space:pre"> </span>6037504<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\RtHDVCpl.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]</div> <div>2008-06-02 20:26<span class="Apple-tab-span" style="white-space:pre"> </span>505720<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\SmoothView\SmoothView.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]</div> <div>2009-06-24 09:37<span class="Apple-tab-span" style="white-space:pre"> </span>39408<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]</div> <div>2007-12-07 01:12<span class="Apple-tab-span" style="white-space:pre"> </span>1029416<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Synaptics\SynTP\SynTPEnh.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToshibaServiceStation]</div> <div>2008-08-04 21:46<span class="Apple-tab-span" style="white-space:pre"> </span>1242424<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\TOSHIBA Service Station\TSS.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]</div> <div>2008-02-06 20:52<span class="Apple-tab-span" style="white-space:pre"> </span>431456<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\Power Saver\TPwrMain.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]</div> <div>2008-01-21 02:23<span class="Apple-tab-span" style="white-space:pre"> </span>1008184<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Windows Defender\MSASCui.exe</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]</div> <div>2008-01-21 02:25<span class="Apple-tab-span" style="white-space:pre"> </span>202240<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Windows Media Player\wmpnscfg.exe</div> <div>.</div> <div>--- Other Services/Drivers In Memory ---</div> <div>.</div> <div>*NewlyCreated* - COMHOST</div> <div>*NewlyCreated* - WS2IFSL</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]</div> <div>LocalServiceAndNoImpersonation<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ <span class="Apple-tab-span" style="white-space:pre"> </span>FontCache</div> <div>.</div> <div>Contents of the 'Scheduled Tasks' folder</div> <div>.</div> <div>2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job</div> <div>- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-30 02:40]</div> <div>.</div> <div>2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3583727236-292728680-4127779811-1000Core.job</div> <div>- c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-02 22:15]</div> <div>.</div> <div>2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3583727236-292728680-4127779811-1000UA.job</div> <div>- c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-02 22:15]</div> <div>.</div> <div>2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job</div> <div>- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 23:10]</div> <div>.</div> <div>2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job</div> <div>- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 23:10]</div> <div>.</div> <div>2012-11-20 c:\windows\Tasks\User_Feed_Synchronization-{DE72462C-983C-4263-A67F-90EFDF957699}.job</div> <div>- c:\windows\system32\msfeedssync.exe [2011-09-23 09:48]</div> <div>.</div> <div>.</div> <div>------- Supplementary Scan -------</div> <div>.</div> <div>uStart Page = hxxp://www.ask.com/?l=dis&o=41648106&gct=hp</div> <div>mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB</div> <div>IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200</div> <div>IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000</div> <div>TCP: DhcpNameServer = 192.168.1.1</div> <div>.</div> <div>- - - - ORPHANS REMOVED - - - -</div> <div>.</div> <div>BHO-{85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll</div> <div>Toolbar-{A531D99C-5A22-449b-83DA-872725C6D0ED} - c:\program files\alotappbar\bin\ALOTHelper.dll</div> <div>MSConfigStartUp-82211620 - c:\programdata\82211620\82211620.exe</div> <div>MSConfigStartUp-cfFncEnabler - cfFncEnabler.exe</div> <div>MSConfigStartUp-NDSTray - NDSTray.exe</div> <div>MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe</div> <div>AddRemove-alotAppbar - c:\program files\alotappbar\alotUninst.exe</div> <div>.</div> <div>.</div> <div>.</div> <div>**************************************************************************</div> <div>.</div> <div>catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net</div> <div>Rootkit scan 2012-11-19 20:05</div> <div>Windows 6.0.6002 Service Pack 2 NTFS</div> <div>.</div> <div>scanning hidden processes ... </div> <div>.</div> <div>scanning hidden autostart entries ... </div> <div>.</div> <div>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</div> <div> TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????? ?m??h????????????????? </div> <div>.</div> <div>scanning hidden files ... </div> <div>.</div> <div>scan completed successfully</div> <div>hidden files: 0</div> <div>.</div> <div>**************************************************************************</div> <div>.</div> <div>--------------------- LOCKED REGISTRY KEYS ---------------------</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]</div> <div>@Denied: (A) (Users)</div> <div>@Denied: (A) (Everyone)</div> <div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div> <div>"BlindDial"=dword:00000000</div> <div>"MSCurrentCountry"=dword:000000b5</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]</div> <div>@Denied: (A) (Users)</div> <div>@Denied: (A) (Everyone)</div> <div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div> <div>"BlindDial"=dword:00000000</div> <div>.</div> <div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]</div> <div>@Denied: (A) (Users)</div> <div>@Denied: (A) (Everyone)</div> <div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div> <div>"BlindDial"=dword:00000000</div> <div>.</div> <div>--------------------- DLLs Loaded Under Running Processes ---------------------</div> <div>.</div> <div>- - - - - - - > 'Explorer.exe'(3736)</div> <div>c:\windows\System32\NaturalLanguage6.dll</div> <div>c:\windows\System32\NLSLexicons0009.dll</div> <div>c:\windows\system32\ieframe.dll</div> <div>.</div> <div>------------------------ Other Running Processes ------------------------</div> <div>.</div> <div>c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe</div> <div>c:\program files\Common Files\Symantec Shared\ccSvcHst.exe</div> <div>c:\windows\system32\agrsmsvc.exe</div> <div>c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe</div> <div>c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe</div> <div>c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe</div> <div>c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe</div> <div>c:\windows\system32\TODDSrv.exe</div> <div>c:\program files\Toshiba\Power Saver\TosCoSrv.exe</div> <div>c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe</div> <div>c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe</div> <div>c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe</div> <div>c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe</div> <div>c:\program files\Windows Media Player\wmpnetwk.exe</div> <div>.</div> <div>**************************************************************************</div> <div>.</div> <div>Completion time: 2012-11-19 20:10:59 - machine was rebooted</div> <div>ComboFix-quarantined-files.txt 2012-11-20 01:10</div> <div>.</div> <div>Pre-Run: 192,523,550,720 bytes free</div> <div>Post-Run: 194,293,886,976 bytes free</div> <div>.</div> <div>- - End Of File - - 25EB4877F3A4C7E189EC5E40F4AE8C9D</div> <div> </div>
  3. sciguy
    First scan found several threats. I clean and reran scan. No threats found the second time. Final Mbar log and system log are below. First Mbar log is attached, if you needed. Malwarebytes Anti-Rootkit 1.1.0.1009 www.malwarebytes.org Database version: v2012.11.19.09 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Coston Family :: COSTONFAMILY-PC [administrator] 11/19/2012 6:23:57 PM mbar-log-2012-11-19 (18-23-57).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: PUP | PUM | P2P Objects scanned: 28969 Time elapsed: 31 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) System log: Malwarebytes Anti-Rootkit 1.1.0.1009 www.malwarebytes.org Database version: v2012.11.19.09 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Coston Family :: COSTONFAMILY-PC [administrator] 11/19/2012 6:23:57 PM mbar-log-2012-11-19 (18-23-57).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: PUP | PUM | P2P Objects scanned: 28969 Time elapsed: 31 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) mbar-log-2012-11-19 (17-16-06).txt
  4. sciguy
    Thanks for the quick response. FYI - I have the flash drive removed now RK Log: RogueKiller V8.3.0 [Nov 19 2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website: http://tigzy.geekstogo.com/roguekiller.php Blog: http://tigzyrk.blogspot.com Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version Started in : Normal mode User : Coston Family [Admin rights] Mode : Scan -- Date : 11/19/2012 14:53:44 ¤¤¤ Bad processes : 219 ¤¤¤ [sUSP PATH] alotservice.exe -- C:\Users\Coston Family\AppData\LocalLow\alotservice\alotservice.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] [RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc] ¤¤¤ Registry Entries : 4 ¤¤¤ [RUN][sUSP PATH] HKCU\[...]\Run : Raakiflybi ("C:\Users\Coston Family\AppData\Roaming\Ifug\yrose.exe") -> FOUND [RUN][sUSP PATH] HKUS\S-1-5-21-3583727236-292728680-4127779811-1000[...]\Run : Raakiflybi ("C:\Users\Coston Family\AppData\Roaming\Ifug\yrose.exe") -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\@ --> FOUND [ZeroAccess][FOLDER] U : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\U --> FOUND [ZeroAccess][FOLDER] L : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\L --> FOUND [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC\Desktop.ini --> FOUND [susp.ASLR|Sig - ZeroAccess][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND ¤¤¤ Driver : [LOADED] ¤¤¤ SSDT[13] : NtAlertResumeThread @ 0x828A35C3 -> HOOKED (Unknown @ 0x880A2DE0) SSDT[14] : NtAlertThread @ 0x8281C255 -> HOOKED (Unknown @ 0x880A2EC0) SSDT[18] : NtAllocateVirtualMemory @ 0x828584FB -> HOOKED (Unknown @ 0x8809FAD8) SSDT[21] : NtAlpcConnectPort @ 0x827FA887 -> HOOKED (Unknown @ 0x87EFE338) SSDT[67] : NtCreateMutant @ 0x82830812 -> HOOKED (Unknown @ 0x880A2B30) SSDT[78] : NtCreateThread @ 0x828A1BE0 -> HOOKED (Unknown @ 0x8809FC68) SSDT[116] : NtDebugActiveProcess @ 0x82874D22 -> HOOKED (Unknown @ 0x880A2630) SSDT[147] : NtFreeVirtualMemory @ 0x82694F1D -> HOOKED (Unknown @ 0x8809F710) SSDT[156] : NtImpersonateAnonymousToken @ 0x827CAF12 -> HOOKED (Unknown @ 0x880A2C20) SSDT[158] : NtImpersonateThread @ 0x827E054F -> HOOKED (Unknown @ 0x880A2D00) SSDT[177] : NtMapViewOfSection @ 0x8282089A -> HOOKED (Unknown @ 0x8809F630) SSDT[184] : NtOpenEvent @ 0x82809DCF -> HOOKED (Unknown @ 0x880A2A50) SSDT[195] : NtOpenProcessToken @ 0x82811A2E -> HOOKED (Unknown @ 0x8809FBA8) SSDT[202] : NtOpenThreadToken @ 0x8282C2AD -> HOOKED (Unknown @ 0x8809F3B0) SSDT[282] : NtResumeThread @ 0x8282BB4A -> HOOKED (Unknown @ 0x88035640) SSDT[289] : NtSetContextThread @ 0x828A306F -> HOOKED (Unknown @ 0x8809F2D0) SSDT[305] : NtSetInformationProcess @ 0x828248C8 -> HOOKED (Unknown @ 0x8809F4A0) SSDT[306] : NtSetInformationThread @ 0x828092AD -> HOOKED (Unknown @ 0x8809F1E0) SSDT[330] : NtSuspendProcess @ 0x828A34FF -> HOOKED (Unknown @ 0x880A2970) SSDT[331] : NtSuspendThread @ 0x827AA92B -> HOOKED (Unknown @ 0x880A2008) SSDT[348] : NtUnmapViewOfSection @ 0x82820B5D -> HOOKED (Unknown @ 0x8809F570) ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts 127.0.0.1 localhost ::1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: Hitachi HTS543232L9SA00 +++++ --- User --- [MBR] 0b46a8cc22c38e1565f36dd48c6e190f [bSP] 0bdde4a1ed5e38f9dae99664337c0a2f : Windows Vista MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 296325 Mo 2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 609947648 | Size: 7419 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_11192012_02d1453.txt >> RKreport[1]_S_11192012_02d1453.txt
  5. sciguy
    Hello. I am helping a friend with a virus on their PC. Malwarebytes detects and tries to remove the infection, but i keeps re-appearing. Thank you in advance for any help. Here are log files: DDS (Ver_2012-11-07.01) - NTFS_x86 Internet Explorer: 9.0.8112.16448 BrowserJavaVersion: 1.6.0_35 Run by Coston Family at 13:04:10 on 2012-11-19 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1620 [GMT -5:00] . AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\SLsvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Windows\system32\agrsmsvc.exe C:\Users\Coston Family\AppData\LocalLow\alotservice\alotservice.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe C:\Windows\system32\TODDSrv.exe C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\RtHDVCpl.exe C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe C:\Program Files\Ask.com\Updater\Updater.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\WUDFHost.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe \\?\C:\Windows\system32\wbem\WMIADAP.EXE C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.ask.com/?l=dis&o=41648106&gct=hp uSearch Bar = hxxp://www.google.com/ie uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: JetMP3: {134DA043-566E-4572-82E6-8978D0ED03D8} - c:\users\coston family\appdata\local\jetmp3\ie\jetmp3.dll BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - BHO: FBDownloader BHO: {553318DA-D010-469E-84B1-496563CAE1BF} - c:\program files\htto group, ltd\fbdownloader ie add-on\FBDownloader.dll BHO: NCO 2.0 IE BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\common files\symantec shared\ids\IPSBHO.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: ALOT Appbar Helper: {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - c:\program files\alotappbar\bin\bho\ALOTHelperBHO.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Show Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll TB: Show Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: ALOT Appbar: {A531D99C-5A22-449b-83DA-872725C6D0ED} - c:\program files\alotappbar\bin\ALOTHelper.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [Facebook Update] "c:\users\coston family\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun uRun: [Raakiflybi] "c:\users\coston family\appdata\roaming\ifug\yrose.exe" uRun: [GoogleChromeAutoLaunch_15197D526E95D11EC6E3FD9BCFC6D540] "c:\program files\google\chrome\application\chrome.exe" --no-startup-window mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [skytel] Skytel.exe mRun: [DSS] c:\windows\bbstore\dss\DSSAGENT.EXE mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe" mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe" mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" StartupFolder: c:\users\coston~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} LSP: mswsock.dll DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{0A2E6BA9-3B42-4B4C-BBFB-E7D86FD7E9DB} : DHCPNameServer = 192.168.0.1 TCP: Interfaces\{C9F947F1-AEF5-43D6-B877-AE0EF28741FD} : DHCPNameServer = 192.168.1.1 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: igfxcui - igfxdev.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248] R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\ipsdefs\20091020.001\IDSvix86.sys [2009-10-21 272432] R2 AlotService;ALOT Update Service;c:\users\coston family\appdata\locallow\alotservice\alotservice.exe [2012-5-10 252264] R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-4-17 40960] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-18 149352] R2 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2008-8-18 46392] R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134736] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720] R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-8-18 7168] R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2009-6-24 290304] R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-4-24 73728] R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-2-19 41008] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608] S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg2012\avgidsagent.exe" --> c:\program files\avg\avg2012\AVGIDSAgent.exe [?] S2 avgwd;AVG WatchDog;"c:\program files\avg\avg2012\avgwdsvc.exe" --> c:\program files\avg\avg2012\avgwdsvc.exe [?] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-12 23888] S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-21 30192] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008] S3 SVRPEDRV;SVRPEDRV;c:\windows\system32\sysprep\PEDRV.SYS [2008-8-21 9216] S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-8-18 1245064] . =============== Created Last 30 ================ . 2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Inyv 2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Cayz 2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Avzuga 2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Zaneub 2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Uxoqur 2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Ucsyos 2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Reviif 2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Ohrena 2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Akdezy 2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Ricyge 2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Ifug 2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Duochu 2012-11-05 02:38:43 96224 ----a-w- c:\program files\mozilla firefox\webapprt-stub.exe 2012-11-05 02:38:43 157272 ----a-w- c:\program files\mozilla firefox\webapp-uninstaller.exe 2012-11-05 02:38:42 91552 ----a-w- c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll 2012-11-05 02:38:42 91552 ----a-w- c:\program files\mozilla firefox\plugins\npCouponPrinter.dll 2012-11-05 02:38:41 1148296 ----a-w- c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll 2012-11-05 02:38:40 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2012-10-25 01:32:10 -------- d-s---w- c:\users\coston family\appdata\local\Arthur's Math Games . ==================== Find3M ==================== . 2012-10-11 02:40:38 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-10-11 02:40:38 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-09-30 00:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-08-29 00:24:56 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-08-29 00:24:53 473072 ----a-w- c:\windows\system32\deployJava1.dll . ============= FINISH: 13:05:30.48 =============== Attach file: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-07.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 6/24/2009 5:42:58 AM System Uptime: 11/19/2012 12:46:11 PM (1 hours ago) . Motherboard: TOSHIBA | | Portable PC Processor: Pentium® Dual-Core CPU T4200 @ 2.00GHz | CPU | 2000/800mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 289 GiB total, 173.074 GiB free. D: is CDROM (UDF) E: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader 8.1.2 ALOT Appbar Amazon Links Amazon MP3 Downloader 1.0.10 AppCore Arthur's Camping Adventure Arthur's Math Games Arthur's Reading Games Arthur's Teacher Trouble Arthur's Thinking Games Ask Toolbar Ask Toolbar Updater AVG 2012 Backup Camera Assistant Software for Toshiba Carmen Sandiego Word Detective v1.0.1 ccCommon CD/DVD Drive Acoustic Silencer Clifford Reading Compatibility Pack for the 2007 Office system Coupon Printer for Windows DVD MovieFactory for TOSHIBA Facebook Plug-In Facebook Video Calling 1.2.0.287 fbDownloader 1.0.2 FBDownloader IE Add-on GearDrvs Google Chrome Google Desktop Google Earth Google Toolbar for Internet Explorer Google Update Helper Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Graphics Media Accelerator Driver Intel® Matrix Storage Manager Java Auto Updater Java 6 Update 35 Java 6 Update 6 JetMP3 LeapFrog Connect LeapFrog Leapster2 Plugin Malwarebytes Anti-Malware version 1.65.1.1000 McAfee Security Scan Plus Microsoft .NET Framework 3.5 SP1 Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Suite Activation Assistant Microsoft Office Word MUI (English) 2007 Microsoft PowerPoint Viewer 97 Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works Microsoft XML Parser MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Musicnotes Software Suite 1.4.6 NetZero Internet Access Installer Norton 360 Norton 360 (Symantec Corporation) Norton 360 HTMLHelp Norton Confidential Core OpenOffice.org 3.2 Picasa 3 Pinball Science Demo QuickBooks Financial Center Realtek 8169 8168 8101E 8102E Ethernet Driver Realtek High Definition Audio Driver REALTEK RTL8187B Wireless LAN Driver Realtek USB 2.0 Card Reader Realtek WiFi Protected Setup Library Safaricom Broadband Schoolhouse Rock: Grammar Rock Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition Security Update for Windows Media Encoder (KB2447961) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Encoder (KB979332) Skype Toolbars Skype™ 5.10 Slam Dunk Typing SPBBC 32bit Symantec Real Time Storage Protection Component Symantec Technical Support Controls SymNet Synaptics Pointing Device Driver The New Way Things Work TOSHIBA Assist TOSHIBA ConfigFree TOSHIBA Desktop Links TOSHIBA Disc Creator TOSHIBA DVD PLAYER TOSHIBA Extended Tiles for Windows Mobility Center TOSHIBA Face Recognition TOSHIBA Hardware Setup TOSHIBA Recovery Disc Creator Toshiba Registration TOSHIBA Service Station TOSHIBA Software Modem TOSHIBA Speech System Applications TOSHIBA Speech System SR Engine(U.S.) Version1.0 TOSHIBA Speech System TTS Engine(U.S.) Version1.0 TOSHIBA Supervisor Password TOSHIBA Value Added Package Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Word 2007 Help (KB963665) Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin) Wal-Mart Digital Photo Manager WildTangent Games Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) Windows Media Encoder 9 Series Yahoo! BrowserPlus 2.9.8 . ==== End Of File ===========================
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.