sciguy

November 22, 2012

Here is the attached file.

Sorry about the delay.

ComboFix.txt

November 20, 2012

<p>Here is combofix txt.</p>

<div>ComboFix 12-11-19.02 - Coston Family 11/19/2012 18:58:03.1.2 - x86</div>

<div>Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1279 [GMT -5:00]</div>

<div>Running from: c:\users\Coston Family\Desktop\ComboFix.exe</div>

<div>AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}</div>

<div>FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}</div>

<div>SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}</div>

<div>SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}</div>

<div>((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>c:\program files\alotappbar</div>

<div>c:\program files\alotappbar\alotUninst.exe</div>

<div>c:\program files\alotappbar\bin\alotappbar.dll</div>

<div>c:\program files\alotappbar\bin\alothelper.dll</div>

<div>c:\program files\alotappbar\bin\alotsettings.exe</div>

<div>c:\program files\alotappbar\bin\alotwidgets.exe</div>

<div>c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll</div>

<div>c:\programdata\0tbpw.pad</div>

<div>c:\users\Coston Family\AppData\Local\jetmp3\ie\jeTMp3.dll</div>

<div>c:\users\Coston Family\AppData\Local\Temp\dssagent.exe</div>

<div>c:\users\Coston Family\AppData\Roaming\Cayz</div>

<div>c:\users\Coston Family\AppData\Roaming\Cayz\fyci.zuq</div>

<div>c:\users\Coston Family\AppData\Roaming\Duochu</div>

<div>c:\users\Coston Family\AppData\Roaming\Duochu\evom.too</div>

<div>c:\users\Coston Family\AppData\Roaming\Ohrena</div>

<div>c:\users\Coston Family\AppData\Roaming\Ohrena\afule.afn</div>

<div>c:\users\Coston Family\AppData\Roaming\Ucsyos</div>

<div>c:\users\Coston Family\AppData\Roaming\Ucsyos\awde.zol</div>

<div>c:\users\COSTON~1\AppData\Local\Temp\dssagent.exe</div>

<div>c:\windows\COUPon~1.ocx</div>

<div>c:\windows\system32\pt</div>

<div>c:\windows\system32\pt\smartfacevcp.dll.mui</div>

<div>c:\windows\system32\pt\toscdspd.cpl.mui</div>

<div>((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>-------\Service_AlotService</div>

<div>((((((((((((((((((((((((( Files Created from 2012-10-20 to 2012-11-20 )))))))))))))))))))))))))))))))</div>

<div>2012-11-20 00:59 . 2012-11-20 01:04<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Local\temp</div>

<div>2012-11-20 00:59 . 2012-11-20 00:59<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Default\AppData\Local\temp</div>

<div>2012-11-19 19:53 . 2012-11-19 19:53<span class="Apple-tab-span" style="white-space:pre"> </span>14336<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\TrueSight.sys</div>

<div>2012-11-19 10:23 . 2012-11-19 10:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Inyv</div>

<div>2012-11-19 10:23 . 2012-11-19 10:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Avzuga</div>

<div>2012-11-19 02:22 . 2012-11-19 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Zaneub</div>

<div>2012-11-19 02:22 . 2012-11-19 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Uxoqur</div>

<div>2012-11-18 14:36 . 2012-11-18 14:36<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Reviif</div>

<div>2012-11-18 14:36 . 2012-11-18 14:36<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Akdezy</div>

<div>2012-11-15 19:44 . 2012-11-19 17:50<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Ricyge</div>

<div>2012-11-15 19:44 . 2012-11-15 19:44<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Ifug</div>

<div>2012-10-25 01:32 . 2012-11-17 01:05<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-s---w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Local\Arthur's Math Games</div>

<div>(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>2012-10-11 02:40 . 2012-07-30 14:26<span class="Apple-tab-span" style="white-space:pre"> </span>696760<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\FlashPlayerApp.exe</div>

<div>2012-10-11 02:40 . 2011-06-08 13:40<span class="Apple-tab-span" style="white-space:pre"> </span>73656<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\FlashPlayerCPLApp.cpl</div>

<div>2012-09-30 00:54 . 2011-12-29 00:43<span class="Apple-tab-span" style="white-space:pre"> </span>22856<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\mbam.sys</div>

<div>2012-08-29 00:24 . 2012-07-18 17:40<span class="Apple-tab-span" style="white-space:pre"> </span>477168<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\npdeployJava1.dll</div>

<div>2012-08-29 00:24 . 2010-10-30 05:44<span class="Apple-tab-span" style="white-space:pre"> </span>473072<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\deployJava1.dll</div>

<div>2009-11-13 01:32 . 2012-11-05 02:38<span class="Apple-tab-span" style="white-space:pre"> </span>119808<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll</div>

<div>((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>*Note* empty entries & legit default entries are not shown </div>

<div>REGEDIT4</div>

<div>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{553318DA-D010-469E-84B1-496563CAE1BF}]</div>

<div>2012-06-23 05:40<span class="Apple-tab-span" style="white-space:pre"> </span>136192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\HTTO Group, Ltd\FBDownloader IE Add-on\FBDownloader.dll</div>

<div>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]</div>

<div>2012-01-03 21:31<span class="Apple-tab-span" style="white-space:pre"> </span>1514152<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Ask.com\GenericAskToolbar.dll</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]</div>

<div>"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]</div>

<div>[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]</div>

<div>[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]</div>

<div>[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]</div>

<div>[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]</div>

<div>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]</div>

<div>"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-24 39408]</div>

<div>"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]</div>

<div>"Facebook Update"="c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]</div>

<div>"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]</div>

<div>"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]</div>

<div>"Raakiflybi"="c:\users\Coston Family\AppData\Roaming\Ifug\yrose.exe" [2012-03-25 423424]</div>

<div>"GoogleChromeAutoLaunch_15197D526E95D11EC6E3FD9BCFC6D540"="c:\program files\Google\Chrome\Application\chrome.exe" [2012-10-31 1242136]</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]</div>

<div>"Skytel"="Skytel.exe" [2007-11-21 1826816]</div>

<div>"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2011-06-06 251744]</div>

<div>"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]</div>

<div>"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]</div>

<div>c:\users\Coston Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\</div>

<div>OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]</div>

<div>c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\</div>

<div>McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]</div>

<div>"EnableUIADesktopToggle"= 0 (0x0)</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]</div>

<div>"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll</div>

<div>[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]</div>

<div>BootExecute<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ <span class="Apple-tab-span" style="white-space:pre"> </span>autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart</div>

<div>[HKLM\~\startupfolder\C:^Users^Coston Family^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]</div>

<div>path=c:\users\Coston Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk</div>

<div>backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup</div>

<div>backupExtension=.Startup</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]</div>

<div>2008-05-09 18:49<span class="Apple-tab-span" style="white-space:pre"> </span>716800<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\FlashCards\TCrdMain.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]</div>

<div>2008-04-29 17:33<span class="Apple-tab-span" style="white-space:pre"> </span>417792<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Camera Assistant Software for Toshiba\traybar.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]</div>

<div>2008-10-17 19:52<span class="Apple-tab-span" style="white-space:pre"> </span>51048<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Common Files\Symantec Shared\CCAPP.EXE</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]</div>

<div>2008-01-21 02:25<span class="Apple-tab-span" style="white-space:pre"> </span>125952<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\ehome\ehtray.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]</div>

<div>2009-11-13 01:32<span class="Apple-tab-span" style="white-space:pre"> </span>30192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Google\Google Desktop Search\GoogleDesktop.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]</div>

<div>2008-06-25 22:05<span class="Apple-tab-span" style="white-space:pre"> </span>170520<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\hkcmd.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]</div>

<div>2008-04-16 00:54<span class="Apple-tab-span" style="white-space:pre"> </span>178712<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]</div>

<div>2008-06-25 22:06<span class="Apple-tab-span" style="white-space:pre"> </span>150040<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\igfxtray.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]</div>

<div>2008-02-26 07:50<span class="Apple-tab-span" style="white-space:pre"> </span>988512<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Norton 360\osCheck.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]</div>

<div>2008-06-25 22:06<span class="Apple-tab-span" style="white-space:pre"> </span>145944<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\igfxpers.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]</div>

<div>2008-04-08 22:14<span class="Apple-tab-span" style="white-space:pre"> </span>6037504<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\RtHDVCpl.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]</div>

<div>2008-06-02 20:26<span class="Apple-tab-span" style="white-space:pre"> </span>505720<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\SmoothView\SmoothView.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]</div>

<div>2009-06-24 09:37<span class="Apple-tab-span" style="white-space:pre"> </span>39408<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]</div>

<div>2007-12-07 01:12<span class="Apple-tab-span" style="white-space:pre"> </span>1029416<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Synaptics\SynTP\SynTPEnh.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToshibaServiceStation]</div>

<div>2008-08-04 21:46<span class="Apple-tab-span" style="white-space:pre"> </span>1242424<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\TOSHIBA Service Station\TSS.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]</div>

<div>2008-02-06 20:52<span class="Apple-tab-span" style="white-space:pre"> </span>431456<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\Power Saver\TPwrMain.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]</div>

<div>2008-01-21 02:23<span class="Apple-tab-span" style="white-space:pre"> </span>1008184<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Windows Defender\MSASCui.exe</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]</div>

<div>2008-01-21 02:25<span class="Apple-tab-span" style="white-space:pre"> </span>202240<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Windows Media Player\wmpnscfg.exe</div>

<div>--- Other Services/Drivers In Memory ---</div>

<div>*NewlyCreated* - COMHOST</div>

<div>*NewlyCreated* - WS2IFSL</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]</div>

<div>LocalServiceAndNoImpersonation<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ <span class="Apple-tab-span" style="white-space:pre"> </span>FontCache</div>

<div>Contents of the 'Scheduled Tasks' folder</div>

<div>2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job</div>

<div>- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-30 02:40]</div>

<div>2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3583727236-292728680-4127779811-1000Core.job</div>

<div>- c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-02 22:15]</div>

<div>2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3583727236-292728680-4127779811-1000UA.job</div>

<div>- c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-02 22:15]</div>

<div>2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job</div>

<div>- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 23:10]</div>

<div>2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job</div>

<div>- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 23:10]</div>

<div>2012-11-20 c:\windows\Tasks\User_Feed_Synchronization-{DE72462C-983C-4263-A67F-90EFDF957699}.job</div>

<div>- c:\windows\system32\msfeedssync.exe [2011-09-23 09:48]</div>

<div>------- Supplementary Scan -------</div>

<div>uStart Page = hxxp://www.ask.com/?l=dis&o=41648106&gct=hp</div>

<div>mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB</div>

<div>IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200</div>

<div>IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000</div>

<div>TCP: DhcpNameServer = 192.168.1.1</div>

<div>- - - - ORPHANS REMOVED - - - -</div>

<div>BHO-{85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll</div>

<div>Toolbar-{A531D99C-5A22-449b-83DA-872725C6D0ED} - c:\program files\alotappbar\bin\ALOTHelper.dll</div>

<div>MSConfigStartUp-82211620 - c:\programdata\82211620\82211620.exe</div>

<div>MSConfigStartUp-cfFncEnabler - cfFncEnabler.exe</div>

<div>MSConfigStartUp-NDSTray - NDSTray.exe</div>

<div>MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe</div>

<div>AddRemove-alotAppbar - c:\program files\alotappbar\alotUninst.exe</div>

<div>catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net</div>

<div>Rootkit scan 2012-11-19 20:05</div>

<div>Windows 6.0.6002 Service Pack 2 NTFS</div>

<div>scanning hidden processes ... </div>

<div>scanning hidden autostart entries ... </div>

<div>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</div>

<div> TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????? ?m??h????????????????? </div>

<div>scanning hidden files ... </div>

<div>scan completed successfully</div>

<div>hidden files: 0</div>

<div>--------------------- LOCKED REGISTRY KEYS ---------------------</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]</div>

<div>@Denied: (A) (Users)</div>

<div>@Denied: (A) (Everyone)</div>

<div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div>

<div>"BlindDial"=dword:00000000</div>

<div>"MSCurrentCountry"=dword:000000b5</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]</div>

<div>@Denied: (A) (Users)</div>

<div>@Denied: (A) (Everyone)</div>

<div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div>

<div>"BlindDial"=dword:00000000</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]</div>

<div>@Denied: (A) (Users)</div>

<div>@Denied: (A) (Everyone)</div>

<div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div>

<div>"BlindDial"=dword:00000000</div>

<div>--------------------- DLLs Loaded Under Running Processes ---------------------</div>

<div>- - - - - - - > 'Explorer.exe'(3736)</div>

<div>c:\windows\System32\NaturalLanguage6.dll</div>

<div>c:\windows\System32\NLSLexicons0009.dll</div>

<div>c:\windows\system32\ieframe.dll</div>

<div>------------------------ Other Running Processes ------------------------</div>

<div>c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe</div>

<div>c:\program files\Common Files\Symantec Shared\ccSvcHst.exe</div>

<div>c:\windows\system32\agrsmsvc.exe</div>

<div>c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe</div>

<div>c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe</div>

<div>c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe</div>

<div>c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe</div>

<div>c:\windows\system32\TODDSrv.exe</div>

<div>c:\program files\Toshiba\Power Saver\TosCoSrv.exe</div>

<div>c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe</div>

<div>c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe</div>

<div>c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe</div>

<div>c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe</div>

<div>c:\program files\Windows Media Player\wmpnetwk.exe</div>

<div>Completion time: 2012-11-19 20:10:59 - machine was rebooted</div>

<div>ComboFix-quarantined-files.txt 2012-11-20 01:10</div>

<div>Pre-Run: 192,523,550,720 bytes free</div>

<div>Post-Run: 194,293,886,976 bytes free</div>

November 19, 2012

First scan found several threats. I clean and reran scan. No threats found the second time.

Final Mbar log and system log are below. First Mbar log is attached, if you needed.

Malwarebytes Anti-Rootkit 1.1.0.1009

www.malwarebytes.org

Database version: v2012.11.19.09

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Coston Family :: COSTONFAMILY-PC [administrator]

11/19/2012 6:23:57 PM

mbar-log-2012-11-19 (18-23-57).txt

Scan type: Quick scan

Scan options disabled: PUP | PUM | P2P

Objects scanned: 28969

Time elapsed: 31 minute(s), 38 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

System log:

Malwarebytes Anti-Rootkit 1.1.0.1009

www.malwarebytes.org

Database version: v2012.11.19.09

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Coston Family :: COSTONFAMILY-PC [administrator]

11/19/2012 6:23:57 PM

mbar-log-2012-11-19 (18-23-57).txt

Scan type: Quick scan

Scan options disabled: PUP | PUM | P2P

Objects scanned: 28969

Time elapsed: 31 minute(s), 38 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

mbar-log-2012-11-19 (17-16-06).txt

November 19, 2012

Thanks for the quick response.

FYI - I have the flash drive removed now

RK Log:

RogueKiller V8.3.0 [Nov 19 2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Coston Family [Admin rights]

Mode : Scan -- Date : 11/19/2012 14:53:44

¤¤¤ Bad processes : 219 ¤¤¤

[sUSP PATH] alotservice.exe -- C:\Users\Coston Family\AppData\LocalLow\alotservice\alotservice.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Raakiflybi ("C:\Users\Coston Family\AppData\Roaming\Ifug\yrose.exe") -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3583727236-292728680-4127779811-1000[...]\Run : Raakiflybi ("C:\Users\Coston Family\AppData\Roaming\Ifug\yrose.exe") -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC\Desktop.ini --> FOUND

[susp.ASLR|Sig - ZeroAccess][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[13] : NtAlertResumeThread @ 0x828A35C3 -> HOOKED (Unknown @ 0x880A2DE0)

SSDT[14] : NtAlertThread @ 0x8281C255 -> HOOKED (Unknown @ 0x880A2EC0)

SSDT[18] : NtAllocateVirtualMemory @ 0x828584FB -> HOOKED (Unknown @ 0x8809FAD8)

SSDT[21] : NtAlpcConnectPort @ 0x827FA887 -> HOOKED (Unknown @ 0x87EFE338)

SSDT[67] : NtCreateMutant @ 0x82830812 -> HOOKED (Unknown @ 0x880A2B30)

SSDT[78] : NtCreateThread @ 0x828A1BE0 -> HOOKED (Unknown @ 0x8809FC68)

SSDT[116] : NtDebugActiveProcess @ 0x82874D22 -> HOOKED (Unknown @ 0x880A2630)

SSDT[147] : NtFreeVirtualMemory @ 0x82694F1D -> HOOKED (Unknown @ 0x8809F710)

SSDT[156] : NtImpersonateAnonymousToken @ 0x827CAF12 -> HOOKED (Unknown @ 0x880A2C20)

SSDT[158] : NtImpersonateThread @ 0x827E054F -> HOOKED (Unknown @ 0x880A2D00)

SSDT[177] : NtMapViewOfSection @ 0x8282089A -> HOOKED (Unknown @ 0x8809F630)

SSDT[184] : NtOpenEvent @ 0x82809DCF -> HOOKED (Unknown @ 0x880A2A50)

SSDT[195] : NtOpenProcessToken @ 0x82811A2E -> HOOKED (Unknown @ 0x8809FBA8)

SSDT[202] : NtOpenThreadToken @ 0x8282C2AD -> HOOKED (Unknown @ 0x8809F3B0)

SSDT[282] : NtResumeThread @ 0x8282BB4A -> HOOKED (Unknown @ 0x88035640)

SSDT[289] : NtSetContextThread @ 0x828A306F -> HOOKED (Unknown @ 0x8809F2D0)

SSDT[305] : NtSetInformationProcess @ 0x828248C8 -> HOOKED (Unknown @ 0x8809F4A0)

SSDT[306] : NtSetInformationThread @ 0x828092AD -> HOOKED (Unknown @ 0x8809F1E0)

SSDT[330] : NtSuspendProcess @ 0x828A34FF -> HOOKED (Unknown @ 0x880A2970)

SSDT[331] : NtSuspendThread @ 0x827AA92B -> HOOKED (Unknown @ 0x880A2008)

SSDT[348] : NtUnmapViewOfSection @ 0x82820B5D -> HOOKED (Unknown @ 0x8809F570)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS543232L9SA00 +++++

--- User ---

[MBR] 0b46a8cc22c38e1565f36dd48c6e190f

[bSP] 0bdde4a1ed5e38f9dae99664337c0a2f : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 296325 Mo

2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 609947648 | Size: 7419 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_11192012_02d1453.txt >>

RKreport[1]_S_11192012_02d1453.txt

November 19, 2012

Hello. I am helping a friend with a virus on their PC. Malwarebytes detects and tries to remove the infection, but i keeps re-appearing.

Thank you in advance for any help.

Here are log files:

DDS (Ver_2012-11-07.01) - NTFS_x86

Internet Explorer: 9.0.8112.16448 BrowserJavaVersion: 1.6.0_35

Run by Coston Family at 13:04:10 on 2012-11-19

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1620 [GMT -5:00]

.

AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\agrsmsvc.exe

C:\Users\Coston Family\AppData\LocalLow\alotservice\alotservice.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe

C:\Program Files\Ask.com\Updater\Updater.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.ask.com/?l=dis&o=41648106&gct=hp

uSearch Bar = hxxp://www.google.com/ie

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: JetMP3: {134DA043-566E-4572-82E6-8978D0ED03D8} - c:\users\coston family\appdata\local\jetmp3\ie\jetmp3.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

BHO: FBDownloader BHO: {553318DA-D010-469E-84B1-496563CAE1BF} - c:\program files\htto group, ltd\fbdownloader ie add-on\FBDownloader.dll

BHO: NCO 2.0 IE BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll

BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\common files\symantec shared\ids\IPSBHO.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: ALOT Appbar Helper: {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - c:\program files\alotappbar\bin\bho\ALOTHelperBHO.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Show Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll

TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: ALOT Appbar: {A531D99C-5A22-449b-83DA-872725C6D0ED} - c:\program files\alotappbar\bin\ALOTHelper.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [Facebook Update] "c:\users\coston family\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun

uRun: [Raakiflybi] "c:\users\coston family\appdata\roaming\ifug\yrose.exe"

uRun: [GoogleChromeAutoLaunch_15197D526E95D11EC6E3FD9BCFC6D540] "c:\program files\google\chrome\application\chrome.exe" --no-startup-window

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [skytel] Skytel.exe

mRun: [DSS] c:\windows\bbstore\dss\DSSAGENT.EXE

mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"

mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\users\coston~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

LSP: mswsock.dll

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{0A2E6BA9-3B42-4B4C-BBFB-E7D86FD7E9DB} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{C9F947F1-AEF5-43D6-B877-AE0EF28741FD} : DHCPNameServer = 192.168.1.1

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: igfxcui - igfxdev.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\ipsdefs\20091020.001\IDSvix86.sys [2009-10-21 272432]

R2 AlotService;ALOT Update Service;c:\users\coston family\appdata\locallow\alotservice\alotservice.exe [2012-5-10 252264]

R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-4-17 40960]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-18 149352]

R2 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2008-8-18 46392]

R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134736]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720]

R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-8-18 7168]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2009-6-24 290304]

R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-4-24 73728]

R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-2-19 41008]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608]

S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg2012\avgidsagent.exe" --> c:\program files\avg\avg2012\AVGIDSAgent.exe [?]

S2 avgwd;AVG WatchDog;"c:\program files\avg\avg2012\avgwdsvc.exe" --> c:\program files\avg\avg2012\avgwdsvc.exe [?]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-12 23888]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-21 30192]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]

S3 SVRPEDRV;SVRPEDRV;c:\windows\system32\sysprep\PEDRV.SYS [2008-8-21 9216]

S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-8-18 1245064]

.

=============== Created Last 30 ================

.

2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Inyv

2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Cayz

2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Avzuga

2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Zaneub

2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Uxoqur

2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Ucsyos

2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Reviif

2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Ohrena

2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Akdezy

2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Ricyge

2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Ifug

2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Duochu

2012-11-05 02:38:43 96224 ----a-w- c:\program files\mozilla firefox\webapprt-stub.exe

2012-11-05 02:38:43 157272 ----a-w- c:\program files\mozilla firefox\webapp-uninstaller.exe

2012-11-05 02:38:42 91552 ----a-w- c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

2012-11-05 02:38:42 91552 ----a-w- c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

2012-11-05 02:38:41 1148296 ----a-w- c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

2012-11-05 02:38:40 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2012-10-25 01:32:10 -------- d-s---w- c:\users\coston family\appdata\local\Arthur's Math Games

.

==================== Find3M ====================

.

2012-10-11 02:40:38 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-10-11 02:40:38 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-09-30 00:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-08-29 00:24:56 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-08-29 00:24:53 473072 ----a-w- c:\windows\system32\deployJava1.dll

.

============= FINISH: 13:05:30.48 ===============

Attach file:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 6/24/2009 5:42:58 AM

System Uptime: 11/19/2012 12:46:11 PM (1 hours ago)

.

Motherboard: TOSHIBA | | Portable PC

Processor: Pentium® Dual-Core CPU T4200 @ 2.00GHz | CPU | 2000/800mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 289 GiB total, 173.074 GiB free.

D: is CDROM (UDF)

E: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 8.1.2

ALOT Appbar

Amazon Links

Amazon MP3 Downloader 1.0.10

AppCore

Arthur's Camping Adventure

Arthur's Math Games

Arthur's Reading Games

Arthur's Teacher Trouble

Arthur's Thinking Games

Ask Toolbar

Ask Toolbar Updater

AVG 2012

Backup

Camera Assistant Software for Toshiba

Carmen Sandiego Word Detective v1.0.1

ccCommon

CD/DVD Drive Acoustic Silencer

Clifford Reading

Compatibility Pack for the 2007 Office system

Coupon Printer for Windows

DVD MovieFactory for TOSHIBA

Facebook Plug-In

Facebook Video Calling 1.2.0.287

fbDownloader 1.0.2

FBDownloader IE Add-on

GearDrvs

Google Chrome

Google Desktop

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Intel® Graphics Media Accelerator Driver

Intel® Matrix Storage Manager

Java Auto Updater

Java 6 Update 35

Java 6 Update 6

JetMP3

LeapFrog Connect

LeapFrog Leapster2 Plugin

Malwarebytes Anti-Malware version 1.65.1.1000

McAfee Security Scan Plus

Microsoft .NET Framework 3.5 SP1

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2007

Microsoft PowerPoint Viewer 97

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Works

Microsoft XML Parser

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Musicnotes Software Suite 1.4.6

NetZero Internet Access Installer

Norton 360

Norton 360 (Symantec Corporation)

Norton 360 HTMLHelp

Norton Confidential Core

OpenOffice.org 3.2

Picasa 3

Pinball Science Demo

QuickBooks Financial Center

Realtek 8169 8168 8101E 8102E Ethernet Driver

Realtek High Definition Audio Driver

REALTEK RTL8187B Wireless LAN Driver

Realtek USB 2.0 Card Reader

Realtek WiFi Protected Setup Library

Safaricom Broadband

Schoolhouse Rock: Grammar Rock

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

Skype Toolbars

Skype™ 5.10

Slam Dunk Typing

SPBBC 32bit

Symantec Real Time Storage Protection Component

Symantec Technical Support Controls

SymNet

Synaptics Pointing Device Driver

The New Way Things Work

TOSHIBA Assist

TOSHIBA ConfigFree

TOSHIBA Desktop Links

TOSHIBA Disc Creator

TOSHIBA DVD PLAYER

TOSHIBA Extended Tiles for Windows Mobility Center

TOSHIBA Face Recognition

TOSHIBA Hardware Setup

TOSHIBA Recovery Disc Creator

Toshiba Registration

TOSHIBA Service Station

TOSHIBA Software Modem

TOSHIBA Speech System Applications

TOSHIBA Speech System SR Engine(U.S.) Version1.0

TOSHIBA Speech System TTS Engine(U.S.) Version1.0

TOSHIBA Supervisor Password

TOSHIBA Value Added Package

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Word 2007 Help (KB963665)

Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)

Wal-Mart Digital Photo Manager

WildTangent Games

Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)

Windows Media Encoder 9 Series

Yahoo! BrowserPlus 2.9.8

.

==== End Of File ===========================

Sign In

sciguy

Posts

Joined

Last visited

Content Type

Events

Profiles

Forums

Posts posted by sciguy

Help Please - Virus infection

Help Please - Virus infection

Help Please - Virus infection

Help Please - Virus infection

Help Please - Virus infection

Browse

Activity

Personal

Business

Business Modules

Partners

Learn

Start here

Type of malware/attacks

How does it get on my computer?

Scams and grifts

Support

Important Information