Jump to content

TrojandintheA

Members
 View Profile  See their activity

  • Posts

    4

  • Joined

  • Last visited

 Content Type 

Posts posted by TrojandintheA

    happili and random trojans, maybe more

    in Resolved Malware Removal Logs

    Posted

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Home Premium

    Boot Device: \Device\HarddiskVolume1

    Install Date: 5/15/2012 9:21:53 PM

    System Uptime: 12/2/2012 6:03:33 PM (0 hours ago)

    .

    Motherboard: LENOVO | | Base Board Product Name

    Processor: Intel® Pentium® CPU P6100 @ 2.00GHz | CPU | 1999/1066mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 931 GiB total, 796.517 GiB free.

    D: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    ==== System Restore Points ===================

    .

    No restore point in system.

    .

    ==== Installed Programs ======================

    .

    64 Bit HP CIO Components Installer

    Adobe Flash Media Live Encoder 3.2

    Adobe Flash Player 11 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Reader X (10.1.4)

    AIM 7

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    Audacity 2.0

    B209a-m

    Bing Bar

    Bonjour

    Broadcom 802.11 Wireless Driver

    BufferChm

    Compatibility Pack for the 2007 Office system

    D3DX10

    Download Updater (AOL LLC)

    Energy Management

    EZ Vinyl/Tape Converter 7.4 by MixMeister

    Firebird 2.5.0.26074 (Win32)

    Google Chrome

    Google Talk Plugin

    Google Update Helper

    Hewlett-Packard ACLM.NET v1.1.0.0

    HP Customer Participation Program 14.0

    HP Photo Creations

    HP Photosmart Plus B209a-m All-in-One Driver Software 14.0 Rel. 6

    HP Product Detection

    HP Smart Web Printing 4.60

    HP Update

    HPPhotoGadget

    HPSSupply

    Intel® Graphics Media Accelerator Driver

    iTunes

    Java 7 Update 7

    Java Auto Updater

    JavaFX 2.1.1

    Jnes 1.1

    Junk Mail filter update

    LAME v3.99.3 (for Windows)

    Malwarebytes Anti-Malware version 1.65.1.1000

    ManyCam 3.0.80 (remove only)

    MarketResearch

    Mesh Runtime

    Messenger Companion

    Microsoft .NET Framework 4 Client Profile

    Microsoft Application Error Reporting

    Microsoft Office XP Media Content

    Microsoft Office XP Professional

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Mozilla Firefox 15.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSI to redistribute MS VS2005 CRT libraries

    MSVCRT

    MSVCRT_amd64

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    Network64

    Norton Security Suite

    Phoenix Viewer 1.6.0.1691

    PS_AIO_06_B209a-m_SW_Min

    QuickTime

    QuickTransfer

    Realtek USB 2.0 Card Reader

    SAM Broadcaster (remove only)

    Scan

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Shop for HP Supplies

    Skype™ 5.10

    SmartWebPrinting

    SoulSeek 157 NS 13e

    Spybot - Search & Destroy

    Toolbox

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    WebReg

    Windows Driver Package - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1)

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live Family Safety

    Windows Live ID Sign-in Assistant

    Windows Live Installer

    Windows Live Language Selector

    Windows Live Mail

    Windows Live Mesh

    Windows Live Mesh ActiveX Control for Remote Connections

    Windows Live Messenger

    Windows Live Messenger Companion Core

    Windows Live MIME IFilter

    Windows Live Movie Maker

    Windows Live Photo Common

    Windows Live Photo Gallery

    Windows Live PIMT Platform

    Windows Live Remote Client

    Windows Live Remote Client Resources

    Windows Live Remote Service

    Windows Live Remote Service Resources

    Windows Live SOXE

    Windows Live SOXE Definitions

    Windows Live UX Platform

    Windows Live UX Platform Language Pack

    Windows Live Writer

    Windows Live Writer Resources

    Windows Media Player Firefox Plugin

    .

    ==== Event Viewer Messages From Past Week ========

    .

    12/2/2012 5:17:09 PM, Error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.

    12/2/2012 5:16:58 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

    12/2/2012 4:56:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

    12/2/2012 4:56:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

    12/2/2012 4:56:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

    12/2/2012 4:56:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

    12/2/2012 4:56:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

    12/2/2012 4:56:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx64 DfsC discache eeCtrl IDSVia64 NetBIOS NetBT nsiproxy Psched rdbss spldr SRTSPX SymIRON SymNetS tdx vwififlt Wanarpv6 WfpLwf

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

    12/2/2012 4:56:27 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

    12/2/2012 4:26:30 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

    12/2/2012 4:20:04 PM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.

    11/30/2012 7:07:17 PM, Error: Service Control Manager [7031] - The Norton Security Suite service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The WLAN AutoConfig service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Windows Audio Endpoint Builder service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Program Compatibility Assistant Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Portable Device Enumerator Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Network Connections service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The HomeGroup Listener service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/30/2012 7:04:08 PM, Error: Service Control Manager [7031] - The Desktop Window Manager Session Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/29/2012 6:14:40 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \\?\Volume{9ff91d15-9f0d-11e1-b468-806e6f6e6963}.

    11/29/2012 4:53:24 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the N360 service.

    11/29/2012 1:58:00 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{7027C483-2649-472C-BFB5-9C874CE431A8} because another computer on the network has the same name. The server could not start.

    11/27/2012 12:54:39 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

    11/27/2012 12:24:35 PM, Error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).

    11/27/2012 12:24:29 PM, Error: Service Control Manager [7022] - The SeaPort service hung on starting.

    11/27/2012 12:23:07 PM, Error: Service Control Manager [7023] - The Spybot-S&D 2 Updating Service service terminated with the following error: %%-2147467243

    11/26/2012 5:24:18 PM, Error: Service Control Manager [7031] - The Human Interface Device Access service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

    11/25/2012 6:20:24 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800b0100: Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 and Windows Server 2008 R2 SP1 for x64-based Systems (KB2729452).

    11/25/2012 12:22:00 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Norton Security Suite service to connect.

    11/25/2012 12:22:00 PM, Error: Service Control Manager [7000] - The Norton Security Suite service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

    .

    ==== End Of File ===========================

    happili and random trojans, maybe more

    in Resolved Malware Removal Logs

    Posted

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16455 BrowserJavaVersion: 10.7.2

    Run by Patrick at 18:14:31 on 2012-12-02

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3895.2610 [GMT -5:00]

    .

    AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

    SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k GPSvcGroup

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\system32\WLANExt.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Windows\system32\taskhost.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe

    C:\Windows\System32\svchost.exe -k HPZ12

    C:\Windows\System32\svchost.exe -k HPZ12

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

    C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

    C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

    C:\Windows\System32\igfxtray.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files (x86)\AIM\aim.exe

    C:\Windows\System32\rundll32.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Windows\System32\svchost.exe -k LocalServicePeerNet

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\system32\svchost.exe -k HPService

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_110_ActiveX.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://www.amazon.com/?_encoding=UTF8&tag=gtzso-20

    uSearch Bar = Preserve

    mWinlogon: Userinit = userinit.exe,

    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

    BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

    BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\coieplg.dll

    BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\ips\ipsbho.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\coieplg.dll

    TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\coieplg.dll

    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

    EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

    EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

    uRun: [AIM] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US

    uRun: [Google Update] "C:\Users\Patrick\AppData\Local\Google\Update\GoogleUpdate.exe" /c

    uRun: [spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean

    uRun: [VirtualStore] rundll32.exe "C:\Users\Patrick\AppData\Local\Windows Live\VirtualStore\biuyynho.dll",vlc_entry__1_0_0eW

    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

    mRun: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

    TCP: NameServer = 192.168.1.1

    TCP: Interfaces\{7027C483-2649-472C-BFB5-9C874CE431A8} : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{7027C483-2649-472C-BFB5-9C874CE431A8}\3514D416E646D41485 : DHCPNameServer = 75.75.75.75 75.75.76.76

    TCP: Interfaces\{7027C483-2649-472C-BFB5-9C874CE431A8}\46963786E6461647 : DHCPNameServer = 192.168.1.254

    TCP: Interfaces\{7027C483-2649-472C-BFB5-9C874CE431A8}\A4 : DHCPNameServer = 75.75.75.75 75.75.76.76

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    Notify: SDWinLogon - SDWinLogon.dll

    SSODL: WebCheck - <orphaned>

    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    x64-Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

    x64-Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\911xqj32.default\

    FF - prefs.js: browser.startup.homepage - hxxp://www.amazon.com/

    FF - prefs.js: network.proxy.type - 0

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll

    FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Users\Patrick\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll

    FF - plugin: C:\Users\Patrick\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

    FF - plugin: C:\Users\Patrick\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    FF - ExtSQL: !HIDDEN! 2012-05-16 18:36; smartwebprinting@hp.com; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    .

    ---- FIREFOX POLICIES ----

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false

    ============= SERVICES / DRIVERS ===============

    .

    R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\0502020.003\symds64.sys [2012-7-16 450680]

    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\0502020.003\symefa64.sys [2012-7-16 912504]

    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20121106.001\BHDrvx64.sys [2012-10-23 1384608]

    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20121130.001\IDSviA64.sys [2012-11-30 513184]

    R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\0502020.003\ironx64.sys [2012-7-16 171128]

    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\0502020.003\symnets.sys [2012-7-16 386168]

    R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbguard.exe [2012-5-17 98304]

    R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\5.2.2.3\ccsvchst.exe [2012-7-16 130008]

    R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2012-11-24 1103392]

    R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2012-11-24 1369624]

    R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2012-11-24 168384]

    R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\Windows\System32\drivers\AcpiVpc.sys [2012-5-15 28176]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-8 138912]

    R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files (x86)\Firebird\Firebird_2_5\bin\fbserver.exe [2012-5-17 3735552]

    R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]

    R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-2-26 158976]

    R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-2-3 271872]

    R3 ManyCam;ManyCam Virtual Webcam;C:\Windows\System32\drivers\mcvidrv_x64.sys [2012-1-11 34304]

    R3 mcaudrv_simple;ManyCam Virtual Microphone;C:\Windows\System32\drivers\mcaudrv_x64.sys [2012-2-22 28160]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944]

    S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-4-1 183560]

    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-6-22 48488]

    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-3-8 1492840]

    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-11-25 19456]

    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2012-5-16 232992]

    S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]

    S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672]

    S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872]

    S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640]

    S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-11-25 57856]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2012-11-25 30208]

    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-2-15 52736]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-5-16 1255736]

    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

    .

    =============== Created Last 30 ================

    .

    2012-12-02 21:40:41 -------- d-----w- C:\Users\Patrick\AppData\Roaming\Malwarebytes

    2012-12-02 21:40:33 -------- d-----w- C:\ProgramData\Malwarebytes

    2012-12-02 21:40:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2012-12-02 21:40:32 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2012-11-30 20:41:43 -------- d-----w- C:\Program Files (x86)\MSECache

    2012-11-25 23:25:42 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys

    2012-11-25 23:25:41 70656 ----a-w- C:\Windows\System32\nlaapi.dll

    2012-11-25 23:25:41 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll

    2012-11-25 23:25:41 52224 ----a-w- C:\Windows\SysWow64\nlaapi.dll

    2012-11-25 23:25:41 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys

    2012-11-25 23:25:41 303104 ----a-w- C:\Windows\System32\nlasvc.dll

    2012-11-25 23:25:41 246272 ----a-w- C:\Windows\System32\netcorehc.dll

    2012-11-25 23:25:41 216576 ----a-w- C:\Windows\System32\ncsi.dll

    2012-11-25 23:25:41 18944 ----a-w- C:\Windows\SysWow64\netevent.dll

    2012-11-25 23:25:41 18944 ----a-w- C:\Windows\System32\netevent.dll

    2012-11-25 23:25:41 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll

    2012-11-25 23:25:41 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll

    2012-11-25 23:13:53 340992 ----a-w- C:\Windows\System32\schannel.dll

    2012-11-25 23:13:53 247808 ----a-w- C:\Windows\SysWow64\schannel.dll

    2012-11-25 23:13:52 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

    2012-11-25 23:13:52 458712 ----a-w- C:\Windows\System32\drivers\cng.sys

    2012-11-25 23:13:52 307200 ----a-w- C:\Windows\System32\ncrypt.dll

    2012-11-25 23:13:52 220160 ----a-w- C:\Windows\SysWow64\ncrypt.dll

    2012-11-25 23:13:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

    2012-11-25 23:13:52 154480 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

    2012-11-25 23:13:52 1448448 ----a-w- C:\Windows\System32\lsasrv.dll

    2012-11-25 23:00:26 -------- d-----w- C:\Windows\CheckSur

    2012-11-25 19:08:16 -------- d-----w- C:\Users\Patrick\AppData\Local\NPE

    2012-11-25 17:36:18 -------- d-----w- C:\Users\Patrick\AppData\Roaming\Tific

    2012-11-25 17:36:17 -------- d-----w- C:\Users\Patrick\AppData\Local\Symantec

    2012-11-25 02:19:51 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

    2012-11-25 02:19:37 17272 ----a-w- C:\Windows\System32\sdnclean64.exe

    2012-11-25 02:19:33 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2

    2012-11-25 02:19:11 -------- d-----w- C:\Users\Patrick\AppData\Local\Programs

    2012-11-21 08:17:58 9728 ----a-w- C:\Windows\System32\Wdfres.dll

    2012-11-21 08:17:58 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys

    2012-11-21 08:17:58 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys

    2012-11-21 08:17:58 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui

    2012-11-21 08:01:06 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys

    2012-11-21 08:01:06 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll

    2012-11-21 08:01:06 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys

    2012-11-21 08:01:05 744448 ----a-w- C:\Windows\System32\WUDFx.dll

    2012-11-21 08:01:05 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll

    2012-11-21 08:01:05 229888 ----a-w- C:\Windows\System32\WUDFHost.exe

    2012-11-21 08:01:05 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll

    2012-11-20 23:54:34 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll

    2012-11-20 23:54:34 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll

    2012-11-20 23:54:34 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll

    2012-11-20 23:54:34 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll

    2012-11-20 23:54:30 3149824 ----a-w- C:\Windows\System32\win32k.sys

    2012-11-20 23:54:29 95744 ----a-w- C:\Windows\System32\synceng.dll

    2012-11-20 23:54:28 78336 ----a-w- C:\Windows\SysWow64\synceng.dll

    .

    ==================== Find3M ====================

    .

    2012-11-21 00:06:09 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-11-21 00:06:09 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2012-10-25 08:12:26 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx

    2012-10-25 08:12:26 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts

    2012-10-16 08:38:37 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38:34 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39:52 561664 ----a-w- C:\Windows\apppatch\AcLayers.dll

    2012-10-09 18:23:05 10220472 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe

    2012-10-08 11:31:03 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2012-10-08 11:23:52 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2012-10-08 11:22:55 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-10-08 11:18:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2012-10-08 11:17:35 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2012-10-08 11:13:33 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-10-08 07:56:24 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-10-08 07:48:03 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-10-08 07:47:44 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-10-08 07:44:05 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2012-10-08 07:43:21 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2012-10-08 07:40:56 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-09-14 19:19:29 2048 ----a-w- C:\Windows\System32\tzres.dll

    2012-09-14 18:28:53 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

    2012-09-04 21:57:23 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

    2012-09-04 21:57:23 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

    2012-09-04 21:57:23 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll

    .

    ============= FINISH: 18:15:34.99 ===============

    happili and random trojans, maybe more

    in Resolved Malware Removal Logs

    Posted

    So I had wide litany of trojans nail my laptop after it was repaired and among them was goodle redirect, trojan.ransom, trojan.happily, and possible others, but I'm not sure. I had gotten rid of them briefly with Norton Power Eraser, but they eventually came back. I thin it might have to do with my Java iles, but its a random guess on my part. Logs will follow next post.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.