Jump to content

MrChris

Members
 View Profile  See their activity

  • Posts

    7

  • Joined

  • Last visited

 Content Type 

Posts posted by MrChris

    Trojan:JS/Medfos.B infection

    in Resolved Malware Removal Logs

    Posted

    Malwarebytes Anti-Malware 1.70.0.1100

    www.malwarebytes.org

    Database version: v2013.01.04.07

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Harman :: HARMAN-PC [administrator]

    1/4/2013 2:22:52 PM

    mbam-log-2013-01-04 (14-22-52).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 233010

    Time elapsed: 31 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 2:27:49 PM, on 1/4/2013

    Platform: Windows 7 SP1 (WinNT 6.00.3505)

    MSIE: Internet Explorer v9.00 (9.00.8112.16457)

    Boot mode: Normal

    Running processes:

    C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_135_ActiveX.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Users\Harman\Desktop\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    O4 - HKUS\S-1-5-21-3165826714-1640661741-705165335-1004\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')

    O4 - HKUS\S-1-5-21-3165826714-1640661741-705165335-1004\..\Run: [KGShareApp] C:\Program Files (x86)\Kodak\KODAK Share Button App\KGShare_App.exe (User 'UpdatusUser')

    O4 - HKUS\S-1-5-21-3165826714-1640661741-705165335-1004\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')

    O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

    O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/select/asusTek_sys_ctrl3.cab

    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB

    O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} (Battlefield Play4Free Updater) - https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

    O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

    O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

    O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

    O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --

    End of file - 7443 bytes

    Trojan:JS/Medfos.B infection

    in Resolved Malware Removal Logs

    Posted

    ComboFix 13-01-01.02 - Harman 01/01/2013 11:30:02.2.4 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3959.2613 [GMT -5:00]

    Running from: c:\users\Harman\Desktop\ComboFix.exe

    Command switches used :: c:\users\Harman\Desktop\CFScript.txt

    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-12-01 to 2013-01-01 )))))))))))))))))))))))))))))))

    .

    .

    2013-01-01 16:34 . 2013-01-01 16:34 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

    2013-01-01 16:34 . 2013-01-01 16:34 -------- d-----w- c:\users\Default\AppData\Local\temp

    2013-01-01 15:07 . 2013-01-01 15:07 76232 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CBBDD05D-93AC-49F4-8B50-F45914AD835F}\offreg.dll

    2012-12-31 22:13 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CBBDD05D-93AC-49F4-8B50-F45914AD835F}\mpengine.dll

    2012-12-30 15:09 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-12-29 17:08 . 2012-12-29 17:21 -------- d-----w- c:\programdata\Spybot - Search & Destroy

    2012-12-29 17:08 . 2012-12-29 17:09 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy

    2012-12-29 15:01 . 2012-12-29 15:01 -------- d-----w- c:\users\Harman\AppData\Local\Programs

    2012-12-20 21:30 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

    2012-12-20 21:30 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

    2012-12-20 21:30 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

    2012-12-20 21:30 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

    2012-12-17 21:26 . 2012-12-17 21:26 -------- d-----w- c:\program files (x86)\AGEIA Technologies

    2012-12-15 18:19 . 2012-10-25 09:20 769168 ----a-w- c:\windows\system32\drivers\Rt64win7.sys

    2012-12-15 18:19 . 2012-10-25 09:20 74344 ----a-w- c:\windows\system32\RtNicProp64.dll

    2012-12-15 18:14 . 2012-12-15 18:14 -------- d-----w- c:\users\Harman\AppData\Local\Razer

    2012-12-15 18:14 . 2012-12-15 18:14 -------- d-----w- c:\programdata\Razer

    2012-12-15 18:14 . 2012-12-15 18:14 -------- d-----w- c:\program files (x86)\Razer

    2012-12-12 01:06 . 2012-11-14 06:06 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll

    2012-12-12 01:06 . 2012-11-14 02:01 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll

    2012-12-12 01:06 . 2012-11-14 07:06 17811968 ----a-w- c:\windows\system32\mshtml.dll

    2012-12-12 01:06 . 2012-11-14 06:32 10925568 ----a-w- c:\windows\system32\ieframe.dll

    2012-12-12 00:02 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-12-12 00:02 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-12-12 00:02 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-12-31 20:04 . 2011-11-18 18:34 281520 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

    2012-12-31 20:04 . 2011-11-18 17:08 281520 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

    2012-12-31 20:04 . 2011-11-18 17:08 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

    2012-12-14 21:49 . 2011-11-18 15:27 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-12-11 22:00 . 2012-03-29 02:16 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-12-11 22:00 . 2011-11-18 03:51 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-12-03 15:47 . 2012-10-11 01:23 1504104 ----a-w- c:\windows\system32\nvdispgenco64.dll

    2012-12-03 15:47 . 2012-10-11 01:23 12603960 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

    2012-12-03 15:47 . 2012-10-11 01:22 2496976 ----a-w- c:\windows\SysWow64\nvapi.dll

    2012-12-03 15:47 . 2012-10-11 01:22 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll

    2012-12-03 15:47 . 2012-02-25 21:50 983936 ----a-w- c:\windows\system32\nvumdshimx.dll

    2012-12-03 15:47 . 2011-11-18 04:52 1805672 ----a-w- c:\windows\system32\nvdispco64.dll

    2012-12-03 15:47 . 2011-05-21 11:01 2816824 ----a-w- c:\windows\system32\nvapi64.dll

    2012-12-01 05:49 . 2012-02-25 21:51 3663213 ----a-w- c:\windows\system32\nvcoproc.bin

    2012-12-01 05:49 . 2011-11-18 04:17 63336 ----a-w- c:\windows\system32\nvshext.dll

    2012-12-01 05:49 . 2011-11-18 04:17 118120 ----a-w- c:\windows\system32\nvmctray.dll

    2012-12-01 05:49 . 2011-11-18 04:17 890216 ----a-w- c:\windows\system32\nvvsvc.exe

    2012-12-01 05:48 . 2011-11-18 04:17 6223208 ----a-w- c:\windows\system32\nvcpl.dll

    2012-12-01 05:48 . 2011-11-18 04:17 3311464 ----a-w- c:\windows\system32\nvsvc64.dll

    2012-12-01 03:43 . 2012-12-01 03:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe

    2012-11-28 20:58 . 2011-11-18 04:42 67413224 ----a-w- c:\windows\system32\MRT.exe

    2012-11-17 18:51 . 2012-03-17 21:33 98304 ----a-w- c:\users\Harman\AppData\Roaming\Microsoft\Windows\Templates\TLPC\LGUTchkdl.dll

    2012-11-17 18:51 . 2012-03-17 21:33 24576 ----a-w- c:\users\Harman\AppData\Roaming\Microsoft\Windows\Templates\TLPC\LGEUSBAutorun.dll

    2012-11-17 18:51 . 2012-03-17 21:33 1347584 ----a-w- c:\users\Harman\AppData\Roaming\Microsoft\Windows\Templates\TLPC\TL_PC.exe

    2012-10-25 09:20 . 2011-11-18 05:24 107552 ----a-w- c:\windows\system32\RTNUninst64.dll

    2012-10-16 08:38 . 2012-11-27 21:11 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38 . 2012-11-27 21:11 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39 . 2012-11-27 21:11 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

    2012-10-09 18:17 . 2012-11-15 05:58 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

    2012-10-09 18:17 . 2012-11-15 05:57 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

    2012-10-09 17:40 . 2012-11-15 05:58 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

    2012-10-09 17:40 . 2012-11-15 05:57 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

    2012-10-04 16:40 . 2012-12-12 00:01 44032 ----a-w- c:\windows\apppatch\acwow64.dll

    2012-10-03 17:56 . 2012-11-15 05:57 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys

    2012-10-03 17:44 . 2012-11-15 05:57 70656 ----a-w- c:\windows\system32\nlaapi.dll

    2012-10-03 17:44 . 2012-11-15 05:57 303104 ----a-w- c:\windows\system32\nlasvc.dll

    2012-10-03 17:44 . 2012-11-15 05:57 246272 ----a-w- c:\windows\system32\netcorehc.dll

    2012-10-03 17:44 . 2012-11-15 05:57 18944 ----a-w- c:\windows\system32\netevent.dll

    2012-10-03 17:44 . 2012-11-15 05:57 216576 ----a-w- c:\windows\system32\ncsi.dll

    2012-10-03 17:42 . 2012-11-15 05:57 569344 ----a-w- c:\windows\system32\iphlpsvc.dll

    2012-10-03 16:42 . 2012-11-15 05:57 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll

    2012-10-03 16:42 . 2012-11-15 05:57 18944 ----a-w- c:\windows\SysWow64\netevent.dll

    2012-10-03 16:42 . 2012-11-15 05:57 156672 ----a-w- c:\windows\SysWow64\ncsi.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]

    R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]

    R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]

    R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]

    R3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys [x]

    R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10x64.sys [2010-09-15 60288]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    R3 vzandnetadb;ADB Interface DriverNet for VZW;c:\windows\system32\Drivers\lgvzandnetadb.sys [2012-05-09 31744]

    R3 vzandnetdiag;LGE AndroidNet for VZW USB Serial Port;c:\windows\system32\DRIVERS\lgvzandnetdiag64.sys [2012-05-09 29696]

    R3 vzandnetmodem;LGE AndroidNet for VZW USB Modem;c:\windows\system32\DRIVERS\lgvzandnetmdm64.sys [2012-05-09 36864]

    R3 vzandnetndis;LGE AndroidNet for VZW NDIS Ethernet Adapter;c:\windows\system32\DRIVERS\lgvzandnetndis64.sys [2012-05-09 94208]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-18 1255736]

    R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-14 14544]

    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-12-01 382824]

    S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-10-25 769168]

    S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [2009-10-01 1307648]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-01-01 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 22:00]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = *.local

    TCP: DhcpNameServer = 192.168.2.1

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2013-01-01 11:35:52

    ComboFix-quarantined-files.txt 2013-01-01 16:35

    ComboFix2.txt 2012-12-31 22:09

    .

    Pre-Run: 388,557,209,600 bytes free

    Post-Run: 388,180,611,072 bytes free

    .

    - - End Of File - - DEB6F962ED2484B915416A5B8639E64A

    Haven't had any problems I know of. It seems to have worked, thanks!

    Trojan:JS/Medfos.B infection

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-12-31.01 - Harman 12/31/2012 17:02:03.1.4 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3959.2726 [GMT -5:00]

    Running from: c:\users\Harman\Desktop\ComboFix.exe

    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\users\Harman\AppData\Roaming\roadrx.dll

    c:\users\Harman\AppData\Roaming\uidfgf.dll

    c:\windows\ico.ico

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-11-28 to 2012-12-31 )))))))))))))))))))))))))))))))

    .

    .

    2012-12-31 22:08 . 2012-12-31 22:08 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

    2012-12-31 22:08 . 2012-12-31 22:08 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-12-31 19:47 . 2012-12-31 19:47 76232 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B8047629-50FD-4791-AA45-CB6D41CC81B1}\offreg.dll

    2012-12-31 15:34 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B8047629-50FD-4791-AA45-CB6D41CC81B1}\mpengine.dll

    2012-12-30 15:09 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-12-29 17:08 . 2012-12-29 17:21 -------- d-----w- c:\programdata\Spybot - Search & Destroy

    2012-12-29 17:08 . 2012-12-29 17:09 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy

    2012-12-29 15:01 . 2012-12-29 15:01 -------- d-----w- c:\users\Harman\AppData\Local\Programs

    2012-12-20 21:30 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

    2012-12-20 21:30 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

    2012-12-20 21:30 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

    2012-12-20 21:30 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

    2012-12-17 21:26 . 2012-12-17 21:26 -------- d-----w- c:\program files (x86)\AGEIA Technologies

    2012-12-15 18:19 . 2012-10-25 09:20 769168 ----a-w- c:\windows\system32\drivers\Rt64win7.sys

    2012-12-15 18:19 . 2012-10-25 09:20 74344 ----a-w- c:\windows\system32\RtNicProp64.dll

    2012-12-15 18:14 . 2012-12-15 18:14 -------- d-----w- c:\users\Harman\AppData\Local\Razer

    2012-12-15 18:14 . 2012-12-15 18:14 -------- d-----w- c:\programdata\Razer

    2012-12-15 18:14 . 2012-12-15 18:14 -------- d-----w- c:\program files (x86)\Razer

    2012-12-12 01:06 . 2012-11-14 06:06 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll

    2012-12-12 01:06 . 2012-11-14 02:01 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll

    2012-12-12 01:06 . 2012-11-14 07:06 17811968 ----a-w- c:\windows\system32\mshtml.dll

    2012-12-12 01:06 . 2012-11-14 06:32 10925568 ----a-w- c:\windows\system32\ieframe.dll

    2012-12-12 00:02 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-12-12 00:02 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-12-12 00:02 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys

    2012-12-02 00:36 . 2012-12-02 00:36 -------- d-----w- c:\programdata\Affinegy

    2012-12-01 23:47 . 2012-12-01 23:47 -------- d-----w- c:\program files (x86)\Belkin

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-12-31 20:04 . 2011-11-18 18:34 281520 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

    2012-12-31 20:04 . 2011-11-18 17:08 281520 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

    2012-12-31 20:04 . 2011-11-18 17:08 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

    2012-12-14 21:49 . 2011-11-18 15:27 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-12-11 22:00 . 2012-03-29 02:16 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-12-11 22:00 . 2011-11-18 03:51 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-12-03 15:47 . 2012-10-11 01:23 1504104 ----a-w- c:\windows\system32\nvdispgenco64.dll

    2012-12-03 15:47 . 2012-10-11 01:23 12603960 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

    2012-12-03 15:47 . 2012-10-11 01:22 2496976 ----a-w- c:\windows\SysWow64\nvapi.dll

    2012-12-03 15:47 . 2012-10-11 01:22 15122280 ----a-w- c:\windows\SysWow64\nvd3dum.dll

    2012-12-03 15:47 . 2012-02-25 21:50 983936 ----a-w- c:\windows\system32\nvumdshimx.dll

    2012-12-03 15:47 . 2011-11-18 04:52 1805672 ----a-w- c:\windows\system32\nvdispco64.dll

    2012-12-03 15:47 . 2011-05-21 11:01 2816824 ----a-w- c:\windows\system32\nvapi64.dll

    2012-12-01 05:49 . 2012-02-25 21:51 3663213 ----a-w- c:\windows\system32\nvcoproc.bin

    2012-12-01 05:49 . 2011-11-18 04:17 63336 ----a-w- c:\windows\system32\nvshext.dll

    2012-12-01 05:49 . 2011-11-18 04:17 118120 ----a-w- c:\windows\system32\nvmctray.dll

    2012-12-01 05:49 . 2011-11-18 04:17 890216 ----a-w- c:\windows\system32\nvvsvc.exe

    2012-12-01 05:48 . 2011-11-18 04:17 6223208 ----a-w- c:\windows\system32\nvcpl.dll

    2012-12-01 05:48 . 2011-11-18 04:17 3311464 ----a-w- c:\windows\system32\nvsvc64.dll

    2012-12-01 03:43 . 2012-12-01 03:43 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe

    2012-11-28 20:58 . 2011-11-18 04:42 67413224 ----a-w- c:\windows\system32\MRT.exe

    2012-11-17 18:51 . 2012-03-17 21:33 98304 ----a-w- c:\users\Harman\AppData\Roaming\Microsoft\Windows\Templates\TLPC\LGUTchkdl.dll

    2012-11-17 18:51 . 2012-03-17 21:33 24576 ----a-w- c:\users\Harman\AppData\Roaming\Microsoft\Windows\Templates\TLPC\LGEUSBAutorun.dll

    2012-11-17 18:51 . 2012-03-17 21:33 1347584 ----a-w- c:\users\Harman\AppData\Roaming\Microsoft\Windows\Templates\TLPC\TL_PC.exe

    2012-10-25 09:20 . 2011-11-18 05:24 107552 ----a-w- c:\windows\system32\RTNUninst64.dll

    2012-10-16 08:38 . 2012-11-27 21:11 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38 . 2012-11-27 21:11 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39 . 2012-11-27 21:11 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

    2012-10-09 18:17 . 2012-11-15 05:58 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

    2012-10-09 18:17 . 2012-11-15 05:57 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

    2012-10-09 17:40 . 2012-11-15 05:58 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

    2012-10-09 17:40 . 2012-11-15 05:57 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

    2012-10-04 16:40 . 2012-12-12 00:01 44032 ----a-w- c:\windows\apppatch\acwow64.dll

    2012-10-03 17:56 . 2012-11-15 05:57 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys

    2012-10-03 17:44 . 2012-11-15 05:57 70656 ----a-w- c:\windows\system32\nlaapi.dll

    2012-10-03 17:44 . 2012-11-15 05:57 303104 ----a-w- c:\windows\system32\nlasvc.dll

    2012-10-03 17:44 . 2012-11-15 05:57 246272 ----a-w- c:\windows\system32\netcorehc.dll

    2012-10-03 17:44 . 2012-11-15 05:57 18944 ----a-w- c:\windows\system32\netevent.dll

    2012-10-03 17:44 . 2012-11-15 05:57 216576 ----a-w- c:\windows\system32\ncsi.dll

    2012-10-03 17:42 . 2012-11-15 05:57 569344 ----a-w- c:\windows\system32\iphlpsvc.dll

    2012-10-03 16:42 . 2012-11-15 05:57 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll

    2012-10-03 16:42 . 2012-11-15 05:57 18944 ----a-w- c:\windows\SysWow64\netevent.dll

    2012-10-03 16:42 . 2012-11-15 05:57 156672 ----a-w- c:\windows\SysWow64\ncsi.dll

    2012-10-03 16:07 . 2012-11-15 05:57 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x]

    R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [x]

    R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [x]

    R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [x]

    R3 bcgame;Nostromo HID Device Minidriver;c:\windows\system32\drivers\bcgame.sys [x]

    R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10x64.sys [2010-09-15 60288]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    R3 vzandnetadb;ADB Interface DriverNet for VZW;c:\windows\system32\Drivers\lgvzandnetadb.sys [2012-05-09 31744]

    R3 vzandnetdiag;LGE AndroidNet for VZW USB Serial Port;c:\windows\system32\DRIVERS\lgvzandnetdiag64.sys [2012-05-09 29696]

    R3 vzandnetmodem;LGE AndroidNet for VZW USB Modem;c:\windows\system32\DRIVERS\lgvzandnetmdm64.sys [2012-05-09 36864]

    R3 vzandnetndis;LGE AndroidNet for VZW NDIS Ethernet Adapter;c:\windows\system32\DRIVERS\lgvzandnetndis64.sys [2012-05-09 94208]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-18 1255736]

    R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-14 14544]

    S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-12-01 382824]

    S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-10-25 769168]

    S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [2009-10-01 1307648]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-12-31 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 22:00]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = *.local

    TCP: DhcpNameServer = 192.168.2.1

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    Completion time: 2012-12-31 17:09:52

    ComboFix-quarantined-files.txt 2012-12-31 22:09

    .

    Pre-Run: 388,620,206,080 bytes free

    Post-Run: 388,519,919,616 bytes free

    .

    - - End Of File - - 05D0F6844437BF177CFD083F077354EB

    Trojan:JS/Medfos.B infection

    in Resolved Malware Removal Logs

    Posted

    Results of screen317's Security Check version 0.99.56

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 9

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    Microsoft Security Essentials

    Antivirus up to date!

    `````````Anti-malware/Other Utilities Check:`````````

    Spybot - Search & Destroy

    Malwarebytes Anti-Malware version 1.70.0.1100

    Java 6 Update 29

    Java version out of Date!

    Adobe Reader 10.1.4 Adobe Reader out of Date!

    ````````Process Check: objlist.exe by Laurent````````

    Microsoft Security Essentials MSMpEng.exe

    Microsoft Security Essentials msseces.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 0%

    ````````````````````End of Log``````````````````````

    # AdwCleaner v2.104 - Logfile created 12/31/2012 at 14:43:40

    # Updated 29/12/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Harman - HARMAN-PC

    # Boot Mode : Normal

    # Running from : C:\Users\Harman\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    Folder Deleted : C:\Users\Harman\AppData\Local\TempDir

    Folder Deleted : C:\Users\Harman\AppData\Local\Wajam

    ***** [Registry] *****

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F464A68D-1CF2-4991-93AB-A84351D7F676}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F464A68D-1CF2-4991-93AB-A84351D7F676}

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16457

    [OK] Registry is clean.

    *************************

    AdwCleaner[s1].txt - [856 octets] - [31/12/2012 14:43:40]

    ########## EOF - C:\AdwCleaner[s1].txt - [915 octets] ##########

    RogueKiller V8.4.2 [Dec 31 2012] by Tigzy

    mail : tigzyRK<at>gmail<dot>com

    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website : http://tigzy.geekstogo.com/roguekiller.php

    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Harman [Admin rights]

    Mode : Scan -- Date : 12/31/2012 14:52:00

    ¤¤¤ Bad processes : 4 ¤¤¤

    [DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Harman\AppData\Roaming\uidfgf.dll -> KILLED [TermProc]

    [DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Harman\AppData\Roaming\roadrx.dll -> KILLED [TermProc]

    [DLL] rundll32.exe -- C:\Windows\SysWOW64\rundll32.exe : C:\Users\Harman\AppData\Roaming\uidfgf.dll -> KILLED [TermProc]

    [DLL] rundll32.exe -- C:\Windows\SysWOW64\rundll32.exe : C:\Users\Harman\AppData\Roaming\roadrx.dll -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 0 ¤¤¤

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: ST3500418AS ATA Device +++++

    --- User ---

    [MBR] e35c2dd7f721838e49c83ffe84065abe

    [bSP] 755690393d549f27f49ce456880fe48d : Windows 7/8 MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[3]_S_12312012_02d1452.txt >>

    RKreport[1]_S_12312012_02d1451.txt ; RKreport[2]_D_12312012_02d1451.txt ; RKreport[3]_S_12312012_02d1452.txt

    Trojan:JS/Medfos.B infection

    in Resolved Malware Removal Logs

    Posted

    DDS

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16457

    Run by Harman at 12:18:48 on 2012-12-31

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3959.2486 [GMT -5:00]

    .

    AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\nvvsvc.exe

    C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

    C:\Windows\system32\svchost.exe -k RPCSS

    c:\Program Files\Microsoft Security Client\MsMpEng.exe

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k GPSvcGroup

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

    C:\Windows\system32\nvvsvc.exe

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Windows\SysWOW64\PnkBstrA.exe

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Windows\system32\taskeng.exe

    C:\Windows\system32\taskhost.exe

    C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe

    C:\Program Files\Logitech\SetPointP\SetPoint.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

    C:\Windows\System32\rundll32.exe

    C:\Windows\System32\rundll32.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_135_ActiveX.exe

    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_135_ActiveX.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Windows\system32\SearchProtocolHost.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    mWinlogon: Userinit = userinit.exe,

    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

    uRun: [uidfgf] "C:\Windows\System32\rundll32.exe" "C:\Users\Harman\AppData\Roaming\uidfgf.dll",get_user_transform_ptr

    uRun: [roadrx] "C:\Windows\System32\rundll32.exe" "C:\Users\Harman\AppData\Roaming\roadrx.dll",_Fini

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab

    DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

    DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} - hxxps://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab

    DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

    TCP: NameServer = 192.168.2.1

    TCP: Interfaces\{E4CA0C8C-6C2D-446B-BB07-5A6D2EE61357} : DHCPNameServer = 192.168.2.1

    SSODL: WebCheck - <orphaned>

    x64-Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming

    x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

    x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

    x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

    x64-SSODL: WebCheck - <orphaned>

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]

    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]

    R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-9-17 56344]

    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-12-15 769168]

    R3 USBMULCD;USB Multi-Channel Audio Device Interface;C:\Windows\System32\drivers\CM10664.sys [2011-11-22 1307648]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S3 MHIKEY10;MHIKEY10;C:\Windows\System32\drivers\MHIKEY10x64.sys [2010-9-15 60288]

    S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2011-4-27 128456]

    S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]

    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-10-27 19456]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-10-27 57856]

    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]

    S3 vzandnetadb;ADB Interface DriverNet for VZW;C:\Windows\System32\drivers\lgvzandnetadb.sys [2012-5-9 31744]

    S3 vzandnetdiag;LGE AndroidNet for VZW USB Serial Port;C:\Windows\System32\drivers\lgvzandnetdiag64.sys [2012-5-9 29696]

    S3 vzandnetmodem;LGE AndroidNet for VZW USB Modem;C:\Windows\System32\drivers\lgvzandnetmdm64.sys [2012-5-9 36864]

    S3 vzandnetndis;LGE AndroidNet for VZW NDIS Ethernet Adapter;C:\Windows\System32\drivers\lgvzandnetndis64.sys [2012-5-9 94208]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-11-18 1255736]

    S3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-13 14544]

    .

    =============== Created Last 30 ================

    .

    2012-12-31 15:39:14 76232 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B8047629-50FD-4791-AA45-CB6D41CC81B1}\offreg.dll

    2012-12-31 15:34:56 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B8047629-50FD-4791-AA45-CB6D41CC81B1}\mpengine.dll

    2012-12-30 15:09:51 9125352 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-12-29 17:08:08 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

    2012-12-29 17:08:08 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

    2012-12-29 15:01:27 -------- d-----w- C:\Users\Harman\AppData\Local\Programs

    2012-12-29 14:43:28 294912 ----a-w- C:\Users\Harman\AppData\Roaming\roadrx.dll

    2012-12-29 14:43:05 596992 ----a-w- C:\Users\Harman\AppData\Roaming\uidfgf.dll

    2012-12-20 21:30:05 46080 ----a-w- C:\Windows\System32\atmlib.dll

    2012-12-20 21:30:05 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

    2012-12-20 21:30:04 367616 ----a-w- C:\Windows\System32\atmfd.dll

    2012-12-20 21:30:04 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll

    2012-12-15 18:19:15 769168 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys

    2012-12-15 18:19:15 74344 ----a-w- C:\Windows\System32\RtNicProp64.dll

    2012-12-15 18:14:15 -------- d-----w- C:\Users\Harman\AppData\Local\Razer

    2012-12-12 01:06:59 887296 ----a-w- C:\Program Files\Internet Explorer\iedvtool.dll

    2012-12-12 01:06:59 678912 ----a-w- C:\Program Files (x86)\Internet Explorer\iedvtool.dll

    2012-12-12 00:02:07 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

    2012-12-12 00:02:07 2048 ----a-w- C:\Windows\System32\tzres.dll

    2012-12-12 00:02:02 3149824 ----a-w- C:\Windows\System32\win32k.sys

    2012-12-02 00:36:37 -------- d-----w- C:\ProgramData\Affinegy

    2012-12-01 23:47:04 -------- d-----w- C:\Program Files (x86)\Belkin

    .

    ==================== Find3M ====================

    .

    2012-12-31 15:32:28 281520 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

    2012-12-31 15:32:28 281520 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

    2012-12-31 15:32:20 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

    2012-12-14 21:49:28 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2012-12-11 22:00:37 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-12-11 22:00:37 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2012-12-01 05:49:26 3663213 ----a-w- C:\Windows\System32\nvcoproc.bin

    2012-12-01 05:49:25 63336 ----a-w- C:\Windows\System32\nvshext.dll

    2012-12-01 05:49:25 118120 ----a-w- C:\Windows\System32\nvmctray.dll

    2012-12-01 05:49:24 890216 ----a-w- C:\Windows\System32\nvvsvc.exe

    2012-12-01 05:48:41 6223208 ----a-w- C:\Windows\System32\nvcpl.dll

    2012-12-01 05:48:37 3311464 ----a-w- C:\Windows\System32\nvsvc64.dll

    2012-12-01 03:43:52 438632 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

    2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll

    2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll

    2012-10-25 09:20:28 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll

    2012-10-16 08:38:37 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38:34 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39:52 561664 ----a-w- C:\Windows\apppatch\AcLayers.dll

    2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll

    2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll

    2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll

    2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll

    2012-10-04 17:46:16 362496 ----a-w- C:\Windows\System32\wow64win.dll

    2012-10-04 17:46:15 243200 ----a-w- C:\Windows\System32\wow64.dll

    2012-10-04 17:46:15 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

    2012-10-04 17:45:55 215040 ----a-w- C:\Windows\System32\winsrv.dll

    2012-10-04 17:43:28 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

    2012-10-04 17:41:16 424960 ----a-w- C:\Windows\System32\KernelBase.dll

    2012-10-04 16:47:41 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

    2012-10-04 16:47:41 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll

    2012-10-04 15:21:55 338432 ----a-w- C:\Windows\System32\conhost.exe

    2012-10-04 14:46:46 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

    2012-10-04 14:46:46 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

    2012-10-04 14:46:44 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

    2012-10-04 14:46:43 2048 ----a-w- C:\Windows\SysWow64\user.exe

    2012-10-04 14:41:50 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

    2012-10-04 14:41:50 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

    2012-10-04 14:41:50 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

    2012-10-04 14:41:50 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

    2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys

    2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll

    2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll

    2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll

    2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll

    2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll

    2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll

    2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll

    2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll

    2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll

    2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys

    2012-10-02 19:50:57 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll

    .

    ============= FINISH: 12:19:25.66 ===============

    Attach

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Home Premium

    Boot Device: \Device\HarddiskVolume1

    Install Date: 11/17/2011 10:41:01 PM

    System Uptime: 12/31/2012 10:23:06 AM (2 hours ago)

    .

    Motherboard: ASUSTeK Computer INC. | | P7H55-M PRO

    Processor: Intel® Core i3 CPU 540 @ 3.07GHz | LGA1156 | 3067/133mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 466 GiB total, 360.887 GiB free.

    D: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    ==== System Restore Points ===================

    .

    RP150: 12/11/2012 8:06:41 PM - Windows Update

    RP151: 12/15/2012 1:18:56 PM - Installed Realtek Ethernet Controller Driver

    RP152: 12/15/2012 7:37:04 PM - Windows Update

    RP153: 12/16/2012 10:54:44 AM - Windows Update

    RP154: 12/20/2012 4:01:51 PM - Windows Update

    RP155: 12/20/2012 4:29:54 PM - Windows Update

    RP156: 12/24/2012 6:04:05 PM - Windows Update

    RP157: 12/28/2012 7:19:34 PM - Windows Update

    RP158: 12/29/2012 11:33:15 AM - Removed KODAK Share Button App.

    .

    ==== Installed Programs ======================

    .

    Adobe Flash Player 11 ActiveX

    Adobe Reader X (10.1.4)

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    Battlefield 3™

    Battlefield Play4Free

    Battlelog Web Plugins

    Belkin Setup and Router Monitor

    Bonjour

    Brother MFL-Pro Suite MFC-465CN

    CCleaner

    Defraggler

    Diablo III

    Disney Toontown Online

    eReg

    ESN Sonar

    Image Plugin

    iTunes

    Java Auto Updater

    Java 6 Update 29

    KODAK Share Button App

    LG Verizon United Drivers

    Logitech SetPoint 6.32

    Malwarebytes Anti-Malware version 1.70.0.1100

    Microsoft .NET Framework 4 Client Profile

    Microsoft .NET Framework 4 Extended

    Microsoft Security Client

    Microsoft Security Essentials

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    NVIDIA 3D Vision Controller Driver 310.70

    NVIDIA 3D Vision Driver 310.70

    NVIDIA Control Panel 310.70

    NVIDIA Graphics Driver 310.70

    NVIDIA HD Audio Driver 1.3.18.0

    NVIDIA Install Application

    NVIDIA PhysX

    NVIDIA PhysX System Software 9.12.1031

    NVIDIA Stereoscopic 3D Driver

    NVIDIA Update 1.11.3

    NVIDIA Update Components

    Origin

    PunkBuster Services

    Razer Game Booster

    Realtek Ethernet Controller Driver

    Realtek High Definition Audio Driver

    Rosetta Stone Version 3

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

    Sonar 5.1 Championship Headset

    Spybot - Search & Destroy

    TeamSpeak 3 Client

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Update for Microsoft .NET Framework 4 Extended (KB2468871)

    Update for Microsoft .NET Framework 4 Extended (KB2533523)

    Update for Microsoft .NET Framework 4 Extended (KB2600217)

    Ventrilo Client for Windows x64

    Windows Driver Package - Eastman Kodak KODAK Digital Camera (01/29/2010 1.4.1.0)

    WinRAR 4.11 (64-bit)

    Wizard101

    WModem Driver Installer

    Yahoo! Messenger

    Yahoo! Software Update

    .

    ==== End Of File ===========================

    Thanks for any help!

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.