Jump to content

Mortifier

Members
 View Profile  See their activity

  • Posts

    10

  • Joined

  • Last visited

 Content Type 

Posts posted by Mortifier

    Svchost.exe trojan restores itself

    in Resolved Malware Removal Logs

    Posted

    well unfortunatley it deleted my avg do not track which is the only thing i left of avg secure search, I really liked that addon....

    # AdwCleaner v2.104 - Logfile created 01/04/2013 at 16:09:33

    # Updated 29/12/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Erik - ERIK-VAIO

    # Boot Mode : Normal

    # Running from : C:\Users\Erik\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    Stopped & Deleted : WajamUpdater

    ***** [Files / Folders] *****

    Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search

    Folder Deleted : C:\Program Files (x86)\AVG Secure Search

    Folder Deleted : C:\Program Files (x86)\Conduit

    Folder Deleted : C:\ProgramData\AVG Secure Search

    Folder Deleted : C:\ProgramData\Partner

    Folder Deleted : C:\Users\Erik\AppData\Local\APN

    Folder Deleted : C:\Users\Erik\AppData\Local\AVG Secure Search

    Folder Deleted : C:\Users\Erik\AppData\Local\Conduit

    Folder Deleted : C:\Users\Erik\AppData\LocalLow\AVG Secure Search

    Folder Deleted : C:\Users\Erik\AppData\LocalLow\boost_interprocess

    Folder Deleted : C:\Users\Erik\AppData\LocalLow\Conduit

    Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    ***** [Registry] *****

    Key Deleted : HKCU\Software\APN

    Key Deleted : HKCU\Software\AVG Secure Search

    Key Deleted : HKCU\Software\IGearSettings

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKCU\Software\Softonic

    Key Deleted : HKCU\Software\Wajam

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

    Key Deleted : HKLM\Software\APN

    Key Deleted : HKLM\Software\AVG Secure Search

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

    Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

    Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Deleted : HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9

    Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

    Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

    Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

    Key Deleted : HKLM\Software\Conduit

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

    Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={31656C56-8DB5-4EB7-8486-8A5BC5C80537}&mid=8c087e22962747d0ad32850b0fedfd0c-fe5d6839176ba86ff95409436d43bc04d03853a7〈=en&ds=gm011&pr=sa&d=2012-05-17 13:35:18&v=12.2.5.32&sap=hp --> hxxp://www.google.com

    -\\ Google Chrome v23.0.1271.97

    File : C:\Users\Erik\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [8483 octets] - [04/01/2013 04:10:24]

    AdwCleaner[R2].txt - [8543 octets] - [04/01/2013 16:09:21]

    AdwCleaner[s2].txt - [8418 octets] - [04/01/2013 16:09:33]

    ########## EOF - C:\AdwCleaner[s2].txt - [8478 octets] ##########

    next log

    Results of screen317's Security Check version 0.99.56

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 9

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Security Center service is not running! This report may not be accurate!

    Windows Firewall Enabled!

    avast! Antivirus

    Antivirus up to date!

    `````````Anti-malware/Other Utilities Check:`````````

    McAfee SiteAdvisor

    Malwarebytes Anti-Malware version 1.70.0.1100

    Adobe Flash Player 10 Flash Player out of Date!

    Adobe Reader 9 Adobe Reader out of Date!

    Google Chrome 21.0.1180.83

    Google Chrome 21.0.1180.89

    Google Chrome 22.0.1229.79

    Google Chrome 22.0.1229.92

    Google Chrome 22.0.1229.94

    Google Chrome 23.0.1271.64

    Google Chrome 23.0.1271.91

    Google Chrome 23.0.1271.95

    Google Chrome 23.0.1271.97

    ````````Process Check: objlist.exe by Laurent````````

    AVAST Software Avast AvastSvc.exe

    AVAST Software Avast AvastUI.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 5%

    ````````````````````End of Log``````````````````````

    Svchost.exe trojan restores itself

    in Resolved Malware Removal Logs

    Posted

    Many thanks sir that nasty bug is gone at last! I just realized that these are the malwarebytes forums, i ddint even notice.

    can you give me anything on rundll32 which ive asked earlier? maybe im just paranoid but it really shouldnt have a page icon or?

    and what about the RK quarantine folder? can i safely delete all the files in it?

    i suspect i shouldnt be keeping roguekiller as it can lead me to deleting important files but im going to stick with the rootkit remover for a while longer, is there any other software you can recommend me that gets rid of nasty infections that dont show up on my antivirus?

    I am forever greatful.

    mbar-log-2013-01-04 (01-36-55).txt

    system-log.txt

    Svchost.exe trojan restores itself

    in Resolved Malware Removal Logs

    Posted

    roguekiller report

    RogueKiller V8.4.2 [Dec 31 2012] by Tigzy

    mail : tigzyRK<at>gmail<dot>com

    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website : http://tigzy.geekstogo.com/roguekiller.php

    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Erik [Admin rights]

    Mode : Scan -- Date : 01/04/2013 00:44:27

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 4 ¤¤¤

    [RUN][sUSP PATH] HKLM\[...]\Wow6432Node\Run : Adobe (C:\ProgramData\Adobe\1A1E3A.vbe) -> FOUND

    [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (109.171.3.191:80) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: TOSHIBA MK3265GSX +++++

    --- User ---

    [MBR] 298065d124ea9f8c8d79cb35b374d373

    [bSP] 6eb07ea6fc3ceb1b2edcb57337305939 : Windows 7/8 MBR Code

    Partition table:

    0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10306 Mo

    1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21108736 | Size: 100 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 21313536 | Size: 294837 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[1]_S_01042013_02d0044.txt >>

    RKreport[1]_S_01042013_02d0044.txt

    Svchost.exe trojan restores itself

    in Resolved Malware Removal Logs

    Posted

    here are the logs i took just now

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer:

    Run by Erik at 0:37:47 on 2013-01-04

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.6126.4595 [GMT 0:00]

    .

    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\nvvsvc.exe

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files\AVAST Software\Avast\AvastSvc.exe

    C:\Windows\system32\WLANExt.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k apphost

    C:\Program Files\Intel\WiFi\bin\EvtEng.exe

    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

    C:\Windows\system32\nvvsvc.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\Explorer.EXE

    C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

    C:\ProgramData\DatacardService\HWDeviceService64.exe

    C:\ProgramData\DatacardService\DCSHelper.exe

    c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe

    C:\Windows\system32\rundll32.exe

    C:\Windows\system32\rundll32.exe

    c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

    C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe

    C:\Program Files\Sony\VAIO Smart Network\VSNService.exe

    C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe

    C:\Windows\SysWOW64\DllHost.exe

    C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe

    C:\Windows\system32\svchost.exe -k iissvcs

    C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

    C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe

    C:\Program Files\Sony\VAIO Power Management\SPMService.exe

    C:\Windows\system32\WUDFHost.exe

    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

    C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe

    C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe

    C:\Windows\system32\wbem\unsecapp.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files\AVAST Software\Avast\AvastUI.exe

    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

    C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe

    C:\Program Files\Sony\VAIO Update\VUAgent.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe

    C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

    C:\Program Files\Sony\VAIO Care\VCPerfService.exe

    C:\Program Files\Sony\VAIO Care\VCsystray.exe

    C:\Program Files\Sony\VAIO Care\VCService.exe

    C:\Program Files\Sony\VAIO Care\VCAgent.exe

    C:\Windows\System32\vds.exe

    C:\Windows\SysWOW64\ctfmon.exe

    C:\Program Files\Sony\VAIO Care\Admload.exe

    C:\Windows\system32\SearchProtocolHost.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxps://isearch.avg.com/?cid={31656C56-8DB5-4EB7-8486-8A5BC5C80537}&mid=8c087e22962747d0ad32850b0fedfd0c-fe5d6839176ba86ff95409436d43bc04d03853a7〈=en&ds=gm011&pr=sa&d=2012-05-17 13:35:18&v=12.2.5.32&sap=hp

    uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEC&bmod=EU01

    uProxyServer = 109.171.3.191:80

    uURLSearchHooks: {00000000-6E41-4FD3-8538-502F5495E5FC} - <orphaned>

    uURLSearchHooks: {687578b9-7132-4a7a-80e4-30ee31099e03} - <orphaned>

    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll

    mWinlogon: Userinit = userinit.exe,

    BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

    BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll

    BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll

    TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>

    TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll

    TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll

    TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

    uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

    mRun: [iSBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"

    mRun: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

    mRun: [Adobe] C:\ProgramData\Adobe\1A1E3A.vbe

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-Explorer: HideSCAHealth = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

    TCP: NameServer = 192.168.1.1 192.168.1.1

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A} : DHCPNameServer = 192.168.1.1 192.168.1.1

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\244564F4E4 : DHCPNameServer = 192.168.22.22 192.168.22.23

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\244575966496 : DHCPNameServer = 192.168.22.22 192.168.22.23

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\244575966496D277964786D264F4E4 : DHCPNameServer = 192.168.22.22 192.168.22.23

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\3375962756C6563737D2D4F64656D6D246362673 : DHCPNameServer = 192.168.1.1 192.168.1.1

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\33D4F62696C65675966496D253531663 : DHCPNameServer = 192.168.1.1 192.168.1.1

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\6796277696E6D65646961673139353333363 : DHCPNameServer = 194.168.4.100 194.168.8.100

    TCP: Interfaces\{814BCE5E-C916-4F24-8BED-24B0F1B8124A}\8656E6E65637379713 : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{BB8C9484-BDD0-485F-9085-847F9BF303D0} : DHCPNameServer = 192.168.1.254

    TCP: Interfaces\{F503C021-1873-4F53-834D-88F21623C22B} : DHCPNameServer = 192.168.1.1 192.168.1.1

    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll

    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll

    Notify: VESWinlogon - VESWinlogon.dll

    SSODL: WebCheck - <orphaned>

    x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

    x64-BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll

    x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - LocalServer32 - <no file>

    x64-TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll

    x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

    x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3

    x64-Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll

    x64-Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

    x64-SSODL: WebCheck - <orphaned>

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-2-29 55856]

    R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2012-2-29 984144]

    R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2012-2-29 370288]

    R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-8-29 30568]

    R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-3-8 283200]

    R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2012-2-29 25232]

    R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2012-2-29 71600]

    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-11-13 44808]

    R2 HWDeviceService64.exe;HWDeviceService64.exe;C:\ProgramData\DatacardService\HWDeviceService64.exe [2011-3-14 346976]

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [2012-12-22 103472]

    R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]

    R2 rimspci;rimspci;C:\Windows\System32\drivers\rimssne64.sys [2009-11-23 93696]

    R2 risdsnpe;risdsnpe;C:\Windows\System32\drivers\risdsne64.sys [2012-4-16 76800]

    R2 SampleCollector;VAIO Care Performance Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2012-3-2 259192]

    R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2012-2-29 104960]

    R2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2012-2-29 845312]

    R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [2012-11-8 711112]

    R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2012-2-29 19968]

    R3 huawei_enumerator;huawei_enumerator;C:\Windows\System32\drivers\ew_jubusenum.sys [2012-12-30 86016]

    R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2009-11-23 151040]

    R3 NETwNv64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETwNv64.sys [2012-4-16 8388096]

    R3 RzSynapse;Razer Driver;C:\Windows\System32\drivers\RzSynapse.sys [2011-11-15 126464]

    R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2009-11-23 11392]

    R3 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2012-2-29 571248]

    R3 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2012-3-2 44736]

    R3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update\VUAgent.exe [2012-12-30 1286784]

    R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2012-4-16 402720]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S2 McShield;McAfee Real-time Scanner; [x]

    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944]

    S2 WajamUpdater;WajamUpdater;"C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" --> C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [?]

    S3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2009-11-23 52264]

    S3 DirMngr;DirMngr;C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [2011-3-2 224256]

    S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\System32\drivers\ew_hwusbdev.sys [2012-12-30 117248]

    S3 ew_usbenumfilter;huawei_CompositeFilter;C:\Windows\System32\drivers\ew_usbenumfilter.sys [2012-12-30 13952]

    S3 ewusbmbb;HUAWEI USB-WWAN miniport;C:\Windows\System32\drivers\ewusbwwan.sys [2012-12-30 421376]

    S3 huawei_cdcacm;huawei_cdcacm;C:\Windows\System32\drivers\ew_jucdcacm.sys [2012-12-30 98816]

    S3 huawei_cdcecm;huawei_cdcecm;C:\Windows\System32\drivers\ew_jucdcecm.sys [2012-12-30 69632]

    S3 huawei_ext_ctrl;huawei_ext_ctrl;C:\Windows\System32\drivers\ew_juextctrl.sys [2012-12-30 28672]

    S3 McSysmon;McAfee SystemGuards; [x]

    S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2009-9-15 6952960]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-3-4 59392]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-3-3 1255736]

    S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]

    .

    =============== Created Last 30 ================

    .

    2013-01-03 06:41:32 -------- d-----w- C:\Users\Erik\AppData\Roaming\Malwarebytes

    2013-01-03 06:41:15 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2013-01-03 06:41:15 -------- d-----w- C:\ProgramData\Malwarebytes

    2013-01-03 06:41:14 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2013-01-02 19:12:19 -------- d-sh--w- C:\ProgramData\SecuROM

    2013-01-02 18:52:36 -------- d-----w- C:\Program Files (x86)\JoWooD Entertainment AG

    2013-01-02 14:46:31 -------- d-----w- C:\Users\Erik\AppData\Roaming\NVIDIA

    2012-12-31 06:38:02 -------- d-----w- C:\ProgramData\SecTaskMan

    2012-12-30 19:50:38 98816 ----a-w- C:\Windows\System32\drivers\ew_jucdcacm.sys

    2012-12-30 19:50:38 86016 ----a-w- C:\Windows\System32\drivers\ew_jubusenum.sys

    2012-12-30 19:50:38 69632 ----a-w- C:\Windows\System32\drivers\ew_jucdcecm.sys

    2012-12-30 19:50:38 421376 ----a-w- C:\Windows\System32\drivers\ewusbwwan.sys

    2012-12-30 19:50:38 32768 ----a-w- C:\Windows\System32\drivers\ewdcsc.sys

    2012-12-30 19:50:38 28672 ----a-w- C:\Windows\System32\drivers\ew_juextctrl.sys

    2012-12-30 19:50:38 221312 ----a-w- C:\Windows\System32\drivers\ewusbmdm.sys

    2012-12-30 19:50:38 22016 ----a-w- C:\Windows\System32\drivers\ew_hwupgrade.sys

    2012-12-30 19:50:38 212992 ----a-w- C:\Windows\System32\drivers\ew_juwwanecm.sys

    2012-12-30 19:50:38 13952 ----a-w- C:\Windows\System32\drivers\ew_usbenumfilter.sys

    2012-12-30 19:50:38 117248 ----a-w- C:\Windows\System32\drivers\ew_hwusbdev.sys

    2012-12-30 19:50:38 1001472 ----a-w- C:\Windows\System32\drivers\mod7700.sys

    2012-12-30 02:15:04 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

    2012-12-30 02:14:57 -------- d-----w- C:\Users\Erik\AppData\Local\PunkBuster

    2012-12-30 02:14:27 -------- d-----w- C:\ProgramData\Orbit

    2012-12-30 02:06:27 281688 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

    2012-12-28 19:36:43 -------- d-----w- C:\ProgramData\NVIDIA Corporation

    2012-12-28 19:34:01 -------- d-----w- C:\NVIDIA

    2012-12-28 19:12:54 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation

    2012-12-28 19:12:40 890216 ----a-w- C:\Windows\System32\nvvsvc.exe

    2012-12-28 19:12:40 63336 ----a-w- C:\Windows\System32\nvshext.dll

    2012-12-28 19:12:40 6223208 ----a-w- C:\Windows\System32\nvcpl.dll

    2012-12-28 19:12:40 3311464 ----a-w- C:\Windows\System32\nvsvc64.dll

    2012-12-28 19:12:40 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll

    2012-12-28 19:12:40 118120 ----a-w- C:\Windows\System32\nvmctray.dll

    2012-12-28 19:12:02 60776 ----a-w- C:\Windows\System32\OpenCL.dll

    2012-12-28 19:12:02 52584 ----a-w- C:\Windows\SysWow64\OpenCL.dll

    2012-12-27 15:06:12 -------- d-----w- C:\Users\Erik\AppData\Local\Razer

    2012-12-25 19:52:38 -------- d-----w- C:\Users\Erik\AppData\Local\Ubisoft Game Launcher

    2012-12-23 22:57:47 -------- d-----w- C:\Program Files (x86)\DreamCatcher

    2012-12-22 22:34:52 -------- d-----w- C:\Program Files\McAfee

    2012-12-22 03:00:34 46080 ----a-w- C:\Windows\System32\atmlib.dll

    2012-12-22 03:00:34 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

    2012-12-22 03:00:33 367616 ----a-w- C:\Windows\System32\atmfd.dll

    2012-12-22 03:00:32 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll

    2012-12-16 01:13:02 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

    2012-12-16 01:13:02 2048 ----a-w- C:\Windows\System32\tzres.dll

    2012-12-16 01:01:03 -------- d-----w- C:\Users\Erik\AppData\Local\ElevatedDiagnostics

    2012-12-12 13:38:01 81 ----a-w- C:\Program Files (x86)\update-dead-island.bat

    2012-12-12 13:38:01 12212040 ----a-w- C:\Program Files (x86)\WMFDist11-WindowsXP.exe

    2012-12-12 13:28:40 -------- d-----w- C:\Program Files (x86)\Dead Island Game of The Year Edition

    2012-12-09 10:24:31 -------- d--h--w- C:\Program Files (x86)\Common Files\EAInstaller

    2012-12-09 10:06:14 -------- d-----w- C:\Program Files (x86)\Mass Effect 3

    .

    ==================== Find3M ====================

    .

    2012-11-28 16:53:55 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

    2012-11-28 16:53:55 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll

    2012-11-22 03:26:40 3149824 ----a-w- C:\Windows\System32\win32k.sys

    2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-11-10 21:12:46 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll

    2012-11-08 14:45:10 30568 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys

    2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll

    2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll

    2012-10-30 22:51:55 984144 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

    2012-10-30 22:51:55 71600 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys

    2012-10-30 22:51:07 41224 ----a-w- C:\Windows\avastSS.scr

    2012-10-15 17:59:28 54072 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys

    .

    ============= FINISH: 0:38:10.14 ===============

    attach.txt

    Svchost.exe trojan restores itself

    in Resolved Malware Removal Logs

    Posted

    Hello,

    at first i saw posting on a forum as my last option but now im just getting desperate and cant afford to make a complete system restore.

    So I have this problem since lately my screen brightness has been flickering which at first i thought was a problem with the power supply (it started after i installed a few torrents), but since this never occurred while in safe mode or on the login screen i began to question my antivirus (avast) and started questioning the active processes in my task manager, there were two suspicious processes, one was svchost and the other was 3 instances of rundll32.

    Then I found this nice little program called malwarebytes anti malware which found svchost.exe in my %temp% folder and svchost.exe as active process and identified it as trojan, additionally virustotal.com identified it as bitcoinminer trojan.

    Unfortunately after removing it with malwarebytes it would restore itself upon a computer restart and ive tried a lot to get rid of it, ive deleted it manually, deleted all restore points and turned off system restore (i had no restore points prior to the incident) but to no avail.

    I hope you can and want to help me remove it and additionally id like to know wether having 3 instances of rundll32.exe running which cannot be ended in task manager and of which the applications in system 32 have a blank page as icon is potentially dangerous. (this was defined as corrupted rundll32 by several internet blogs i found on google)

    I'm ready to fully cooperate and post any logs you demand, but please dont let me download too much software as I am currently on mobile broadband.

    thankyou for your help!

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.