Jump to content

jabberwock

Members
 View Profile  See their activity

  • Posts

    2

  • Joined

  • Last visited

 Content Type 

Posts posted by jabberwock

    upddlg.exe from mcafee total protection would run every hour and trigger a wav file

    in Resolved Malware Removal Logs

    Posted

    Hi

    I used to run mcafee total protection. However, I noticed that the updater (upddlg.exe) would run every hour and would trigger a sound (windows navigation start.wav) on my computer several times in rapid succession. This isn't the normal behavior and uninstalling and reinstalling did not fix it. I have since changed my antivirus protection, but I am still concerned I might have something unwanted on my computer.

    Here are the dds and attach files. Thanks in advance.

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.4.0

    Run by Admin1 at 18:13:34 on 2013-04-14

    Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.4086.1253 [GMT -7:00]

    .

    AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

    SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Program Files\Microsoft Security Client\MsMpEng.exe

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k GPSvcGroup

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files\Palm, Inc\novacomd\amd64\novacomd.exe

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

    C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Windows\system32\igfxsrvc.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe

    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

    C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

    C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Windows\System32\svchost.exe -k LocalServicePeerNet

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Users\admin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Windows\system32\taskhost.exe

    C:\Windows\splwow64.exe

    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

    C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe

    C:\Windows\System32\taskmgr.exe

    C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    D:\D Programs\VLC\vlc.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Windows\system32\taskhost.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\Common Files\Speedbit\SbUpdate\SBUpdate.exe

    C:\Windows\System32\igfxtray.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Windows\system32\igfxsrvc.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files (x86)\DAP\DAP.exe

    D:\D Programs\Bomgar\Representative\icta9.bomgar.com\bomgar-rep.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe

    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

    C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

    C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe

    C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files (x86)\iTunes\iTunesHelper.exe

    C:\Windows\SysWOW64\NOTEPAD.EXE

    C:\Windows\system32\wuauclt.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    D:\D Programs\Malwarebytes' Anti-Malware\mbamscheduler.exe

    D:\D Programs\Malwarebytes' Anti-Malware\mbamservice.exe

    D:\D Programs\Malwarebytes' Anti-Malware\mbamgui.exe

    D:\D Programs\Malwarebytes' Anti-Malware\mbam.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://search.speedbit.com

    mSearchAssistant = hxxp://start.facemoods.com/?a=ostpl&s={searchTerms}&f=4

    BHO: ContributeBHO Class: {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

    BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

    BHO: SpeedBit Link Verification Helper: {D5974A72-C81C-4DC3-BE77-A8A7BBC8864E} - C:\Program Files (x86)\DAP\LinkVerifier.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

    TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

    TB: Contribute Toolbar: {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll

    TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

    uRun: [DownloadAccelerator] "C:\Program Files (x86)\DAP\DAP.EXE" /STARTUP

    mRun: [brMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN

    mRun: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun

    mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"

    mRun: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"

    mRun: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

    mRun: [uCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"

    mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

    mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

    mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

    mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

    mRun: [Garmin Lifetime Updater] C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized

    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

    mRun: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [LGODDFU] "C:\Program Files (x86)\lg_fwupdate\lgfw.exe" blrun

    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

    mRunOnce: [Malwarebytes Anti-Malware] D:\D Programs\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BOMGAR~1.LNK - D:\D Programs\Bomgar\Representative\icta9.bomgar.com\bomgar-rep.exe

    mPolicies-Explorer: NoDrives = dword:0

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm

    IE: &Verify with DAP - C:\Program Files (x86)\DAP\dapverify.htm

    IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

    IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

    IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

    IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

    IE: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

    .

    INFO: HKCU has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    DPF: {5554DCB0-700B-498D-9B58-4E40E5814405} - hxxps://clic.cir2.com/CAMBRIDGE.COMPLIANCE.ADVERTISING/Reserved.ReportViewerWebControl.axd?ReportSession=0233larlf12kzoj5ortfwy45&ControlID=bc7a9848472e432fb702861a0f6fef97&Culture=1033&UICulture=1033&ReportStack=1&OpType=PrintCab

    DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    DPF: {E7DA7F8D-27AB-4EE9-8FC0-3FEC9ECFE758} - hxxps://clic.cir2.com/WebCapture/DynamicWebTWAIN.cab

    TCP: NameServer = 192.168.1.1

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB} : NameServer = 208.67.222.222,208.67.220.220

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB} : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB}\052434027596D26496 : NameServer = 208.67.222.222,208.67.220.220

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB}\052434027596D26496 : DHCPNameServer = 10.1.100.5 208.67.222.222

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB}\2656C6B696E6E2439316 : DHCPNameServer = 192.168.2.1

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB}\A697B6 : NameServer = 208.67.222.222,208.67.220.220

    TCP: Interfaces\{2775338A-C83D-47DF-8796-5C6D6DBA34BB}\A697B6 : DHCPNameServer = 76.14.0.8 76.14.0.9 76.14.96.14

    TCP: Interfaces\{8826120A-7263-4C63-BB4F-E9E9AD7D4C08} : DHCPNameServer = 10.1.100.5 208.67.222.222

    TCP: Interfaces\{A5DCA0B2-C7C4-42E0-8BCF-2BFB47D2394D} : DHCPNameServer = 68.28.68.132 68.28.138.132

    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie.dll

    Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie.dll

    Notify: SDWinLogon - SDWinLogon.dll

    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

    x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

    x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

    x64-Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    .

    INFO: x64-HKLM has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie64.dll

    x64-Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Program Files (x86)\DAP\dapie64.dll

    x64-Notify: igfxcui - igfxdev.dll

    x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

    Hosts: 127.0.0.1 www.spywareinfo.com

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\Admin1\AppData\Roaming\Mozilla\Firefox\Profiles\ndi00b7v.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://search.speedbit.com/searchresults.asp?src=default&q=

    FF - prefs.js: browser.search.selectedEngine - SpeedBit Search

    FF - prefs.js: browser.startup.homepage - hxxp://search.speedbit.com

    FF - prefs.js: keyword.URL - hxxp://search.speedbit.com/searchresults.asp?src=default&q=

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    .

    ---- FIREFOX POLICIES ----

    user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);

    ============= SERVICES / DRIVERS ===============

    .

    R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2012-10-29 339392]

    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-1-20 230320]

    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-8-30 55280]

    R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-8-25 13672]

    R2 MBAMScheduler;MBAMScheduler;D:\D Programs\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-1-3 418376]

    R2 MBAMService;MBAMService;D:\D Programs\Malwarebytes' Anti-Malware\mbamservice.exe [2013-1-3 701512]

    R2 NovacomD;Palm Novacom;C:\Program Files\Palm, Inc\novacomd\amd64\novacomd.exe [2011-6-24 72192]

    R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2013-1-3 1103392]

    R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2013-1-3 1369624]

    R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2013-1-3 168384]

    R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-3-19 3289208]

    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-5-3 25928]

    R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]

    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]

    S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]

    S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2012-3-26 22528]

    S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-1-20 130008]

    S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360]

    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-1-3 19456]

    S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

    S3 SydexFDD;Sydex Diskette Driver;C:\Windows\SysWOW64\drivers\SYDEXFDD.SYS [2012-12-4 13359]

    S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2010-11-21 88960]

    S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2013-1-3 29696]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-1-3 57856]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-1-3 30208]

    S3 tsusbhub;tsusbhub;C:\Windows\System32\drivers\tsusbhub.sys [2010-11-21 117248]

    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-4-12 1255736]

    .

    =============== File Associations ===============

    .

    ShellExec: dreamweaver.exe: Open="C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS5.5\dreamweaver.exe", "%1"

    .

    =============== Created Last 30 ================

    .

    2013-04-14 14:23:43 9311288 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F71A3FF2-968A-457E-A226-613C171E57FD}\mpengine.dll

    2013-04-13 09:28:32 9311288 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2013-04-11 20:52:44 -------- d-----w- C:\Users\Admin1\AppData\Roaming\EQATEC Analytics

    2013-04-11 20:32:38 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

    2013-04-11 20:32:02 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2013-04-11 20:32:02 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2013-04-11 20:32:01 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2013-04-11 20:32:01 182896 ----a-w- C:\Program Files\Internet Explorer\sqmapi.dll

    2013-04-11 20:32:01 149616 ----a-w- C:\Program Files (x86)\Internet Explorer\sqmapi.dll

    2013-04-11 20:32:00 996352 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll

    2013-04-11 20:32:00 768512 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

    2013-04-11 20:32:00 304640 ----a-w- C:\Program Files\Internet Explorer\IEShims.dll

    2013-04-10 03:40:24 3153408 ----a-w- C:\Windows\System32\win32k.sys

    2013-04-10 03:40:23 1655656 ----a-w- C:\Windows\System32\drivers\ntfs.sys

    2013-04-10 03:39:40 223752 ----a-w- C:\Windows\System32\drivers\fvevol.sys

    2013-04-10 03:39:39 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

    2013-04-10 03:39:38 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

    2013-04-10 03:39:38 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

    2013-04-10 03:39:37 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

    2013-04-10 03:39:37 43520 ----a-w- C:\Windows\System32\csrsrv.dll

    2013-04-10 03:39:37 112640 ----a-w- C:\Windows\System32\smss.exe

    2013-03-30 12:47:01 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A077C729-A2AD-4E61-B2B4-446F66368BAF}\gapaengine.dll

    2013-03-30 12:35:12 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

    2013-03-30 12:35:05 -------- d-----w- C:\Program Files\Microsoft Security Client

    2013-03-28 20:09:11 -------- d-----w- C:\Users\Admin1\AppData\Roaming\SpiderOak

    2013-03-20 21:46:48 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys

    2013-03-17 08:56:50 -------- d-----w- C:\Windows\rescache

    .

    ==================== Find3M ====================

    .

    2013-04-04 21:50:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2013-04-02 10:34:28 282744 ------w- C:\Windows\System32\MpSigStub.exe

    2013-03-13 03:30:52 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-03-13 03:30:52 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2013-02-22 06:27:49 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2013-02-22 06:20:51 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2013-02-22 06:19:37 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2013-02-22 06:15:48 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2013-02-22 06:15:23 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2013-02-22 03:46:00 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2013-02-22 03:38:00 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2013-02-22 03:37:50 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2013-02-22 03:34:17 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

    2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

    2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

    2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

    2013-02-09 05:13:22 6264848 ----a-w- C:\ProgramData\1360394077-bomgar-rep-installer.exe.exe

    2013-01-20 22:59:04 230320 ----a-w- C:\Windows\System32\drivers\MpFilter.sys

    2013-01-20 22:59:04 130008 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys

    .

    ============= FINISH: 18:13:52.07 ===============

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Ultimate

    Boot Device: \Device\HarddiskVolume2

    Install Date: 4/12/2012 1:27:17 PM

    System Uptime: 4/12/2013 8:12:59 PM (46 hours ago)

    .

    Motherboard: Intel Corp. | | Base Board Product Name

    Processor: Intel® Core2 Duo CPU T5750 @ 2.00GHz | CPU | 2000/667mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 62 GiB total, 2.746 GiB free.

    D: is FIXED (NTFS) - 125 GiB total, 41.524 GiB free.

    E: is FIXED (NTFS) - 278 GiB total, 2.95 GiB free.

    G: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    Class GUID:

    Description:

    Device ID: ACPI\TOS1901\2&DABA3FF&2

    Manufacturer:

    Name:

    PNP Device ID: ACPI\TOS1901\2&DABA3FF&2

    Service:

    .

    ==== System Restore Points ===================

    .

    RP176: 4/11/2013 1:30:45 PM - Windows Update

    .

    ==== Installed Programs ======================

    .

    7-Zip 9.20 (x64 edition)

    Adobe Acrobat X Pro - English, Français, Deutsch

    Adobe AIR

    Adobe Community Help

    Adobe Content Viewer

    Adobe Creative Suite 5.5 Master Collection

    Adobe Flash Player 11 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Reader XI (11.0.02)

    Adobe Story

    Adobe Widget Browser

    Allway Sync version 12.12.12

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    Bomgar Representative Console 11.1.4 [icta9.bomgar.com]

    Bonjour

    Brother MFL-Pro Suite MFC-9840CDW

    C5500n - C5800Ldn Series GDI Driver from OKI® Printing Solutions for Windows

    CCleaner

    Cisco WebEx Meetings

    Contour Storyteller

    ConvertHelper 2.2

    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

    Download Accelerator Plus (DAP)

    Dynamic Web TWAIN Plug-in

    Garmin Communicator Plugin x64

    Garmin Lifetime Updater

    Google Chrome

    Google Talk Plugin

    Google Update Helper

    GPL Ghostscript

    HP Officejet 6700 Basic Device Software

    iCloud

    Intel® Graphics Media Accelerator Driver

    IrfanView (remove only)

    iTunes

    Java Auto Updater

    Java 7 Update 4

    LG Burning Tool

    LG CyberLink LabelPrint

    LG CyberLink Media Suite

    LG CyberLink PowerBackup

    LG CyberLink YouCam

    LG ODD Auto Firmware Update

    Malwarebytes Anti-Malware version 1.75.0.1300

    Microsoft .NET Framework 4 Client Profile

    Microsoft Camera Codec Pack

    Microsoft Office Access MUI (English) 2010

    Microsoft Office Access Setup Metadata MUI (English) 2010

    Microsoft Office Excel MUI (English) 2010

    Microsoft Office Groove MUI (English) 2010

    Microsoft Office InfoPath MUI (English) 2010

    Microsoft Office Live Meeting 2007

    Microsoft Office Office 64-bit Components 2010

    Microsoft Office OneNote MUI (English) 2010

    Microsoft Office Outlook MUI (English) 2010

    Microsoft Office PowerPoint MUI (English) 2010

    Microsoft Office Professional Plus 2010

    Microsoft Office Proof (English) 2010

    Microsoft Office Proof (French) 2010

    Microsoft Office Proof (Spanish) 2010

    Microsoft Office Proofing (English) 2010

    Microsoft Office Publisher MUI (English) 2010

    Microsoft Office Shared 64-bit MUI (English) 2010

    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

    Microsoft Office Shared MUI (English) 2010

    Microsoft Office Shared Setup Metadata MUI (English) 2010

    Microsoft Office Word MUI (English) 2010

    Microsoft Security Client

    Microsoft Security Essentials

    Microsoft Silverlight

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Microsoft_VC80_ATL_x86

    Microsoft_VC80_ATL_x86_x64

    Microsoft_VC80_CRT_x86

    Microsoft_VC80_CRT_x86_x64

    Microsoft_VC80_MFC_x86

    Microsoft_VC80_MFC_x86_x64

    Microsoft_VC80_MFCLOC_x86

    Microsoft_VC80_MFCLOC_x86_x64

    Microsoft_VC90_ATL_x86

    Microsoft_VC90_ATL_x86_x64

    Microsoft_VC90_CRT_x86

    Microsoft_VC90_CRT_x86_x64

    Microsoft_VC90_MFC_x86

    Microsoft_VC90_MFC_x86_x64

    Microsoft_VC90_MFCLOC_x86

    Microsoft_VC90_MFCLOC_x86_x64

    Mozilla Firefox 20.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MuseScore 1.2 MuseScore score typesetter

    NetX360

    Novacomd

    OpenDNS Updater 2.2.1

    PDF Settings CS5

    PxMergeModule

    QuickTime

    RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

    SewArt

    Sibelius Scorch (Firefox, Opera, Netscape only)

    Skype Click to Call

    Skype™ 6.1

    SpiderOak

    Spybot - Search & Destroy

    Synaptics Pointing Device Driver

    Synthesia (remove only)

    The Retirement Analysis Kit

    TOSHIBA Supervisor Password

    TurboTax 2011

    TurboTax 2011 wcaiper

    TurboTax 2011 WinPerFedFormset

    TurboTax 2011 WinPerReleaseEngine

    TurboTax 2011 WinPerTaxSupport

    TurboTax 2011 wrapper

    UMPlayer 0.98 [P4]

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Update for Microsoft Office 2010 (KB2494150)

    Update for Microsoft Office 2010 (KB2553092)

    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

    Visual C++ 8.0 x64 Runtime Setup Package

    Visual C++ 8.0 x86 Runtime Setup Package

    VLC media player 2.0.5

    VLC Streamer 2.23

    Wilcom TrueSizer

    Windows Driver Package - Palm (WinUSB) Palm Devices (10/09/2009 1.0.1)

    ZoneAlarm LTD Toolbar

    .

    ==== Event Viewer Messages From Past Week ========

    .

    4/11/2013 2:53:59 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

    4/11/2013 2:52:54 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found.

    4/11/2013 2:52:52 PM, Error: Service Control Manager [7000] - The wntpport service failed to start due to the following error: The system cannot find the file specified.

    4/10/2013 2:09:13 PM, Error: volsnap [35] - The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.

    .

    ==== End Of File ===========================

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.