new here, but following these steps: http://forums.malwarebytes.org/index.php?showtopic=9573 http://forums.malwarebytes.org/index.php?showtopic=132005 Here is the DDS Log: DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK Internet Explorer: 9.0.8112.16502Run by amissal at 13:50:13 on 2013-08-28Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.12286.11188 [GMT -7:00].AV: Symantec Endpoint Protection *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: Symantec Endpoint Protection *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}.============== Running Processes ===============.C:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\Explorer.EXEC:\Windows\system32\ctfmon.exeC:\Windows\helppane.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\System32\svchost.exe -k swprvC:\Windows\System32\cscript.exe.============== Pseudo HJT Report ===============.mWinlogon: Userinit = userinit.exe,BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLLBHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dllBHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLLBHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dlluRun: [sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe /autoRunuRunOnce: [mctadmin] C:\Windows\System32\mctadmin.exemRun: [soundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exemRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exemRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"mRun: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServicesmRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"mRun: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe"mRun: [symantec Backup Exec System Recovery 2010] "C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe"mRunOnce: [regV2iPlugin] regsvr32 /s "C:\Program Files (x86)\Common Files\Symantec Shared\RPAM\V2iPlugin.dll"mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silentmRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScriptStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLSY~1.LNK - C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SOLIDW~1.LNK - C:\Program Files (x86)\Common Files\SolidWorks Installation Manager\BackgroundDownloading\sldBgDwld.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\START3~1.LNK - C:\Program Files\3Dconnexion\3Dconnexion 3DxSoftware\3DxWare64\3dxsrv.exemPolicies-Explorer: NoActiveDesktop = dword:1mPolicies-System: ConsentPromptBehaviorAdmin = dword:5mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableUIADesktopToggle = dword:0mPolicies-System: DisableCAD = dword:1IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}TCP: NameServer = 192.168.174.238 192.168.174.237 192.168.176.162 192.168.176.182TCP: Interfaces\{08197393-19A4-40F6-B2DD-CAF84FAF0146} : DHCPNameServer = 192.168.174.238 192.168.174.237 192.168.176.162 192.168.176.182TCP: Interfaces\{E90819B2-67FD-44A2-9045-962B9AED62F0} : DHCPNameServer = 192.168.174.238 192.168.174.237 192.168.176.162 192.168.176.182Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLHandler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dllSSODL: WebCheck - <orphaned>SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLLLSA: Authentication Packages = msv1_0 wvauthx64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLLx64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllx64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLLx64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllx64-Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquietx64-Run: [Conisio Login Manager] "C:\PROGRA~1\SOLIDW~2\EDMSER~1.EXE" /runatloginx64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dllx64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dllx64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLx64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>x64-Notify: spba - C:\Program Files\Common Files\SPBA\homefus2.dllx64-SSODL: WebCheck - <orphaned>x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.============= SERVICES / DRIVERS ===============.R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-8-3 55856]R2 Symantec AntiVirus;Symantec Endpoint Protection;C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe [2011-11-13 1846592]S2 Backup Exec System Recovery;Backup Exec System Recovery;C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe [2009-10-1 4585312]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 dcpsysmgrsvc;Dell System Manager Service;C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe [2010-8-24 517488]S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-8-3 13336]S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2010-4-30 6237800]S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [2010-10-5 87336]S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-8-28 140376]S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-10-17 1431888]S3 GenericMount Helper Service;GenericMount Helper Service;C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelper.exe [2009-9-21 1571336]S3 GenericMount;Generic Mount Driver;C:\Windows\System32\drivers\GenericMount.sys [2009-9-21 54320]S3 netvsc;netvsc;C:\Windows\System32\drivers\netvsc60.sys [2010-11-21 168448]S3 OracleOraClient11g_home1CMAdmin;OracleOraClient11g_home1CMAdmin;C:\app\jbrookbank\product\11.2.0\client_2\BIN\CMADMIN.EXE [2011-8-18 745472]S3 OracleOraClient11g_home1CMan;OracleOraClient11g_home1CMan;C:\app\jbrookbank\product\11.2.0\client_2\BIN\CMGW.EXE [2011-8-18 229376]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-11-20 19456]S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;C:\Windows\System32\dllhost.exe [2009-7-13 9728]S3 SymSnapService;SymSnapService;C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe [2009-9-21 2963960]S3 SynthVid;SynthVid;C:\Windows\System32\drivers\VMBusVideoM.sys [2010-11-21 22528]S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-11-20 57856]S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2012-11-20 30208]S3 vcredist_x64;vcredist_x64;C:\BROWSE~1\MFC_files\vcredist_x64.exe --> C:\BROWSE~1\MFC_files\vcredist_x64.exe [?]S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184].=============== Created Last 30 ================.2013-08-28 16:46:22 -------- d-----w- C:\Users\amissal\AppData\Roaming\Malwarebytes2013-08-28 16:46:13 -------- d-----w- C:\ProgramData\Malwarebytes2013-08-28 16:46:12 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys2013-08-28 16:46:12 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2013-08-28 16:46:00 -------- d-----w- C:\Users\amissal\AppData\Local\Programs2013-08-28 12:51:27 -------- d-----w- C:\ProgramData\d7DaaU7X2013-08-20 08:15:50 2048 ----a-w- C:\Windows\SysWow64\tzres.dll2013-08-20 08:15:50 2048 ----a-w- C:\Windows\System32\tzres.dll2013-08-20 08:08:06 -------- d-----w- C:\Windows\System32\MRT2013-08-20 08:01:25 30720 ----a-w- C:\Windows\System32\cryptdlg.dll2013-08-20 08:01:25 24576 ----a-w- C:\Windows\SysWow64\cryptdlg.dll2013-08-20 08:01:20 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll2013-08-20 08:01:20 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll2013-08-20 08:00:56 1887232 ----a-w- C:\Windows\System32\d3d11.dll2013-08-20 08:00:56 1505280 ----a-w- C:\Windows\SysWow64\d3d11.dll2013-08-15 08:09:18 139776 ----a-w- C:\Windows\System32\cryptnet.dll2013-08-15 08:09:17 184320 ----a-w- C:\Windows\System32\cryptsvc.dll2013-08-15 08:09:17 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll2013-08-15 08:09:17 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll2013-08-15 08:09:16 224256 ----a-w- C:\Windows\System32\wintrust.dll2013-08-15 08:09:16 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll2013-08-15 08:09:16 1472512 ----a-w- C:\Windows\System32\crypt32.dll2013-08-15 08:09:16 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll2013-08-15 08:05:43 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL2013-08-15 08:05:43 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL2013-08-15 08:04:41 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll2013-08-15 08:04:41 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll2013-08-15 08:00:31 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb.==================== Find3M ====================.2013-07-25 03:37:25 2312704 ----a-w- C:\Windows\System32\jscript9.dll2013-07-25 03:30:49 1392128 ----a-w- C:\Windows\System32\wininet.dll2013-07-25 03:29:41 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl2013-07-25 03:28:46 173056 ----a-w- C:\Windows\System32\ieUnatt.exe2013-07-25 03:28:31 599040 ----a-w- C:\Windows\System32\vbscript.dll2013-07-25 03:27:20 2382848 ----a-w- C:\Windows\System32\mshtml.tlb2013-07-25 02:32:35 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll2013-07-25 02:26:10 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll2013-07-25 02:25:30 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl2013-07-25 02:23:59 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe2013-07-25 02:23:58 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll2013-07-09 06:03:30 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe2013-07-09 05:54:22 1732032 ----a-w- C:\Windows\System32\ntdll.dll2013-07-09 05:53:12 243712 ----a-w- C:\Windows\System32\wow64.dll2013-07-09 05:03:34 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe2013-07-09 05:03:34 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe2013-07-09 04:53:47 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll2013-07-09 04:52:33 5120 ----a-w- C:\Windows\SysWow64\wow32.dll2013-07-09 04:45:07 44032 ----a-w- C:\Windows\apppatch\acwow64.dll2013-07-09 02:49:42 25600 ----a-w- C:\Windows\SysWow64\setup16.exe2013-07-09 02:49:41 7680 ----a-w- C:\Windows\SysWow64\instnm.exe2013-07-09 02:49:39 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll2013-07-09 02:49:38 2048 ----a-w- C:\Windows\SysWow64\user.exe2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys2013-06-15 04:32:16 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys2013-06-05 03:34:27 3153920 ----a-w- C:\Windows\System32\win32k.sys2013-06-04 06:00:13 624128 ----a-w- C:\Windows\System32\qedit.dll2013-06-04 04:53:07 509440 ----a-w- C:\Windows\SysWow64\qedit.dll.============= FINISH: 13:50:17.67 =============== No Attach file because it says not to post it unless specifically asked for it The RogueKiller64 Log: RogueKiller V8.6.7 _x64_ [Aug 28 2013] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.adlice.com/forum/Website : http://www.adlice.com/softwares/roguekiller/Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Safe mode with network supportUser : amissal [Admin rights]Mode : Scan -- Date : 08/28/2013 13:56:52| ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 5 ¤¤¤[RUN][sUSP PATH] HKUS\S-1-5-21-2629721653-3217561959-3569617690-3290\[...]\Run : AS2014 (C:\ProgramData\d7DaaU7X\d7DaaU7X.exe [x]) -> FOUND[RUN][ZeroAccess] HKUS\S-1-5-21-2629721653-3217561959-3569617690-3290\[...]\Run : Google Update ("C:\Users\jbrookbank\AppData\Local\Google\Desktop\Install\{75bcf01a-41a3-b52f-5f48-8ab809ea9370}\???\???\???๛\{75bcf01a-41a3-b52f-5f48-8ab809ea9370}\GoogleUpdate.exe" >) -> FOUND[RUN][sUSP PATH] HKLM\[...]\Wow6432Node\[...]\RunOnce : Malwarebytes Anti-Malware (cleanup) (rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [x][7][x]) -> FOUND[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤--> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD2500AAKX-753CA1 +++++--- User ---[MBR] 552ae5bae58b5e7a9ed9581680c255bd[bSP] 2dfa851a71cb3d932cd438f3fdc85c0d : Windows Vista MBR CodePartition table:0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 750 Mo2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1617920 | Size: 237684 MoUser = LL1 ... OK!User = LL2 ... OK! +++++ PhysicalDrive1: WDC WD2500AAKX-753CA1 +++++--- User ---[MBR] 58c5d33ec061363e5a22eb6c3088c5cf[bSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR CodePartition table:0 - [ACTIVE] FAT32 (0x0b) [VISIBLE] Offset (sectors): 8064 | Size: 7494 MoUser = LL1 ... OK!Error reading LL2 MBR! Finished : << RKreport[0]_S_08282013_135652.txt >>
