Jump to content

bnbn1382

Members
 View Profile  See their activity

  • Posts

    7

  • Joined

  • Last visited

 Content Type 

Posts posted by bnbn1382

    ATTACH: ESET Virus? & password auto copy

    in Resolved Malware Removal Logs

    Posted

    I was playing MapleStory game.

    I didn't realize until I accidently pressed Ctrl+P

    Everytime I try to log in, and put password, it auto copies.

    I don't know where it goes but here are the logs.

    Scanned both on Avira and Malwarebytes. Updated database.

    I ran quick scan too yesterday. No detection.

    Malwarebytes'

    Malwarebytes' Anti-Malware 1.50.1.1100

    www.malwarebytes.org

    Database version: 6336

    Windows 5.1.2600 Service Pack 3

    Internet Explorer 8.0.6001.18702

    2011-04-11 ?? 5:39:49

    mbam-log-2011-04-11 (17-39-49).txt

    Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|)

    Objects scanned: 273559

    Time elapsed: 52 minute(s), 29 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    DDS

    .

    DDS (Ver_11-03-05.01) - NTFSx86

    Run by xp at 22:02:15.75 on 2011-04-12

    Internet Explorer: 8.0.6001.18702

    Microsoft Windows XP Professional 5.1.2600.3.949.82.1033.18.3071.1733 [GMT -4:00]

    .

    AV: AntiVir Desktop *Enabled/Updated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

    AV: ESET Smart Security 4.2 *Enabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

    FW: ESET Personal firewall *Disabled*

    .

    ============== Running Processes ===============

    .

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost -k DcomLaunch

    svchost.exe

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\Program Files\Avira\AntiVir Desktop\sched.exe

    svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\RTHDCPL.EXE

    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files\Common Files\Java\Java Update\jusched.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe

    C:\WINDOWS\system32\hphmon04.exe

    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Steam\steam.exe

    C:\Program Files\nerds.de\ipMIDI Trial\IPMidiMon.exe

    C:\Program Files\Workspace Macro Pro 6.5\WMPHotkeys.exe

    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

    C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

    C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

    C:\WINDOWS\system32\svchost.exe -k imgsvc

    C:\Program Files\Mozilla Firefox 4.0 Beta 8\firefox.exe

    C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

    C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\HPHipm11.exe

    C:\WINDOWS\System32\svchost.exe -k HTTPFilter

    C:\WINDOWS\system32\wscntfy.exe

    C:\Program Files\Mozilla Firefox 4.0 Beta 8\plugin-container.exe

    C:\GMS\MapleStory\MapleStory.exe

    C:\Documents and Settings\xp\My Documents\????\dds.scr

    C:\WINDOWS\system32\conime.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = about:blank

    uInternet Settings,ProxyServer = http=;ftp=;https=;

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~4\office14\GROOVEEX.DLL

    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

    BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL

    BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    uRun: [steam] "c:\program files\steam\steam.exe" -silent

    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

    uRun: [Google Update] "c:\documents and settings\xp\local settings\application data\google\update\GoogleUpdate.exe" /c

    mRun: [igfxTray] c:\windows\system32\igfxtray.exe

    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

    mRun: [Persistence] c:\windows\system32\igfxpers.exe

    mRun: [RTHDCPL] RTHDCPL.EXE

    mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

    mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

    mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

    mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

    mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe

    mRun: [HPHmon04] c:\windows\system32\hphmon04.exe

    mRun: [HPHUPD04] "c:\program files\hp photosmart 11\hphinstall\unipatch\hphupd04.exe"

    mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

    dRunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32

    dRunOnce: [iE8] rundll32 advpack.dll,LaunchINFSection IE8.INF,FirstUserStart

    dRunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ipmidi~1.lnk - c:\program files\nerds.de\ipmidi trial\IPMidiMon.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\worksp~1.lnk - c:\program files\workspace macro pro 6.5\WMPHotkeys.exe

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000

    IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

    LSP: c:\program files\avira\antivir desktop\avsda.dll

    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab

    DPF: {39461460-2552-4D51-A062-3AB6A7B902E9} - hxxp://online.shbamerica.com/shttp/install/down/INIS70.cab

    DPF: {563DF2AD-1EB7-4C84-8DA8-52A0A134E30E} - hxxp://www.icantek.com/support/oem/activex/icsview.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

    DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.3.13.0.cab

    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

    DPF: {FE342FC7-4374-4EBE-86DB-D73AE861F779} - hxxp://cafe.naver.com/common/activex/NaverAXGuide.cab

    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

    Handler: s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - c:\program files\initech\shttp\InitechSHTTPInterface.10120.dll

    Name-Space Handler: http\s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - c:\program files\initech\shttp\InitechSHTTPInterface.10120.dll

    Notify: AtiExtEvent - Ati2evxx.dll

    Notify: igfxcui - igfxdev.dll

    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - c:\docume~1\xp\applic~1\mozilla\firefox\profiles\opzh9f1m.default\

    FF - prefs.js: browser.startup.homepage - hxxp://www.daum.net

    FF - plugin: c:\documents and settings\all users\application data\nexon\ngm\npNxGame.dll

    FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll

    FF - plugin: c:\documents and settings\xp\application data\mozilla\plugins\npgoogletalk.dll

    FF - plugin: c:\documents and settings\xp\application data\mozilla\plugins\npgtpo3dautoplugin.dll

    FF - plugin: c:\documents and settings\xp\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll

    FF - plugin: c:\progra~1\micros~4\office14\NPAUTHZ.DLL

    FF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLL

    FF - plugin: c:\program files\ahnlab\asp\components\aosmgr\conflict_377\npaosmgr.dll

    FF - plugin: c:\program files\ahnlab\asp\mykeydefense 2.5\npmkd25aos.dll

    FF - plugin: c:\program files\ahnlab\asp\mykeydefense 2.5\npmkd25sp.dll

    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

    FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll

    FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll

    .

    ============= SERVICES / DRIVERS ===============

    .

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-4-12 11608]

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-7-29 115008]

    R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\avira\antivir desktop\avmailc.exe [2011-4-12 339624]

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-4-12 135336]

    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-4-12 269480]

    R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\avira\antivir desktop\avwebgrd.exe [2011-4-12 421032]

    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-4-12 61960]

    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-9-25 363344]

    R2 NIHardwareService;NIHardwareService;c:\program files\common files\native instruments\hardware\NIHardwareService.exe [2010-10-19 3791872]

    R3 ipMIDI;nerds.de ipMIDI - Ethernet Midi Ports SvcDesc(WDM);c:\windows\system32\drivers\ipmidi.sys [2010-4-5 18688]

    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-9-25 20952]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 ekrn;ESET Service;"c:\program files\eset\eset smart security\ekrn.exe" --> c:\program files\eset\eset smart security\ekrn.exe [?]

    S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-11-13 1691480]

    S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2011-4-5 30312]

    S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]

    S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\eaglexnt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]

    S3 gbxavs;gbxavs;c:\windows\system32\drivers\gbxavs.sys [2011-2-10 35408]

    S3 gbxusb;gbxusb;c:\windows\system32\drivers\gbxusb.sys [2011-2-10 276432]

    S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208]

    S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [2010-12-11 142320]

    S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [2010-12-11 88944]

    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

    S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

    S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-4-5 96488]

    S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2011-4-5 12776]

    S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2011-4-5 121576]

    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    .

    =============== Created Last 30 ================

    .

    2011-04-12 21:08:13 -------- d-----w- c:\windows\system32\NtmsData

    2011-04-12 21:07:26 -------- d-----w- c:\docume~1\xp\applic~1\Avira

    2011-04-12 21:05:18 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys

    2011-04-12 21:05:16 -------- d-----w- c:\program files\Avira

    2011-04-12 21:05:16 -------- d-----w- c:\docume~1\alluse~1\applic~1\Avira

    2011-04-10 23:29:03 -------- d-----w- c:\docume~1\xp\locals~1\applic~1\AskToolbar

    2011-04-10 16:09:57 -------- d-----w- c:\program files\Ask.com

    2011-04-10 16:01:42 -------- d-----w- c:\program files\Bome's Midi Translator Classic

    2011-04-10 02:24:18 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{E63F6C18-0762-46E9-8101-206AFAF0E93A}

    2011-04-10 02:24:01 -------- d-----w- c:\program files\common files\Digidesign

    2011-04-10 02:23:47 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{BB25779E-744C-48F3-94DE-CD6F60A5AC55}

    2011-04-09 02:16:09 -------- d-----w- c:\docume~1\xp\locals~1\applic~1\WMTools Downloaded Files

    2011-04-09 02:03:31 -------- d-----w- C:\Fraps

    2011-04-08 22:34:18 -------- d-----w- c:\program files\Auto Mouse Mover

    2011-04-07 19:51:02 -------- d-----w- c:\docume~1\alluse~1\applic~1\IObit

    2011-04-07 19:51:00 -------- d-----w- c:\program files\IObit

    2011-04-06 13:26:57 -------- d-----w- c:\docume~1\alluse~1\applic~1\Firefly Studios

    2011-04-06 13:14:07 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll

    2011-04-06 13:14:07 251672 ----a-w- c:\windows\system32\xactengine2_5.dll

    2011-04-06 13:14:06 68888 ----a-w- c:\windows\system32\xinput1_3.dll

    2011-04-06 13:14:06 62744 ----a-w- c:\windows\system32\xinput1_2.dll

    2011-04-06 13:14:06 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

    2011-04-06 13:14:06 237848 ----a-w- c:\windows\system32\xactengine2_4.dll

    2011-04-06 13:14:06 236824 ----a-w- c:\windows\system32\xactengine2_3.dll

    2011-04-06 13:14:06 15128 ----a-w- c:\windows\system32\x3daudio1_1.dll

    2011-04-06 13:13:54 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll

    2011-04-06 13:10:29 -------- d-----w- c:\program files\Firefly Studios

    2011-04-05 17:30:55 12776 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys

    2011-04-05 17:30:55 121576 ----a-w- c:\windows\system32\drivers\ssadmdm.sys

    2011-04-05 17:30:55 10344 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys

    2011-04-05 17:30:54 96488 ----a-w- c:\windows\system32\drivers\ssadbus.sys

    2011-04-05 17:30:54 30312 ----a-w- c:\windows\system32\drivers\ssadadb.sys

    2011-04-05 17:30:54 10216 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys

    2011-04-05 17:29:55 14920 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys

    2011-04-05 17:29:55 132424 ----a-w- c:\windows\system32\drivers\sscdmdm.sys

    2011-04-05 17:29:55 12616 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys

    2011-04-05 17:29:55 12616 ----a-w- c:\windows\system32\drivers\sscdcm.sys

    2011-04-05 17:29:55 12488 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys

    2011-04-05 17:29:55 12488 ----a-w- c:\windows\system32\drivers\sscdwh.sys

    2011-04-05 17:29:55 104648 ----a-w- c:\windows\system32\drivers\sscdbus.sys

    2011-04-04 03:26:41 30592 -c--a-w- c:\windows\system32\dllcache\rndismpx.sys

    2011-04-04 03:26:41 30592 ----a-w- c:\windows\system32\drivers\rndismpx.sys

    2011-04-04 03:26:41 12800 -c--a-w- c:\windows\system32\dllcache\usb8023x.sys

    2011-04-04 03:26:41 12800 ----a-w- c:\windows\system32\drivers\usb8023x.sys

    2011-04-04 02:20:36 1416680 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01005.dll

    2011-04-04 02:20:36 10344 ----a-w- c:\windows\system32\drivers\ssadcm.sys

    2011-04-04 02:20:36 10216 ----a-w- c:\windows\system32\drivers\ssadwh.sys

    2011-04-04 02:20:19 -------- d-----w- c:\docume~1\alluse~1\applic~1\Samsung

    2011-04-04 02:19:56 -------- d-----w- c:\program files\Samsung

    2011-04-04 02:19:17 4659712 ----a-w- c:\windows\system32\Redemption.dll

    2011-04-04 02:19:16 770912 ----a-w- c:\windows\system32\Msfdbqp.dll

    2011-04-04 02:19:16 511328 ----a-w- c:\windows\system32\Synchronization2.dll

    2011-04-04 02:19:16 397152 ----a-w- c:\windows\system32\Msfdbse.dll

    2011-04-04 02:19:16 253280 ----a-w- c:\windows\system32\MetaStore2.dll

    2011-04-04 02:19:16 230240 ----a-w- c:\windows\system32\Msfdb.dll

    2011-04-04 02:19:16 189792 ----a-w- c:\windows\system32\SimpleProviders2.dll

    2011-04-04 02:19:16 171360 ----a-w- c:\windows\system32\FileSyncProvider2.dll

    2011-04-04 02:19:16 156512 ----a-w- c:\windows\system32\FeedSync2.dll

    2011-04-02 03:26:35 -------- d--h--w- c:\windows\PIF

    2011-03-29 01:13:53 -------- d-----w- c:\docume~1\xp\applic~1\NeopleLauncherDFO

    2011-03-22 01:02:00 -------- d-----w- c:\program files\Cheat Engine 6

    .

    ==================== Find3M ====================

    .

    2011-03-11 05:14:18 821824 ----a-w- c:\windows\system32\dgderapi.dll

    2011-02-22 06:38:44 86016 ----a-w- c:\windows\system32\frapsvid.dll

    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll

    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll

    2011-01-21 14:42:25 439808 ----a-w- c:\windows\system32\shimgvw.dll

    .

    ============= FINISH: 22:04:37.40 ===============

    Help me fast as possible. Infected with "Pinomate.exe"

    in Resolved Malware Removal Logs

    Posted

    I was using computer, and noticed how I could not shutdown my computer and how all programs gave errors when tried to start it up.

    I went to task manager, and found something called "pinomate.exe"

    I closed the process, and I looked on online and said:

    http://www.prevx.com/filenames/24776813834...NOMATE.EXE.html

    Is there anyway to remove this?

    Also does this malware have ability to steal passwords?(Keyloggers etc)

    Please say "NO" to this... I really can't change more than 50 different accounts with different passwords.

    PLEASE HELP ASAP :)

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.