new threat after av protection 2011 removal

ineedhelp11 · November 26, 2011

this is too weird to me coincidence. i got hitted by av protection 2011 first then used malewarebytes to scan and detect the maleware files and used microsoft fixit but then i got hitted by piracy protection and is scanning system now. what the hells going on? when are these hits gonna stop?

ineedhelp11 · November 27, 2011

ok, after i got rid of piracy protection, i got something new and more malicious.

this malewares called windows 7 internet security 2012. it changed my malewarebytes icon to open the maleware windows when clicked upon.

the file name for this malware under task manager box is called lfu.exe*32.

i'm writing this in safe mode. i'm also redownloaded malewarebytes in safe mode and going to scan in safe mode and see what happens.

i perviously rid of the malewares in normal mode. does this make that much different when you don't scan in safe mode?

please advise on what else i need to do to stop the frequency of these maleware hits that started recently.

ineedhelp11 · November 27, 2011

ok, requesting serious help. i can't install malewarebytes even in safe mode with networking. when i try to open malewarebyte, it opens the windows 7 internet security 2012 page ,which is the maleware.

i can't scan if i can't install, please help.

ineedhelp11 · November 27, 2011

nevermind, i resolved it. i located the source from task manager and delete it in the app folder. i installed malewarebytes and scanned and found some maleware files, delete them and restarted and everything seemed alright.

but a little while ago, some maleware sneaked into my system again called windows 7 antispyware 2012 and its associated file name in task manager is nmk.exe*32.

i located the source from task manager and deleted it again and pop-up recurrence stopped.

can somebody help me put an end to these hits, its getting annoying?

ineedhelp11 · November 27, 2011

they were in appdata/local folder both cases.

need to kill the backdoor agents...

ineedhelp11 · November 27, 2011

i had a couple times where pc auto-shuts down. my systems already been scanned with malwarebyte. were thess caused by some backdoor agent?

screen317 · December 3, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

ineedhelp11 · December 8, 2011

mbam:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8331

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

12/8/2011 12:16:52 AM

mbam-log-2011-12-08 (00-16-20).txt

Scan type: Quick scan

Objects scanned: 229402

Time elapsed: 7 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 7

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\founder7231\AppData\Local\Temp\115.8504.exe (Trojan.FakeMS) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\dcm.dll (Trojan.FakeMS) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\lkdoqtzida (Trojan.FakeMS) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\utc.dll (Trojan.FakeMS) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\zglqqqjueu (Trojan.FakeMS) -> No action taken.

c:\Users\founder7231\local settings\temporary internet files\Content.IE5\F1986WGL\file[1].exe (Trojan.FakeMS) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\0.9114157549241122.exe (Exploit.Drop.2) -> No action taken.

dss:

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by founder7231 at 0:17:21 on 2011-12-08

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.2382 [GMT -5:00]

.

AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe

C:\Program Files (x86)\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe

C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe

C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe

C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

C:\Windows\system32\svchost.exe -k regsvc

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\ping.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe -k defragsvc

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=et1831&r=173605102216p04g5v145r45n1s44o

mDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&m=et1831&r=173605102216p04g5v145r45n1s44o

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll

mWinlogon: Userinit=userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\IPSBHO.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Updater For Simppull Toolbar: {c4b8bab4-1667-11df-a242-ba9455d89593} - C:\Program Files (x86)\simppulltoolbar\auxi\simppulltoolbAu.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO: WeCareReminder Class: {d824f0de-3d60-4f57-9eb1-66033ecd8abb} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No File

BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

BHO: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll

BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - C:\Program Files (x86)\Yontoo Layers\YontooIEClient.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll

TB: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll

TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [Google Update] "C:\Users\founder7231\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [msnmsgr] ~"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1

uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe

mRun: [inCD] C:\Program Files (x86)\Ahead\InCD\InCD.exe

mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [<NO NAME>]

mRun: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

mRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

StartupFolder: C:\Users\FOUNDE~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-explorer: HideSCAHealth = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

LSP: mswsock.dll

DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{DBA49E91-4F47-4D6F-A324-9758D022C244} : DhcpNameServer = 192.168.1.1 192.168.1.1

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

Notify: klartew - C:\Windows\system32\config\systemprofile\AppData\Local\klartew.dll

SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO-X64: 0x1 - No File

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

BHO-X64: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

BHO-X64: Symantec NCO BHO - No File

BHO-X64: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\IPSBHO.DLL

BHO-X64: Symantec Intrusion Prevention - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Updater For Simppull Toolbar: {C4B8BAB4-1667-11DF-A242-BA9455D89593} - C:\Program Files (x86)\simppulltoolbar\auxi\simppulltoolbAu.dll

BHO-X64: Updater For Simppull Toolbar - No File

BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO-X64: WeCareReminder Class: {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll

BHO-X64: WeCareReminder - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No File

BHO-X64: SweetIM Toolbar Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

BHO-X64: SWEETIE - No File

BHO-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll

BHO-X64: Yontoo Layers: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers\YontooIEClient.dll

BHO-X64: Yontoo Layers - No File

TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll

TB-X64: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll

TB-X64: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll

TB-X64: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun-x64: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun-x64: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"

mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe

mRun-x64: [inCD] C:\Program Files (x86)\Ahead\InCD\InCD.exe

mRun-x64: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

mRun-x64: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [(Default)]

mRun-x64: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

mRun-x64: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

mRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

mRunOnce-x64: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\founder7231\AppData\Roaming\Mozilla\Firefox\Profiles\qaf8rdjb.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=BABTDF&PC=BBLN&q=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=937811&p=

FF - prefs.js: network.proxy.type - 4

FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll

FF - component: C:\Users\founder7231\AppData\Roaming\Mozilla\Firefox\Profiles\qaf8rdjb.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPAdbESD.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: C:\Users\founder7231\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Users\founder7231\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Users\founder7231\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

============= SERVICES / DRIVERS ===============

.

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1008000.029\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1008000.029\SYMEFA64.SYS [?]

R1 BHDrvx64;Symantec Heuristics Driver;C:\Windows\system32\Drivers\NISx64\1008000.029\BHDrvx64.sys --> C:\Windows\system32\Drivers\NISx64\1008000.029\BHDrvx64.sys [?]

R1 ccHP;Symantec Hash Provider;C:\Windows\system32\Drivers\NISx64\1008000.029\ccHPx64.sys --> C:\Windows\system32\Drivers\NISx64\1008000.029\ccHPx64.sys [?]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100518.002\IDSviA64.sys [2010-5-24 463408]

R2 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2011-5-29 401920]

R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-6-6 45912]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast4\ashServ.exe [2010-6-6 132736]

R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-6-15 249648]

R2 Greg_Service;GRegService;C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [2009-8-28 1150496]

R2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;C:\Program Files (x86)\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [2009-3-12 86016]

R2 mi-raysat_3dsmax2010_64;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit;C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe [2009-3-12 86016]

R2 mi-raysat_3dsmax2012_64;mental ray 3.9 Satellite for Autodesk 3ds Max 2012 64-bit - English 64-bit;C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe [2011-2-22 86016]

R2 Norton Internet Security;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe [2010-5-24 117640]

R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-8-9 2255464]

R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]

R2 Updater Service;Updater Service;C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [2009-10-29 240160]

R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2010-6-6 243328]

R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2010-6-6 345728]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-5-10 135664]

S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-7-7 195336]

S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-7-2 1431888]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-5-10 135664]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 SYMNDISV;Symantec Network Filter Driver;C:\Windows\system32\Drivers\NISx64\1008000.029\SYMNDISV.SYS --> C:\Windows\system32\Drivers\NISx64\1008000.029\SYMNDISV.SYS [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== File Associations ===============

.

.exe=ah

.

=============== Created Last 30 ================

.

2011-12-08 03:01:50 -------- d-----w- C:\Users\founder7231\AppData\Local\{546F7082-20CA-458D-9FB3-2503AE2514B1}

2011-12-08 03:01:39 -------- d-----w- C:\Users\founder7231\AppData\Local\{6AC4D03D-540E-4397-AF00-E643DC75F5A3}

2011-12-05 06:05:36 -------- d-----w- C:\Users\founder7231\AppData\Local\{B127E439-F4E3-4950-ABC7-13FA6594DAD5}

2011-12-05 05:20:30 -------- d-----w- C:\Users\founder7231\AppData\Local\{839D3B33-794A-458E-96AC-858BD4CF111B}

2011-12-05 05:20:19 -------- d-----w- C:\Users\founder7231\AppData\Local\{EF4BD751-0002-4E30-9A13-7881E4CA05A9}

2011-12-05 04:35:31 -------- d-----w- C:\Users\founder7231\AppData\Local\{B8FCDF4C-3345-499C-8288-4AFAEE16AD92}

2011-12-05 04:35:20 -------- d-----w- C:\Users\founder7231\AppData\Local\{02D387DD-CA93-411C-A67E-9C8147570C31}

2011-12-04 02:46:12 -------- d-----w- C:\Users\founder7231\AppData\Local\{DD3AC634-1AC5-4E8B-88F1-B37CF5AAD3F4}

2011-12-04 02:46:02 -------- d-----w- C:\Users\founder7231\AppData\Local\{2A556394-CADF-4A68-BA4B-3986099D9884}

2011-12-03 21:04:31 -------- d-----w- C:\Users\founder7231\AppData\Local\{7EE6E3EF-DC0A-4BD8-82B4-A68429AE9B08}

2011-12-03 06:33:56 -------- d-----w- C:\Users\founder7231\AppData\Local\{FC755AA7-8384-441B-96D6-F28C631D057C}

2011-12-03 06:33:45 -------- d-----w- C:\Users\founder7231\AppData\Local\{FD06F1C5-0721-4B3B-B7B9-90EDC564804C}

2011-12-03 05:14:49 -------- d-----w- C:\Users\founder7231\AppData\Local\{62904A82-4122-409F-86F3-1BDE25731283}

2011-12-03 05:14:37 -------- d-----w- C:\Users\founder7231\AppData\Local\{D7DE7DC4-38AC-4B89-85F2-D8F17F28078C}

2011-12-02 06:20:34 -------- d-----w- C:\Users\founder7231\AppData\Local\{F39720B5-8871-4262-8A56-75C8711DD8A5}

2011-12-02 06:20:23 -------- d-----w- C:\Users\founder7231\AppData\Local\{1FB0C8EA-0265-4C2C-977A-E321D5D192E5}

2011-12-02 05:30:00 -------- d-----w- C:\Users\founder7231\AppData\Local\{270DDCFF-7256-4534-B916-697411A05FF0}

2011-12-02 05:29:49 -------- d-----w- C:\Users\founder7231\AppData\Local\{69ADFFC7-0852-45C6-8DB8-430F9F7B42E2}

2011-12-01 22:31:23 -------- d-----w- C:\Users\founder7231\AppData\Local\{2E1192A6-FCD2-4795-877C-C4FE2A09AE1C}

2011-12-01 22:31:13 -------- d-----w- C:\Users\founder7231\AppData\Local\{C0124C77-2D5B-4860-853A-17F0445DAABB}

2011-12-01 12:44:51 -------- d-----w- C:\Users\founder7231\AppData\Local\{568E0090-9E16-4D23-8918-D9455B7FF717}

2011-12-01 04:48:57 -------- d-sh--w- C:\found.001

2011-12-01 01:59:30 -------- d-----w- C:\Users\founder7231\AppData\Local\{59E1EB4A-9ABF-4440-BDA0-845F05B1B40A}

2011-12-01 01:51:30 -------- d-----w- C:\Users\founder7231\AppData\Local\{AA44DCDA-FEDF-460D-B133-4A396B3C6A1A}

2011-12-01 00:16:54 -------- d-sh--w- C:\found.000

2011-11-30 23:44:21 -------- d-----w- C:\Users\founder7231\AppData\Local\{45E5942F-88B6-4B21-9D8B-1473C29DB1FC}

2011-11-30 23:44:07 -------- d-----w- C:\Users\founder7231\AppData\Local\{C340F6DA-BE7A-477F-9B70-7987AEBE832B}

2011-11-30 23:28:30 -------- d-----w- C:\Users\founder7231\AppData\Local\{340DA7F4-EECD-47E5-B174-23A1C63F05C8}

2011-11-29 22:56:57 -------- d-----w- C:\Users\founder7231\AppData\Local\{76692C07-9F72-4C21-8AE7-AF93487AC004}

2011-11-29 22:56:46 -------- d-----w- C:\Users\founder7231\AppData\Local\{E54B14D1-1CBA-4948-BAF6-D1E10A2ACC78}

2011-11-28 22:23:09 -------- d-----w- C:\Users\founder7231\AppData\Local\{8B1306DA-6D92-428D-8ED0-82C5C05BF57F}

2011-11-28 22:22:59 -------- d-----w- C:\Users\founder7231\AppData\Local\{99DBE7AB-2168-4693-8B42-01C73D6CB005}

2011-11-28 20:29:15 -------- d-----w- C:\Users\founder7231\AppData\Local\{33CCCDD8-7EC6-47AA-84D4-E6B373E65366}

2011-11-28 20:29:04 -------- d-----w- C:\Users\founder7231\AppData\Local\{139FE20D-4428-4489-8E06-947683F26839}

2011-11-27 03:03:53 -------- d-----w- C:\Users\founder7231\AppData\Local\{50067468-B9E9-48FF-9508-70B11D4648ED}

2011-11-27 03:03:43 -------- d-----w- C:\Users\founder7231\AppData\Local\{AC0D1FB8-8337-4166-8927-51B08B0EA17F}

2011-11-27 03:00:19 -------- d-----w- C:\Users\founder7231\AppData\Local\{97B2383E-3B79-4993-8FA5-289FEED88A63}

2011-11-27 02:29:16 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-11-27 01:32:43 -------- d-----w- C:\Users\founder7231\AppData\Local\{3AFF129B-8677-4403-AD41-BCDA7FBA8066}

2011-11-27 01:08:28 -------- d-----w- C:\Users\founder7231\AppData\Local\{1977E70C-E616-4B18-9BF4-2CA89E3B47E7}

2011-11-27 01:00:29 -------- d-----w- C:\Users\founder7231\AppData\Local\{1ED66661-9688-46FC-8E75-03D92689224E}

2011-11-27 01:00:17 -------- d-----w- C:\Users\founder7231\AppData\Local\{954BD340-28F2-43E6-8B32-8158A811F380}

2011-11-26 20:15:37 -------- d-----w- C:\Users\founder7231\AppData\Local\{4F710B64-BB2B-489D-9710-4C51166C83AC}

2011-11-26 20:15:23 -------- d-----w- C:\Users\founder7231\AppData\Local\{84925C6A-78C3-45CE-AF14-73D9F2389BCB}

2011-11-26 08:55:10 -------- d-----w- C:\Users\founder7231\AppData\Local\{EE52BC06-7A93-4CDA-ACC5-601F8C9A36C1}

2011-11-26 08:54:07 -------- d-----w- C:\Users\founder7231\AppData\Local\{ABB42E49-3F02-4110-895C-A4C6120FE0B0}

2011-11-26 08:25:43 -------- d-----w- C:\Program Files (x86)\FEB9F

2011-11-26 03:45:50 -------- d-----w- C:\Users\founder7231\AppData\Local\{054CA38C-D37D-497E-A8B9-DD3085EA224B}

2011-11-26 03:45:48 -------- d-----w- C:\Users\founder7231\AppData\Local\{053DF7F5-4F91-4F92-83E6-4C8F2DFB39A7}

2011-11-25 06:16:11 -------- d-----w- C:\Users\founder7231\AppData\Roaming\Z33oonF4a

2011-11-25 06:16:11 -------- d-----w- C:\Users\founder7231\AppData\Roaming\AmmmH55sWJ7E

2011-11-25 06:16:06 -------- d-----w- C:\Users\founder7231\AppData\Roaming\OivvDD3onF4aH5W

2011-11-25 06:16:04 -------- d-----w- C:\Users\founder7231\AppData\Roaming\PrrzzONNtx0uc2i

2011-11-25 06:16:04 -------- d-----w- C:\Users\founder7231\AppData\Roaming\eGG55aQHHdWK7R9

2011-11-24 04:28:33 -------- d-----w- C:\Users\founder7231\AppData\Roaming\dUCelIPNy1v2

2011-11-24 04:28:33 -------- d-----w- C:\Users\founder7231\AppData\Roaming\BpmG5aQJ6W

2011-11-24 03:42:18 -------- d-----w- C:\amv convert

2011-11-24 03:30:22 -------- d-----w- C:\Users\founder7231\AppData\Local\{51B0A5D5-911F-4C70-A5BD-11B852916349}

2011-11-24 03:30:12 -------- d-----w- C:\Users\founder7231\AppData\Local\{0F87A4AD-7A37-4C2A-94D3-DCE7BFC569B8}

2011-11-22 00:55:48 -------- d-----w- C:\Users\founder7231\AppData\Local\{1A6A8873-4140-42F1-A670-1AEC11A7D145}

2011-11-22 00:55:37 -------- d-----w- C:\Users\founder7231\AppData\Local\{A1F887E9-9EB4-4923-AAE3-10EE1F70897D}

2011-11-21 06:05:15 -------- d-----w- C:\Users\founder7231\AppData\Local\{A0247D39-B9F0-4573-9FFA-0CB737FE470B}

2011-11-21 06:05:05 -------- d-----w- C:\Users\founder7231\AppData\Local\{E3A73508-337C-40E3-A971-32ACF7B6B847}

2011-11-21 04:31:36 -------- d-----w- C:\Program Files (x86)\LP

2011-11-21 04:26:49 -------- d-----w- C:\Users\founder7231\AppData\Roaming\FEB9F

2011-11-21 04:26:15 -------- d-----w- C:\Users\founder7231\AppData\Roaming\B4CFE

2011-11-21 04:26:13 -------- d-----w- C:\Users\founder7231\AppData\Roaming\BsssQJJ6dK

2011-11-21 04:26:12 -------- d-----w- C:\Users\founder7231\AppData\Roaming\zccAA1uvD2ob4pG

2011-11-21 04:26:09 -------- d-----w- C:\Users\founder7231\AppData\Roaming\ozzONyyxA0uv2iF

2011-11-21 04:26:07 -------- d-----w- C:\Users\founder7231\AppData\Roaming\uJJJ77dEK8gR

2011-11-21 04:26:07 -------- d-----w- C:\Users\founder7231\AppData\Roaming\oPPNNyccA1u

2011-11-21 04:25:42 -------- d-----we C:\Windows\system64

2011-11-20 23:06:57 -------- d-----w- C:\Users\founder7231\AppData\Local\{A5B45029-7FD3-451C-89B2-499BE009747E}

2011-11-20 23:06:47 -------- d-----w- C:\Users\founder7231\AppData\Local\{70C977AC-5EAB-4F65-BDC6-560D29F57E0E}

2011-11-20 05:07:00 -------- d-----w- C:\Users\founder7231\AppData\Local\{628B09A7-9E36-4782-BA76-5157EEB9B8B6}

2011-11-20 05:06:49 -------- d-----w- C:\Users\founder7231\AppData\Local\{2C15D511-EE7D-4A5A-98E2-3402BA9F3F6E}

2011-11-20 04:21:52 -------- d-----w- C:\Users\founder7231\AppData\Local\{04111364-CFA4-4CFC-B484-64E884E3EE45}

2011-11-20 04:21:41 -------- d-----w- C:\Users\founder7231\AppData\Local\{374FD8A5-4186-4665-A408-0F5C894175D3}

2011-11-19 07:42:03 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A38FB65C-1A7D-4EA3-B7DA-6644DB0A6C42}\mpengine.dll

2011-11-19 07:37:18 -------- d-----w- C:\Users\founder7231\AppData\Local\{78DF5E65-8674-4ED5-B097-2ACC7F81FA01}

2011-11-19 07:37:05 -------- d-----w- C:\Users\founder7231\AppData\Local\{AB3A057F-3A3A-4E52-9038-4C372EA9D68F}

2011-11-17 03:41:27 -------- d-----w- C:\Users\founder7231\AppData\Local\{95CE71F2-6FEE-4649-B589-A7A9F46BD34F}

2011-11-17 03:41:17 -------- d-----w- C:\Users\founder7231\AppData\Local\{5CB8717C-844D-4E8D-9ADC-70982B518586}

2011-11-16 02:33:58 -------- d-----w- C:\Users\founder7231\AppData\Local\{8C496FFB-261C-40BE-A59C-032E24D268A7}

2011-11-16 02:33:47 -------- d-----w- C:\Users\founder7231\AppData\Local\{F5E14D19-4DB4-4CF2-AD7B-8936B982CB8A}

2011-11-14 00:23:16 -------- d-----w- C:\Users\founder7231\AppData\Local\{893DC89A-C2D2-4EDA-9ED7-898B941B84C5}

2011-11-14 00:23:06 -------- d-----w- C:\Users\founder7231\AppData\Local\{9F993F26-AC53-475A-81D9-CB7F65CE14F4}

2011-11-11 00:55:58 -------- d-----w- C:\Users\founder7231\AppData\Local\{667A281D-40F0-40F9-B66B-4467AFAE2E87}

2011-11-11 00:55:48 -------- d-----w- C:\Users\founder7231\AppData\Local\{9CB361C0-8714-4213-BA9A-268386698B8D}

2011-11-11 00:52:12 -------- d-----w- C:\Users\founder7231\AppData\Local\{858685B3-38EF-4DB8-A70A-6EE56143AB72}

2011-11-11 00:52:01 -------- d-----w- C:\Users\founder7231\AppData\Local\{05E0A0BB-C3D0-4A8C-9A9E-2A25F8AA82CE}

2011-11-09 20:46:39 -------- d-----w- C:\Users\founder7231\AppData\Local\{2A93670A-C40C-4781-9F7F-0B6F5AD18A98}

2011-11-09 20:46:28 -------- d-----w- C:\Users\founder7231\AppData\Local\{0CC55135-97FE-4B1A-8AF6-C05C3E218DA0}

2011-11-09 20:22:15 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll

2011-11-09 20:22:15 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll

2011-11-09 20:22:11 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-11-09 20:22:07 3144704 ----a-w- C:\Windows\System32\win32k.sys

2011-11-09 03:44:02 -------- d-----w- C:\Users\founder7231\AppData\Local\{D789EEEE-609B-4016-A68E-C56B179D5B23}

2011-11-09 03:43:50 -------- d-----w- C:\Users\founder7231\AppData\Local\{74B11D46-0534-476A-B268-0B6BFE4A79CB}

.

==================== Find3M ====================

.

2006-05-03 16:06:54 163328 --sha-r- C:\Windows\SysWOW64\flvDX.dll

2007-02-21 17:47:16 31232 --sha-r- C:\Windows\SysWOW64\msfDX.dll

2008-03-16 19:30:52 216064 --sha-r- C:\Windows\SysWOW64\nbDX.dll

2010-01-07 04:00:00 107520 --sha-r- C:\Windows\SysWOW64\TAKDSDecoder.dll

.

============= FINISH: 0:18:18.92 ===============

please get back to me asap. thanks!

ineedhelp11 · December 8, 2011

something weird happened recently. i was able to run mbam and dds. but whenever i click the mbam icon, it would prompt installation and avast anti- virus icon is offline as well. i reinstalled mbam before and after scan and restart, i'm back to windows and i can't open mbam and it prompts installation again.

can you advice on how to fix these problems?

ineedhelp11 · December 9, 2011

i resolved apps not opening problem when i scanned in safe mode.

following is report:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8336

Windows 6.1.7601 Service Pack 1 (Safe Mode)

Internet Explorer 9.0.8112.16421

12/8/2011 8:01:49 PM

mbam-log-2011-12-08 (20-01-35).txt

Scan type: Quick scan

Objects scanned: 228433

Time elapsed: 3 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\AH (Rogue.MultipleAV) -> No action taken.

Registry Values Infected:

HKEY_CLASSES_ROOT\ah\Content Type (Rogue.MultipleAV) -> Value: Content Type -> No action taken.

Registry Data Items Infected:

HKEY_CLASSES_ROOT\.exe\(default) (PUM.HijackExefiles) -> Bad: (ah) Good: (exefile) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\founder7231\AppData\Local\Temp\ayhinkiqcq (Trojan.FakeAlert) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\gcc.dll (Trojan.FakeAlert) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\mnu.dll (Trojan.Agent) -> No action taken.

c:\Users\founder7231\AppData\Local\Temp\oakiwnehaz (Trojan.Agent) -> No action taken.

screen317 · December 13, 2011

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

ineedhelp11 · December 13, 2011

ComboFix 11-12-12.02 - founder7231 12/12/2011 21:49:54.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.1505 [GMT -5:00]

Running from: c:\users\founder7231\Downloads\ComboFix.exe

AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\LP

c:\program files (x86)\Search Toolbar

c:\program files (x86)\Search Toolbar\icon.ico

c:\program files (x86)\Search Toolbar\SearchToolbar.dll

c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe

c:\program files (x86)\Search Toolbar\SearchToolbarUpdater.exe

c:\programdata\Tarma Installer

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico

c:\users\founder7231\AppData\Roaming\AmmmH55sWJ7E

c:\users\founder7231\AppData\Roaming\AmmmH55sWJ7E\Cloud AV 2012.ico

c:\users\founder7231\AppData\Roaming\Mozilla\Firefox\Profiles\qaf8rdjb.default\searchplugins\bing-zugo.xml

c:\windows\system32\consrv.dll

c:\windows\System64

.

((((((((((((((((((((((((( Files Created from 2011-11-13 to 2011-12-13 )))))))))))))))))))))))))))))))

.

2011-12-13 03:05 . 2011-12-13 03:05 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2011-12-13 03:05 . 2011-12-13 03:05 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-12-13 03:05 . 2011-12-13 03:05 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-12-08 06:36 . 2011-12-11 07:58 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-12-01 04:48 . 2011-12-01 04:48 -------- d-----w- C:\found.001

2011-12-01 01:42 . 2011-12-01 01:43 -------- d-----w- c:\users\TEMP

2011-12-01 00:16 . 2011-12-01 00:16 -------- d-----w- C:\found.000

2011-11-27 02:54 . 2011-11-27 02:54 -------- d-----w- c:\users\Guest\AppData\Roaming\Malwarebytes

2011-11-26 08:25 . 2011-11-26 08:25 -------- d-----w- c:\program files (x86)\FEB9F

2011-11-25 06:16 . 2011-11-25 06:16 -------- d-----w- c:\users\founder7231\AppData\Roaming\Z33oonF4a

2011-11-25 06:16 . 2011-11-25 06:16 -------- d-----w- c:\users\founder7231\AppData\Roaming\OivvDD3onF4aH5W

2011-11-25 06:16 . 2011-11-25 06:31 -------- d-----w- c:\users\founder7231\AppData\Roaming\PrrzzONNtx0uc2i

2011-11-25 06:16 . 2011-11-25 06:16 -------- d-----w- c:\users\founder7231\AppData\Roaming\eGG55aQHHdWK7R9

2011-11-24 04:28 . 2011-11-24 04:28 -------- d-----w- c:\users\founder7231\AppData\Roaming\dUCelIPNy1v2

2011-11-24 04:28 . 2011-11-24 04:28 -------- d-----w- c:\users\founder7231\AppData\Roaming\BpmG5aQJ6W

2011-11-24 03:42 . 2011-11-24 04:51 -------- d-----w- C:\amv convert

2011-11-21 04:26 . 2011-11-26 08:52 -------- d-----w- c:\users\founder7231\AppData\Roaming\FEB9F

2011-11-21 04:26 . 2011-11-28 02:40 -------- d-----w- c:\users\founder7231\AppData\Roaming\B4CFE

2011-11-21 04:26 . 2011-11-21 04:26 -------- d-----w- c:\users\founder7231\AppData\Roaming\BsssQJJ6dK

2011-11-21 04:26 . 2011-11-21 04:26 -------- d-----w- c:\users\founder7231\AppData\Roaming\zccAA1uvD2ob4pG

2011-11-21 04:26 . 2011-11-21 04:26 -------- d-----w- c:\users\founder7231\AppData\Roaming\ozzONyyxA0uv2iF

2011-11-21 04:26 . 2011-11-24 04:49 -------- d-----w- c:\users\founder7231\AppData\Roaming\oPPNNyccA1u

2011-11-21 04:26 . 2011-11-21 04:26 -------- d-----w- c:\users\founder7231\AppData\Roaming\uJJJ77dEK8gR

2011-11-19 07:42 . 2011-10-07 04:16 8570192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A38FB65C-1A7D-4EA3-B7DA-6644DB0A6C42}\mpengine.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-14 03:02 . 2011-10-14 03:02 3949320 ----a-w- c:\programdata\Microsoft\BingBar\BBSvc\7.0.822.0oemBingBarSetup-Partner.EXE

2011-09-29 16:29 . 2011-11-09 20:22 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-09-29 04:03 . 2011-11-09 20:22 3144704 ----a-w- c:\windows\system32\win32k.sys

2006-05-03 16:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll

2007-02-21 17:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll

2008-03-16 19:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll

2010-01-07 04:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]

2011-02-01 19:58 1499440 ----a-r- c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2011-05-18 21:25 194912 ------w- c:\program files (x86)\Yontoo Layers\YontooIEClient.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-29 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-01 421160]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"InCD"="c:\program files (x86)\Ahead\InCD\InCD.exe" [2003-11-25 1232946]

"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2011-03-20 273544]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2011-06-02 114992]

"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-03-24 599328]

.

c:\users\founder7231\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"HideSCAHealth"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\klartew]

2011-11-29 21:27 11264 ----a-w- c:\windows\System32\config\systemprofile\AppData\Local\klartew.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]

@="FSFilter Activity Monitor"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 135664]

R2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;c:\program files (x86)\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [2009-03-12 86016]

R2 mi-raysat_3dsmax2010_64;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 64-bit 64-bit;c:\program files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe [2009-03-12 86016]

R2 mi-raysat_3dsmax2012_64;mental ray 3.9 Satellite for Autodesk 3ds Max 2012 64-bit - English 64-bit;c:\program files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe [2011-02-23 86016]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-07-07 195336]

R3 CEDRIVER55;CEDRIVER55;c:\program files (x86)\Cheat Engine\dbk64.sys [x]

R3 CEDRIVER60;CEDRIVER60;c:\program files (x86)\Cheat Engine 6\dbk64.sys [x]

R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-07-15 1431888]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 135664]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\NISx64\1008000.029\SYMNDISV.SYS [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1008000.029\SYMEFA64.SYS [x]

S1 BHDrvx64;Symantec Heuristics Driver;c:\windows\System32\Drivers\NISx64\1008000.029\BHDrvx64.sys [x]

S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\NISx64\1008000.029\ccHPx64.sys [x]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100518.002\IDSvia64.sys [2010-05-18 463408]

S2 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2007-04-30 54616]

S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-06-15 249648]

S2 Greg_Service;GRegService;c:\program files (x86)\eMachines\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 Norton Internet Security;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe [2009-10-29 117640]

S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]

S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]

S2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [2009-07-04 240160]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 04:50]

.

2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-11 04:50]

.

2011-12-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3811944950-3358311789-1212778198-1000Core.job

- c:\users\founder7231\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-15 13:00]

.

2011-12-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3811944950-3358311789-1212778198-1000UA.job

- c:\users\founder7231\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-15 13:00]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"combofix"="c:\combofix\CF4806.3XE" [2010-11-20 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

FF - ProfilePath - c:\users\founder7231\AppData\Roaming\Mozilla\Firefox\Profiles\qaf8rdjb.default\

FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{C4B8BAB4-1667-11DF-A242-BA9455D89593} - c:\program files (x86)\simppulltoolbar\auxi\simppulltoolbAu.dll

BHO-{E4E6BF2A-1667-11DF-A01F-1F9655D89593} - (no file)

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-Weather - c:\program files (x86)\AWS\WeatherBug\Weather.exe

Toolbar-Locked - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-Search Toolbar - c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Norton Internet Security]

"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files (x86)\Norton Internet Security\Engine\16.8.0.41\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

c:\program files (x86)\Ahead\InCD\InCDsrv.exe

c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

.

**************************************************************************

.

Completion time: 2011-12-12 22:32:35 - machine was rebooted

ComboFix-quarantined-files.txt 2011-12-13 03:32

.

Pre-Run: 607,131,480,064 bytes free

Post-Run: 608,281,563,136 bytes free

.

- - End Of File - - D38C4A6B9FD2FBA78F1B81B752CF3461

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by founder7231 at 22:51:09 on 2011-12-12

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.2631 [GMT -5:00]

.

AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe

C:\Program Files (x86)\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe

C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe

C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe

C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

C:\Windows\system32\svchost.exe -k regsvc

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

C:\Program Files (x86)\QuickTime\QTTask.exe

C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\SearchFilterHost.exe