thelilyblue Posted November 27, 2011 ID:498421 Share Posted November 27, 2011 Hello,Last night I was attacked by a 'System Security 2011' Trojan/Malware. I managed to remove it using Malwarebytes in safe mode, however, PUP.BitMiner stubbornly remains. It seems like it's attempting to use the svchost, ping and tmproxy.exe processes to contact various IPs (Mostly German and Russian). I've already gotten alerts from my ISP that it looks like a bot is running on one of my machines. I re-ran Malwarebytes and it removed PUP.BitMiner (again), but it seems to still be there. I'm at a loss on what to do next. The DDS info is below.Thank you for any assistance..DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26Run by Susan at 21:33:05 on 2011-11-26Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3957.2118 [GMT -5:00].AV: Trend Micro Internet Security *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}SP: Trend Micro Internet Security *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Program Files\DisplayLink Core Software\DisplayLinkManager.exeC:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\nvvsvc.exeC:\Windows\SYSTEM32\WISPTIS.EXEC:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exeC:\Windows\system32\FBAgent.exeC:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exeC:\Program Files\ATKGFNEX\GFNEXSrv.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\SYSTEM32\WISPTIS.EXEC:\Windows\system32\taskhost.exeC:\Program Files\Common Files\microsoft shared\ink\TabTip.exeC:\Program Files\SUPERAntiSpyware\SASCORE64.EXEC:\Windows\system32\Dwm.exeC:\Program Files\DisplayLink Core Software\DisplayLinkUI.exeC:\Windows\Explorer.EXEC:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exeC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Windows\system32\taskeng.exeC:\Program Files (x86)\ASUS\Splendid\ACMON.exeC:\Program Files\P4G\BatteryLife.exeC:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exeC:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exeC:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exeC:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exeC:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exeC:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exeC:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exeC:\Program Files (x86)\Bonjour\mDNSResponder.exeC:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exeC:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exeC:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exeC:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exeC:\Windows\SysWOW64\nlssrv32.exeC:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Windows\System32\rundll32.exeC:\Program Files\Trend Micro\Internet Security\SfCtlCom.exeC:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exeC:\Program Files\Logitech\GamePanel Software\LGDevAgt.exeC:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\Tablet\Wacom\Wacom_Tablet.exeC:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exeC:\Program Files (x86)\AIM\aim.exeC:\Program Files (x86)\Steam\Steam.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exeC:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exeC:\Program Files (x86)\ASUS\ATK Media\DMedia.exeC:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exeC:\Program Files\SIMU\SGE\SGETask.ExeC:\Program Files (x86)\iTunes\iTunesHelper.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Windows\system32\svchost.exe -k bthsvcsC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Windows\system32\SearchIndexer.exeC:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Program Files\Trend Micro\Internet Security\TmProxy.exeC:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exeC:\Program Files\Trend Micro\BM\TMBMSRV.exeC:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exeC:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exeC:\Program Files\iPod\bin\iPodService.exeC:\Windows\SysWOW64\ACEngSvr.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Windows\system32\wuauclt.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exeC:\Windows\System32\svchost.exe -k secsvcsC:\Windows\system32\svchost.exe -k SDRSVCC:\Windows\SysWOW64\ping.exeC:\Windows\system32\conhost.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://asus.msn.comuDefault_Page_URL = hxxp://asus.msn.comuInternet Settings,ProxyOverride = *.localmWinlogon: Userinit=userinit.exe,BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dllBHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dlluRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-USuRun: [PlayNC Launcher] uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silentuRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exemRun: [Microsoft Pinyin IME Migration] C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALLmRun: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"mRun: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exemRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exemRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exemRun: [VolPanel] "C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" /rmRun: [updReg] C:\Windows\UpdReg.EXEmRun: [setwallpaper] c:\programdata\SetWallpaper.cmdmRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymPolicies-explorer: NoActiveDesktop = 1 (0x1)mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableLUA = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)mPolicies-system: PromptOnSecureDesktop = 0 (0x0)IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htmIE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmIE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLLLSP: mswsock.dllTrusted Zone: clonewarsadventures.comTrusted Zone: freerealms.comTrusted Zone: soe.comTrusted Zone: sony.comTrusted Zone: play.net\*DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabTCP: DhcpNameServer = 192.168.0.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26} : DhcpNameServer = 192.168.0.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26}\2456C6B696E6F5E4F575962756C6563737F5438373236364 : DhcpNameServer = 192.168.2.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26}\849726F6279616D2E4 : DhcpNameServer = 192.168.2.1 192.168.2.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26}\E4544574541425 : DhcpNameServer = 192.168.1.1TCP: Interfaces\{F8FD5456-6B46-4750-A8EB-F4A7DECEC953} : DhcpNameServer = 192.168.0.1SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllBHO-X64: Search Helper - No FileBHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dllBHO-X64: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dllBHO-X64: Google Dictionary Compression sdch - No FileBHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllBHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllTB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllmRun-x64: [Microsoft Pinyin IME Migration] C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALLmRun-x64: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"mRun-x64: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exemRun-x64: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exemRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exemRun-x64: [VolPanel] "C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" /rmRun-x64: [updReg] C:\Windows\UpdReg.EXEmRun-x64: [setwallpaper] c:\programdata\SetWallpaper.cmdmRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttrayIE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm.================= FIREFOX ===================.FF - ProfilePath - C:\Users\Susan\AppData\Roaming\Mozilla\Firefox\Profiles\f6oh7rqs.default\FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/igFF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dllFF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dllFF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllFF - plugin: C:\Users\Susan\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dllFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com.---- FIREFOX POLICIES ----FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false============= SERVICES / DRIVERS ===============.R? BTCFilterService;USB Networking Driver Filter ServiceR? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86R? clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64R? Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing ServiceR? Creative Audio Engine Licensing Service;Creative Audio Engine Licensing ServiceR? DisplayLinkUsbPort;DisplayLink USB DeviceR? fssfltr;fssfltrR? fsssvc;Windows Live Family SafetyR? gupdate;Google Update Service (gupdate)R? gupdatem;Google Update Service (gupdatem)R? motccgp;Motorola USB Composite Device DriverR? motccgpfl;MotCcgpFlServiceR? Motousbnet;Motorola USB Networking Driver ServiceR? motusbdevice;Motorola USB Dev DriverR? Razerlow;Razer Pro|SolutionsR? SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 DriverR? TsUsbFlt;TsUsbFltR? wacmoumonitor;Wacom Mode HelperR? WatAdminSvc;Windows Activation Technologies ServiceS? !SASCORE;SAS Core ServiceS? AFBAgent;AFBAgentS? ASMMAP64;ASMMAP64S? btwl2cap;Bluetooth L2CAP ServiceS? DAZContentManagementService;DAZ Content Management ServiceS? DisplayLinkService;DisplayLinkManagerS? dlkmd;dlkmdS? dlkmdldr;dlkmdldrS? HECIx64;Intel® Management Engine InterfaceS? Impcd;ImpcdS? L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)S? LGBusEnum;Logitech GamePanel Virtual Bus Enumerator DriverS? LGVirHid;Logitech Gamepanel Virtual HID Device DriverS? MBAMProtector;MBAMProtectorS? MBAMService;MBAMServiceS? MotoConnect Service;MotoConnect ServiceS? NETw1v64;Intel® Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 BitS? nlsX86cc;Nalpeiron Licensing ServiceS? NVHDA;Service for NVIDIA High Definition Audio DriverS? rimspci;rimspciS? rixdpcie;rixdpcieS? SASDIFSV;SASDIFSVS? SASKUTIL;SASKUTILS? TabletServiceWacom;TabletServiceWacomS? tmpreflt;tmprefltS? TmProxy;Trend Micro Proxy ServiceS? UNS;Intel® Management & Security Application User Notification ServiceS? vwififlt;Virtual WiFi Filter Driver.=============== Created Last 30 ================.2011-11-26 23:35:13 -------- d-----w- C:\Users\Susan\AppData\Roaming\SUPERAntiSpyware.com2011-11-26 23:34:33 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com2011-11-26 23:34:33 -------- d-----w- C:\Program Files\SUPERAntiSpyware2011-11-26 06:02:28 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F792CE92-DB97-416C-8222-A3F81CA04D19}\offreg.dll2011-11-26 05:10:08 -------- d-----w- C:\Users\Susan\AppData\Roaming\Malwarebytes2011-11-26 05:09:27 -------- d-----w- C:\ProgramData\Malwarebytes2011-11-26 05:09:24 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys2011-11-26 05:09:24 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2011-11-26 04:42:33 -------- d-----w- C:\Users\Susan\AppData\Roaming\FKKK7ffRL2011-11-26 04:42:24 -------- d-----we C:\Windows\system642011-11-25 22:31:48 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F792CE92-DB97-416C-8222-A3F81CA04D19}\mpengine.dll2011-11-20 22:13:31 -------- d-----w- C:\Program Files (x86)\Common Files\DAZ2011-11-20 22:08:14 -------- d-----w- C:\ProgramData\DAZ 3D2011-11-20 22:08:12 -------- d-----w- C:\Program Files\DAZ 3D2011-11-20 22:05:03 -------- d-----w- C:\Program Files (x86)\DAZ 3D2011-11-20 22:04:28 -------- d-----w- C:\Users\Susan\AppData\Roaming\DAZ 3D2011-11-10 00:21:42 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll2011-11-10 00:21:42 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll2011-11-10 00:21:41 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys2011-11-10 00:21:39 3144704 ----a-w- C:\Windows\System32\win32k.sys.==================== Find3M ====================.2011-11-22 00:12:17 45056 ----a-w- C:\Windows\System32\acovcnt.exe2011-10-02 17:44:54 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb.============= FINISH: 21:34:34.99 ===============I did some monkeying around and PUP.BitMiner SEEMS to be gone. Malwarebytes is not picking it up any more and it doesn't seem like there are any more outgoing attempts for it to block. However, I'm still a bit wary. For lack of any better terms, things still don't seem quite right. My computer is taking longer than it ought to to boot and svchost.exe still seems to be eating up a lot of memory. I'm posting a new logfile to see if anyone can spot anything that might be remaining.Thanks again for any assistance..DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26Run by Susan at 1:24:16 on 2011-11-27Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3957.1824 [GMT -5:00].AV: Trend Micro Internet Security *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}SP: Trend Micro Internet Security *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Program Files\DisplayLink Core Software\DisplayLinkManager.exeC:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\nvvsvc.exeC:\Windows\SYSTEM32\WISPTIS.EXEC:\Windows\system32\FBAgent.exeC:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exeC:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exeC:\Program Files\ATKGFNEX\GFNEXSrv.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\SYSTEM32\WISPTIS.EXEC:\Windows\system32\taskhost.exeC:\Program Files\Common Files\microsoft shared\ink\TabTip.exeC:\Windows\system32\Dwm.exeC:\Program Files\DisplayLink Core Software\DisplayLinkUI.exeC:\Windows\Explorer.EXEC:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exeC:\Program Files\SUPERAntiSpyware\SASCORE64.EXEC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exeC:\Windows\system32\taskeng.exeC:\Program Files (x86)\ASUS\Splendid\ACMON.exeC:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exeC:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exeC:\Program Files\P4G\BatteryLife.exeC:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exeC:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exeC:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exeC:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exeC:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exeC:\Program Files (x86)\Bonjour\mDNSResponder.exeC:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exeC:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exeC:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Windows\System32\rundll32.exeC:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exeC:\Program Files\Logitech\GamePanel Software\LGDevAgt.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files (x86)\AIM\aim.exeC:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exeC:\Program Files (x86)\Steam\Steam.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\Windows\SysWOW64\nlssrv32.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\Program Files\Trend Micro\Internet Security\SfCtlCom.exeC:\Program Files\SIMU\SGE\SGETask.ExeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exeC:\Program Files\Tablet\Wacom\Wacom_Tablet.exeC:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exeC:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exeC:\Program Files (x86)\ASUS\ATK Media\DMedia.exeC:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exeC:\Program Files (x86)\iTunes\iTunesHelper.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Tablet\Wacom\Wacom_TabletUser.exeC:\Program Files\Tablet\Wacom\Wacom_Tablet.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Trend Micro\Internet Security\TmProxy.exeC:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exeC:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exeC:\Windows\system32\svchost.exe -k bthsvcsC:\Windows\system32\SearchIndexer.exeC:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exeC:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exeC:\Windows\SysWOW64\ACEngSvr.exeC:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Windows\servicing\TrustedInstaller.exeC:\Program Files\Trend Micro\BM\TMBMSRV.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\wuauclt.exeC:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Windows\system32\sppsvc.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exeC:\Windows\System32\svchost.exe -k secsvcsC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\SysWOW64\cscript.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://asus.msn.comuInternet Settings,ProxyOverride = *.localBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dllBHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllTB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dlluRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-USuRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silentuRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exemRun: [Microsoft Pinyin IME Migration] C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALLmRun: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"mRun: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exemRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exemRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exemRun: [VolPanel] "C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" /rmRun: [updReg] C:\Windows\UpdReg.EXEmRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttrayStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{60D6618B-153F-4353-8185-908E676E5888}\_DCE9A4DB2A5F2786140FA3.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SGETask.lnk - C:\Program Files\SIMU\SGE\SGETask.ExemPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableLUA = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)mPolicies-system: PromptOnSecureDesktop = 0 (0x0)IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htmIE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmIE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLLTrusted Zone: clonewarsadventures.comTrusted Zone: freerealms.comTrusted Zone: soe.comTrusted Zone: sony.comTrusted Zone: play.net\*DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cabTCP: DhcpNameServer = 192.168.0.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26} : DhcpNameServer = 192.168.0.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26}\2456C6B696E6F5E4F575962756C6563737F5438373236364 : DhcpNameServer = 192.168.2.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26}\849726F6279616D2E4 : DhcpNameServer = 192.168.2.1 192.168.2.1TCP: Interfaces\{EF515C5E-5D48-4453-BE59-D3C0DB64DD26}\E4544574541425 : DhcpNameServer = 192.168.1.1TCP: Interfaces\{F8FD5456-6B46-4750-A8EB-F4A7DECEC953} : DhcpNameServer = 192.168.0.1BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllBHO-X64: Search Helper - No FileBHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dllBHO-X64: Google Dictionary Compression sdch: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dllBHO-X64: Google Dictionary Compression sdch - No FileBHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllBHO-X64: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllTB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB-X64: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dllmRun-x64: [Microsoft Pinyin IME Migration] C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALLmRun-x64: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"mRun-x64: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exemRun-x64: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exemRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exemRun-x64: [VolPanel] "C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe" /rmRun-x64: [updReg] C:\Windows\UpdReg.EXEmRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttrayIE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm.================= FIREFOX ===================.FF - ProfilePath - C:\Users\Susan\AppData\Roaming\Mozilla\Firefox\Profiles\f6oh7rqs.default\FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/igFF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dllFF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dllFF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dllFF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dllFF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllFF - plugin: C:\Users\Susan\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dllFF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com.---- FIREFOX POLICIES ----FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false.============= SERVICES / DRIVERS ===============.R0 dlkmdldr;dlkmdldr;C:\Windows\system32\drivers\dlkmdldr.sys --> C:\Windows\system32\drivers\dlkmdldr.sys [?]R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]R2 AFBAgent;AFBAgent;"C:\Windows\system32\FBAgent.exe" --> C:\Windows\system32\FBAgent.exe [?]R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2010-3-2 14904]R2 DAZContentManagementService;DAZ Content Management Service;C:\Program Files\DAZ 3D\Content Management Service\ContentManagementServer.exe [2011-11-20 22528]R2 DisplayLinkService;DisplayLinkManager;C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [2010-3-23 8610664]R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-11-26 366152]R2 MotoConnect Service;MotoConnect Service;C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-9-3 91456]R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\System32\nlssrv32.exe [2010-10-1 57344]R2 rimspci;rimspci;C:\Windows\system32\DRIVERS\rimspe64.sys --> C:\Windows\system32\DRIVERS\rimspe64.sys [?]R2 rixdpcie;rixdpcie;C:\Windows\system32\DRIVERS\rixdpe64.sys --> C:\Windows\system32\DRIVERS\rixdpe64.sys [?]R2 TabletServiceWacom;TabletServiceWacom;C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe [2010-10-1 5671792]R2 tmpreflt;tmpreflt;C:\Windows\system32\DRIVERS\tmpreflt.sys --> C:\Windows\system32\DRIVERS\tmpreflt.sys [?]R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-3-2 2314240]R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]R3 dlkmd;dlkmd;C:\Windows\system32\drivers\dlkmd.sys --> C:\Windows\system32\drivers\dlkmd.sys [?]R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys --> C:\Windows\system32\DRIVERS\Impcd.sys [?]R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\LGBusEnum.sys --> C:\Windows\system32\drivers\LGBusEnum.sys [?]R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\system32\drivers\LGVirHid.sys --> C:\Windows\system32\drivers\LGVirHid.sys [?]R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]R3 NETw1v64;Intel® Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\NETw1v64.sys --> C:\Windows\system32\DRIVERS\NETw1v64.sys [?]R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]R3 TmProxy;Trend Micro Proxy Service;C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [2010-3-2 917768]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-2 135664]S3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\system32\DRIVERS\motfilt.sys --> C:\Windows\system32\DRIVERS\motfilt.sys [?]S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-3-2 79360]S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-3-2 79360]S3 DisplayLinkUsbPort;DisplayLink USB Device;C:\Windows\system32\DRIVERS\DisplayLinkUsbPort_5.2.24075.0.sys --> C:\Windows\system32\DRIVERS\DisplayLinkUsbPort_5.2.24075.0.sys [?]S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]S3 fsssvc;Windows Live Family Safety;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2008-12-8 533344]S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-3-2 135664]S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\system32\DRIVERS\motccgp.sys --> C:\Windows\system32\DRIVERS\motccgp.sys [?]S3 motccgpfl;MotCcgpFlService;C:\Windows\system32\DRIVERS\motccgpfl.sys --> C:\Windows\system32\DRIVERS\motccgpfl.sys [?]S3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\system32\DRIVERS\Motousbnet.sys --> C:\Windows\system32\DRIVERS\Motousbnet.sys [?]S3 motusbdevice;Motorola USB Dev Driver;C:\Windows\system32\DRIVERS\motusbdevice.sys --> C:\Windows\system32\DRIVERS\motusbdevice.sys [?]S3 Razerlow;Razer Pro|Solutions;C:\Windows\system32\drivers\DB3G.sys --> C:\Windows\system32\drivers\DB3G.sys [?]S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]S3 wacmoumonitor;Wacom Mode Helper;C:\Windows\system32\DRIVERS\wacmoumonitor.sys --> C:\Windows\system32\DRIVERS\wacmoumonitor.sys [?]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?].=============== Created Last 30 ================.2011-11-27 04:32:54 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F792CE92-DB97-416C-8222-A3F81CA04D19}\offreg.dll2011-11-27 03:19:59 -------- d-sh--w- C:\$RECYCLE.BIN2011-11-27 02:58:34 98816 ----a-w- C:\Windows\sed.exe2011-11-27 02:58:34 518144 ----a-w- C:\Windows\SWREG.exe2011-11-27 02:58:34 256000 ----a-w- C:\Windows\PEV.exe2011-11-27 02:58:34 208896 ----a-w- C:\Windows\MBR.exe2011-11-27 02:58:27 -------- d-----w- C:\ComboFix2011-11-26 23:35:13 -------- d-----w- C:\Users\Susan\AppData\Roaming\SUPERAntiSpyware.com2011-11-26 23:34:33 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com2011-11-26 23:34:33 -------- d-----w- C:\Program Files\SUPERAntiSpyware2011-11-26 05:10:08 -------- d-----w- C:\Users\Susan\AppData\Roaming\Malwarebytes2011-11-26 05:09:27 -------- d-----w- C:\ProgramData\Malwarebytes2011-11-26 05:09:24 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys2011-11-26 05:09:24 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2011-11-26 04:42:33 -------- d-----w- C:\Users\Susan\AppData\Roaming\FKKK7ffRL2011-11-25 22:31:48 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{F792CE92-DB97-416C-8222-A3F81CA04D19}\mpengine.dll2011-11-20 22:13:31 -------- d-----w- C:\Program Files (x86)\Common Files\DAZ2011-11-20 22:08:14 -------- d-----w- C:\ProgramData\DAZ 3D2011-11-20 22:08:12 -------- d-----w- C:\Program Files\DAZ 3D2011-11-20 22:05:03 -------- d-----w- C:\Program Files (x86)\DAZ 3D2011-11-20 22:04:28 -------- d-----w- C:\Users\Susan\AppData\Roaming\DAZ 3D2011-11-10 00:21:42 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll2011-11-10 00:21:42 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll2011-11-10 00:21:41 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys2011-11-10 00:21:39 3144704 ----a-w- C:\Windows\System32\win32k.sys.==================== Find3M ====================.2011-11-22 00:12:17 45056 ----a-w- C:\Windows\System32\acovcnt.exe2011-10-02 17:44:54 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb.============= FINISH: 1:25:52.41 =============== Link to post Share on other sites More sharing options...
Staff screen317 Posted December 3, 2011 Staff ID:500940 Share Posted December 3, 2011 Hi and welcome to Malwarebytes. Please update MBAM, run a Quick Scan, and post its log. Next, please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix When the tool is finished, it will produce a report for you.Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system. Link to post Share on other sites More sharing options...
Staff screen317 Posted December 12, 2011 Staff ID:503872 Share Posted December 12, 2011 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Staff screen317 Posted December 22, 2011 Staff ID:508160 Share Posted December 22, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts