Assist in removing 'win 7 antispyware 2012' - jvs.exe

[kornfreak21]

Attach.txt

For your review. Please advise accordingly.

Thanks so much.

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421

Run by Splaybe at 17:11:32 on 2011-12-13

Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.1271.526 [GMT -8:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Program Files\AVAST Software\Avast\afwServ.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\Macromed\Flash\FlashUtil11e_ActiveX.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\ctfmon.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://yahoo.com/

mStart Page = about:blank

uInternet Settings,ProxyOverride = *.local;192.168.*.*

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: Free YouTube to MP3 Converter - c:\users\splaybe\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm

LSP: mswsock.dll

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{30049010-DC31-427D-BC71-628124959067} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{76643260-1401-4513-9520-E2F35F7BA502} : DhcpNameServer = 192.168.1.1

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: SDWinLogon - SDWinLogon.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\splaybe\appdata\roaming\mozilla\firefox\profiles\9ed7qy16.default\

FF - prefs.js: browser.startup.homepage - www.yahoo.com

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\canon\easy-photoprint ex\NPEZFFPI.DLL

FF - plugin: c:\program files\common files\motive\npMotive.dll

FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\users\splaybe\appdata\local\google\update\1.3.21.79\npGoogleUpdate3.dll

.

============= SERVICES / DRIVERS ===============

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2011-12-2 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2011-12-2 195416]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2011-12-2 111320]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-9-19 435032]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-9-19 314456]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]

R1 MpKsl02d84222;MpKsl02d84222;c:\programdata\microsoft\microsoft antimalware\definition updates\{272c7e88-35e6-402d-ac7d-3c570db02439}\MpKsl02d84222.sys [2011-12-13 29904]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-7-18 116608]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-9-19 20568]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-9-19 55128]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-12-2 44768]

R2 avast! Firewall;avast! Firewall;c:\program files\avast software\avast\afwServ.exe [2011-12-2 127192]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-13 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-13 22216]

R3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\drivers\VSTBS23.SYS [2009-7-13 266752]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]

S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024]

S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]

S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2009-7-13 20992]

S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-5-13 15872]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-5-13 52224]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-2-13 1343400]

.

=============== Created Last 30 ================

.

2011-12-13 23:32:11 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-13 23:32:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-13 23:24:36 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{272c7e88-35e6-402d-ac7d-3c570db02439}\MpKsl02d84222.sys

2011-12-13 23:24:29 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{272c7e88-35e6-402d-ac7d-3c570db02439}\offreg.dll

2011-12-13 07:16:21 -------- d-----w- C:\sh4ldr

2011-12-13 07:16:21 -------- d-----w- c:\program files\Enigma Software Group

2011-12-13 07:13:20 -------- d-----w- c:\windows\1C7CC8E2CFCF41E6A8637C7A45CE8A78.TMP

2011-12-13 07:13:16 -------- d-----w- c:\program files\common files\Wise Installation Wizard

2011-12-13 07:03:40 -------- d-----w- c:\users\splaybe\appdata\local\Secunia PSI

2011-12-13 07:03:17 -------- d-----w- c:\program files\Secunia

2011-12-13 04:20:30 6823496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{272c7e88-35e6-402d-ac7d-3c570db02439}\mpengine.dll

2011-12-13 00:12:40 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys

2011-12-13 00:12:39 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys

2011-12-13 00:12:38 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys

2011-12-12 22:19:35 -------- d-----w- c:\program files\Glary Utilities

2011-12-12 22:13:25 -------- d-----w- c:\program files\DVD Maker

2011-12-03 01:36:50 111320 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-12-03 01:36:11 195416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-12-03 01:35:54 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2011-11-25 19:38:11 158056 ----a-w- c:\programdata\microsoft\windows\sqm\manifest\Sqm10139.bin

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-11-18 03:20:12 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-11-14 04:19:14 -------- d-----w- c:\programdata\vsosdk

2011-11-14 02:27:29 -------- d-----w- c:\programdata\CanonIJ

2011-11-14 02:26:40 -------- d--h--w- c:\programdata\CanonIJScan

.

==================== Find3M ====================

.

2011-11-28 18:01:25 41184 ----a-w- c:\windows\avastSS.scr

2011-11-28 17:53:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-28 17:52:07 55128 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-11-11 21:03:12 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-24 22:29:02 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2011-10-24 22:29:02 69632 ----a-w- c:\windows\system32\QuickTime.qts

2011-10-16 07:37:46 87608 ----a-w- c:\users\splaybe\appdata\roaming\inst.exe

2011-10-16 07:37:46 47360 ----a-w- c:\users\splaybe\appdata\roaming\pcouffin.sys

2011-10-03 13:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-29 16:03:04 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-09-29 03:37:56 2341888 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 17:13:15.45 ===============

DDS.txt

[kornfreak21]

Anyone get a chance to review yet and is there anything remaining I must remove?

thanks!

[LDTate]

Whether you wish to continue with cleaning or not, you should be aware that you may have been infected by a backdoor trojan. This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

• Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  
• Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  
• Consider what other private information could possibly have been taken from your computer and take appropriate steps
  
• Removing this infection can also disable the ability to connect to the internet.

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

Please post back to let me know how you wish to proceed.

[kornfreak21]

Please remove this topic as I have already remedied this matter.

Thanks anyways, keep up the good work.

[LDTate]

Thank you for taking the time to post back and letting us know

Peace be with you

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!