Redirect of all search results

kennyf · March 15, 2012

I seem to be lucky in as much as it only interupts my search results. A direct typed address or a click on favorites not effected. I get redirected to an address with ip addresses like 63.209.69.107and then some bogus page. Have also seen the fake virus scanner but have clicked out in time i guess. I use Microsoft essentials. I have tryed malwarebytes to scan and it finds nothing. Also gmer shows no results. Thanks -Lucky but Frustrated.

kennyf · March 15, 2012

My Computer Info.

screen317 · March 15, 2012

Hi and welcome to Malwarebytes.

In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly in your reply.

kennyf · March 15, 2012

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.03.15.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Kenny :: KENNY-PC [administrator]

3/15/2012 4:21:14 PM

mbam-log-2012-03-15 (16-21-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 203847

Time elapsed: 2 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.03.15.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Kenny :: KENNY-PC [administrator]

3/15/2012 4:21:14 PM

mbam-log-2012-03-15 (16-21-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 203847

Time elapsed: 2 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.03.15.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Kenny :: KENNY-PC [administrator]

3/15/2012 4:21:14 PM

mbam-log-2012-03-15 (16-21-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 203847

Time elapsed: 2 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.03.15.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Kenny :: KENNY-PC [administrator]

3/15/2012 4:21:14 PM

mbam-log-2012-03-15 (16-21-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 203847

Time elapsed: 2 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Thank You For the help.

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.03.15.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Kenny :: KENNY-PC [administrator]

3/15/2012 4:21:14 PM

mbam-log-2012-03-15 (16-21-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 203847

Time elapsed: 2 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Kenny at 16:23:03 on 2012-03-15

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4091.2355 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\DRIVERS\xaudio64.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\SeaPort.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingApp.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingBar.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingSurrogate.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.cbsnews.com/?ocid=MIE8MSNB/

uWindow Title = Internet Explorer, optimized for Bing and MSN

uURLSearchHooks: H - No File

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Groove Folder Synchronization: {0f802439-432b-1c45-7cd3-59de607400c2} - C:\Windows\SysWOW64\KBDDCAN.DLL

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Windows Live ID Sign-in Helper: {1f16312e-19de-5861-0ba2-71716c621717} - C:\Windows\SysWOW64\fdPProxy.dll

BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll

BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll"

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

dRunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f

dRunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f

StartupFolder: C:\Users\Kenny\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ERUNTA~1.LNK - C:\Program Files (x86)\ERUNT\AUTOBACK.EXE

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 75.75.76.76 75.75.75.75

TCP: Interfaces\{037AEAC4-C825-4164-8D9F-487EA929E4E3} : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{23186FDD-D6B1-418E-8FCD-806ABA5FA22A} : DhcpNameServer = 75.75.76.76 75.75.75.75

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO-X64: 0x1 - No File

BHO-X64: Groove Folder Synchronization: {0F802439-432B-1C45-7CD3-59DE607400C2} - C:\Windows\SysWOW64\KBDDCAN.DLL

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Windows Live ID Sign-in Helper: {1F16312E-19DE-5861-0BA2-71716C621717} - C:\Windows\SysWOW64\fdPProxy.dll

BHO-X64: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll

BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll"

TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB-X64: {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File

TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

.

============= SERVICES / DRIVERS ===============

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\SeaPort.EXE [2012-1-21 240408]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETw5s64.sys --> C:\Windows\system32\DRIVERS\NETw5s64.sys [?]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2mdx64.sys --> C:\Windows\system32\DRIVERS\o2mdx64.sys [?]

R3 O2SDRDR;O2SDRDR;C:\Windows\system32\DRIVERS\o2sdx64.sys --> C:\Windows\system32\DRIVERS\o2sdx64.sys [?]

R3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]

R3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]

R3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]

S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BBSvc.EXE [2012-1-21 192792]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 CAXHWAZL;CAXHWAZL;C:\Windows\system32\DRIVERS\CAXHWAZL.sys --> C:\Windows\system32\DRIVERS\CAXHWAZL.sys [?]

S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]

S3 mbamchameleon;mbamchameleon;\??\C:\Windows\system32\drivers\mbamchameleon.sys --> C:\Windows\system32\drivers\mbamchameleon.sys [?]

S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;C:\Windows\system32\DRIVERS\netr7364.sys --> C:\Windows\system32\DRIVERS\netr7364.sys [?]

S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-03-15 13:44:11 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{10E6BF4B-E7CE-42EF-B3DB-CAC972780868}\offreg.dll

2012-03-15 13:43:23 8643640 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{10E6BF4B-E7CE-42EF-B3DB-CAC972780868}\mpengine.dll

2012-03-15 02:51:50 -------- d-----w- C:\Program Files (x86)\UnHackMe

2012-03-15 02:39:22 -------- d-----w- C:\Program Files\Oracle

2012-03-15 02:38:51 750488 ----a-w- C:\Windows\System32\npdeployJava1.dll

2012-03-15 02:38:51 660368 ----a-w- C:\Windows\System32\deployJava1.dll

2012-03-14 22:23:52 98816 ----a-w- C:\Windows\sed.exe

2012-03-14 22:23:52 518144 ----a-w- C:\Windows\SWREG.exe

2012-03-14 22:23:52 256000 ----a-w- C:\Windows\PEV.exe

2012-03-14 22:23:52 208896 ----a-w- C:\Windows\MBR.exe

2012-03-14 22:23:50 -------- d-s---w- C:\ComboFix

2012-03-14 14:45:43 -------- d-----w- C:\Program Files (x86)\SpywareBlaster

2012-03-14 13:28:34 -------- d-----w- C:\Users\Kenny\AppData\Roaming\SUPERAntiSpyware.com

2012-03-14 13:27:57 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2012-03-14 13:27:57 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2012-03-14 10:52:53 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-03-14 10:52:52 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2012-03-14 10:52:52 3913584 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2012-03-14 09:32:11 3145728 ----a-w- C:\Windows\System32\win32k.sys

2012-03-14 09:32:11 1544192 ----a-w- C:\Windows\System32\DWrite.dll

2012-03-14 09:32:11 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll

2012-03-14 09:29:31 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe

2012-03-14 09:29:31 77312 ----a-w- C:\Windows\System32\rdpwsx.dll

2012-03-14 09:29:31 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll

2012-03-14 09:29:30 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll

2012-03-14 09:29:30 1031680 ----a-w- C:\Windows\System32\rdpcore.dll

2012-03-14 09:29:29 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys

2012-03-14 09:29:26 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys

2012-03-12 20:46:15 29808 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2012-03-12 20:42:29 -------- d-----w- C:\Users\Kenny\AppData\Roaming\Malwarebytes

2012-03-12 20:42:21 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-03-12 20:42:21 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-03-12 19:44:09 -------- d-----w- C:\sh4ldr

2012-03-12 19:44:09 -------- d-----w- C:\Program Files\Enigma Software Group

2012-03-12 19:43:10 -------- d-----w- C:\Windows\5B210B8AB66E4702B44D0D6F388D29EB.TMP

2012-03-12 12:23:51 -------- d-----w- C:\Users\Kenny\AppData\Local\Threat Expert

2012-03-12 12:07:34 -------- d-----w- C:\Program Files (x86)\PC Tools

2012-03-12 12:05:17 230952 ----a-w- C:\Windows\System32\drivers\PCTSD64.sys

2012-03-12 12:05:17 -------- d-----w- C:\Program Files (x86)\Common Files\PC Tools

2012-03-12 12:04:57 -------- d-----w- C:\ProgramData\PC Tools

2012-03-12 02:49:59 -------- d-----w- C:\Windows\Downloaded Installations

2012-03-11 23:07:42 8643640 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-03-11 22:33:43 -------- d-----w- C:\ProgramData\SpeedyPC Software

2012-03-11 22:04:33 39184 ----a-w- C:\Windows\System32\Partizan.exe

2012-03-11 21:55:36 2 --shatr- C:\Windows\winstart.bat

2012-03-11 19:33:04 927800 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E3688C9F-6EBA-48AD-8376-27B33CC3ACB2}\gapaengine.dll

2012-03-11 19:32:00 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2012-03-11 19:31:58 -------- d-----w- C:\Program Files\Microsoft Security Client

2012-03-11 18:24:27 -------- d-----w- C:\Program Files (x86)\Trend Micro

2012-03-11 04:29:48 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-03-11 04:09:38 -------- d-----w- C:\ProgramData\Malwarebytes

2012-03-10 18:17:16 889664 ----a-w- C:\Windows\System32\nvvsvc.exe

2012-03-10 18:17:16 63296 ----a-w- C:\Windows\System32\nvshext.dll

2012-03-10 18:17:16 6074176 ----a-w- C:\Windows\System32\nvcpl.dll

2012-03-10 18:17:16 3089728 ----a-w- C:\Windows\System32\nvsvc64.dll

2012-03-10 18:17:16 2561856 ----a-w- C:\Windows\System32\nvsvcr.dll

2012-03-10 18:17:16 118080 ----a-w- C:\Windows\System32\nvmctray.dll

2012-03-10 01:28:40 98 ---ha-w- C:\aaw7boot.cmd

2012-03-10 01:23:48 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{13BE0816-07C1-44AD-8B7A-734327D20984}\mpengine.dll

2012-03-09 14:11:03 -------- d-----w- C:\Windows\SysWow64\2055

2012-03-09 14:10:37 -------- d-----w- C:\Windows\SysWow64\2002

2012-03-08 03:52:35 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2012-03-08 03:37:58 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys

2012-03-05 03:29:54 -------- d-----w- C:\Users\Kenny\AppData\Roaming\Elephant Games

2012-03-05 03:27:25 -------- d-----w- C:\Program Files (x86)\Games

2012-02-26 17:38:42 72512 ----a-w- C:\Windows\System32\nvapo64v.dll

2012-02-26 17:38:42 1451840 ----a-w- C:\Windows\System32\nvhdagenco6420103.dll

2012-02-26 17:38:41 31040 ----a-w- C:\Windows\System32\nvhdap64.dll

2012-02-26 17:38:41 188224 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys

2012-02-26 17:38:22 -------- d-----w- C:\Program Files\NVIDIA Corporation

2012-02-26 17:37:48 -------- d-----w- C:\NVIDIA

2012-02-24 12:07:10 86016 ----a-w- C:\Windows\unvise32qt.exe

2012-02-20 03:32:07 -------- d-----w- C:\ProgramData\Tages

2012-02-19 23:40:47 -------- d-----w- C:\Windows\en

2012-02-19 23:38:58 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2012-02-19 23:37:26 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6fd86fea1ccef5f01\MeshBetaRemover.exe

2012-02-19 23:11:49 -------- d-----w- C:\Program Files\CCleaner

2012-02-17 12:23:06 -------- d-----w- C:\Program Files (x86)\Guild Wars

2012-02-15 11:52:43 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll

2012-02-15 11:52:43 634880 ----a-w- C:\Windows\System32\msvcrt.dll

2012-02-15 11:52:38 515584 ----a-w- C:\Windows\System32\timedate.cpl

2012-02-15 11:52:38 509952 ----a-w- C:\Windows\System32\ntshrui.dll

2012-02-15 11:52:38 498688 ----a-w- C:\Windows\System32\drivers\afd.sys

2012-02-15 11:52:38 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll

2012-02-15 11:52:37 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl

.

==================== Find3M ====================

.

2012-03-15 03:36:22 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-23 15:18:36 279656 ------w- C:\Windows\System32\MpSigStub.exe

2012-02-03 12:00:14 164992 ----a-w- C:\Windows\SysWow64\drivers\athsgt.sys

2012-02-03 12:00:11 12544 ----a-w- C:\Windows\SysWow64\drivers\limsgt.sys

2011-12-31 23:19:13 466456 ----a-w- C:\Windows\System32\wrap_oal.dll

2011-12-31 23:19:13 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2011-12-31 23:19:13 122904 ----a-w- C:\Windows\System32\OpenAL32.dll

2011-12-31 23:19:13 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2011-12-28 15:10:42 279616 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys

.

============= FINISH: 16:23:45.18 ===============

kennyf · March 16, 2012

I guess you can't help me since i had a problem with your damn paste clipboard.

screen317 · March 17, 2012

I guess you can't help me since i had a problem with your damn paste clipboard.

What are you talking about? I can see your post fine. Please don't get angry.......

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

kennyf · March 17, 2012

Ok- Here they are:

ComboFix 12-03-16.03 - Kenny 03/17/2012 9:45.4.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4091.2779 [GMT -5:00]

Running from: c:\users\Kenny\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-02-17 to 2012-03-17 )))))))))))))))))))))))))))))))

.

2012-03-17 14:49 . 2012-03-17 14:49 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2012-03-17 14:49 . 2012-03-17 14:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-03-16 23:58 . 2012-02-08 04:14 8643640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB3AC9A4-B31E-4A41-B545-21E2C9DC3A78}\mpengine.dll

2012-03-16 22:06 . 2012-03-16 22:07 -------- d-----w- c:\programdata\SecTaskMan

2012-03-16 22:02 . 2012-03-16 22:05 -------- dc-h--w- c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}

2012-03-16 22:01 . 2012-03-16 22:01 -------- d-----w- c:\users\Kenny\AppData\Local\PackageAware

2012-03-16 19:58 . 2012-03-16 19:58 -------- d-----w- c:\users\Kenny\AppData\Roaming\LucasArts

2012-03-16 16:23 . 2012-03-16 16:24 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-03-16 16:23 . 2011-12-10 20:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-03-16 12:12 . 2012-03-16 12:12 -------- d-----w- c:\windows\SysWow64\3021

2012-03-15 02:39 . 2012-03-15 02:39 -------- d-----w- c:\program files\Oracle

2012-03-15 02:38 . 2012-01-10 18:28 750488 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-03-15 02:38 . 2012-01-10 18:28 660368 ----a-w- c:\windows\system32\deployJava1.dll

2012-03-15 02:37 . 2012-03-15 02:38 -------- d-----w- c:\program files\Java

2012-03-14 10:52 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-03-14 10:52 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-03-14 10:52 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-03-14 09:32 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll

2012-03-14 09:32 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll

2012-03-14 09:32 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys

2012-03-14 09:29 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll

2012-03-14 09:29 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-03-14 09:29 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-03-14 09:29 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll

2012-03-14 09:29 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll

2012-03-14 09:29 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-03-14 09:29 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2012-03-12 20:42 . 2012-03-12 20:42 -------- d-----w- c:\users\Kenny\AppData\Roaming\Malwarebytes

2012-03-12 19:44 . 2012-03-12 19:44 -------- d-----w- c:\program files\Enigma Software Group

2012-03-12 19:43 . 2012-03-12 20:11 -------- d-----w- c:\windows\5B210B8AB66E4702B44D0D6F388D29EB.TMP

2012-03-12 12:23 . 2012-03-12 12:23 -------- d-----w- c:\users\Kenny\AppData\Local\Threat Expert

2012-03-12 12:07 . 2012-03-12 12:07 -------- d-----w- c:\program files (x86)\PC Tools

2012-03-12 12:05 . 2012-03-12 20:24 -------- d-----w- c:\program files (x86)\Common Files\PC Tools

2012-03-12 12:05 . 2012-02-24 15:36 230952 ----a-w- c:\windows\system32\drivers\PCTSD64.sys

2012-03-12 12:04 . 2012-03-12 12:36 -------- d-----w- c:\programdata\PC Tools

2012-03-12 02:49 . 2012-03-12 02:49 -------- d-----w- c:\windows\Downloaded Installations

2012-03-11 23:07 . 2012-02-08 04:14 8643640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-03-11 22:33 . 2012-03-11 22:43 -------- d-----w- c:\programdata\SpeedyPC Software

2012-03-11 22:04 . 2012-03-11 22:04 39184 ----a-w- c:\windows\system32\Partizan.exe

2012-03-11 21:55 . 2012-03-15 02:52 2 --shatr- c:\windows\winstart.bat

2012-03-11 19:33 . 2012-03-11 19:32 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E3688C9F-6EBA-48AD-8376-27B33CC3ACB2}\gapaengine.dll

2012-03-11 19:32 . 2012-03-11 19:32 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2012-03-11 19:31 . 2012-03-11 19:32 -------- d-----w- c:\program files\Microsoft Security Client

2012-03-11 18:24 . 2012-03-11 18:24 -------- d-----w- c:\program files (x86)\Trend Micro

2012-03-11 04:29 . 2012-03-11 04:29 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-03-11 04:09 . 2012-03-11 04:09 -------- d-----w- c:\programdata\Malwarebytes

2012-03-10 18:17 . 2012-03-10 18:17 -------- d-----w- c:\programdata\NVIDIA

2012-03-10 18:17 . 2012-02-10 03:14 6074176 ----a-w- c:\windows\system32\nvcpl.dll

2012-03-10 18:17 . 2012-02-10 03:14 3089728 ----a-w- c:\windows\system32\nvsvc64.dll

2012-03-10 18:17 . 2012-02-10 03:07 2561856 ----a-w- c:\windows\system32\nvsvcr.dll

2012-03-10 18:17 . 2012-02-10 03:07 889664 ----a-w- c:\windows\system32\nvvsvc.exe

2012-03-10 18:17 . 2012-02-10 03:07 63296 ----a-w- c:\windows\system32\nvshext.dll

2012-03-10 18:17 . 2012-02-10 03:07 118080 ----a-w- c:\windows\system32\nvmctray.dll

2012-03-10 01:23 . 2012-03-01 19:21 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13BE0816-07C1-44AD-8B7A-734327D20984}\mpengine.dll

2012-03-09 14:11 . 2012-03-16 12:12 -------- d-----w- c:\windows\SysWow64\2055

2012-03-09 14:10 . 2012-03-09 14:10 -------- d-----w- c:\windows\SysWow64\2002

2012-03-08 03:37 . 2012-03-08 03:37 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2012-03-05 03:29 . 2012-03-05 03:29 -------- d-----w- c:\users\Kenny\AppData\Roaming\Elephant Games

2012-03-05 03:27 . 2012-03-09 17:34 -------- d-----w- c:\program files (x86)\Games

2012-02-26 17:38 . 2012-01-17 12:45 72512 ----a-w- c:\windows\system32\nvapo64v.dll

2012-02-26 17:38 . 2012-01-17 12:45 1451840 ----a-w- c:\windows\system32\nvhdagenco6420103.dll

2012-02-26 17:38 . 2012-01-17 12:46 31040 ----a-w- c:\windows\system32\nvhdap64.dll

2012-02-26 17:38 . 2012-01-17 12:45 188224 ----a-w- c:\windows\system32\drivers\nvhda64v.sys

2012-02-26 17:38 . 2012-03-10 18:17 -------- d-----w- c:\program files\NVIDIA Corporation

2012-02-26 17:37 . 2012-02-26 17:37 -------- d-----w- C:\NVIDIA

2012-02-24 12:07 . 1999-11-10 18:05 86016 ----a-w- c:\windows\unvise32qt.exe

2012-02-20 03:32 . 2012-02-20 03:32 -------- d-----w- c:\programdata\Tages

2012-02-19 23:40 . 2012-02-19 23:40 -------- d-----w- c:\windows\en

2012-02-19 23:38 . 2012-02-19 23:38 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition

2012-02-19 23:38 . 2012-03-10 23:40 -------- dc----w- c:\windows\system32\DRVSTORE

2012-02-19 23:37 . 2012-02-19 23:37 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\6fd86fea1ccef5f01\MeshBetaRemover.exe

2012-02-19 23:25 . 2012-02-19 23:47 -------- d-----w- c:\program files\Windows Live

2012-02-19 23:11 . 2012-02-29 23:30 -------- d-----w- c:\program files\CCleaner

2012-02-19 23:09 . 2012-02-19 23:09 -------- d-----w- c:\program files\7-Zip

2012-02-17 12:23 . 2012-02-17 12:23 -------- d-----w- c:\program files (x86)\Guild Wars

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-15 03:36 . 2011-09-19 15:53 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-23 15:18 . 2011-09-19 16:00 279656 ------w- c:\windows\system32\MpSigStub.exe

2012-02-03 12:00 . 2012-02-03 12:00 164992 ----a-w- c:\windows\SysWow64\drivers\athsgt.sys

2012-02-03 12:00 . 2012-02-03 12:00 12544 ----a-w- c:\windows\SysWow64\drivers\limsgt.sys

2012-01-04 10:44 . 2012-02-15 11:52 509952 ----a-w- c:\windows\system32\ntshrui.dll

2012-01-04 08:58 . 2012-02-15 11:52 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll

2011-12-31 23:19 . 2011-10-13 11:23 466456 ----a-w- c:\windows\system32\wrap_oal.dll

2011-12-31 23:19 . 2011-10-13 11:23 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2011-12-31 23:19 . 2011-10-13 11:23 122904 ----a-w- c:\windows\system32\OpenAL32.dll

2011-12-31 23:19 . 2011-10-13 11:23 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll

2011-12-30 06:26 . 2012-02-15 11:52 515584 ----a-w- c:\windows\system32\timedate.cpl

2011-12-30 05:27 . 2012-02-15 11:52 478720 ----a-w- c:\windows\SysWow64\timedate.cpl

2011-12-28 03:59 . 2012-02-15 11:52 498688 ----a-w- c:\windows\system32\drivers\afd.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{0F802439-432B-1C45-7CD3-59DE607400C2}]

2009-07-14 01:11 73728 ----a-w- c:\windows\SysWOW64\KBDDCAN.DLL

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{2E90012A-40C7-6932-71FF-6EB3583B4BEB}]

2011-06-11 07:58 73728 ----a-w- c:\windows\SysWOW64\mffc100enu.dll

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"adaware"="reg.exe delete HKCU\Software\AppDataLow\Software\adaware" [X]

"adaware_XP"="reg.exe delete HKCU\Software\adaware" [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2009-07-14 27136]

R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.352.0\SeaPort.exe [2012-01-21 240408]

R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 hexmagic;hexmagic;c:\windows\system32\drivers\hexmagic.sys [x]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys [x]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.352.0\BBSvc.exe [2012-01-21 192792]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]

S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx64.sys [x]

S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx64.sys [x]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2012-03-16 c:\windows\Tasks\At1.job

- c:\windows\SysWOW64\reeg.exe [2009-07-13 01:14]

.

2012-03-16 c:\windows\Tasks\At2.job

- c:\windows\SysWOW64\taasklist.exe [2009-07-13 01:14]

.

--------- x86-64 -----------

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.cbsnews.com/?ocid=MIE8MSNB/

mLocal Page = c:\windows\system32\blank.htm

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 75.75.76.76 75.75.75.75

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-3974904213-1714037821-1548854753-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (S-1-5-21-3974904213-1714037821-1548854753-1001)

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-3974904213-1714037821-1548854753-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (S-1-5-21-3974904213-1714037821-1548854753-1001)

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_USERS\S-1-5-21-3974904213-1714037821-1548854753-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:de,c3,8d,0f,b5,ef,fe,33,23,9c,d6,63,2d,f7,42,f2,bb,d6,3b,49,9a,ed,77,

84,dd,84,45,e8,ac,28,db,3f,96,8f,50,06,e6,d5,85,5a,61,d1,19,7f,24,e6,53,2a,\

"??"=hex:1b,5c,00,6c,19,29,b6,60,a7,81,26,f9,6d,5e,cb,bb

.

[HKEY_USERS\S-1-5-21-3974904213-1714037821-1548854753-1001\Software\SecuROM\License information*]

"datasecu"=hex:30,d1,14,ac,0d,c6,af,15,6b,19,cf,47,74,9b,89,bf,19,50,34,0c,b4,

69,50,af,26,b1,00,c1,a4,17,00,89,ca,74,00,94,ce,ad,fb,7d,45,05,a0,6c,1f,f4,\

"rkeysecu"=hex:05,34,13,a2,22,06,63,9f,9d,7d,81,00,92,99,7c,60

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]

"value"="?\09\05\17\0e\0b\06?"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-03-17 09:54:04 - machine was rebooted

ComboFix-quarantined-files.txt 2012-03-17 14:54

.

Pre-Run: 229,692,833,792 bytes free

Post-Run: 229,483,610,112 bytes free

.

- - End Of File - - B5DE878AB390CE3F35EA02A21708A856

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Kenny at 9:56:27 on 2012-03-17

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4091.2508 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BBSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\notepad.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Microsoft Security Client\msseces.exe

c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\SeaPort.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingApp.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingBar.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingSurrogate.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.cbsnews.com/?ocid=MIE8MSNB/

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Groove Folder Synchronization: {0f802439-432b-1c45-7cd3-59de607400c2} - C:\Windows\SysWOW64\KBDDCAN.DLL

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Adobe PDF Link Helper: {2e90012a-40c7-6932-71ff-6eb3583b4beb} - C:\Windows\SysWow64\mffc100enu.dll

BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll

BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll"

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

dRunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f

dRunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 75.75.76.76 75.75.75.75

TCP: Interfaces\{037AEAC4-C825-4164-8D9F-487EA929E4E3} : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{23186FDD-D6B1-418E-8FCD-806ABA5FA22A} : DhcpNameServer = 75.75.76.76 75.75.75.75

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO-X64: 0x1 - No File

BHO-X64: Groove Folder Synchronization: {0F802439-432B-1C45-7CD3-59DE607400C2} - C:\Windows\SysWOW64\KBDDCAN.DLL

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Adobe PDF Link Helper: {2E90012A-40C7-6932-71FF-6EB3583B4BEB} - C:\Windows\SysWow64\mffc100enu.dll

BHO-X64: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll

BHO-X64: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File

TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BingExt.dll"

TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\BBSvc.EXE [2012-1-21 192792]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-3-16 652360]

R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.352.0\SeaPort.EXE [2012-1-21 240408]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]