logs of malwarebytes and hijack

tyler · February 5, 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:05:52 AM, on 2/5/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Bell\Security Manager\Fws.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Personal Vault\VaultClientUpgrade.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)

O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Sympatico Security Manager (Radialpoint Security Services) - Radialpoint Inc. - C:\Program Files\Bell\Security Manager\RpsSecurityAware.exe

O23 - Service: Sympatico Security Manager Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Bell\Security Manager\rpsupdaterR.exe

O23 - Service: Sympatico Security Manager Firewall (RP_FWS) - Bell Sympatico - C:\Program Files\Bell\Security Manager\Fws.exe

O23 - Service: Personal Vault Upgrade Service (VaultClientUpgrade) - BELL - C:\Program Files\Personal Vault\VaultClientUpgrade.exe

--

End of file - 2606 bytes

Malwarebytes' Anti-Malware 1.33

Database version: 1730

Windows 5.1.2600 Service Pack 3

2/4/2009 9:04:05 PM

mbam-log-2009-02-04 (21-04-05).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|)

Objects scanned: 116200

Time elapsed: 26 minute(s), 23 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Awaiting further instuction

tyler · February 5, 2009

not sure i gave enough info both programs could not delete those malware for good whats next step.

tyler · February 5, 2009

ok i used combofix here is result

ComboFix 09-02-04.01 - user 2009-02-05 3:49:54.2 - FAT32x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.236 [GMT -5:00]

Running from: c:\documents and settings\user\Desktop\ComboFix.exe

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated)

AV: Sympatico Security Manager Anti-Virus *On-access scanning disabled* (Updated)

FW: Sympatico Security Manager Firewall *disabled*

.

((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))

.

2009-02-05 03:12 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll

2009-02-04 19:53 . 2009-02-04 19:53 <DIR> d--hs---- C:\FOUND.016

2009-02-04 19:45 . 2009-02-04 19:45 <DIR> d-------- c:\program files\Trend Micro

2009-02-04 19:44 . 2009-02-04 19:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira

2009-02-04 05:14 . 2009-02-04 05:14 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-04 05:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-04 05:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-04 02:29 . 2009-02-04 02:29 <DIR> d-------- c:\documents and settings\user\Application Data\Malwarebytes

2009-02-04 01:29 . 2009-02-04 01:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\TEMP

2009-02-03 14:51 . 2009-02-03 14:51 45,568 --------- c:\windows\system32\clickfile.exe

2009-02-01 10:01 . 2009-02-01 10:01 <DIR> d--hs---- c:\windows\system32\twain32

2009-02-01 02:52 . 2009-02-01 02:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard

2009-02-01 02:03 . 2009-02-01 02:03 <DIR> d-------- c:\program files\Windows Installer Clean Up

2009-02-01 02:02 . 2009-02-01 02:03 <DIR> d-------- c:\program files\MSECACHE

2009-02-01 01:44 . 2009-02-01 01:44 <DIR> d-------- c:\program files\Common Files\iS3

2009-02-01 01:43 . 2009-02-01 01:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!

2009-02-01 01:20 . 2009-02-01 01:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-31 09:42 . 2007-08-29 16:06 512,000 --a------ c:\windows\system32\HPIPMX.dll

2009-01-31 09:42 . 2007-08-29 16:06 237,568 --a------ c:\windows\system32\HPIPMXRes.dll

2009-01-31 09:42 . 2007-08-29 16:06 163,840 --a------ c:\windows\system32\CP1215LI.DLL

2009-01-31 09:42 . 2007-08-29 16:06 143,360 --a------ c:\windows\system32\CP1215LM.DLL

2009-01-31 09:42 . 2007-08-29 16:06 114,688 --a------ c:\windows\system32\HPMCoSetup.dll

2009-01-31 09:42 . 2007-08-29 16:06 106,496 --a------ c:\windows\system32\ZSPOOL.DLL

2009-01-31 09:42 . 2007-08-29 16:06 61,440 --a------ c:\windows\system32\ZIMF.DLL

2009-01-31 09:42 . 2008-02-11 15:26 57,344 --a------ c:\windows\system32\CP1215EWS.dll

2009-01-31 09:42 . 2007-08-29 16:06 53,248 --a------ c:\windows\system32\ZTAG.DLL

2009-01-31 09:38 . 2009-01-31 09:38 <DIR> d-------- c:\program files\Hewlett-Packard

2009-01-31 09:17 . 2009-01-31 09:17 <DIR> d-------- c:\documents and settings\user\Application Data\Hewlett-Packard

2009-01-31 06:02 . 2009-02-05 03:53 1,104 --a------ c:\windows\yogodjvv

2009-01-25 17:24 . 2009-01-25 17:24 <DIR> d-------- c:\documents and settings\user\tyler2

2009-01-24 14:51 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll

2009-01-24 14:49 . 2009-01-24 14:49 <DIR> d-------- c:\windows\Logs

2009-01-24 14:49 . 2009-01-24 14:49 302,928 --a------ C:\dxwebsetup.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-31 21:39 90,112 ----a-w c:\windows\DUMP46cd.tmp

2009-01-31 21:07 90,112 ----a-w c:\windows\DUMP562e.tmp

2008-12-13 06:40 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll

2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys

2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys

2008-11-27 16:14 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll

2008-11-27 16:14 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll

2008-11-27 16:14 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll

2008-11-27 16:14 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll

2008-11-27 16:14 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll

2008-09-15 08:06 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091520080916\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSetActiveDesktop"= 1 (0x1)

"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=

"c:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.7.6383-enUS-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\MSN Messenger\\MsnMsgr.Exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

R2 VaultClientUpgrade;Personal Vault Upgrade Service;c:\program files\Personal Vault\VaultClientUpgrade.exe [2008-03-07 53248]

S0 yogodjvv;yogodjvv;c:\windows\system32\drivers\ojmpkcyu.sys []

S3 Radialpoint Security Services;Sympatico Security Manager;c:\program files\Bell\Security Manager\RpsSecurityAware.exe [2008-03-10 67824]

S3 XDva143;XDva143;\??\c:\windows\system32\XDva143.sys --> c:\windows\system32\XDva143.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c047c248-1f9e-11dd-929f-00016c2deccd}]

\Shell\AutoRun\command - I:\start.exe

.

Contents of the 'Scheduled Tasks' folder

2005-12-23 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-06-18 17:17]

2009-02-05 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2009-02-04 c:\windows\Tasks\Registry OK Schedule.job

- c:\program files\Registry OK\RegistryOK.exe []

2009-02-05 c:\windows\Tasks\HP WEP.job

- c:\program files\HP\Dfawep\bin\hpbdfawep.exe [2007-04-25 14:28]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\5nquye0b.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-05 03:54:28

Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(680)

c:\program files\CA\PPRT\bin\CACheck.dll

c:\program files\CA\PPRT\bin\CAHook.dll

c:\program files\CA\PPRT\bin\CAServer.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\BELL\SECURITY MANAGER\FWS.EXE

c:\windows\SYSTEM32\LEXBCES.EXE

c:\windows\SYSTEM32\LEXPPS.EXE

c:\program files\COMMON FILES\AUTHENTIUM\ANTIVIRUS\DVPAPI.EXE

c:\program files\CA\PPRT\BIN\ITMRTSVC.EXE

c:\windows\SYSTEM32\WDFMGR.EXE

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-02-05 3:56:09 - machine was rebooted

ComboFix-quarantined-files.txt 2009-02-05 08:56:08

ComboFix2.txt 2009-02-05 08:13:38

Pre-Run: 46,057,455,616 bytes free

Post-Run: 46,036,287,488 bytes free

155 --- E O F --- 2009-01-19 08:04:27

p.s. i could not find out how to turn off some avirl antivir, and i ran hyjack this after and i got the same files as before with some new ones for pop ups i need assistance bad please help me.

AdvancedSetup · February 5, 2009

Sorry for the delay, please try to be patient as there are many others requesting assistance too and there are only so many of us to help you.

STEP 1 Remove unwanted Anti-Virus

The logs show that you have multiple Anti-Virus products installed. You can only have 1 installed.

Avira AntiVir PersonalEdition

Sympatico Security Manager Anti-Virus

Please choose one and FULLY remove the other one. You should do that NOW.

STEP 2

I would recommend removing Registry OK cleaning the Registry can often cause more harm than good.

STEP 3

I would recommend using NTFS for the file system instead of FAT32x86 but we can take care of that later if you want to.

STEP 4

Click on START - RUN and copy/paste the contents of the CODE box into the run line and click OK

It will blink a window very quickly and that's it, it's done.

REG DELETE HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\{c047c248-1f9e-11dd-929f-00016c2deccd} /F

STEP 5

Download but do not yet run ComboFix

If you have a previous version of Combofix.exe, delete it and download a fresh copy.

Download it to your DESKTOP - it MUST run from the Desktop

download.bleepingcomputer.com/sUBs/ComboFix.exe

subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

Driver::
yogodjvv
XDva143


File::
c:\windows\Tasks\Registry OK Schedule.job
c:\windows\system32\drivers\ojmpkcyu.sys
c:\windows\system32\XDva143.sys
c:\windows\system32\clickfile.exe
c:\windows\system32\HPIPMX.dll
c:\windows\system32\HPIPMXRes.dll
c:\windows\system32\CP1215LI.DLL
c:\windows\system32\CP1215LM.DLL
c:\windows\system32\HPMCoSetup.dll
c:\windows\system32\ZSPOOL.DLL
c:\windows\system32\ZIMF.DLL
c:\windows\system32\CP1215EWS.dll
c:\windows\system32\ZTAG.DLL
c:\windows\yogodjvv
c:\windows\DUMP46cd.tmp
c:\windows\DUMP562e.tmp

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
Disconnect from the Internet.
Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

STEP 6

CCleaner

CCleaner
Double-click on the downloaded file "ccsetup216.exe" and install the application.
Keep the default installation folder "C:\Program Files\CCleaner"
Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
Click finish when done and close ALL PROGRAMS
Start the CCleaner program.
Click on Registry and Uncheck Registry Integrity so that it does not run
Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
Click on Run Cleaner button on the bottom right side of the program.
Click OK to any prompts

STEP 7

Update and Scan with Malwarebytes' Anti-Malware

Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
[*]When the update is complete, select the Scanner tab
[*]Select Perform quick scan, then click Scan.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Be sure that everything is checked, and click Remove Selected.
[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then RESTART the computer

AFTER the reboot run HJT Do a system scan and save a logfile

The post back NEW MBAM and HJT logs in that order please.

tyler · February 5, 2009

Malwarebytes' Anti-Malware 1.33

Database version: 1732

Windows 5.1.2600 Service Pack 3

2/5/2009 5:24:00 PM

mbam-log-2009-02-05 (17-24-00).txt

Scan type: Quick Scan

Objects scanned: 59001

Time elapsed: 2 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\yogodjvv (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\ojmpkcyu.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:29:01 PM, on 2/5/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Bell\Security Manager\Fws.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Personal Vault\VaultClientUpgrade.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\internet explorer\iexplore.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll