MWBS cannot remove Trojan.Dropper.BCminer

mlww2usa · June 3, 2012

Hello,

I was a recent reciepient of this wonderful little bugger. I have tried to wipe out with Malewarebytes and used Microsoft AV no luck. I have noticed that after this hit I no longer have control of MS Firewall or Windows Defender. Looks like it damaged or removed the services. Appreciate any help!!!

I have attached the logs below for DDS and Malewarebytes......

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.06.02.06

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

Matt :: MATT-PC [administrator]

6/2/2012 8:39:10 PM

mbam-log-2012-06-02 (20-39-10).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 548326

Time elapsed: 1 hour(s), 5 minute(s), 27 second(s)

Memory Processes Detected: 1

C:\Users\Matt\AppData\Local\hlqxfs.exe (Trojan.Agent) -> 3064 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 4

C:\Users\Matt\AppData\Local\hlqxfs.exe (Trojan.Agent) -> Delete on reboot.

C:\Program Files (x86)\Bethesda Softworks\Star Trek Legacy\BatchFilesUU.exe (Adware.Onlinegames) -> Quarantined and deleted successfully.

C:\Program Files (x86)\FREEzeFlip\bin\1.0.4.0\LaunchHelp.dll (Adware.Seekmo) -> Quarantined and deleted successfully.

C:\Windows\Installer\{24c91c19-2c95-4982-c16d-d1be8ce9f70a}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.

(end)

DDS.TXT

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Matt at 11:45:33 on 2012-06-03

.

============== Running Processes ===============

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.swagbucks.com/?cmd=home

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

uRun: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

mRun: [RemoteControl] "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"

mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPPSC2~1.LNK - C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPODDT~1.LNK - C:\Program Files (x86)\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: DhcpNameServer = 10.0.0.1

TCP: Interfaces\{014E09BE-D95D-44E9-B97C-5D5C861EDB87} : DhcpNameServer = 10.0.0.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO-X64: Increase performance and video formats for your HTML5 <video> - No File

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

mRun-x64: [RemoteControl] "C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe"

mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

mRun-x64: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

.

============= SERVICES / DRIVERS ===============

.

=============== Created Last 30 ================

.

2012-06-03 03:01:48 927800 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{11016DAD-196D-4DC1-B2DD-B6B4D4499279}\gapaengine.dll

2012-06-03 03:01:45 8955792 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{48B45165-E834-4CBC-BBC0-0D675C8E0CC5}\mpengine.dll

2012-06-03 02:56:23 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2012-06-03 02:56:18 -------- d-----w- C:\Program Files\Microsoft Security Client

2012-06-03 02:56:00 374664 ----a-w- C:\Windows\System32\drivers\netio.sys

2012-06-02 16:40:38 419488 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-06-01 18:05:40 -------- d-----w- C:\Users\Matt\AppData\Roaming\wargaming.net

2012-06-01 18:05:28 -------- d--h--w- C:\Windows\msdownld.tmp

2012-06-01 18:05:28 -------- d-----w- C:\Windows\SysWow64\directx

2012-06-01 18:05:27 -------- d-----w- C:\Games

2012-05-30 00:49:09 8955792 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{ACA6B8E3-B2BB-48CF-9857-F089CFDB2ECE}\mpengine.dll

2012-05-25 20:27:08 281032 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2012-05-25 20:24:37 -------- d-----w- C:\Users\Matt\AppData\Local\PunkBuster

2012-05-25 20:24:37 -------- d-----w- C:\Users\Matt\AppData\Local\CrashRpt

2012-05-25 20:23:41 -------- d-----w- C:\Program Files (x86)\Microsoft Chart Controls

2012-05-19 22:58:37 5504880 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-05-19 22:58:36 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2012-05-19 22:58:36 3902320 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2012-05-19 22:58:35 3143680 ----a-w- C:\Windows\System32\win32k.sys

2012-05-19 22:58:34 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll

2012-05-19 22:58:34 1732096 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL

2012-05-19 22:58:34 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll

2012-05-19 22:58:34 1393664 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll

2012-05-19 22:58:34 1367552 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll

2012-05-19 22:58:33 1895280 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2012-05-14 02:24:46 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll

2012-05-14 02:24:46 1541120 ----a-w- C:\Windows\System32\DWrite.dll

2012-05-14 02:24:45 902656 ----a-w- C:\Windows\System32\d2d1.dll

2012-05-14 02:24:45 320512 ----a-w- C:\Windows\System32\d3d10_1core.dll

2012-05-14 02:24:45 218624 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll

2012-05-14 02:24:45 197120 ----a-w- C:\Windows\System32\d3d10_1.dll

2012-05-14 02:24:45 1837568 ----a-w- C:\Windows\System32\d3d10warp.dll

2012-05-14 02:24:45 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll

2012-05-14 02:24:45 1170944 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2012-05-14 02:24:45 1074176 ----a-w- C:\Windows\SysWow64\DWrite.dll

2012-05-11 01:26:36 75632 ----a-w- C:\Windows\System32\drivers\partmgr.sys

.

==================== Find3M ====================

.

2012-06-02 16:40:38 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-05-28 18:07:54 281032 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2012-05-28 01:49:43 281032 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2012-05-27 19:18:20 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2012-04-04 19:56:40 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-03-21 00:44:12 98688 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys

2012-03-21 00:44:12 203888 ----a-w- C:\Windows\System32\drivers\MpFilter.sys

.

============= FINISH: 11:46:08.37 ===============

Attach.TXT

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

==== Disk Partitions =========================

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

1ClickDownload

Activision®

Adobe Flash Player 10 Plugin

Adobe Reader 9.5.1

Agricultural Simulator 2011

Amazon MP3 Downloader 1.0.10

Apple Application Support

Apple Software Update

ARMA 2: Free

AviSynth 2.5

CCleaner

Coupon Printer for Windows

DivX Setup

DVDFab 6.0.7.0 (18/09/2009)

Empire: Total War

Enigma: Rising Tide International GOLD Edition

Hearts of Iron 2

HP Photo and Imaging 2.0 - All-in-One

HP Photo and Imaging 2.0 - All-in-One Drivers

HP Photo and Imaging 2.0 - hp psc 2170 series

hp psc 2170 series

ImgBurn

IsoBuster 2.8.5

Java Auto Updater

Java 6 Update 29

John Tiller's Campaign Series

Malwarebytes Anti-Malware version 1.61.0.1400

Medieval II: Total War

Medieval II: Total War Kingdoms

Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

MKVtoolnix 5.0.1

Mount & Blade: With Fire and Sword

MSVC80_x86

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Napoleon: Total War

Naval War: Arctic Circle Demo

Nero 8

neroxml

NVIDIA 3D Vision Controller Driver

NVIDIA PhysX

NVIDIA Stereoscopic 3D Driver

PC Connectivity Solution

PowerDirector Express

PowerDVD

PowerProducer

PT Boats: Knights of The Sea

PunkBuster Services

QuickPar 0.9

QuickTime

Realtek High Definition Audio Driver

Red Orchestra 2: Heroes of Stalingrad

Roblox

Rome: Total War - Alexander

Rome: Total War Gold Edition

Safari

Security Update for 2007 Microsoft Office System (KB951550)

Security Update for 2007 Microsoft Office System (KB951944)

Sniper Elite V2 Demo

SpeedFan (remove only)

SPORE™

Star Trek Legacy

Star Trek Online

Steam

The Operational Art of War: Century of Warfare

Tom Clancy's Splinter Cell

Total War: SHOGUN 2

Transformers - War for Cybertron

Universal Extractor 1.6

VC80CRTRedist - 8.0.50727.6195

VCRedistSetup

Veetle TV 0.9.18

Videora Xbox 360 Converter 6

VLC media player 1.0.1

Wargame: European Escalation

Win7codecs

Wolfenstein

World of Warplanes

Xvid 1.1.3 final uninstall

YouTube Downloader App 3.00

.

==== End Of File ===========================

Maniac · June 4, 2012

Hello mlww2usa and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 2

Download aswMBR.exe ( 1.8mB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

Step 3

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
[*]Press "Scan".
[*]It will create a log (FSS.txt) in the same directory the tool is run.
[*]Please copy and paste the log to your reply.

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
aswMBR log
Farbar Service Scanner log
a new fresh DDS log file

mlww2usa · June 5, 2012

HI Maniac,

Thank you for taking the time to help! I havew noticed the latest MalewareBytes report shows the file is no longer listed in the report. Not sure if you can see any other issues in the logs but my Firewall still does not seem to be working. I have uploaded all the logs you requested below.....

Malwarebytes Anti-Malware (Trial) 1.61.0.1400

www.malwarebytes.org

Database version: v2012.06.04.09

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

Matt :: MATT-PC [administrator]

Protection: Enabled

6/4/2012 8:12:30 PM

mbam-log-2012-06-04 (20-12-30).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 213695

Time elapsed: 3 minute(s), 27 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Run date: 2012-06-04 20:19:07

-----------------------------

20:19:07.340 OS Version: Windows x64 6.1.7600

20:19:07.340 Number of processors: 4 586 0x1707

20:19:07.340 ComputerName: MATT-PC UserName: Matt

20:19:08.885 Initialize success

20:19:22.925 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

20:19:22.941 Disk 0 Vendor: SAMSUNG_ 1AA0 Size: 610480MB BusType: 8

20:19:22.941 Disk 0 MBR read successfully

20:19:22.956 Disk 0 MBR scan

20:19:22.956 Disk 0 Windows 7 default MBR code

20:19:22.956 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 597032 MB offset 63

20:19:22.972 Disk 0 scanning C:\Windows\system32\drivers

20:19:27.683 Service scanning

20:19:37.480 Modules scanning

20:19:37.480 Disk 0 trace - called modules:

20:19:37.496 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

20:19:37.496 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800530d060]

20:19:37.496 3 CLASSPNP.SYS[fffff88000dbb43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004ca9050]

20:19:37.496 Scan finished successfully

20:19:52.409 Disk 0 MBR has been saved successfully to "C:\Users\Matt\Desktop\Maleware fix\MBR.dat"

20:19:52.409 The log file has been saved successfully to "C:\Users\Matt\Desktop\Maleware fix\aswMBR.txt"

FARBAR

Farbar Service Scanner Version: 05-06-2012

Ran by Matt (administrator) on 04-06-2012 at 20:21:03

Running from "C:\Users\Matt\Desktop\Maleware fix"

Windows 7 Ultimate (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

mpsdrv Service is not running. Checking service configuration:

The start type of mpsdrv service is OK.

The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.

bfe Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

wscsvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys

[2012-02-14 16:07] - [2011-12-27 23:59] - 0499200 ____A (Microsoft Corporation) DB9D6C6B2CD95A9CA414D045B627422E

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys

[2012-05-19 18:58] - [2012-03-30 07:09] - 1895280 ____A (Microsoft Corporation) 624C5B3AA4C99B3184BB922D9ECE3FF0

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll

[2009-07-13 20:09] - [2009-07-13 21:41] - 0824832 ____A (Microsoft Corporation) AECAB449567D1846DAD63ECE49E893E3

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll

[2009-07-13 19:36] - [2009-07-13 21:41] - 0170496 ____A (Microsoft Corporation) 765A27C3279CE11D14CB9E4F5869FCA5

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll

[2009-07-13 20:36] - [2009-07-13 21:41] - 2418176 ____A (Microsoft Corporation) 38340204A2D0228F1E87740FC5E554A7

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

DDS LOG

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Matt at 20:22:27 on 2012-06-04

.

============== Running Processes ===============

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.swagbucks.com/?cmd=home

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll