Link Redirect

nexus18 · July 9, 2012

Basically chatting on Facebook when Security Shield pops up saying it has been fully installed. Obviously I proceeded to kill the process and run a scan with Malwarebytes, effectively preventing the infection from becoming worse. The thing is that after getting rid of the Security Shield I started getting redirected everytime I clicked on any Google search link. Ran another scan with Malwarebytes and it always finds 4-5 infections, but everytime it "erases" them with a reboot, they come back.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32

Run by Jose Luis Jr at 18:11:18 on 2012-07-09

Microsoft Windows 7 Alienware 2010 6.1.7600.0.1252.1.1033.18.3054.1210 [GMT -5:00]

.

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Motorola\Bluetooth\obexsrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Aeria Games\Ignite\aeriaignite.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe

C:\Users\Jose Luis Jr\AppData\Local\Akamai\netsession_win.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe

C:\Users\Jose Luis Jr\AppData\Local\Akamai\netsession_win.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\PROGRA~1\Raptr\raptr.exe

C:\PROGRA~1\Raptr\raptr_im.exe

C:\Program Files\Motorola\Bluetooth\audiosrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe

"C:\Windows\System32\svchost.exe" -k LocalServiceDns

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = www.rtwincustomize.net

uInternet Settings,ProxyOverride = <local>

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [Raptr] c:\progra~1\raptr\raptrstub.exe --startup

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun

uRun: [steam] "c:\program files\steam\Steam.exe" -silent

uRun: [sony PC Companion] "c:\program files\sony\sony pc companion\PCCompanion.exe" /Background

uRun: [<NO NAME>] c:\users\jose luis jr\appdata\roaming\Epicbot.exe

uRun: [Akamai NetSession Interface] "c:\users\jose luis jr\appdata\local\akamai\netsession_win.exe"

uRun: [Adobe] rundll32.exe "c:\users\jose luis jr\appdata\local\ati\adobe\tlhxjalb.dll",CreateInstance

mRun: [Welcome Center] c:\windows\system32\rundll32.exe c:\windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [uVS10 Preload] c:\program files\ulead systems\ulead videostudio se dvd\uvPL.exe

mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [bTMTrayAgent] rundll32.exe "c:\program files\motorola\bluetooth\btmshell.dll",TrayApp

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [Aeria Ignite] "c:\program files\aeria games\ignite\aeriaignite.exe" silent

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "c:\programdata\malwarebytes\malwarebytes' anti-malware\cleanup.dll",ProcessCleanupScript

dRun: [Adobe] rundll32.exe "c:\users\jose luis jr\appdata\local\ati\adobe\tlhxjalb.dll",CreateInstance

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\motorola\bluetooth\btmiesend.htm

LSP: mswsock.dll

DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{B2A6CA56-F312-4438-A660-D9BCEE99EAEA} : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{B2A6CA56-F312-4438-A660-D9BCEE99EAEA}\25164696F6C4162637 : DhcpNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{B2A6CA56-F312-4438-A660-D9BCEE99EAEA}\3457E61656353686F6F6C6 : DhcpNameServer = 192.168.1.254

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\jose luis jr\appdata\roaming\mozilla\firefox\profiles\iohkau5y.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll

FF - plugin: c:\program files\sony\media go\npmediago.dll

FF - plugin: c:\program files\sony\playstation network downloader\nppsndl.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_262.dll

FF - plugin: c:\windows\system32\npdeployJava1.dll

FF - plugin: c:\windows\system32\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extentions.y2layers.installId - 2b69f06d-e188-4180-a02c-65c8a38955e9

FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader

.

============= SERVICES / DRIVERS ===============

.

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-4-4 63928]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-4-21 172032]

R2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\motorola\bluetooth\obexsrv.exe [2012-6-12 508680]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-6-23 654408]

R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2012-4-21 5550592]

R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2012-4-21 176128]

R3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\motorola\bluetooth\devmgrsrv.exe [2012-6-12 3511888]

R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\motorola\bluetooth\audiosrv.exe [2012-6-12 901384]

R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2010-5-26 136304]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-6-23 22344]

R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-6-10 394856]

R4 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [2012-7-9 203088]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-7 160944]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-21 250056]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\drivers\btmcom.sys [2012-6-12 41344]

S3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\drivers\btmusb.sys [2012-6-12 402432]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2012-5-4 13224]

S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\drivers\MijXfilt.sys [2012-4-21 95304]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-5-4 113120]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [2009-3-25 86824]

S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [2009-3-25 15016]

S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [2009-3-25 114728]

S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [2009-3-25 106208]

S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [2009-3-25 26024]

S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [2009-3-25 104744]

S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [2009-3-25 109864]

S3 Sony PC Companion;Sony PC Companion;c:\program files\sony\sony pc companion\PCCService.exe [2012-5-4 155320]

S3 StkCMini;Syntek AVStream USB2.0 ATV;c:\windows\system32\drivers\StkCMini.sys [2012-4-21 1521544]

S3 WatAdminSvc;WatAdminSvc;c:\windows\system32\wat\WatAdminSvc.exe [2012-4-21 1343400]

.

=============== Created Last 30 ================

.

2012-07-09 22:41:13 -------- d-----w- c:\program files\FileASSASSIN

2012-07-09 22:38:51 -------- d-----w- c:\program files\PC Tools

2012-07-09 22:35:11 203088 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2012-07-09 22:35:11 -------- d-----w- c:\program files\common files\PC Tools

2012-07-09 22:34:36 -------- d-----w- c:\programdata\PC Tools

2012-07-09 22:34:35 -------- d-----w- c:\users\jose luis jr\appdata\roaming\TestApp

2012-07-09 22:33:37 -------- d-----w- C:\TDSSKiller_Quarantine

2012-07-09 22:10:22 54016 ----a-w- c:\windows\system32\drivers\fjgomadg.sys

2012-07-09 05:32:57 98816 ----a-w- c:\windows\sed.exe

2012-07-09 05:32:57 518144 ----a-w- c:\windows\SWREG.exe

2012-07-09 05:32:57 256000 ----a-w- c:\windows\PEV.exe

2012-07-09 05:32:57 208896 ----a-w- c:\windows\MBR.exe

2012-07-09 05:32:49 -------- d-s---w- C:\ComboFix

2012-07-08 22:06:24 -------- d-sh--w- c:\windows\system32\%APPDATA%

2012-07-07 01:33:10 6762896 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{0f44621f-86db-4f1c-80c1-b0b77dd46135}\mpengine.dll

2012-07-07 01:31:35 -------- d-----w- c:\users\jose luis jr\appdata\local\{46357C85-6EAB-42B7-BC89-9DF5B2AD5544}

2012-07-07 01:31:25 -------- d-----w- c:\users\jose luis jr\appdata\local\{A8AA8540-56C3-4B50-B914-5433493C4DC4}

2012-07-03 21:18:09 -------- d-----w- c:\users\jose luis jr\appdata\roaming\inkscape

2012-07-03 20:49:32 -------- d-----w- c:\program files\Inkscape

2012-07-01 22:35:14 -------- d-----w- c:\users\jose luis jr\appdata\roaming\.techniclauncher

2012-07-01 05:33:34 -------- d-----w- c:\users\jose luis jr\appdata\local\Aeria Games

2012-07-01 05:31:59 -------- d-----w- c:\users\jose luis jr\appdata\local\Akamai

2012-07-01 05:31:53 -------- d-----w- c:\programdata\Aeria Games

2012-07-01 05:31:29 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2012-07-01 05:31:28 -------- d-----w- c:\program files\Aeria Games

2012-06-29 22:24:55 -------- d-----w- c:\users\jose luis jr\appdata\roaming\EpicBot

2012-06-29 22:13:49 -------- d-----w- c:\program files\EpicBot

2012-06-26 21:53:52 -------- d-----w- c:\users\jose luis jr\appdata\roaming\OpenOffice.org

2012-06-26 21:50:09 -------- d-----w- c:\program files\OpenOffice.org 3

2012-06-26 21:09:49 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-26 21:09:36 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-26 21:09:27 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-26 21:09:27 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-25 01:44:36 -------- d-----w- c:\users\jose luis jr\jagexcache1

2012-06-23 06:53:39 -------- d-----w- c:\users\jose luis jr\appdata\local\Macromedia

2012-06-23 05:54:59 -------- d-----w- c:\users\jose luis jr\appdata\roaming\Malwarebytes

2012-06-23 05:54:51 -------- d-----w- c:\programdata\Malwarebytes

2012-06-23 05:54:50 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-23 05:54:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-06-12 23:04:16 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-12 23:04:12 2342400 ----a-w- c:\windows\system32\win32k.sys

2012-06-12 23:04:11 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-06-12 23:04:11 57856 ----a-w- c:\windows\system32\rdpwsx.dll

2012-06-12 23:04:11 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-06-12 18:28:53 41344 ----a-w- c:\windows\system32\drivers\btmcom.sys

2012-06-12 18:28:23 402432 ----a-w- c:\windows\system32\drivers\btmusb.sys

2012-06-12 18:28:23 312912 ----a-w- c:\windows\system32\btmcls.dll

2012-06-12 18:28:23 -------- d-----w- c:\program files\Motorola

2012-06-12 18:28:16 -------- d-----w- c:\program files\common files\Macrovision Shared

.

==================== Find3M ====================

.

2012-06-23 06:51:25 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-23 06:51:25 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-05-21 17:26:00 13824 ----a-w- c:\windows\system32\slwga.dll

2012-05-21 17:25:59 409088 ----a-w- c:\windows\system32\systemcpl.dll

2012-05-21 17:25:58 811520 ----a-w- c:\windows\system32\user32.dll

2012-05-17 22:45:37 1800192 ----a-w- c:\windows\system32\jscript9.dll

2012-05-17 22:35:47 1129472 ----a-w- c:\windows\system32\wininet.dll

2012-05-17 22:35:39 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2012-05-17 22:29:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2012-05-17 22:24:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-05-04 07:11:24 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys

2012-05-04 07:11:24 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys

2012-05-04 07:11:24 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2012-05-04 07:10:20 476960 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-05-04 07:10:20 472864 ----a-w- c:\windows\system32\deployJava1.dll

2012-04-22 03:18:32 0 ----a-w- c:\windows\ativpsrm.bin

.

============= FINISH: 18:17:50.63 ===============

screen317 · July 9, 2012

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

nexus18 · July 9, 2012

Here is the MalwareBytes log. Going to run Combofix as of now.

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.07.07.01

Windows 7 x86 NTFS

Internet Explorer 9.0.8112.16421

Jose Luis Jr :: JOSELUISJR-PC [administrator]

7/9/2012 6:29:03 PM

mbam-log-2012-07-09 (18-34-28).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 209445

Time elapsed: 5 minute(s), 10 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 2

C:\Windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\00000008.@ (Trojan.Dropper.BCMiner) -> No action taken.

C:\Windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\80000000.@ (Trojan.Sirefef) -> No action taken.

(end)

nexus18 · July 9, 2012

Done running Combofix, heres the log. DDS log on the works as of now.

ComboFix 12-07-08.03 - Jose Luis Jr 07/09/2012 18:39:52.1.8 - x86

Microsoft Windows 7 Alienware 2010 6.1.7600.0.1252.1.1033.18.3054.1462 [GMT -5:00]

Running from: c:\users\Jose Luis Jr\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\users\Jose Luis Jr\AppData\Local\{f2089992-f439-78e2-f9f3-fce4ad6145b6}

c:\users\Jose Luis Jr\AppData\Local\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\@

c:\users\Jose Luis Jr\AppData\Local\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\n

c:\users\Jose Luis Jr\AppData\Local\ATI\Adobe\tlhxjalb.dll

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\@

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\L\00000004.@

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\L\1afb2d56

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\L\201d3dde

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\n

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\00000004.@

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\00000008.@

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\000000cb.@

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\80000000.@

c:\windows\Installer\{f2089992-f439-78e2-f9f3-fce4ad6145b6}\U\80000032.@

.

Infected copy of c:\windows\system32\services.exe was found and disinfected

Restored copy from - c:\32788r22fwjfw\HarddiskVolumeShadowCopy4_!Windows!System32!services.exe

.

Infected copy of c:\windows\system32\services.exe was found and disinfected

Restored copy from - c:\32788r22fwjfw\HarddiskVolumeShadowCopy4_!Windows!System32!services.exe

.

((((((((((((((((((((((((( Files Created from 2012-06-09 to 2012-07-09 )))))))))))))))))))))))))))))))

.

2012-07-09 23:45 . 2012-07-09 23:47 -------- d-----w- c:\users\Jose Luis Jr\AppData\Local\temp

2012-07-09 23:45 . 2012-07-09 23:45 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-07-09 23:23 . 2012-07-09 23:23 -------- d-----w- c:\program files\Inbox

2012-07-09 22:41 . 2012-07-09 22:41 -------- d-----w- c:\program files\FileASSASSIN

2012-07-09 22:38 . 2012-07-09 23:37 -------- d-----w- c:\program files\PC Tools

2012-07-09 22:35 . 2012-07-09 23:37 -------- d-----w- c:\program files\Common Files\PC Tools

2012-07-09 22:35 . 2012-05-11 16:14 203088 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2012-07-09 22:34 . 2012-07-09 22:56 -------- d-----w- c:\programdata\PC Tools

2012-07-09 22:34 . 2012-07-09 22:34 -------- d-----w- c:\users\Jose Luis Jr\AppData\Roaming\TestApp

2012-07-09 22:33 . 2012-07-09 22:33 -------- d-----w- C:\TDSSKiller_Quarantine

2012-07-08 22:06 . 2012-07-08 22:06 -------- d-sh--w- c:\windows\system32\%APPDATA%

2012-07-07 01:33 . 2012-05-31 03:41 6762896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0F44621F-86DB-4F1C-80C1-B0B77DD46135}\mpengine.dll

2012-07-03 21:18 . 2012-07-03 21:18 -------- d-----w- c:\users\Jose Luis Jr\AppData\Roaming\inkscape

2012-07-03 20:49 . 2012-07-03 20:57 -------- d-----w- c:\program files\Inkscape

2012-07-01 22:35 . 2012-07-01 22:38 -------- d-----w- c:\users\Jose Luis Jr\AppData\Roaming\.techniclauncher

2012-07-01 05:33 . 2012-07-01 05:33 -------- d-----w- c:\users\Jose Luis Jr\AppData\Local\Aeria Games

2012-07-01 05:31 . 2012-07-01 05:33 -------- d-----w- c:\users\Jose Luis Jr\AppData\Local\Akamai

2012-07-01 05:31 . 2012-07-01 05:31 -------- d-----w- c:\programdata\Aeria Games

2012-07-01 05:31 . 2012-07-01 05:31 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2012-07-01 05:31 . 2012-07-01 05:31 -------- d-----w- c:\program files\Aeria Games

2012-06-29 22:24 . 2012-06-29 22:25 -------- d-----w- c:\users\Jose Luis Jr\AppData\Roaming\EpicBot

2012-06-29 22:13 . 2012-06-29 22:13 -------- d-----w- c:\program files\EpicBot

2012-06-26 21:53 . 2012-06-26 21:53 -------- d-----w- c:\users\Jose Luis Jr\AppData\Roaming\OpenOffice.org

2012-06-26 21:50 . 2012-06-26 21:50 -------- d-----w- c:\program files\OpenOffice.org 3

2012-06-26 21:09 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-26 21:09 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-26 21:09 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-26 21:09 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-26 21:09 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-26 21:09 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-26 21:09 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-26 21:09 . 2012-06-02 20:19 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-26 21:09 . 2012-06-02 20:12 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-06-25 01:44 . 2012-06-25 01:44 -------- d-----w- c:\users\Jose Luis Jr\jagexcache1

2012-06-23 06:53 . 2012-06-23 06:53 -------- d-----w- c:\users\Jose Luis Jr\AppData\Local\Macromedia

2012-06-23 05:54 . 2012-06-23 05:54 -------- d-----w- c:\users\Jose Luis Jr\AppData\Roaming\Malwarebytes

2012-06-23 05:54 . 2012-06-23 05:54 -------- d-----w- c:\programdata\Malwarebytes

2012-06-23 05:54 . 2012-06-23 05:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-06-23 05:54 . 2012-04-04 20:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-12 23:04 . 2012-04-28 03:19 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-06-12 23:04 . 2012-05-15 01:12 2342400 ----a-w- c:\windows\system32\win32k.sys

2012-06-12 23:04 . 2012-04-26 04:48 57856 ----a-w- c:\windows\system32\rdpwsx.dll

2012-06-12 23:04 . 2012-04-26 04:48 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-06-12 23:04 . 2012-04-26 04:43 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-06-12 18:28 . 2010-06-30 17:02 41344 ----a-w- c:\windows\system32\drivers\btmcom.sys

2012-06-12 18:28 . 2012-06-12 18:28 -------- d-----w- c:\program files\Motorola

2012-06-12 18:28 . 2010-10-26 23:59 402432 ----a-w- c:\windows\system32\drivers\btmusb.sys

2012-06-12 18:28 . 2010-10-25 21:45 312912 ----a-w- c:\windows\system32\btmcls.dll

2012-06-12 18:28 . 2012-06-12 18:28 -------- d-----w- c:\program files\Common Files\Macrovision Shared

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-23 06:51 . 2012-04-21 05:19 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-23 06:51 . 2012-04-21 05:19 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-02 04:28 . 2011-03-28 23:36 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2012-05-21 17:26 . 2012-04-21 19:04 13824 ----a-w- c:\windows\system32\slwga.dll

2012-05-21 17:25 . 2009-07-13 23:40 409088 ----a-w- c:\windows\system32\systemcpl.dll

2012-05-21 17:25 . 2009-07-13 23:24 811520 ----a-w- c:\windows\system32\user32.dll

2012-05-04 07:11 . 2012-05-04 07:11 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys

2012-05-04 07:11 . 2012-05-04 07:11 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys

2012-05-04 07:11 . 2012-05-04 07:11 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2012-05-04 07:10 . 2012-05-04 07:10 476960 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-05-04 07:10 . 2012-04-22 02:48 472864 ----a-w- c:\windows\system32\deployJava1.dll

2012-04-22 08:06 . 2012-04-22 08:06 86528 ----a-w- c:\windows\system32\iesysprep.dll

2012-04-22 08:06 . 2012-04-22 08:06 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2012-04-22 08:06 . 2012-04-22 08:06 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2012-04-22 08:06 . 2012-04-22 08:06 74752 ----a-w- c:\windows\system32\iesetup.dll

2012-04-22 08:06 . 2012-04-22 08:06 63488 ----a-w- c:\windows\system32\tdc.ocx

2012-04-22 08:06 . 2012-04-22 08:06 48640 ----a-w- c:\windows\system32\mshtmler.dll

2012-04-22 08:06 . 2012-04-22 08:06 420864 ----a-w- c:\windows\system32\vbscript.dll

2012-04-22 08:06 . 2012-04-22 08:06 367104 ----a-w- c:\windows\system32\html.iec

2012-04-22 08:06 . 2012-04-22 08:06 35840 ----a-w- c:\windows\system32\imgutil.dll

2012-04-22 08:06 . 2012-04-22 08:06 23552 ----a-w- c:\windows\system32\licmgr10.dll

2012-04-22 08:06 . 2012-04-22 08:06 161792 ----a-w- c:\windows\system32\msls31.dll

2012-04-22 08:06 . 2012-04-22 08:06 152064 ----a-w- c:\windows\system32\wextract.exe

2012-04-22 08:06 . 2012-04-22 08:06 150528 ----a-w- c:\windows\system32\iexpress.exe

2012-04-22 08:06 . 2012-04-22 08:06 11776 ----a-w- c:\windows\system32\mshta.exe

2012-04-22 08:06 . 2012-04-22 08:06 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2012-04-22 08:06 . 2012-04-22 08:06 101888 ----a-w- c:\windows\system32\admparse.dll

2012-06-16 05:55 . 2012-04-22 03:37 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2012-05-21 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll

[7] 2010-11-20 . F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 . 811520 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\4a7f49b3f65af6828820068e5dd598c8\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Raptr"="c:\progra~1\Raptr\raptrstub.exe" [2012-04-16 53168]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-08 17425072]

"Steam"="c:\program files\Steam\Steam.exe" [2012-04-30 1242448]

"Sony PC Companion"="c:\program files\Sony\Sony PC Companion\PCCompanion.exe" [2012-05-31 445624]

"Akamai NetSession Interface"="c:\users\Jose Luis Jr\AppData\Local\Akamai\netsession_win.exe" [2012-05-26 4327744]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Welcome Center"="c:\windows\system32\OobeFldr.dll" [2010-06-05 954880]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-04 8120864]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-05 102400]

"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-09 36864]

"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2010-10-25 20895312]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"Aeria Ignite"="c:\program files\Aeria Games\Ignite\aeriaignite.exe" [2012-05-24 1241184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 btmaudio;Motorola Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys [x]

R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys [x]

R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [x]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x]

R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]

R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]

R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]

R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]

R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]

R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]

R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]

R3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [x]

R3 StkCMini;Syntek AVStream USB2.0 ATV;c:\windows\system32\Drivers\StkCMini.sys [x]

R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [x]

S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2012-07-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 06:51]

.

------- Supplementary Scan -------

.

uStart Page = www.rtwincustomize.net

uInternet Settings,ProxyOverride = <local>

IE: {{bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\Motorola\Bluetooth\btmiesend.htm

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Jose Luis Jr\AppData\Roaming\Mozilla\Firefox\Profiles\iohkau5y.default\

FF - prefs.js: network.proxy.type - 0

FF - user.js: extentions.y2layers.installId - 2b69f06d-e188-4180-a02c-65c8a38955e9

FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-Adobe - c:\users\Jose Luis Jr\AppData\Local\ATI\Adobe\tlhxjalb.dll

HKU-Default-Run-Adobe - c:\users\Jose Luis Jr\AppData\Local\ATI\Adobe\tlhxjalb.dll

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\AUDIODG.EXE

c:\windows\system32\atieclxx.exe

c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\windows\System32\rundll32.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\Motorola\Bluetooth\btplayerctrl.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\System32\rundll32.exe

.

**************************************************************************

.

Completion time: 2012-07-09 18:49:48 - machine was rebooted

ComboFix-quarantined-files.txt 2012-07-09 23:49

.

Pre-Run: 324,248,911,872 bytes free

Post-Run: 325,051,179,008 bytes free

.

- - End Of File - - BB2AAB214E24C9C5A55AB256D82520AF

nexus18 · July 9, 2012

New DDS log after running Combofix.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_32

Run by Jose Luis Jr at 18:51:37 on 2012-07-09

Microsoft Windows 7 Alienware 2010 6.1.7600.0.1252.1.1033.18.3054.1684 [GMT -5:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Motorola\Bluetooth\obexsrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Aeria Games\Ignite\aeriaignite.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Motorola\Bluetooth\audiosrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\Explorer.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE