Newsfudge Malware

herbchristopher · July 14, 2012

My wife downloaded some malware. I had Microsoft Security Essentials running in the background, but it did not catch it then or after scanning my computer. The malware typically would reroute a websearch at Google to a website called Newsfudge. After restarting my computer I cannot run in normal mode, it's too slow, and actually freezes up after 30 seconds after windows is all booted up. I can run safe mode just fine.

I installed Malwarebytes and it found three files that needed to be removed. My computer still freezes after boot up. I read that you no longer use HiJackThis. So, I ran the MalwareBytes tool and these are my results:

DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK

Internet Explorer: 9.0.8112.16421

Run by Chris at 21:28:48 on 2012-07-13

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4010.3185 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

.

============== Running Processes ===============

.

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

C:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\windows\Explorer.EXE

C:\windows\system32\ctfmon.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\system32\NOTEPAD.EXE

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\SysWOW64\cscript.exe

C:\windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://www.google.com/

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN

mStart Page = hxxp://lenovo.msn.com

uInternet Settings,ProxyOverride = *.local

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\PlusIEContextMenu.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: EgisPBIE Class: {7b51ccbe-4af9-44a6-bdab-d7f7e4c4e6f9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: ZeonIEEventHelper Class: {da986d7d-ccaf-47b2-84fe-bfa1549bebf9} - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: Nuance PDF: {e3286bf1-e654-42ff-b4a6-5e111731df6b} - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll

uRun: [WLSync] "C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe" /background

uRun: [Facebook Update] "C:\Users\Chris\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [dysiap] rundll32.exe "C:\Users\Chris\AppData\Roaming\dysiap.dll",FileCreate

uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

mRun: [PLTSR] "C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Append the content of the link to existing PDF file - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML

IE: Append the content of the selected links to existing PDF file - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML

IE: Append to existing PDF file - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML

IE: Create PDF file - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML

IE: Create PDF file from the content of the link - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML

IE: Create PDF files from the selected links - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: Open with Nuance PDF Converter 6.0 - C:\Program Files (x86)\Nuance\PDF Professional 6\cnvres_eng.dll /100

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.3.0.cab

TCP: DhcpNameServer = 208.180.42.68 208.180.42.100

TCP: Interfaces\{8B659D86-C6E6-4607-AC33-8014EC4846CD} : DhcpNameServer = 208.180.42.100 208.180.42.68

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E} : DhcpNameServer = 208.180.42.68 208.180.42.100

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E}\24F696E676F60284F6473707F647 : DhcpNameServer = 10.1.0.1 66.103.64.5 66.103.80.4

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E}\3747275676963786F6573747F6E6765756374727F6F6D6 : DhcpNameServer = 4.2.2.1

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E}\442716B65686F6D656 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E}\841435D2743747 : DhcpNameServer = 4.2.2.2 4.2.2.1 10.28.54.45 10.28.55.20

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E}\84562726023557464656E6C496E6B6 : DhcpNameServer = 208.180.42.100 208.180.42.68

TCP: Interfaces\{917ADF30-AF7E-4E4A-AE06-41E500A3685E}\D45646963616C602D496C6560275966696 : DhcpNameServer = 97.64.183.164 97.64.209.37

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

LSA: Notification Packages = scecli EgisPwdFilter EgisDSPwdFilter EgisPLPwdFilter

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO-X64: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\PlusIEContextMenu.dll

BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: EgisPBIE Class: {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll

BHO-X64: EgisPBIE - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: ZeonIEEventHelper Class: {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: Nuance PDF: {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files (x86)\Nuance\PDF Professional 6\Bin\ZeonIEFavClient.dll

mRun-x64: [PLTSR] "C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

.

============= SERVICES / DRIVERS ===============

.

R0 fbfmon;fbfmon;C:\windows\system32\drivers\fbfmon.sys --> C:\windows\system32\drivers\fbfmon.sys [?]

R0 LHDmgr;LHDmgr;C:\windows\system32\DRIVERS\LhdX64.sys --> C:\windows\system32\DRIVERS\LhdX64.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]

R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]

R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUVStor.sys --> C:\windows\system32\Drivers\RtsUVStor.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]

S0 MpFilter;Microsoft Malware Protection Driver;C:\windows\system32\DRIVERS\MpFilter.sys --> C:\windows\system32\DRIVERS\MpFilter.sys [?]

S1 BPntDrv;BPntDrv;C:\windows\system32\drivers\BPntDrv.sys --> C:\windows\system32\drivers\BPntDrv.sys [?]

S1 EgisTecFF;EgisTecFF;C:\windows\system32\DRIVERS\EgisTecFF.sys --> C:\windows\system32\DRIVERS\EgisTecFF.sys [?]

S1 mwlPSDFilter;mwlPSDFilter;C:\windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\windows\system32\DRIVERS\mwlPSDFilter.sys [?]

S1 mwlPSDNServ;mwlPSDNServ;C:\windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\windows\system32\DRIVERS\mwlPSDNServ.sys [?]

S1 mwlPSDVDisk;mwlPSDVDisk;C:\windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\windows\system32\DRIVERS\mwlPSDVDisk.sys [?]

S2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 EgisTec Service Help;EgisTec Service Help;C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024]

S2 EgisTec Service;EgisTec Service;C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856]

S2 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096]

S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);C:\windows\system32\Drivers\FPSensor.sys --> C:\windows\system32\Drivers\FPSensor.sys [?]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc --> C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [?]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-7-12 655944]

S2 PDFProFiltSrv;PDFProFiltSrv;C:\Program Files (x86)\Nuance\PDF Professional 6\PDFProFiltSrv.exe [2009-7-27 134944]

S2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-7-13 1153368]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]

S2 SSICloudService;SSICloudService;C:\Program Files (x86)\Software Secure, Inc\SSICloudService\SSICloudService.exe [2012-2-3 220160]

S2 SSIRuntimeService;SSIRuntimeService;C:\Program Files (x86)\Software Secure, Inc\SSIRuntimeService\SSIRuntimeService.exe [2012-2-3 33792]

S2 SsiSrpDiagnosticsService;SSI SRP Diagnostics Service;C:\Program Files (x86)\Software Secure, Inc\Software Secure, Inc\SsiDiagnosticsService.exe [2010-12-6 15360]

S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-10-4 2656280]

S2 WebUpdate4;Web Update Wizard Service V4;C:\Windows\SysWOW64\WebUpdateSvc4.exe [2007-5-18 229856]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-6 250056]

S3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\system32\DRIVERS\clwvd.sys --> C:\windows\system32\DRIVERS\clwvd.sys [?]

S3 cphs;Intel® Content Protection HECI Service;C:\Windows\SysWOW64\IntelCpHeciSvc.exe [2012-3-19 276248]

S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2012-3-20 14216]

S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2012-3-20 8456]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc --> C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [?]

S3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]

S3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys --> C:\windows\system32\drivers\mbam.sys [?]

S3 NisDrv;Microsoft Network Inspection System;C:\windows\system32\DRIVERS\NisDrvWFP.sys --> C:\windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]

S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]

S3 vm331avs;Digital Camera 1;C:\windows\system32\Drivers\vm331avs.sys --> C:\windows\system32\Drivers\vm331avs.sys [?]

S3 vmuvcflt;Vimicro USB Camera Filter;C:\windows\system32\Drivers\vmuvcflt.sys --> C:\windows\system32\Drivers\vmuvcflt.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]

S3 wsvd;wsvd;C:\windows\system32\DRIVERS\wsvd.sys --> C:\windows\system32\DRIVERS\wsvd.sys [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-07-14 02:14:46 -------- dc----w- C:\Users\Chris\AppData\Local\{DB61C036-6D9B-46E8-824F-96E682D2CC1E}

2012-07-14 02:14:31 -------- dc----w- C:\Users\Chris\AppData\Local\{FCF97C6A-F02C-40F1-BEA5-A8A67F045541}

2012-07-14 01:40:49 -------- dc----w- C:\ProgramData\Spybot - Search & Destroy

2012-07-14 01:40:49 -------- dc----w- C:\Program Files (x86)\Spybot - Search & Destroy

2012-07-13 03:15:34 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C0ACB4D6-48CA-46C1-8164-EB1614896BE9}\offreg.dll

2012-07-13 02:07:37 -------- dc----w- C:\Users\Chris\AppData\Roaming\Malwarebytes

2012-07-13 02:07:15 -------- dc----w- C:\ProgramData\Malwarebytes

2012-07-13 02:07:11 24904 -c--a-w- C:\windows\System32\drivers\mbam.sys

2012-07-13 02:07:10 -------- dc----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-07-13 01:30:17 -------- dc----w- C:\Users\Chris\AppData\Local\{466B1C3D-CC8A-11E1-8270-B8AC6F996F26}

2012-07-13 01:30:13 377856 -c--a-w- C:\Users\Chris\AppData\Roaming\dysiap.dll

2012-07-12 23:54:28 -------- dc----w- C:\Users\Chris\AppData\Local\{570CB5D4-EBD4-4390-9C37-04D449D74FDF}

2012-07-12 14:02:19 9013136 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C0ACB4D6-48CA-46C1-8164-EB1614896BE9}\mpengine.dll

2012-07-12 11:54:00 -------- dc----w- C:\Users\Chris\AppData\Local\{B3727647-22C6-4954-9E59-EEDCAC8EF799}

2012-07-12 11:53:47 -------- dc----w- C:\Users\Chris\AppData\Local\{25BAF4D9-1712-4155-A308-8F0DDCB9C77B}

2012-07-12 03:11:14 3148800 ----a-w- C:\windows\System32\win32k.sys

2012-07-11 20:36:37 2004480 ----a-w- C:\windows\System32\msxml6.dll

2012-07-11 20:30:52 466944 ----a-w- C:\Program Files\Common Files\System\ado\msadomd.dll

2012-07-11 20:30:52 258048 ----a-w- C:\Program Files\Common Files\System\msadc\msadco.dll

2012-07-11 20:30:52 1499136 ----a-w- C:\Program Files\Common Files\System\ado\msado15.dll

2012-07-11 20:30:52 1019904 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msado15.dll

2012-07-11 20:30:51 805376 ----a-w- C:\windows\SysWow64\cdosys.dll

2012-07-11 20:30:51 61440 ----a-w- C:\Program Files\Common Files\System\ado\msador15.dll

2012-07-11 20:30:51 57344 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msador15.dll

2012-07-11 20:30:51 495616 ----a-w- C:\Program Files\Common Files\System\ado\msadox.dll

2012-07-11 20:30:51 372736 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msadox.dll

2012-07-11 20:30:51 352256 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msadomd.dll

2012-07-11 20:30:51 212992 ----a-w- C:\Program Files (x86)\Common Files\System\msadc\msadco.dll

2012-07-11 20:30:51 143360 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msjro.dll

2012-07-11 20:30:51 1133568 ----a-w- C:\windows\System32\cdosys.dll

2012-07-11 18:12:46 -------- dc----w- C:\Users\Chris\AppData\Local\{E8512AEA-F566-46E6-AD1F-C0A81EC2E7BC}

2012-07-11 13:37:57 9013136 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-07-11 04:20:21 -------- dc----w- C:\Users\Chris\AppData\Local\{A1020FD3-5904-4424-875E-6A4ED46E726F}

2012-07-10 16:19:57 -------- dc----w- C:\Users\Chris\AppData\Local\{26C3EF90-1AA3-4CBE-9AEA-26F45F1ABC6B}

2012-07-10 16:19:46 -------- dc----w- C:\Users\Chris\AppData\Local\{090FE3BC-89B4-430D-9116-8591A1283E06}

2012-07-10 04:19:21 -------- dc----w- C:\Users\Chris\AppData\Local\{2E2FD7E8-6C3D-4F64-A6C6-EB6104485E89}

2012-07-09 14:37:21 -------- dc----w- C:\Users\Chris\AppData\Local\{D47F37C4-A3F6-4F5F-A79D-CB5C83474DBF}

2012-07-09 14:37:07 -------- dc----w- C:\Users\Chris\AppData\Local\{43A7FC58-A32E-43FF-9A92-048841C5AC43}

2012-07-08 16:05:12 -------- dc----w- C:\Users\Chris\AppData\Local\{B7067734-4A9F-4B6C-BE5B-3F7B14C76F50}

2012-07-08 16:04:58 -------- dc----w- C:\Users\Chris\AppData\Local\{27DCC5D2-B198-4A21-9450-BA6BB053A31D}

2012-07-07 16:21:52 -------- dc----w- C:\Users\Chris\AppData\Local\{C06882D4-6EBE-4219-AF72-ECE408FA5704}

2012-07-07 03:40:43 -------- dc----w- C:\Users\Chris\AppData\Local\{D9E3B73D-FE12-4D80-B74A-BBC8BFE2F453}

2012-07-06 15:40:18 -------- dc----w- C:\Users\Chris\AppData\Local\{A358D6C1-CE24-43A2-B5D3-91D815140E1B}

2012-07-06 03:39:54 -------- dc----w- C:\Users\Chris\AppData\Local\{1A336D29-03BF-407A-9A1C-4B695EC361EB}

2012-07-05 15:39:30 -------- dc----w- C:\Users\Chris\AppData\Local\{CFA67504-011F-42C8-9AF4-75920C0B50EE}

2012-07-05 03:39:06 -------- dc----w- C:\Users\Chris\AppData\Local\{84F06CCF-6A0A-4357-867A-0E3B3A59640D}

2012-07-04 12:32:12 -------- dc----w- C:\Users\Chris\AppData\Local\{7C13DB0D-274C-4DFD-89B4-4A3C5E6FEADA}

2012-07-04 12:32:00 -------- dc----w- C:\Users\Chris\AppData\Local\{2E027742-59F9-4765-8C5C-E70938F658BA}

2012-07-04 00:31:34 -------- dc----w- C:\Users\Chris\AppData\Local\{F720AD1D-F796-4B97-8EB4-1347D2334F1A}

2012-07-03 21:18:16 927800 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{90504DF0-2127-42AD-A2F9-511AA75917AD}\gapaengine.dll

2012-07-03 12:31:10 -------- dc----w- C:\Users\Chris\AppData\Local\{57DE7C23-7513-4599-9F06-4D6A430C871E}

2012-07-02 18:06:26 -------- dc----w- C:\Users\Chris\AppData\Local\{9B8FFC94-50B8-4D57-9983-5A4338524D58}

2012-07-02 03:08:35 -------- dc----w- C:\Users\Chris\AppData\Local\{4AA1B356-15DE-4C70-83B3-92266EF748DF}

2012-06-30 22:58:50 -------- dc----w- C:\Users\Chris\AppData\Local\{FB7EA9AA-F34C-43AE-8EB4-597B795744F1}

2012-06-27 21:47:00 -------- dc----w- C:\Users\Chris\AppData\Local\{C7EF70AD-A7C8-48B1-AEE3-825977808AF6}

2012-06-27 03:57:53 -------- dc----w- C:\Users\Chris\AppData\Local\{859821BC-1CAC-4B98-9311-5735EEA295F5}

2012-06-26 12:43:47 -------- dc----w- C:\Users\Chris\AppData\Local\{8C0CE7F1-B765-440D-B3F3-248033817097}

2012-06-25 12:59:25 -------- dc----w- C:\Users\Chris\AppData\Local\{11D3FD59-D01F-43D8-8371-A14856F56A8B}

2012-06-25 00:28:43 -------- dc----w- C:\Users\Chris\AppData\Local\{80C479DD-F1D1-4B3A-BC21-A945646147D5}

2012-06-25 00:28:30 -------- dc----w- C:\Users\Chris\AppData\Local\{030C6BE1-E8E2-41C4-9A38-06247B64F634}

2012-06-19 16:34:05 2622464 ----a-w- C:\windows\System32\wucltux.dll

2012-06-19 16:33:46 99840 ----a-w- C:\windows\System32\wudriver.dll

2012-06-19 16:33:14 36864 ----a-w- C:\windows\System32\wuapp.exe

2012-06-19 16:33:14 186752 ----a-w- C:\windows\System32\wuwebv.dll

2012-06-19 14:47:36 -------- dc----w- C:\Users\Chris\AppData\Local\{0F4CB182-767B-46C2-A423-DA8142882239}

2012-06-19 14:47:24 -------- dc----w- C:\Users\Chris\AppData\Local\{E2B13B73-A41A-4BBC-909E-A1DD28C5AE9B}

2012-06-19 02:46:57 -------- dc----w- C:\Users\Chris\AppData\Local\{EBC7F20E-2DF2-46CA-8A29-2B5FC291C510}

2012-06-19 02:46:45 -------- dc----w- C:\Users\Chris\AppData\Local\{0A1176DE-E556-4456-87B9-01A29826AF88}

2012-06-17 17:15:50 -------- dc----w- C:\Users\Chris\AppData\Local\{7A6768B1-00E1-49C5-857E-3FC797A67AD6}

2012-06-17 17:15:35 -------- dc----w- C:\Users\Chris\AppData\Local\{0E11B8F3-03FE-412F-B524-2D5EF888E5D8}

2012-06-15 20:50:18 -------- dc----w- C:\Users\Chris\AppData\Local\{735E2C68-8953-4990-8D0A-509DA0B78BD3}

2012-06-15 20:50:07 -------- dc----w- C:\Users\Chris\AppData\Local\{8673A41E-CB9E-44A5-9493-75A495C21F39}

2012-06-15 02:59:00 514560 ----a-w- C:\windows\SysWow64\qdvd.dll

2012-06-15 02:59:00 366592 ----a-w- C:\windows\System32\qdvd.dll

2012-06-15 02:28:58 -------- dc----w- C:\Users\Chris\AppData\Local\{DAA8BFC6-929F-4C55-8BC8-B03E39B25DA2}

2012-06-14 14:28:33 -------- dc----w- C:\Users\Chris\AppData\Local\{59FCD77E-0828-482E-8724-6BC0572C1B11}

.

==================== Find3M ====================

.

2012-07-12 11:54:30 426184 -c--a-w- C:\windows\SysWow64\FlashPlayerApp.exe

2012-07-12 11:54:29 70344 -c--a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-12 03:10:15 2048 ----a-w- C:\windows\SysWow64\msxml3r.dll

2012-07-12 03:10:15 2048 ----a-w- C:\windows\System32\msxml3r.dll

2012-07-12 03:10:15 1881600 ----a-w- C:\windows\System32\msxml3.dll

2012-07-12 03:10:15 1390080 ----a-w- C:\windows\SysWow64\msxml6.dll

2012-07-12 03:10:15 1236992 ----a-w- C:\windows\SysWow64\msxml3.dll

2012-07-12 03:09:08 340992 ----a-w- C:\windows\System32\schannel.dll

2012-07-12 03:09:08 307200 ----a-w- C:\windows\System32\ncrypt.dll

2012-07-12 03:09:08 225280 ----a-w- C:\windows\SysWow64\schannel.dll

2012-07-12 03:09:08 219136 ----a-w- C:\windows\SysWow64\ncrypt.dll

2012-07-12 03:09:07 96768 ----a-w- C:\windows\SysWow64\sspicli.dll

2012-07-12 03:09:07 95600 ----a-w- C:\windows\System32\drivers\ksecdd.sys

2012-07-12 03:09:07 458704 ----a-w- C:\windows\System32\drivers\cng.sys

2012-07-12 03:09:07 22016 ----a-w- C:\windows\SysWow64\secur32.dll

2012-07-12 03:09:07 151920 ----a-w- C:\windows\System32\drivers\ksecpkg.sys

2012-07-12 03:05:09 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb

2012-07-12 03:05:09 2382848 ----a-w- C:\windows\System32\mshtml.tlb

2012-07-12 03:05:09 2311680 ----a-w- C:\windows\System32\jscript9.dll

2012-07-12 03:05:09 1800192 ----a-w- C:\windows\SysWow64\jscript9.dll

2012-07-12 03:05:09 173056 ----a-w- C:\windows\System32\ieUnatt.exe

2012-07-12 03:05:09 1494528 ----a-w- C:\windows\System32\inetcpl.cpl

2012-07-12 03:05:09 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe

2012-07-12 03:05:09 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl

2012-07-12 03:05:09 1392128 ----a-w- C:\windows\System32\wininet.dll

2012-07-12 03:05:08 1129472 ----a-w- C:\windows\SysWow64\wininet.dll

2012-06-19 04:12:46 209920 ----a-w- C:\windows\System32\profsvc.dll

2012-06-17 17:23:32 9216 ----a-w- C:\windows\System32\rdrmemptylst.exe

2012-06-17 17:23:32 77312 ----a-w- C:\windows\System32\rdpwsx.dll

2012-06-17 17:23:32 149504 ----a-w- C:\windows\System32\rdpcorekmts.dll

2012-06-17 17:18:52 5559664 ----a-w- C:\windows\System32\ntoskrnl.exe

2012-06-17 17:18:52 3968368 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe

2012-06-17 17:18:52 3913072 ----a-w- C:\windows\SysWow64\ntoskrnl.exe

2012-06-17 17:18:21 210944 ----a-w- C:\windows\System32\drivers\rdpwd.sys

2012-06-17 17:18:10 3216384 ----a-w- C:\windows\System32\msi.dll

2012-06-17 17:18:10 2342400 ----a-w- C:\windows\SysWow64\msi.dll

2012-06-17 17:17:57 184320 ----a-w- C:\windows\System32\cryptsvc.dll

2012-06-17 17:17:57 1462272 ----a-w- C:\windows\System32\crypt32.dll

2012-06-17 17:17:57 140288 ----a-w- C:\windows\SysWow64\cryptsvc.dll

2012-06-17 17:17:57 1158656 ----a-w- C:\windows\SysWow64\crypt32.dll

2012-06-17 17:17:57 103936 ----a-w- C:\windows\SysWow64\cryptnet.dll

2012-06-17 17:17:56 140288 ----a-w- C:\windows\System32\cryptnet.dll

2012-05-18 23:16:19 1544704 ----a-w- C:\windows\System32\DWrite.dll

2012-05-18 23:16:19 1077248 ----a-w- C:\windows\SysWow64\DWrite.dll

2012-05-18 23:05:16 75120 ----a-w- C:\windows\System32\drivers\partmgr.sys

2012-05-18 23:02:39 1918320 ----a-w- C:\windows\System32\drivers\tcpip.sys

2012-05-07 14:41:34 50546 -c--a-w- C:\windows\SysWow64\wuwuninst.exe

2009-08-14 19:31:00 1370112 -c--a-w- C:\Program Files (x86)\bsgui.dll

2009-08-14 19:26:50 3101184 -c--a-w- C:\Program Files (x86)\bsapi.dll

.

============= FINISH: 21:30:06.89 ===============

What are your suggestions?

Maniac · July 14, 2012

Hello herbchristopher and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

To post the content of Attach.txt .

herbchristopher · July 15, 2012

I appreciate the help. Here's my DDS log: