zamanigg Posted July 22, 2012 ID:574648 Share Posted July 22, 2012 Hi,I have run Malwarebytes as well as Spybot - Search and Destroy and I still get redirects from google as well as ads on pages that should not have ads. Thanks for helping me out..DDS (Ver_2011-08-26.01) - NTFSx86Internet Explorer: 8.0.6001.19272Run by zamanmm at 16:08:45 on 2012-07-22Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.3061.1294 [GMT -4:00].AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\ibmpmsvc.exeC:\Windows\system32\svchost.exe -k rpcssC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exeC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k GPSvcGroupC:\Windows\system32\SLsvc.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\system32\taskeng.exeC:\Windows\system32\taskeng.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\system32\IPSSVC.EXEC:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exeC:\Windows\system32\AEADISRV.EXEC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Windows\system32\atashost.exeC:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Windows\system32\svchost.exe -k bthsvcsC:\Program Files\QUBEE WCM\GPCommonService.exeC:\Windows\system32\svchost.exe -k hpdevmgmtC:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exeC:\Windows\system32\spool\DRIVERS\W32X86\3\lxddserv.exeC:\Windows\System32\svchost.exe -k HPZ12C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exeC:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exeC:\Program Files\Panasonic\TrapMonitor\Trapmnnt.exeC:\Windows\System32\svchost.exe -k HPZ12C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\system32\ptumlcmsvc.exeC:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exeC:\Windows\System32\TPHDEXLG.exeC:\Program Files\Lenovo\Client Security Solution\tvttcsd.exeC:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exeC:\Program Files\Lenovo\Rescue and Recovery\rrservice.exeC:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exec:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exeC:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exeC:\Windows\System32\svchost.exe -k WerSvcGroupC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Windows\system32\DRIVERS\xaudio.exeC:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exeC:\Program Files\Spybot - Search & Destroy\SDWinSec.exeC:\Program Files\Common Files\Lenovo\Logger\logmon.exeC:\Program Files\Lenovo\System Update\SUService.exec:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Windows\system32\svchost.exe -k HPServiceC:\Windows\system32\DllHost.exeC:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Windows\System32\rundll32.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\Panasonic\Panasonic-DMS\RPT Network Printer Port\Msgsrv.exeC:\Program Files\Hewlett-Packard\HP Software Update\hpwuschd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exeC:\Program Files\Logitech\QuickCam\Quickcam.exeC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\QUBEE WCM\QUBEE WCM.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\ThinkPad\Bluetooth Software\BTTray.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Panasonic\Panasonic-DMS\LRecvTrap\LRecvTrap.exeC:\Program Files\iPod\bin\iPodService.exeC:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exeC:\Program Files\QUBEE WCM\wimax\WmMMgr.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Program Files\Hewlett-Packard\Digital Imaging\smart web printing\hpswp_clipbook.exeC:\Windows\system32\rundll32.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Windows\system32\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exeC:\Windows\system32\wuauclt.exeC:\Windows\servicing\TrustedInstaller.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\WerCon.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe.============== Pseudo HJT Report ===============.uSearch Page = hxxp://www.google.comuStart Page = hxxp://www.google.com/uSearch Bar = PreserveuInternet Settings,ProxyOverride = localhost;*.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%suURLSearchHooks: FCToolbarURLSearchHook Class: {c1b8770b-7d91-c494-31e0-e62db08b9414} - c:\program files\bucksbee loyalty plugin - w3i\Helper.dlluURLSearchHooks: H - No FileuURLSearchHooks: H - No FileBHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No FileBHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_printenhancer.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dllBHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.7.2.3\coIEPlg.dllBHO: Bucksbee Loyalty Plugin - W3i: {626a9bf6-a6f4-18f4-159b-52a7a586c40b} - c:\program files\bucksbee loyalty plugin - w3i\BucksBee Loyalty Plugin.dllBHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.7.2.3\ips\IPSBHO.DLLBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dllBHO: RewardsArcadeSuite: {b6ef6c45-5e8d-4c3b-b580-a5073261a381} - c:\program files\rewardsarcadesuite\RewardsArcadeSuite.dllBHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dllBHO: CPwmIEBrowserHelper Object: {f040e541-a427-4cf7-85d8-75e3e0f476c5} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dllBHO: TBSB07898 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\coupons.com couponbar\tbcore3.dllBHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_BHO.dllTB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.7.2.3\coIEPlg.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dllTB: Coupons.com CouponBar: {8660e5b3-6c41-44de-8503-98d99bbecd41} - c:\program files\coupons.com couponbar\tbcore3.dllTB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No FileTB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No FileTB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No FileTB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No FileEB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_bho.dlluRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRunuRun: [QUBEE WCM] "c:\program files\qubee wcm\QUBEE WCM.exe" minimizeduRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrunuRun: [installIQUpdater] "c:\program files\w3i\installiqupdater\InstallIQUpdater.exe" /silent /autorunuRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exeuRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [Google Update] "c:\users\zamanmm\appdata\local\google\update\GoogleUpdate.exe" /cmRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hidemRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exemRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitormRun: [<NO NAME>]mRun: [LenovoOobeOffers] c:\swtools\lenovowelcome\lenovooobeoffers.exe /filepath="c:\swshare\firstrun.txt"mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exemRun: [RPT Msgsrv] "c:\program files\panasonic\panasonic-dms\rpt network printer port\Msgsrv.exe" /NRPT Network Printer /SmRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exemRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hidemRun: [Cisco AnyConnect Secure Mobility Agent for Windows] "c:\program files\cisco\cisco anyconnect secure mobility client\vpnui.exe" -minimizedStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\jobsta~1.lnk - c:\program files\panasonic\panasonic-dms\lrecvtrap\LRecvTrap.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\autoru~1\digita~1.lnk - c:\program files\digital line detect\DLG.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\autoru~1\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exemPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htmIE: {0045D4BC-5189-4b67-969C-83BB1906C421} - {0FE81B52-73FA-425F-8F06-3F32451AC73F} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dllIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLLIE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_BHO.dllIE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dllDPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CABDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cabDPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabTCP: DhcpNameServer = 192.168.1.1TCP: Interfaces\{803FC278-F797-4213-9E4F-829AE9D9FD55} : DhcpNameServer = 180.234.0.193 180.234.0.197TCP: Interfaces\{C9697EE0-222B-4F23-A61D-0A5C7B10426B} : DhcpNameServer = 192.168.1.1TCP: Interfaces\{CFFA5286-0D07-40C6-BABC-811702F106B0} : DhcpNameServer = 180.234.0.193 180.234.0.197TCP: Interfaces\{D3510E5F-6489-45C4-9374-CA9B3DDA2BC9} : DhcpNameServer = 180.234.0.193 180.234.0.197TCP: Interfaces\{DB3C85D0-8D16-468C-8E13-33AFE808BDA4} : DhcpNameServer = 192.168.1.1Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLNotify: GoToAssist Express Customer - c:\program files\citrix\gotoassist express customer\240\g2ax_winlogon.dllNotify: igfxcui - igfxdev.dllLSA: Notification Packages = scecli ACGinaHosts: 127.0.0.1 www.spywareinfo.com.============= SERVICES / DRIVERS ===============.R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1207020.003\symds.sys [2012-6-14 340088]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1207020.003\symefa.sys [2012-6-14 744568]R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2007-3-2 19760]R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\bashdefs\20120711.002\BHDrvx86.sys [2012-7-12 821920]R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\ipsdefs\20120720.001\IDSvix86.sys [2012-7-20 382624]R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2007-2-19 13744]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1207020.003\ironx86.sys [2012-6-14 136312]R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\nis\1207020.003\symtdiv.sys [2012-6-14 331384]R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2010-8-25 43912]R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-8-8 21504]R2 GPCommonService;GPCommonService;c:\program files\qubee wcm\GPCommonService.exe [2012-2-29 90112]R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2007-5-25 99248]R2 MTKWMPROT;MediaTek WiMAX Modem Protocol Driver;c:\windows\system32\drivers\mtkwmptv.sys [2012-2-29 15360]R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.7.2.3\ccsvchst.exe [2012-6-14 130008]R2 ptumlcmsvc;PTUML290 Connection Manager Service;c:\windows\system32\ptumlcmsvc.exe [2011-9-14 113168]R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2012-7-3 1153368]R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-7-5 3048136]R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2007-1-8 569344]R2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files\cisco\cisco anyconnect secure mobility client\vpnagent.exe [2012-6-7 478712]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-6-15 106656]R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2006-9-13 35264]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-2 135664]S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-5 160944]S3 acsint;acsint;c:\windows\system32\drivers\acsint.sys [2012-6-28 38440]S3 acsmux;acsmux;c:\windows\system32\drivers\acsmux.sys [2012-6-7 57256]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 250056]S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2006-11-2 167936]S3 GoToAssist Express Customer;GoToAssist Express Customer;c:\program files\citrix\gotoassist express customer\240\g2ax_service.exe [2010-10-12 161144]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-2 135664]S3 MT7118VU;MediaTek MT7118 WiMAX USB Card Driver for VISTA;c:\windows\system32\drivers\mt7118vu.sys [2012-2-29 131072]S3 PTUMLBUS;PTUML USB Composite Device Driver;c:\windows\system32\drivers\PTUMLBUS.sys [2011-9-14 59664]S3 PTUMLCVsp;PANTECH UML290 Connection Manager Port;c:\windows\system32\drivers\PTUMLCVsp.sys [2011-9-14 168208]S3 PTUMLMdm;PANTECH UML290;c:\windows\system32\drivers\PTUMLMdm.sys [2011-9-14 168208]S3 PTUMLNVsp;PANTECH UML290 NMEA Port;c:\windows\system32\drivers\PTUMLNVsp.sys [2011-9-14 168848]S3 PTUMLVsp;PANTECH UML290 Diagnostic Port;c:\windows\system32\drivers\PTUMLVsp.sys [2011-9-14 168208]S3 ssmirrdr;ssmirrdr;c:\windows\system32\drivers\ssmirrdr.sys [2011-10-3 10112]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]S4 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]S4 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2007-3-30 55936].=============== Created Last 30 ================.2012-07-22 17:19:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys2012-07-22 17:19:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-07-11 16:22:25 2047488 ----a-w- c:\windows\system32\win32k.sys2012-07-11 16:16:17 -------- d-sh--w- c:\windows\system32\%APPDATA%2012-07-11 16:13:22 708608 ----a-w- c:\program files\common files\system\ado\msado15.dll2012-07-11 16:13:14 1401856 ----a-w- c:\windows\system32\msxml6.dll2012-07-11 16:13:14 1248768 ----a-w- c:\windows\system32\msxml3.dll2012-07-11 16:13:12 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys2012-07-11 16:13:12 278528 ----a-w- c:\windows\system32\schannel.dll2012-07-11 16:13:12 204288 ----a-w- c:\windows\system32\ncrypt.dll2012-07-03 18:44:11 -------- d-----w- c:\programdata\Spybot - Search & Destroy2012-07-03 18:44:11 -------- d-----w- c:\program files\Spybot - Search & Destroy2012-07-03 18:40:14 -------- d-----w- c:\users\zamanmm\appdata\roaming\Ad-Aware Antivirus2012-06-28 18:19:36 38440 ----a-r- c:\windows\system32\drivers\acsint.sys2012-06-24 16:02:09 2422272 ----a-w- c:\windows\system32\wucltux.dll2012-06-24 16:01:46 88576 ----a-w- c:\windows\system32\wudriver.dll2012-06-24 16:01:31 33792 ----a-w- c:\windows\system32\wuapp.exe2012-06-24 16:01:31 171904 ----a-w- c:\windows\system32\wuwebv.dll.==================== Find3M ====================.2012-07-11 23:47:15 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-07-11 23:47:15 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe2012-06-07 15:35:31 10744 ----a-w- c:\windows\system32\vpncategories.dll2012-06-07 15:35:26 33272 ----a-w- c:\windows\system32\vpnevents.dll2012-06-07 15:25:20 23976 ----a-w- c:\windows\system32\drivers\vpnva.sys2012-06-07 15:24:23 57256 ----a-r- c:\windows\system32\drivers\acsmux.sys2012-05-15 06:37:49 916992 ----a-w- c:\windows\system32\wininet.dll2012-05-15 06:32:25 43520 ----a-w- c:\windows\system32\licmgr10.dll2012-05-15 06:32:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl2012-05-15 06:31:44 109056 ----a-w- c:\windows\system32\iesysprep.dll2012-05-15 06:31:43 71680 ----a-w- c:\windows\system32\iesetup.dll2012-05-15 05:01:56 385024 ----a-w- c:\windows\system32\html.iec2012-05-15 03:26:05 133632 ----a-w- c:\windows\system32\ieUnatt.exe2012-05-15 03:23:41 1638912 ----a-w- c:\windows\system32\mshtml.tlb2012-05-01 14:03:49 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys.============= FINISH: 16:12:17.88 ===============DDS (Ver_2011-08-26.01).Microsoft® Windows Vista™ BusinessBoot Device: \Device\HarddiskVolume2Install Date: 7/18/2008 3:45:52 PMSystem Uptime: 7/22/2012 3:54:32 PM (1 hours ago).Motherboard: LENOVO | | 76591PUProcessor: Intel® Core™2 Duo CPU T7300 @ 2.00GHz | None | 2001/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 68 GiB total, 7.109 GiB free.D: is CDROM ().==== Disabled Device Manager Items =============.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: Microsoft Tun Miniport AdapterDevice ID: ROOT\*TUNMP\0001Manufacturer: MicrosoftName: Teredo Tunneling Pseudo-InterfacePNP Device ID: ROOT\*TUNMP\0001Service: tunmp.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for WindowsDevice ID: ROOT\NET\0000Manufacturer: Cisco SystemsName: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for WindowsPNP Device ID: ROOT\NET\0000Service: vpnva.==== System Restore Points ===================.RP1316: 7/21/2012 1:12:38 PM - Windows UpdateRP1317: 7/21/2012 6:43:00 PM - Removed WinZip 15.0RP1318: 7/22/2012 12:15:20 PM - Windows Update.==== Installed Programs ======================.Update for Microsoft Office 2007 (KB2508958)32 Bit HP CIO Components Installer4500_G510nz_Help4500G510nz4500G510nz_Software_Min7-Zip 9.22betaAccess HelpAcrobat.comAdobe AIRAdobe Flash Player 10 PluginAdobe Flash Player 11 ActiveXAdobe Reader 9.5.1Apple Application SupportApple Mobile Device SupportApple Software UpdateBonjourBrother P-touch Address Book 1.1Brother P-touch Editor 5.0Brother P-touch SoftwareBrother QL-570 User's GuideBucksbee Loyalty Plugin - W3iBufferChmBusiness Contact Manager for Outlook 2007 SP2Canon MP Navigator 2.2Canon MP530Canon MP530 User RegistrationCanon Utilities Easy-PhotoPrintCisco AnyConnect Secure Mobility ClientCisco AnyConnect Secure Mobility ClientClient Security SolutionCoupon Printer for WindowsCouponBarDestinationsDeviceDiscoveryDocMgrDocProcDownload Updater (AOL LLC)EPSON Printer SoftwareEPSON ScanFaxgetPlus® for AdobeGoogle ChromeGoogle EarthGoogle Update HelperGoogle UpdaterGoToAssist Customer 1.5.0.240GPBaseService2Help CenterHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)HP Customer Participation Program 13.0HP Document Manager 2.0HP Imaging Device Functions 13.0HP LaserJet P2030 SeriesHP Officejet 4500 G510n-zHP Smart Web Printing 4.5HP Solution Center 13.0HP UpdateHPProductAssistanthppusgP2030HPSSupplyHyper Electronics Mappers UtilitiesIntel® Graphics Media Accelerator DriverIntel® PRO Network Connections DriversiTunesJava™ 6 Update 29Java™ 6 Update 7Java™ SE Runtime Environment 6Junk Mail filter updateLenovo RegistrationLenovo System Interface DriverLenovo ThinkVantage ToolboxLexmark 2500 SeriesLivestationLogitech Desktop MessengerLogitech Print ServiceLogitech QuickCamLogitech UpdaterLogitech Webcam SoftwareLogitech® Camera DriverMaintenance ManagerMalwarebytes Anti-Malware version 1.62.0.1300MarketResearchMessage Center PlusMicrosoft .NET Framework 1.1Microsoft .NET Framework 1.1 Security Update (KB2416447)Microsoft .NET Framework 1.1 Security Update (KB979906)Microsoft .NET Framework 3.5 SP1Microsoft .NET Framework 4 Client ProfileMicrosoft Application Error ReportingMicrosoft Choice GuardMicrosoft Office 2003 Web ComponentsMicrosoft Office 2007 Primary Interop AssembliesMicrosoft Office 2007 Service Pack 3 (SP3)Microsoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Accounting 2008Microsoft Office Accounting 2008 Equifax AddinMicrosoft Office Accounting 2008 Fixed Asset ManagerMicrosoft Office Accounting 2008 PayPal AddinMicrosoft Office Accounting ADP Payroll AddinMicrosoft Office Excel MUI (English) 2007Microsoft Office File Validation Add-InMicrosoft Office Live Add-in 1.5Microsoft Office Outlook ConnectorMicrosoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Professional 2007Microsoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Small Business Connectivity ComponentsMicrosoft Office Word MUI (English) 2007Microsoft SilverlightMicrosoft SQL Server 2005Microsoft SQL Server 2005 Compact Edition [ENU]Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)Microsoft SQL Server 2005 Tools Express EditionMicrosoft SQL Server Native ClientMicrosoft SQL Server Setup Support Files (English)Microsoft SQL Server VSS WriterMicrosoft Sync Framework Runtime Native v1.0 (x86)Microsoft Sync Framework Services Native v1.0 (x86)Microsoft VC9 runtime librariesMicrosoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053Microsoft Visual C++ 2005 RedistributableMove Media PlayerMrvlUsgTrackingMSVCRTMSXML 4.0 SP2 (KB936181)MSXML 4.0 SP2 (KB941833)MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MVisionNetworkNorton Internet SecurityOCR Software by I.R.I.S. 13.0Octoshape add-in for Adobe Flash PlayerOn Screen DisplayPanasonic Job Status UtilityPanasonic Printer DriversPanasonic Printing SystemPanasonic RPT Network Printer PortPanasonic Windows Firewall Setting ToolPANTECH UML290Picasa 3Presentation DirectorProductivity Center Supplement for ThinkPadQUBEE WiMAX Connection ManagerRealPlayerRegistry patch for Windows Vista USB S3 PM EnablementRegistry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows VistaRegistry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows VistaRescue and RecoveryRewardsArcadeSuiteRhapsody Player EngineRSA SecurID Software Token 1.0.1 for Web SDKScanSecurity Update for CAPICOM (KB931906)Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596744) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596785) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596792) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596871) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596880) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2597162) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2597969) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2598041) 32-Bit EditionSecurity Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit EditionSecurity Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit EditionSecurity Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit EditionSecurity Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit EditionSecurity Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit EditionSecurity Update for Microsoft Office Word 2007 (KB2596917) 32-Bit EditionShop for HP SuppliesSkype Click to CallSkype™ 5.9SmartWebPrintingSolutionCenterSoundMAXSpybot - Search & DestroyStatusSystem Migration AssistantSystem UpdateTeleTracker OnlineThinkPad Bluetooth with Enhanced Data Rate Software 6.0.1.4900ThinkPad EasyEject UtilityThinkPad FullScreen MagnifierThinkPad Hotkey Features SetupThinkPad Mobility Center CustomizationThinkPad ModemThinkPad Power Management DriverThinkPad Power ManagerThinkPad UltraNav DriverThinkPad UltraNav UtilityThinkpad Wireless LAN Adapters Software (11a/b/g/n)ThinkVantage Access ConnectionsThinkVantage Active Protection SystemThinkVantage Productivity CenterThinkVantage Technologies Welcome MessageToolboxTrayAppUltimate Media PlayerUpdate for 2007 Microsoft Office System (KB967642)Update for Microsoft .NET Framework 3.5 SP1 (KB963707)Update for Microsoft .NET Framework 4 Client Profile (KB2468871)Update for Microsoft .NET Framework 4 Client Profile (KB2533523)Update for Microsoft .NET Framework 4 Client Profile (KB2600217)Update for Microsoft Office 2007 Help for Common Features (KB963673)Update for Microsoft Office Access 2007 Help (KB963663)Update for Microsoft Office Excel 2007 Help (KB963678)Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit EditionUpdate for Microsoft Office Outlook 2007 Help (KB963677)Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687310) 32-Bit EditionUpdate for Microsoft Office Powerpoint 2007 Help (KB963669)Update for Microsoft Office Publisher 2007 Help (KB963667)Update for Microsoft Office Script Editor Help (KB963671)Update for Microsoft Office Word 2007 Help (KB963665)VerizonWirelessVZAccess ManagerWallpapersWebCam for MSN MessengerWebExWebRegWindows Driver Package - Intel (e1express) Net (02/27/2007 9.7.37.0)Windows Driver Package - Intel (iaStor) hdc (02/12/2007 7.0.0.1020)Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011)Windows Driver Package - Intel hdc (12/06/2006 6.8.0.3002)Windows Driver Package - Intel System (09/15/2006 7.0.0.1011)Windows Driver Package - Intel System (09/15/2006 8.0.0.1008)Windows Driver Package - Intel System (09/15/2006 8.0.0.1010)Windows Driver Package - Intel System (09/15/2006 8.2.0.1000)Windows Driver Package - Intel USB (09/15/2006 8.0.0.1008)Windows Driver Package - Lenovo (IBMPMDRV) System (02/27/2007 1.42)Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)Windows Driver Package - Ricoh Company (rismxdp) hdc (11/18/2006 6.00.01.05)Windows Driver Package - Ricoh Company MMC Host Controller (11/14/2006 6.00.01.04)Windows Firewall Setting ToolWindows Live CallWindows Live Communications PlatformWindows Live EssentialsWindows Live ID Sign-in AssistantWindows Live MailWindows Live MessengerWindows Live Movie MakerWindows Live Photo GalleryWindows Live SyncWindows Live ToolbarWindows Live Upload ToolWindows Live WriterWorthware - CellSell H.A.C.I. Thin-Client (162).==== Event Viewer Messages From Past Week ========.7/22/2012 4:04:09 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.7/22/2012 4:03:39 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.7/22/2012 4:02:06 PM, Error: Service Control Manager [7022] - The KtmRm for Distributed Transaction Coordinator service hung on starting.7/22/2012 3:59:23 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/22/2012 3:59:22 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.7/22/2012 3:56:01 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.7/22/2012 3:55:54 PM, Error: Microsoft-Windows-ResourcePublication [1002] - Element Provider\Microsoft.Base.Publication/Publication/Computer failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.7/22/2012 12:24:35 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656353).7/22/2012 12:20:06 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656370).7/21/2012 1:52:15 PM, Error: Microsoft-Windows-TBS [516] - An error occurred while communicating with the TPM. The driver returned 0x8007045d.7/21/2012 1:12:20 PM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.24. The computer with the IP address 192.168.1.36 did not allow the name to be claimed by this computer.7/19/2012 8:09:52 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.7/18/2012 4:34:34 PM, Error: TPM [13] - The device driver for the Trusted Platform Module (TPM) encountered a non-recoverable error in the TPM hardware, which prevents TPM services (such as data encryption) from being used. For further help, please contact the computer manufacturer.7/18/2012 10:10:48 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Adobe Flash Player Update Service service to connect.7/18/2012 10:10:48 AM, Error: Service Control Manager [7000] - The Adobe Flash Player Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/18/2012 1:50:00 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Zamans-PC\zamanmm SID (S-1-5-21-3894235439-4067020577-3388496322-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.7/17/2012 11:24:42 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NIS service.7/15/2012 7:39:42 AM, Error: netbt [4321] - The name "ZAMANS-PC :0" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.3 did not allow the name to be claimed by this computer..==== End Of File =========================== Link to post Share on other sites More sharing options...
Maniac Posted July 23, 2012 ID:574991 Share Posted July 23, 2012 Hello zamanigg and ! My name is Maniac and I will be glad to help you solve your malware problem.Please note:If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.Make sure you read all of the instructions and fixes thoroughly before continuing with them.Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.Step 1I see you are running Teatimer.I suggest you to disable it because it can interfere with the changes you'll make on your system.When everything is done and your log is clean again, you can enable it again.If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.How to disable TeaTimer <== click me for instructions.After you disabled Teatimer, download ResetTeaTimer.exe to your desktop. Then run ResetTeaTimer.exe.This will only take a few seconds.Step 2Please uninstall the following applications:Bucksbee Loyalty Plugin - W3iRewardsArcadeSuiteStep 3Launch Malwarebytes' Anti-MalwareGo to Update tab and select Check for Updates. If an update is found, it will download and install the latest version. Go to Scanner tab and select Perform Quick Scan, then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.Step 4Download aswMBR.exe to your desktop. Double click the aswMBR.exe to run it Click the "Scan" button to start scan On completion of the scan click save log, save it to your desktop and post in your next reply In your next reply, post the following log files:Malwarebytes' Anti-Malware logaswMBR loga new fresh DDS log file Link to post Share on other sites More sharing options...
zamanigg Posted July 23, 2012 Author ID:575375 Share Posted July 23, 2012 Hi Maniac,I was unable to run aswMBR.exe. It gave me a BSOD twice. Just tried to go to IBM's website through google and got redirected to monster.com Malwarebytes Anti-Malware 1.62.0.1300www.malwarebytes.orgDatabase version: v2012.07.23.11Windows Vista Service Pack 2 x86 NTFSInternet Explorer 8.0.6001.19272zamanmm :: ZAMANS-PC [administrator]7/23/2012 6:31:38 PMmbam-log-2012-07-23 (18-31-38).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 205545Time elapsed: 10 minute(s), 3 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end).DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.19272Run by zamanmm at 19:25:58 on 2012-07-23Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.3061.1317 [GMT -4:00].AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\ibmpmsvc.exeC:\Windows\system32\svchost.exe -k rpcssC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exeC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k GPSvcGroupC:\Windows\system32\SLsvc.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\System32\spoolsv.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\system32\taskeng.exeC:\Windows\system32\IPSSVC.EXEC:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exeC:\Windows\system32\AEADISRV.EXEC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Windows\system32\atashost.exeC:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Windows\system32\svchost.exe -k bthsvcsC:\Program Files\QUBEE WCM\GPCommonService.exeC:\Windows\system32\svchost.exe -k hpdevmgmtC:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exeC:\Windows\system32\spool\DRIVERS\W32X86\3\lxddserv.exeC:\Windows\System32\svchost.exe -k HPZ12C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exeC:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exeC:\Program Files\Panasonic\TrapMonitor\Trapmnnt.exeC:\Windows\System32\svchost.exe -k HPZ12C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\system32\ptumlcmsvc.exeC:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exeC:\Windows\System32\TPHDEXLG.exeC:\Program Files\Lenovo\Client Security Solution\tvttcsd.exeC:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exeC:\Program Files\Lenovo\Rescue and Recovery\rrservice.exeC:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exec:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exeC:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exeC:\Windows\System32\svchost.exe -k WerSvcGroupC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Windows\system32\DRIVERS\xaudio.exeC:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exeC:\Program Files\Lenovo\System Update\SUService.exeC:\Program Files\Spybot - Search & Destroy\SDWinSec.exeC:\Program Files\Common Files\Lenovo\Logger\logmon.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exeC:\Windows\system32\svchost.exe -k HPServiceC:\Windows\system32\DllHost.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Windows\System32\rundll32.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\Panasonic\Panasonic-DMS\RPT Network Printer Port\Msgsrv.exeC:\Program Files\Hewlett-Packard\HP Software Update\hpwuschd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exeC:\Program Files\Logitech\QuickCam\Quickcam.exeC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\QUBEE WCM\QUBEE WCM.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\ThinkPad\Bluetooth Software\BTTray.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Panasonic\Panasonic-DMS\LRecvTrap\LRecvTrap.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exeC:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exeC:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exeC:\Program Files\QUBEE WCM\wimax\WmMMgr.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Windows\system32\rundll32.exeC:\Users\zamanmm\AppData\Local\Google\Chrome\Application\chrome.exeC:\Windows\system32\wuauclt.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uSearch Page = hxxp://www.google.comuStart Page = hxxp://www.google.com/uSearch Bar = PreserveuInternet Settings,ProxyOverride = localhost;*.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%suURLSearchHooks: H - No FileuURLSearchHooks: H - No FileBHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No FileBHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_printenhancer.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.7.2.3\coIEPlg.dllBHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.7.2.3\ips\IPSBHO.DLLBHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dllBHO: CPwmIEBrowserHelper Object: {f040e541-a427-4cf7-85d8-75e3e0f476c5} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dllBHO: TBSB07898 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\coupons.com couponbar\tbcore3.dllBHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_BHO.dllTB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.7.2.3\coIEPlg.dllTB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dllTB: Coupons.com CouponBar: {8660e5b3-6c41-44de-8503-98d99bbecd41} - c:\program files\coupons.com couponbar\tbcore3.dllTB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No FileTB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No FileTB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No FileTB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No FileEB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_bho.dlluRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRunuRun: [QUBEE WCM] "c:\program files\qubee wcm\QUBEE WCM.exe" minimizeduRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrunuRun: [installIQUpdater] "c:\program files\w3i\installiqupdater\InstallIQUpdater.exe" /silent /autorunuRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [Google Update] "c:\users\zamanmm\appdata\local\google\update\GoogleUpdate.exe" /cmRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hidemRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exemRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitormRun: [<NO NAME>] mRun: [LenovoOobeOffers] c:\swtools\lenovowelcome\lenovooobeoffers.exe /filepath="c:\swshare\firstrun.txt"mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exemRun: [RPT Msgsrv] "c:\program files\panasonic\panasonic-dms\rpt network printer port\Msgsrv.exe" /NRPT Network Printer /SmRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exemRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hidemRun: [Cisco AnyConnect Secure Mobility Agent for Windows] "c:\program files\cisco\cisco anyconnect secure mobility client\vpnui.exe" -minimizedStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\jobsta~1.lnk - c:\program files\panasonic\panasonic-dms\lrecvtrap\LRecvTrap.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\autoru~1\digita~1.lnk - c:\program files\digital line detect\DLG.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\autoru~1\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exemPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htmIE: {0045D4BC-5189-4b67-969C-83BB1906C421} - {0FE81B52-73FA-425F-8F06-3F32451AC73F} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dllIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLLIE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hewlett-packard\digital imaging\smart web printing\hpswp_BHO.dllDPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CABDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cabDPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabTCP: DhcpNameServer = 192.168.1.1TCP: Interfaces\{803FC278-F797-4213-9E4F-829AE9D9FD55} : DhcpNameServer = 180.234.0.193 180.234.0.197TCP: Interfaces\{C9697EE0-222B-4F23-A61D-0A5C7B10426B} : DhcpNameServer = 192.168.1.1TCP: Interfaces\{CFFA5286-0D07-40C6-BABC-811702F106B0} : DhcpNameServer = 180.234.0.193 180.234.0.197TCP: Interfaces\{D3510E5F-6489-45C4-9374-CA9B3DDA2BC9} : DhcpNameServer = 180.234.0.193 180.234.0.197TCP: Interfaces\{DB3C85D0-8D16-468C-8E13-33AFE808BDA4} : DhcpNameServer = 192.168.1.1Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLNotify: GoToAssist Express Customer - c:\program files\citrix\gotoassist express customer\240\g2ax_winlogon.dllNotify: igfxcui - igfxdev.dllLSA: Notification Packages = scecli ACGinaHosts: 127.0.0.1 www.spywareinfo.com.============= SERVICES / DRIVERS ===============.R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1207020.003\symds.sys [2012-6-14 340088]R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1207020.003\symefa.sys [2012-6-14 744568]R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2007-3-2 19760]R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\bashdefs\20120711.002\BHDrvx86.sys [2012-7-12 821920]R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\ipsdefs\20120720.001\IDSvix86.sys [2012-7-20 382624]R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2007-2-19 13744]R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1207020.003\ironx86.sys [2012-6-14 136312]R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\nis\1207020.003\symtdiv.sys [2012-6-14 331384]R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2010-8-25 43912]R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-8-8 21504]R2 GPCommonService;GPCommonService;c:\program files\qubee wcm\GPCommonService.exe [2012-2-29 90112]R2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2007-5-25 99248]R2 MTKWMPROT;MediaTek WiMAX Modem Protocol Driver;c:\windows\system32\drivers\mtkwmptv.sys [2012-2-29 15360]R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.7.2.3\ccsvchst.exe [2012-6-14 130008]R2 ptumlcmsvc;PTUML290 Connection Manager Service;c:\windows\system32\ptumlcmsvc.exe [2011-9-14 113168]R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2012-7-3 1153368]R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-7-5 3048136]R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\lenovo\rescue and recovery\rrpservice.exe [2007-1-8 569344]R2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files\cisco\cisco anyconnect secure mobility client\vpnagent.exe [2012-6-7 478712]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2012-6-15 106656]R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-7-23 40776]R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2006-9-13 35264]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-2 135664]S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-5 160944]S3 acsint;acsint;c:\windows\system32\drivers\acsint.sys [2012-6-28 38440]S3 acsmux;acsmux;c:\windows\system32\drivers\acsmux.sys [2012-6-7 57256]S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-5 250056]S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2006-11-2 167936]S3 GoToAssist Express Customer;GoToAssist Express Customer;c:\program files\citrix\gotoassist express customer\240\g2ax_service.exe [2010-10-12 161144]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-2 135664]S3 MT7118VU;MediaTek MT7118 WiMAX USB Card Driver for VISTA;c:\windows\system32\drivers\mt7118vu.sys [2012-2-29 131072]S3 PTUMLBUS;PTUML USB Composite Device Driver;c:\windows\system32\drivers\PTUMLBUS.sys [2011-9-14 59664]S3 PTUMLCVsp;PANTECH UML290 Connection Manager Port;c:\windows\system32\drivers\PTUMLCVsp.sys [2011-9-14 168208]S3 PTUMLMdm;PANTECH UML290;c:\windows\system32\drivers\PTUMLMdm.sys [2011-9-14 168208]S3 PTUMLNVsp;PANTECH UML290 NMEA Port;c:\windows\system32\drivers\PTUMLNVsp.sys [2011-9-14 168848]S3 PTUMLVsp;PANTECH UML290 Diagnostic Port;c:\windows\system32\drivers\PTUMLVsp.sys [2011-9-14 168208]S3 ssmirrdr;ssmirrdr;c:\windows\system32\drivers\ssmirrdr.sys [2011-10-3 10112]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]S4 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]S4 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2007-3-30 55936].=============== Created Last 30 ================.2012-07-23 22:31:03 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2012-07-22 17:19:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys2012-07-22 17:19:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-07-11 16:22:25 2047488 ----a-w- c:\windows\system32\win32k.sys2012-07-11 16:16:17 -------- d-sh--w- c:\windows\system32\%APPDATA%2012-07-11 16:13:22 708608 ----a-w- c:\program files\common files\system\ado\msado15.dll2012-07-11 16:13:14 1401856 ----a-w- c:\windows\system32\msxml6.dll2012-07-11 16:13:14 1248768 ----a-w- c:\windows\system32\msxml3.dll2012-07-11 16:13:12 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys2012-07-11 16:13:12 278528 ----a-w- c:\windows\system32\schannel.dll2012-07-11 16:13:12 204288 ----a-w- c:\windows\system32\ncrypt.dll2012-07-03 18:44:11 -------- d-----w- c:\programdata\Spybot - Search & Destroy2012-07-03 18:44:11 -------- d-----w- c:\program files\Spybot - Search & Destroy2012-07-03 18:40:14 -------- d-----w- c:\users\zamanmm\appdata\roaming\Ad-Aware Antivirus2012-06-28 18:19:36 38440 ----a-r- c:\windows\system32\drivers\acsint.sys2012-06-24 16:02:09 2422272 ----a-w- c:\windows\system32\wucltux.dll2012-06-24 16:01:46 88576 ----a-w- c:\windows\system32\wudriver.dll2012-06-24 16:01:31 33792 ----a-w- c:\windows\system32\wuapp.exe2012-06-24 16:01:31 171904 ----a-w- c:\windows\system32\wuwebv.dll.==================== Find3M ====================.2012-07-11 23:47:15 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-07-11 23:47:15 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe2012-06-07 15:35:31 10744 ----a-w- c:\windows\system32\vpncategories.dll2012-06-07 15:35:26 33272 ----a-w- c:\windows\system32\vpnevents.dll2012-06-07 15:25:20 23976 ----a-w- c:\windows\system32\drivers\vpnva.sys2012-06-07 15:24:23 57256 ----a-r- c:\windows\system32\drivers\acsmux.sys2012-05-15 06:37:49 916992 ----a-w- c:\windows\system32\wininet.dll2012-05-15 06:32:25 43520 ----a-w- c:\windows\system32\licmgr10.dll2012-05-15 06:32:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl2012-05-15 06:31:44 109056 ----a-w- c:\windows\system32\iesysprep.dll2012-05-15 06:31:43 71680 ----a-w- c:\windows\system32\iesetup.dll2012-05-15 05:01:56 385024 ----a-w- c:\windows\system32\html.iec2012-05-15 03:26:05 133632 ----a-w- c:\windows\system32\ieUnatt.exe2012-05-15 03:23:41 1638912 ----a-w- c:\windows\system32\mshtml.tlb2012-05-01 14:03:49 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys.============= FINISH: 19:27:20.85 ===============.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2011-08-26.01).Microsoft® Windows Vista™ Business Boot Device: \Device\HarddiskVolume2Install Date: 7/18/2008 3:45:52 PMSystem Uptime: 7/23/2012 7:10:52 PM (0 hours ago).Motherboard: LENOVO | | 76591PUProcessor: Intel® Core2 Duo CPU T7300 @ 2.00GHz | None | 2001/200mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 68 GiB total, 6.832 GiB free.D: is CDROM ().==== Disabled Device Manager Items =============.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: Microsoft Tun Miniport AdapterDevice ID: ROOT\*TUNMP\0001Manufacturer: MicrosoftName: Teredo Tunneling Pseudo-InterfacePNP Device ID: ROOT\*TUNMP\0001Service: tunmp.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for WindowsDevice ID: ROOT\NET\0000Manufacturer: Cisco SystemsName: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for WindowsPNP Device ID: ROOT\NET\0000Service: vpnva.==== System Restore Points ===================.RP1319: 7/23/2012 2:02:29 PM - Windows UpdateRP1320: 7/23/2012 5:39:01 PM - Windows Update.==== Installed Programs ======================. Update for Microsoft Office 2007 (KB2508958)32 Bit HP CIO Components Installer4500_G510nz_Help4500G510nz4500G510nz_Software_Min7-Zip 9.22betaAccess HelpAcrobat.comAdobe AIRAdobe Flash Player 10 PluginAdobe Flash Player 11 ActiveXAdobe Reader 9.5.1Apple Application SupportApple Mobile Device SupportApple Software UpdateBonjourBrother P-touch Address Book 1.1Brother P-touch Editor 5.0Brother P-touch SoftwareBrother QL-570 User's GuideBufferChmBusiness Contact Manager for Outlook 2007 SP2Canon MP Navigator 2.2Canon MP530Canon MP530 User RegistrationCanon Utilities Easy-PhotoPrintCisco AnyConnect Secure Mobility ClientCisco AnyConnect Secure Mobility Client Client Security SolutionCoupon Printer for WindowsCouponBarDestinationsDeviceDiscoveryDocMgrDocProcDownload Updater (AOL LLC)EPSON Printer SoftwareEPSON ScanFaxgetPlus® for AdobeGoogle ChromeGoogle EarthGoogle Update HelperGoogle UpdaterGoToAssist Customer 1.5.0.240GPBaseService2Help CenterHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)HP Customer Participation Program 13.0HP Document Manager 2.0HP Imaging Device Functions 13.0HP LaserJet P2030 SeriesHP Officejet 4500 G510n-zHP Smart Web Printing 4.5HP Solution Center 13.0HP UpdateHPProductAssistanthppusgP2030HPSSupplyHyper Electronics Mappers UtilitiesIntel® Graphics Media Accelerator DriverIntel® PRO Network Connections DriversiTunesJava 6 Update 29Java 6 Update 7Java SE Runtime Environment 6Junk Mail filter updateLenovo RegistrationLenovo System Interface DriverLenovo ThinkVantage ToolboxLexmark 2500 SeriesLivestationLogitech Desktop MessengerLogitech Print ServiceLogitech QuickCamLogitech UpdaterLogitech Webcam SoftwareLogitech® Camera DriverMaintenance ManagerMalwarebytes Anti-Malware version 1.62.0.1300MarketResearchMessage Center PlusMicrosoft .NET Framework 1.1Microsoft .NET Framework 1.1 Security Update (KB2416447)Microsoft .NET Framework 1.1 Security Update (KB979906)Microsoft .NET Framework 3.5 SP1Microsoft .NET Framework 4 Client ProfileMicrosoft Application Error ReportingMicrosoft Choice GuardMicrosoft Office 2003 Web ComponentsMicrosoft Office 2007 Primary Interop AssembliesMicrosoft Office 2007 Service Pack 3 (SP3)Microsoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Accounting 2008Microsoft Office Accounting 2008 Equifax AddinMicrosoft Office Accounting 2008 Fixed Asset ManagerMicrosoft Office Accounting 2008 PayPal AddinMicrosoft Office Accounting ADP Payroll AddinMicrosoft Office Excel MUI (English) 2007Microsoft Office File Validation Add-InMicrosoft Office Live Add-in 1.5Microsoft Office Outlook ConnectorMicrosoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Professional 2007Microsoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Small Business Connectivity ComponentsMicrosoft Office Word MUI (English) 2007Microsoft SilverlightMicrosoft SQL Server 2005Microsoft SQL Server 2005 Compact Edition [ENU]Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)Microsoft SQL Server 2005 Tools Express EditionMicrosoft SQL Server Native ClientMicrosoft SQL Server Setup Support Files (English)Microsoft SQL Server VSS WriterMicrosoft Sync Framework Runtime Native v1.0 (x86)Microsoft Sync Framework Services Native v1.0 (x86)Microsoft VC9 runtime librariesMicrosoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053Microsoft Visual C++ 2005 RedistributableMove Media PlayerMrvlUsgTrackingMSVCRTMSXML 4.0 SP2 (KB936181)MSXML 4.0 SP2 (KB941833)MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MVisionNetworkNorton Internet SecurityOCR Software by I.R.I.S. 13.0Octoshape add-in for Adobe Flash PlayerOn Screen DisplayPanasonic Job Status UtilityPanasonic Printer DriversPanasonic Printing SystemPanasonic RPT Network Printer PortPanasonic Windows Firewall Setting ToolPANTECH UML290Picasa 3Presentation DirectorProductivity Center Supplement for ThinkPadQUBEE WiMAX Connection ManagerRealPlayerRegistry patch for Windows Vista USB S3 PM EnablementRegistry patch of Changing Timing of IDLE IRP by Finger Print Driver for Windows Vista Registry Patch of Enabling Device Initiated Power Management(DIPM) on SATA for Windows VistaRescue and RecoveryRhapsody Player EngineRSA SecurID Software Token 1.0.1 for Web SDKScanSecurity Update for CAPICOM (KB931906)Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596792) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596871) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2598041) 32-Bit EditionSecurity Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit EditionSecurity Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit EditionSecurity Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit EditionSecurity Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition Shop for HP SuppliesSkype Click to CallSkype™ 5.9SmartWebPrintingSolutionCenterSoundMAXSpybot - Search & DestroyStatusSystem Migration AssistantSystem UpdateTeleTracker OnlineThinkPad Bluetooth with Enhanced Data Rate Software 6.0.1.4900ThinkPad EasyEject Utility ThinkPad FullScreen MagnifierThinkPad Hotkey Features SetupThinkPad Mobility Center CustomizationThinkPad ModemThinkPad Power Management DriverThinkPad Power ManagerThinkPad UltraNav DriverThinkPad UltraNav UtilityThinkpad Wireless LAN Adapters Software (11a/b/g/n)ThinkVantage Access ConnectionsThinkVantage Active Protection SystemThinkVantage Productivity CenterThinkVantage Technologies Welcome MessageToolboxTrayAppUltimate Media PlayerUpdate for 2007 Microsoft Office System (KB967642)Update for Microsoft .NET Framework 3.5 SP1 (KB963707)Update for Microsoft .NET Framework 4 Client Profile (KB2468871)Update for Microsoft .NET Framework 4 Client Profile (KB2533523)Update for Microsoft .NET Framework 4 Client Profile (KB2600217)Update for Microsoft Office 2007 Help for Common Features (KB963673)Update for Microsoft Office Access 2007 Help (KB963663)Update for Microsoft Office Excel 2007 Help (KB963678)Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit EditionUpdate for Microsoft Office Outlook 2007 Help (KB963677)Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687310) 32-Bit EditionUpdate for Microsoft Office Powerpoint 2007 Help (KB963669)Update for Microsoft Office Publisher 2007 Help (KB963667)Update for Microsoft Office Script Editor Help (KB963671)Update for Microsoft Office Word 2007 Help (KB963665)VerizonWirelessVZAccess ManagerWallpapersWebCam for MSN MessengerWebExWebRegWindows Driver Package - Intel (e1express) Net (02/27/2007 9.7.37.0)Windows Driver Package - Intel (iaStor) hdc (02/12/2007 7.0.0.1020)Windows Driver Package - Intel hdc (11/15/2006 8.2.0.1011)Windows Driver Package - Intel hdc (12/06/2006 6.8.0.3002)Windows Driver Package - Intel System (09/15/2006 7.0.0.1011)Windows Driver Package - Intel System (09/15/2006 8.0.0.1008)Windows Driver Package - Intel System (09/15/2006 8.0.0.1010)Windows Driver Package - Intel System (09/15/2006 8.2.0.1000)Windows Driver Package - Intel USB (09/15/2006 8.0.0.1008)Windows Driver Package - Lenovo (IBMPMDRV) System (02/27/2007 1.42)Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)Windows Driver Package - Ricoh Company (rismxdp) hdc (11/18/2006 6.00.01.05)Windows Driver Package - Ricoh Company MMC Host Controller (11/14/2006 6.00.01.04)Windows Firewall Setting ToolWindows Live CallWindows Live Communications PlatformWindows Live EssentialsWindows Live ID Sign-in AssistantWindows Live MailWindows Live MessengerWindows Live Movie MakerWindows Live Photo GalleryWindows Live SyncWindows Live ToolbarWindows Live Upload ToolWindows Live WriterWorthware - CellSell H.A.C.I. Thin-Client (162).==== Event Viewer Messages From Past Week ========.7/23/2012 8:06:21 AM, Error: Microsoft-Windows-TBS [516] - An error occurred while communicating with the TPM. The driver returned 0x8007045d.7/23/2012 7:20:17 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.7/23/2012 7:19:33 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrkWks service.7/23/2012 7:19:33 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.7/23/2012 7:19:33 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.7/23/2012 7:12:44 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the vpnagent service.7/23/2012 7:12:44 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.7/23/2012 7:12:36 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer WebEx Document Loader with shared resource name WebEx Document Loader. Error 1722. The printer cannot be used by others on the network.7/23/2012 7:11:43 PM, Error: EventLog [6008] - The previous system shutdown at 7:09:44 PM on 7/23/2012 was unexpected.7/23/2012 6:56:49 PM, Error: Service Control Manager [7022] - The KtmRm for Distributed Transaction Coordinator service hung on starting.7/23/2012 6:50:50 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer WebEx Document Loader with shared resource name WebEx Document Loader. Error 2114. The printer cannot be used by others on the network.7/23/2012 6:50:03 PM, Error: EventLog [6008] - The previous system shutdown at 6:47:57 PM on 7/23/2012 was unexpected.7/23/2012 5:43:00 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656353).7/23/2012 5:41:17 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656370).7/23/2012 2:03:51 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Volume Shadow Copy service to connect.7/23/2012 2:03:51 PM, Error: Service Control Manager [7000] - The Volume Shadow Copy service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/23/2012 2:03:51 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}7/22/2012 6:56:42 PM, Error: netbt [4321] - The name "ZAMANS-PC :0" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.3 did not allow the name to be claimed by this computer.7/22/2012 3:59:23 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/22/2012 3:59:22 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.7/22/2012 3:55:54 PM, Error: Microsoft-Windows-ResourcePublication [1002] - Element Provider\Microsoft.Base.Publication/Publication/Computer failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.7/21/2012 1:12:20 PM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.24. The computer with the IP address 192.168.1.36 did not allow the name to be claimed by this computer.7/19/2012 8:09:52 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.7/18/2012 4:34:34 PM, Error: TPM [13] - The device driver for the Trusted Platform Module (TPM) encountered a non-recoverable error in the TPM hardware, which prevents TPM services (such as data encryption) from being used. For further help, please contact the computer manufacturer.7/18/2012 10:10:48 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Adobe Flash Player Update Service service to connect.7/18/2012 10:10:48 AM, Error: Service Control Manager [7000] - The Adobe Flash Player Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/18/2012 1:50:00 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Zamans-PC\zamanmm SID (S-1-5-21-3894235439-4067020577-3388496322-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.7/17/2012 11:24:42 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NIS service..==== End Of File =========================== Link to post Share on other sites More sharing options...
Maniac Posted July 24, 2012 ID:575566 Share Posted July 24, 2012 Please try to run aswMBR in Safe mode:http://windows.microsoft.com/en-us/windows-vista/start-your-computer-in-safe-mode Link to post Share on other sites More sharing options...
zamanigg Posted July 24, 2012 Author ID:576025 Share Posted July 24, 2012 I still crash Link to post Share on other sites More sharing options...
Maniac Posted July 25, 2012 ID:576547 Share Posted July 25, 2012 Don't worry.Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/combofix/how-to-use-combofix* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please post the C:\ComboFix.txt in your next reply for further review.Note: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error. Link to post Share on other sites More sharing options...
Maurice Naggar Posted July 31, 2012 ID:578970 Share Posted July 31, 2012 @zamaniggAre you still with us ? Kindly provide a status update. Link to post Share on other sites More sharing options...
Maurice Naggar Posted August 2, 2012 ID:579748 Share Posted August 2, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
zamanigg Posted August 13, 2012 Author ID:584719 Share Posted August 13, 2012 Hi,I'm back. Just got done moving into a new place. I have run the combofix program successfully. Also, after running the program, I got a redirect from a google search. I am not sure if combofix was supposed to prevent it or not but here is the log.ComboFix 12-08-13.01 - zamanmm 08/13/2012 15:09:32.1.2 - x86Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.3061.1244 [GMT -4:00]Running from: c:\users\zamanmm\Downloads\ComboFix.exeAV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..C:\ac:\programdata\SPL5618.tmpc:\users\zamanmm\Documents\~WRL0003.tmpc:\users\zamanmm\Documents\~WRL0005.tmpc:\users\zamanmm\Documents\~WRL0009.tmpc:\users\zamanmm\Documents\~WRL2320.tmpc:\users\zamanmm\Documents\~WRL3132.tmpc:\users\zamanmm\Documents\~WRL4064.tmpc:\users\zamanmm\g2ax_customer_downloadhelper_win32_x86.exec:\windows\system32\~GLH0086.TMPc:\windows\system32\~GLH0092.TMPc:\windows\system32\~GLH0093.TMPc:\windows\system32\~GLH0099.TMPc:\windows\system32\~GLH009a.TMPc:\windows\system32\~GLH009b.TMPc:\windows\system32\TPAPSLOG.LOGc:\windows\system32\TPHDLOG0.LOGc:\windows\system32\URTTempc:\windows\system32\URTTemp\regtlib.exec:\windows\system32\wmm_cur.log..((((((((((((((((((((((((( Files Created from 2012-07-13 to 2012-08-13 )))))))))))))))))))))))))))))))..2012-08-13 19:18 . 2012-08-13 19:18 -------- d-----w- c:\users\Default\AppData\Local\temp2012-08-09 22:48 . 2012-08-09 22:48 -------- d-----w- c:\program files\Oracle2012-08-09 22:47 . 2012-07-06 02:06 772544 ----a-w- c:\windows\system32\npDeployJava1.dll2012-08-09 22:42 . 2012-08-09 22:42 -------- d-----w- c:\programdata\McAfee2012-08-06 14:38 . 2007-02-27 04:16 103936 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxdddrpp.dll2012-07-28 21:23 . 2012-07-29 16:56 -------- d-----w- c:\windows\system32\drivers\NIS\1307010.0052012-07-25 22:02 . 2012-07-25 22:02 -------- d-----w- c:\windows\hpoj4500g510g-m2012-07-23 23:57 . 2010-09-07 18:09 13680 ----a-w- c:\windows\system32\drivers\smiif32.sys2012-07-23 23:57 . 2012-07-23 23:57 -------- d-----w- C:\DRIVERS2012-07-23 23:54 . 2012-07-23 23:54 -------- d-----w- c:\users\zamanmm\AppData\Local\ApplicationHistory2012-07-22 17:19 . 2012-07-22 17:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-07-22 17:19 . 2012-07-03 17:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-08-02 23:47 . 2012-04-05 14:12 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe2012-08-02 23:47 . 2011-06-08 15:22 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-07-28 21:28 . 2009-05-23 19:21 141944 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS2012-07-06 02:06 . 2010-05-02 03:21 687544 ----a-w- c:\windows\system32\deployJava1.dll2012-06-13 13:40 . 2012-07-11 16:22 2047488 ----a-w- c:\windows\system32\win32k.sys2012-06-07 15:35 . 2012-06-07 15:35 10744 ----a-w- c:\windows\system32\vpncategories.dll2012-06-07 15:35 . 2012-06-07 15:35 33272 ----a-w- c:\windows\system32\vpnevents.dll2012-06-07 15:25 . 2012-06-07 15:25 23976 ----a-w- c:\windows\system32\drivers\vpnva.sys2012-06-07 15:24 . 2012-06-28 18:19 38440 ----a-r- c:\windows\system32\drivers\acsint.sys2012-06-07 15:24 . 2012-06-07 15:24 57256 ----a-r- c:\windows\system32\drivers\acsmux.sys2012-06-05 16:47 . 2012-07-11 16:13 1401856 ----a-w- c:\windows\system32\msxml6.dll2012-06-05 16:47 . 2012-07-11 16:13 1248768 ----a-w- c:\windows\system32\msxml3.dll2012-06-04 15:26 . 2012-07-11 16:13 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys2012-06-02 22:19 . 2012-06-24 16:02 53784 ----a-w- c:\windows\system32\wuauclt.exe2012-06-02 22:19 . 2012-06-24 16:02 45080 ----a-w- c:\windows\system32\wups2.dll2012-06-02 22:19 . 2012-06-24 16:01 35864 ----a-w- c:\windows\system32\wups.dll2012-06-02 22:19 . 2012-06-24 16:01 577048 ----a-w- c:\windows\system32\wuapi.dll2012-06-02 22:19 . 2012-06-24 16:02 1933848 ----a-w- c:\windows\system32\wuaueng.dll2012-06-02 22:12 . 2012-06-24 16:02 2422272 ----a-w- c:\windows\system32\wucltux.dll2012-06-02 22:12 . 2012-06-24 16:01 88576 ----a-w- c:\windows\system32\wudriver.dll2012-06-02 19:19 . 2012-06-24 16:01 171904 ----a-w- c:\windows\system32\wuwebv.dll2012-06-02 19:12 . 2012-06-24 16:01 33792 ----a-w- c:\windows\system32\wuapp.exe2012-06-02 00:04 . 2012-07-11 16:13 278528 ----a-w- c:\windows\system32\schannel.dll2012-06-02 00:03 . 2012-07-11 16:13 204288 ----a-w- c:\windows\system32\ncrypt.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{8660E5B3-6C41-44DE-8503-98D99BBECD41}"= "c:\program files\Coupons.com CouponBar\tbcore3.dll" [2012-02-06 2664864].[HKEY_CLASSES_ROOT\clsid\{8660e5b3-6c41-44de-8503-98d99bbecd41}][HKEY_CLASSES_ROOT\TBSB07898.TBSB07898.3][HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}][HKEY_CLASSES_ROOT\TBSB07898.TBSB07898].[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{8660E5B3-6C41-44DE-8503-98D99BBECD41}"= "c:\program files\Coupons.com CouponBar\tbcore3.dll" [2012-02-06 2664864].[HKEY_CLASSES_ROOT\clsid\{8660e5b3-6c41-44de-8503-98d99bbecd41}][HKEY_CLASSES_ROOT\TBSB07898.TBSB07898.3][HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}][HKEY_CLASSES_ROOT\TBSB07898.TBSB07898].[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]"QUBEE WCM"="c:\program files\QUBEE WCM\QUBEE WCM.exe" [2010-06-25 798720]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-04 39408]"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-14 820520]"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2007-04-10 321072]"LenovoOobeOffers"="c:\swtools\LenovoWelcome\LenovoOobeOffers.exe" [2006-12-29 28672]"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-10 1282048]"RPT Msgsrv"="c:\program files\Panasonic\Panasonic-DMS\RPT Network Printer Port\Msgsrv.exe" [2007-04-11 57344]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-06-07 522744]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2007-3-29 719664]HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]Job Status Utility.lnk - c:\program files\Panasonic\Panasonic-DMS\LRecvTrap\LRecvTrap.exe [2008-6-24 147456].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabledDigital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-7-18 50688]Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-9-23 169472].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]2010-10-12 16:08 147832 ----a-w- c:\program files\Citrix\GoToAssist Express Customer\240\g2ax_winlogon.dll.[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe""Google Update"="c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe" /c.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe""lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe".[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001.R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [x]R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [x]R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvcbthsvcs REG_MULTI_SZ BthServHPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12HPService REG_MULTI_SZ HPSLPSVCLocalServiceAndNoImpersonation REG_MULTI_SZ FontCachehpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc.Contents of the 'Scheduled Tasks' folder.2012-08-13 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 23:47].2012-08-03 c:\windows\Tasks\Google Software Updater.job- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-18 23:54].2012-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc7aec95b5ec60.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-02 21:16].2012-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-02 21:16].2010-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894235439-4067020577-3388496322-1000Core1cab612236fd982.job- c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-05 19:50].2012-08-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894235439-4067020577-3388496322-1000Core1cc8dc88cb16ea1.job- c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-05 19:50].2012-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894235439-4067020577-3388496322-1000UA.job- c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-05 19:50].2009-11-23 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job- c:\program files\PC-Doctor\pcdlauncher.exe [2009-11-20 10:12].2009-11-23 c:\windows\Tasks\SystemToolsDailyTest.job- c:\program files\PC-Doctor\pcdr5cuiw32.exe [2010-02-18 00:15]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Settings,ProxyOverride = localhost;*.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: DhcpNameServer = 192.168.1.1DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CABDPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab.- - - - ORPHANS REMOVED - - - -.HKCU-Run-InstallIQUpdater - c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2012-08-13 15:24Windows 6.0.6002 Service Pack 2 NTFS.scanning hidden processes ... .scanning hidden autostart entries ... .scanning hidden files ... ..c:\windows\system32\TPAPSLOG.LOG 128 bytes.scan completed successfullyhidden files: 1.**************************************************************************.[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.7.1.5\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (LocalSystem)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c5,db,61,b5,50,2f,44,95,81,5b,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c5,db,61,b5,50,2f,44,95,81,5b,\.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'Explorer.exe'(13092)c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dllc:\windows\system32\btncopy.dll.------------------------ Other Running Processes ------------------------.c:\windows\system32\ibmpmsvc.exec:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exec:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exec:\program files\LENOVO\HOTKEY\TPHKLOAD.exec:\program files\LENOVO\HOTKEY\TPHKSVC.exec:\windows\system32\IPSSVC.EXEc:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exec:\program files\LENOVO\HOTKEY\tposdsvc.exec:\windows\system32\AEADISRV.EXEc:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\windows\system32\atashost.exec:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exec:\program files\Bonjour\mDNSResponder.exec:\program files\QUBEE WCM\GPCommonService.exec:\program files\LENOVO\VIRTSCRL\lvvsst.exec:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exec:\progra~1\LENOVO\VIRTSCRL\virtscrl.exec:\windows\system32\lxddcoms.exec:\program files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exec:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exec:\program files\Panasonic\TrapMonitor\Trapmnnt.exec:\windows\system32\ptumlcmsvc.exec:\program files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exec:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exec:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exec:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exec:\windows\System32\TPHDEXLG.exec:\program files\Lenovo\Client Security Solution\tvttcsd.exec:\program files\Lenovo\Rescue and Recovery\rrpservice.exec:\program files\Lenovo\HOTKEY\TPONSCR.exec:\program files\Lenovo\Zoom\TpScrex.exec:\program files\Lenovo\Rescue and Recovery\rrservice.exec:\program files\Common Files\Lenovo\Scheduler\tvtsched.exec:\program files\Lenovo\Rescue and Recovery\ADM\IUService.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEc:\windows\system32\DRIVERS\xaudio.exec:\program files\ThinkPad\ConnectUtilities\AcSvc.exec:\program files\Spybot - Search & Destroy\SDWinSec.exec:\program files\Lenovo\System Update\SUService.exec:\program files\Common Files\Lenovo\Logger\logmon.exec:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exec:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\windows\system32\wbem\unsecapp.exe.**************************************************************************.Completion time: 2012-08-13 15:35:55 - machine was rebootedComboFix-quarantined-files.txt 2012-08-13 19:35.Pre-Run: 6,719,647,744 bytes freePost-Run: 6,859,485,184 bytes free.- - End Of File - - 03A0EC6B869C04FD226F0C27DD5E107A Link to post Share on other sites More sharing options...
Maniac Posted August 14, 2012 ID:584906 Share Posted August 14, 2012 1. Close any open browsers.2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it:Folder::c:\program files\Coupons.com CouponBarRegistry::[-HKEY_CLASSES_ROOT\clsid\{8660e5b3-6c41-44de-8503-98d99bbecd41}][-HKEY_CLASSES_ROOT\TBSB07898.TBSB07898.3][-HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}][-HKEY_CLASSES_ROOT\TBSB07898.TBSB07898][-HKEY_CLASSES_ROOT\clsid\{8660e5b3-6c41-44de-8503-98d99bbecd41}][-HKEY_CLASSES_ROOT\TBSB07898.TBSB07898.3][-HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}][-HKEY_CLASSES_ROOT\TBSB07898.TBSB07898][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{8660E5B3-6C41-44DE-8503-98D99BBECD41}"=-[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{8660E5B3-6C41-44DE-8503-98D99BBECD41}"=-JavaClearCache::Save this as CFScript.txt, in the same location as ComboFix.exeRefering to the picture above, drag CFScript into ComboFix.exeWhen finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Link to post Share on other sites More sharing options...
zamanigg Posted August 14, 2012 Author ID:585225 Share Posted August 14, 2012 ComboFix 12-08-14.05 - zamanmm 08/14/2012 16:57:39.2.2 - x86Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.3061.1477 [GMT -4:00]Running from: c:\users\zamanmm\Downloads\ComboFix.exeCommand switches used :: c:\users\zamanmm\Downloads\CFScript.txtAV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\program files\Coupons.com CouponBarc:\program files\Coupons.com CouponBar\arrow_refresh.pngc:\program files\Coupons.com CouponBar\basis.xmlc:\program files\Coupons.com CouponBar\chrome\coupons.com.crx\coupons.com.crxc:\program files\Coupons.com CouponBar\cog.pngc:\program files\Coupons.com CouponBar\computer_delete.pngc:\program files\Coupons.com CouponBar\coupons.com.dllc:\program files\Coupons.com CouponBar\dataLoader.jsc:\program files\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\coupons.com.xpic:\program files\Coupons.com CouponBar\icons3.bmpc:\program files\Coupons.com CouponBar\info.txtc:\program files\Coupons.com CouponBar\login.pngc:\program files\Coupons.com CouponBar\logo.pngc:\program files\Coupons.com CouponBar\lua5.1.dllc:\program files\Coupons.com CouponBar\search.pngc:\program files\Coupons.com CouponBar\TbCommonUtils.dllc:\program files\Coupons.com CouponBar\tbcore3.dllc:\program files\Coupons.com CouponBar\tbhelper.dllc:\program files\Coupons.com CouponBar\TbHelper2.exec:\program files\Coupons.com CouponBar\todays_deals.pngc:\program files\Coupons.com CouponBar\uninstall.exec:\program files\Coupons.com CouponBar\Uninstall\IRIMG1.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG1.JPGc:\program files\Coupons.com CouponBar\Uninstall\IRIMG2.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG2.JPGc:\program files\Coupons.com CouponBar\Uninstall\IRIMG3.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG3.JPGc:\program files\Coupons.com CouponBar\Uninstall\IRIMG4.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG4.JPGc:\program files\Coupons.com CouponBar\Uninstall\IRIMG5.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG5.JPGc:\program files\Coupons.com CouponBar\Uninstall\IRIMG6.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG7.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG8.BMPc:\program files\Coupons.com CouponBar\Uninstall\IRIMG9.BMPc:\program files\Coupons.com CouponBar\Uninstall\uninstall.datc:\program files\Coupons.com CouponBar\Uninstall\uninstall.xmlc:\program files\Coupons.com CouponBar\update.exec:\program files\Coupons.com CouponBar\version.txtc:\windows\system32\TPAPSLOG.LOGc:\windows\system32\TPHDLOG0.LOGc:\windows\system32\wmm_cur.log..((((((((((((((((((((((((( Files Created from 2012-07-14 to 2012-08-14 )))))))))))))))))))))))))))))))..2012-08-14 21:10 . 2012-08-14 21:10 -------- d-----w- C:\A2012-08-14 21:06 . 2012-08-14 21:06 -------- d-----w- c:\users\TEMP\AppData\Local\temp2012-08-14 21:06 . 2012-08-14 21:06 -------- d-----w- c:\users\Default\AppData\Local\temp2012-08-09 22:48 . 2012-08-09 22:48 -------- d-----w- c:\program files\Oracle2012-08-09 22:42 . 2012-08-09 22:42 -------- d-----w- c:\programdata\McAfee2012-08-06 14:38 . 2007-02-27 04:16 103936 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxdddrpp.dll2012-07-28 21:23 . 2012-07-29 16:56 -------- d-----w- c:\windows\system32\drivers\NIS\1307010.0052012-07-25 22:02 . 2012-07-25 22:02 -------- d-----w- c:\windows\hpoj4500g510g-m2012-07-23 23:57 . 2010-09-07 18:09 13680 ----a-w- c:\windows\system32\drivers\smiif32.sys2012-07-23 23:57 . 2012-07-23 23:57 -------- d-----w- C:\DRIVERS2012-07-23 23:54 . 2012-07-23 23:54 -------- d-----w- c:\users\zamanmm\AppData\Local\ApplicationHistory2012-07-22 17:19 . 2012-07-22 17:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2012-07-22 17:19 . 2012-07-03 17:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2012-08-02 23:47 . 2012-04-05 14:12 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe2012-08-02 23:47 . 2011-06-08 15:22 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2012-07-28 21:28 . 2009-05-23 19:21 141944 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS2012-07-06 02:06 . 2012-08-09 22:47 772544 ----a-w- c:\windows\system32\npDeployJava1.dll2012-07-06 02:06 . 2010-05-02 03:21 687544 ----a-w- c:\windows\system32\deployJava1.dll2012-06-13 13:40 . 2012-07-11 16:22 2047488 ----a-w- c:\windows\system32\win32k.sys2012-06-07 15:35 . 2012-06-07 15:35 10744 ----a-w- c:\windows\system32\vpncategories.dll2012-06-07 15:35 . 2012-06-07 15:35 33272 ----a-w- c:\windows\system32\vpnevents.dll2012-06-07 15:25 . 2012-06-07 15:25 23976 ----a-w- c:\windows\system32\drivers\vpnva.sys2012-06-07 15:24 . 2012-06-28 18:19 38440 ----a-r- c:\windows\system32\drivers\acsint.sys2012-06-07 15:24 . 2012-06-07 15:24 57256 ----a-r- c:\windows\system32\drivers\acsmux.sys2012-06-05 16:47 . 2012-07-11 16:13 1401856 ----a-w- c:\windows\system32\msxml6.dll2012-06-05 16:47 . 2012-07-11 16:13 1248768 ----a-w- c:\windows\system32\msxml3.dll2012-06-04 15:26 . 2012-07-11 16:13 440704 ----a-w- c:\windows\system32\drivers\ksecdd.sys2012-06-02 22:19 . 2012-06-24 16:02 53784 ----a-w- c:\windows\system32\wuauclt.exe2012-06-02 22:19 . 2012-06-24 16:02 45080 ----a-w- c:\windows\system32\wups2.dll2012-06-02 22:19 . 2012-06-24 16:01 35864 ----a-w- c:\windows\system32\wups.dll2012-06-02 22:19 . 2012-06-24 16:01 577048 ----a-w- c:\windows\system32\wuapi.dll2012-06-02 22:19 . 2012-06-24 16:02 1933848 ----a-w- c:\windows\system32\wuaueng.dll2012-06-02 22:12 . 2012-06-24 16:02 2422272 ----a-w- c:\windows\system32\wucltux.dll2012-06-02 22:12 . 2012-06-24 16:01 88576 ----a-w- c:\windows\system32\wudriver.dll2012-06-02 19:19 . 2012-06-24 16:01 171904 ----a-w- c:\windows\system32\wuwebv.dll2012-06-02 19:12 . 2012-06-24 16:01 33792 ----a-w- c:\windows\system32\wuapp.exe2012-06-02 00:04 . 2012-07-11 16:13 278528 ----a-w- c:\windows\system32\schannel.dll2012-06-02 00:03 . 2012-07-11 16:13 204288 ----a-w- c:\windows\system32\ncrypt.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]"QUBEE WCM"="c:\program files\QUBEE WCM\QUBEE WCM.exe" [2010-06-25 798720]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-04 39408]"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-08-14 820520]"PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2007-04-10 321072]"LenovoOobeOffers"="c:\swtools\LenovoWelcome\LenovoOobeOffers.exe" [2006-12-29 28672]"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-10 1282048]"RPT Msgsrv"="c:\program files\Panasonic\Panasonic-DMS\RPT Network Printer Port\Msgsrv.exe" [2007-04-11 57344]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2012-06-07 522744]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2007-3-29 719664]HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]Job Status Utility.lnk - c:\program files\Panasonic\Panasonic-DMS\LRecvTrap\LRecvTrap.exe [2008-6-24 147456].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabledDigital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-7-18 50688]Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-9-23 169472].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]2010-10-12 16:08 147832 ----a-w- c:\program files\Citrix\GoToAssist Express Customer\240\g2ax_winlogon.dll.[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe""Google Update"="c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe" /c.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe""lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe".[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]"DisableMonitoring"=dword:00000001.[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001.R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [x]R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [x]R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]..[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvcbthsvcs REG_MULTI_SZ BthServHPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12HPService REG_MULTI_SZ HPSLPSVCLocalServiceAndNoImpersonation REG_MULTI_SZ FontCachehpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc.Contents of the 'Scheduled Tasks' folder.2012-08-14 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 23:47].2012-08-03 c:\windows\Tasks\Google Software Updater.job- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-18 23:54].2012-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc7aec95b5ec60.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-02 21:16].2012-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-02 21:16].2010-03-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894235439-4067020577-3388496322-1000Core1cab612236fd982.job- c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-05 19:50].2012-08-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894235439-4067020577-3388496322-1000Core1cc8dc88cb16ea1.job- c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-05 19:50].2012-08-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3894235439-4067020577-3388496322-1000UA.job- c:\users\zamanmm\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-05 19:50].2009-11-23 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job- c:\program files\PC-Doctor\pcdlauncher.exe [2009-11-20 10:12].2009-11-23 c:\windows\Tasks\SystemToolsDailyTest.job- c:\program files\PC-Doctor\pcdr5cuiw32.exe [2010-02-18 00:15].2012-08-14 c:\windows\Tasks\User_Feed_Synchronization-{DB1F06DB-C5AA-402C-8CD5-553AAD0E9856}.job- c:\windows\system32\msfeedssync.exe [2012-06-14 03:24]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Settings,ProxyOverride = localhost;*.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: DhcpNameServer = 192.168.1.1DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CABDPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} - hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab.- - - - ORPHANS REMOVED - - - -.AddRemove-CouponBar5.0.0.5 - c:\program files\Coupons.com CouponBar\uninstall.exe...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2012-08-14 17:10Windows 6.0.6002 Service Pack 2 NTFS.scanning hidden processes ... .scanning hidden autostart entries ... .scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.7.1.5\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (LocalSystem)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c5,db,61,b5,50,2f,44,95,81,5b,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a2,c5,db,61,b5,50,2f,44,95,81,5b,\.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'Explorer.exe'(10484)c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dllc:\windows\system32\btncopy.dll.------------------------ Other Running Processes ------------------------.c:\windows\system32\ibmpmsvc.exec:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exec:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exec:\program files\LENOVO\HOTKEY\TPHKLOAD.exec:\program files\LENOVO\HOTKEY\TPHKSVC.exec:\windows\system32\IPSSVC.EXEc:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exec:\program files\LENOVO\HOTKEY\tposdsvc.exec:\windows\system32\AEADISRV.EXEc:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\windows\system32\atashost.exec:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exec:\program files\Bonjour\mDNSResponder.exec:\program files\QUBEE WCM\GPCommonService.exec:\program files\LENOVO\VIRTSCRL\lvvsst.exec:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exec:\windows\system32\lxddcoms.exec:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exec:\program files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exec:\progra~1\LENOVO\VIRTSCRL\virtscrl.exec:\program files\Lenovo\HOTKEY\TPONSCR.exec:\program files\Panasonic\TrapMonitor\Trapmnnt.exec:\program files\Lenovo\Zoom\TpScrex.exec:\program files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exec:\windows\system32\ptumlcmsvc.exec:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exec:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exec:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exec:\windows\System32\TPHDEXLG.exec:\program files\Lenovo\Client Security Solution\tvttcsd.exec:\program files\Lenovo\Rescue and Recovery\rrpservice.exec:\program files\Lenovo\Rescue and Recovery\rrservice.exec:\program files\Common Files\Lenovo\Scheduler\tvtsched.exec:\program files\Lenovo\Rescue and Recovery\ADM\IUService.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEc:\windows\system32\DRIVERS\xaudio.exec:\program files\ThinkPad\ConnectUtilities\AcSvc.exec:\program files\Spybot - Search & Destroy\SDWinSec.exec:\program files\Lenovo\System Update\SUService.exec:\program files\Common Files\Lenovo\Logger\logmon.exec:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exec:\windows\system32\wbem\unsecapp.exe.**************************************************************************.Completion time: 2012-08-14 17:26:26 - machine was rebootedComboFix-quarantined-files.txt 2012-08-14 21:24ComboFix2.txt 2012-08-13 19:35.Pre-Run: 7,050,407,936 bytes freePost-Run: 6,835,748,864 bytes free.- - End Of File - - C9DF207C9CC9C4C60F32A3597F3F6CFF Link to post Share on other sites More sharing options...
Maniac Posted August 15, 2012 ID:585547 Share Posted August 15, 2012 Please run a free online scan with the ESET Online ScannerNote: You will need to use Internet Explorer for this scanTick the box next to YES, I accept the Terms of UseClick StartWhen asked, allow the ActiveX control to installClick StartMake sure that the options Remove found threats and the option Scan unwanted applications is checkedClick Scan (This scan can take several hours, so please be patient)Once the scan is completed, you may close the windowUse Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txtCopy and paste that log as a reply to this topic Link to post Share on other sites More sharing options...
zamanigg Posted August 21, 2012 Author ID:588369 Share Posted August 21, 2012 Ran ESET Online Scanner and it removed 5 things, 2 worms, 2 trojans and something else. Couldn't finish the scan and ran it fully today. It found no threats. I cannot find any log file associated with this program. Link to post Share on other sites More sharing options...
Maniac Posted August 21, 2012 ID:588372 Share Posted August 21, 2012 How are things running now? Link to post Share on other sites More sharing options...
Staff screen317 Posted August 30, 2012 Staff ID:591664 Share Posted August 30, 2012 Are you still with us? This topic will be closed in a few days if we do not hear back from you. Link to post Share on other sites More sharing options...
Maurice Naggar Posted September 9, 2012 ID:595250 Share Posted September 9, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts