Infected! The specified device does not exist as an installed device.

ubigred · August 20, 2012

Hello all.

I am issues with my Toshiba laptop.

I have access to the internet and for the most part things seem, except for the network sharing capabilities can not be turned on. Furthermore, I am not able to enable Windows Firewall or Defender. I am running Vista.

I ran the Malware Removal program and below you will see the log.

Please help and advise. Thanks!

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.18.01

Windows Vista Service Pack 1 x86 NTFS

Internet Explorer 8.0.6001.19088

Owner :: OWNER-PC [administrator]

8/18/2012 3:19:22 AM

mbam-log-2012-08-20 (13-55-19).txt

Scan type: Full scan (C:\|)

Scan options disabled: P2P

Objects scanned: 453503

Time elapsed: 2 hour(s), 46 minute(s), 21 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 1

HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Owner\AppData\Local\ain.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> No action taken.

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\Users\Owner\AppData\Local\Temp\is1373634743\IWantThis_US.exe (Adware.GamePlayLabs) -> No action taken.

C:\Users\Owner\AppData\Local\Temp\wz38c6\Microsoft Office 2007 FULL + Keygen ( Vista comp.)\Office [Keygen].exe (RiskWare.Tool.CK) -> No action taken.

C:\Users\Owner\AppData\Local\Temp\wz3ab9\Microsoft Office 2007 FULL + Keygen ( Vista comp.)\Office [Keygen].exe (RiskWare.Tool.CK) -> No action taken.

C:\Users\Owner\AppData\Local\Temp\wz8540\Microsoft Office 2007 FULL + Keygen ( Vista comp.)\Office [Keygen].exe (RiskWare.Tool.CK) -> No action taken.

C:\Users\Owner\Documents\Vuze Downloads\Microsoft Office 2007 FULL + Keygen ( Vista comp.)\Microsoft Office 2007 FULL + Keygen ( Vista comp.)\Office [Keygen].exe (RiskWare.Tool.CK) -> No action taken.

C:\Users\Owner\Documents\Microsoft Office 2007 FULL + Keygen ( Vista comp.)\Office [Keygen].exe (RiskWare.Tool.CK) -> No action taken.

(end)

ubigred · August 20, 2012

Help would be much appreciated.

ubigred · August 20, 2012

dds.txt

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.19088 BrowserJavaVersion: 1.6.0_33

Run by Owner at 15:55:54 on 2012-08-20

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\agrsmsvc.exe

C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Program Files\CinemaNow\CinemaNow Media Manager\CNRpc.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

C:\Program Files\Toshiba\SmoothView\SmoothView.exe

C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Toshiba\ConfigFree\NDSTray.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Toshiba\TOSHIBA Service Station\TSS.exe

C:\Program Files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe

C:\Program Files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Users\Owner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Windows\System32\OptionalFeatures.exe

C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Owner\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Owner\Downloads\dds.com

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k WindowsMobile

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart

mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart

uURLSearchHooks: H - No File

BHO: NCO 2.0 IE BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\common files\symantec shared\coshared\browser\2.6\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\progra~1\common~1\symant~1\ids\IPSBHO.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7725.1624\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Show Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\alwil software\avast5\aswWebRepIE.dll

TB: {043C5167-00BB-4324-AF7E-62013FAEDACF} - No File

TB: {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File

TB: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File

uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [MusicManager] "c:\users\owner\appdata\local\programs\google\musicmanager\MusicManager.exe"

uRun: [307537703] c:\users\owner\appdata\local\temp\tmph5745375836265147951.tmp

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start

mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe

mRun: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

mRun: [iTSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [NDSTray.exe] NDSTray.exe

mRun: [cfFncEnabler.exe] cfFncEnabler.exe

mRun: [ToshibaServiceStation] "c:\program files\toshiba\toshiba service station\TSS.exe" /hide

mRun: [PCMAgent] "c:\program files\cyberlink\powercinema for toshiba\PCMAgent.exe"

mRun: [CLMLServer] "c:\program files\cyberlink\powercinema for toshiba\kernel\clml\CLMLSvc.exe"

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [osCheck] "c:\program files\norton 360\osCheck.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe

mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [CinemaNowMediaManagerApp] c:\program files\cinemanow\cinemanow media manager\CinemaNowShell.exe -start

mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW

mRun: [HTC Sync Loader] "c:\program files\htc\htc sync 3.0\htcUPCTLoader.exe" -startup

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

Trusted Zone: cinemanow.com

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.254.254

TCP: Interfaces\{05D79543-2CF0-4D61-9A2B-62B02ADB519C} : DhcpNameServer = 192.168.42.129

TCP: Interfaces\{15B4BE00-DEE4-49F2-AEDB-009FFEAFC43E} : DhcpNameServer = 192.168.42.129

TCP: Interfaces\{182B74AA-35CD-479B-AACD-563CC37020FF} : DhcpNameServer = 192.168.254.254

TCP: Interfaces\{F835D912-1E37-4FCF-8E2D-20F6481C5667} : DhcpNameServer = 192.168.42.129

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Notify: igfxcui - igfxdev.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\6zil0nd0.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=HP_ss&mntrId=1254a72700000000000000216b26add0

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=109935&tt=050412_30b&babsrc=KW_ss&mntrId=1254a72700000000000000216b26add0&q=

FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.50826.0\npctrlui.dll

FF - plugin: c:\users\owner\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: c:\users\owner\appdata\local\google\update\1.3.21.67\npGoogleUpdate3.dll

FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\users\owner\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_265.dll

FF - plugin: c:\windows\system32\npdeployJava1.dll

FF - plugin: c:\windows\system32\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109935&tt=050412_30b

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - 1254a72700000000000000216b26add0

FF - user.js: extensions.BabylonToolbar_i.hardId - 1254a72700000000000000216b26add0

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15440

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1711:34:45

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

.

============= SERVICES / DRIVERS ===============

.

R? COH_Mon;COH_Mon

R? dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)

R? gupdate;Google Update Service (gupdate)

R? gupdatem;Google Update Service (gupdatem)

R? HTCAND32;HTC Device Driver

R? htcnprot;HTC NDIS Protocol Driver

R? MozillaMaintenance;Mozilla Maintenance Service

R? ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.)

R? Symantec Core LC;Symantec Core LC

R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0

S? aswFsBlk;aswFsBlk

S? aswMonFlt;aswMonFlt

S? aswSnx;aswSnx

S? aswSP;aswSP

S? avast! Antivirus;avast! Antivirus

S? CinemaNow Service;CinemaNow Service

S? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

S? ConfigFree Service;ConfigFree Service

S? FwLnk;FwLnk Driver

S? IDSvix86;Symantec Intrusion Prevention Driver

S? LiveUpdate Notice;LiveUpdate Notice

S? NETw5v32;Intel® Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit

S? PassThru Service;Internet Pass-Through Service

S? SmartFaceVWatchSrv;SmartFaceVWatchSrv

S? SYMNDISV;SYMNDISV

S? TMachInfo;TMachInfo

S? TOSHIBA SMART Log Service;TOSHIBA SMART Log Service

.

=============== Created Last 30 ================

.

2012-08-20 20:09:10 -------- d-----w- c:\windows\system32\eu-ES

2012-08-20 20:09:10 -------- d-----w- c:\windows\system32\ca-ES

2012-08-20 20:09:09 -------- d-----w- c:\windows\system32\vi-VN

2012-08-20 19:08:24 -------- d-----w- c:\windows\system32\EventProviders

2012-08-08 20:55:45 476976 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-08-02 20:16:21 4024320 ----a-w- c:\program files\GUT841A.tmp

2012-08-02 20:16:21 -------- d-----w- c:\program files\GUM8419.tmp

.

==================== Find3M ====================

.

2012-08-08 20:55:26 472880 ----a-w- c:\windows\system32\deployJava1.dll

2012-07-19 07:00:37 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-07-19 07:00:37 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-07-03 18:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-07-03 16:21:53 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-07-03 16:21:53 57656 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2012-07-03 16:21:32 41224 ----a-w- c:\windows\avastSS.scr

.

============= FINISH: 15:57:36.79 ===============

ubigred · August 20, 2012

Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 8/14/2009 11:06:37 PM

System Uptime: 8/20/2012 3:11:49 PM (0 hours ago)

.

Motherboard: Intel Corp. | | Base Board Product Name

Processor: Intel® Core2 Duo CPU T5800 @ 2.00GHz | CPU | 800/800mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 231 GiB total, 118.38 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP469: 8/18/2012 2:33:24 AM - Scheduled Checkpoint

RP470: 8/18/2012 3:00:10 AM - Windows Update

RP471: 8/20/2012 2:07:21 PM - Windows Update

.

==== Installed Programs ======================

.

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 8.2.0

Amazon Links

AppCore

Apple Application Support

Apple Software Update

avast! Free Antivirus

Backup

Bluetooth Stack for Windows by Toshiba

Camera Assistant Software for Toshiba

ccCommon

CD/DVD Drive Acoustic Silencer

CinemaNow Media Manager

CyberLink PowerCinema for TOSHIBA

DivX Converter

DivX Plus DirectShow Filters

DivX Setup

DivX Version Checker

DivX Web Player

DVD MovieFactory for TOSHIBA

FormatFactory 2.60

GearDrvs

Google Chrome

Google Drive

Google Talk Plugin

Google Toolbar for Internet Explorer

Google Update Helper

HashCheck Shell Extension (x86-32)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

HTC BMP USB Driver

HTC Driver Installer

HTC Sync

HTC Touch Pro2 User Guide

Intel PROSet Wireless

Intel® Graphics Media Accelerator Driver

Intel® PROSet/Wireless WiFi Software

Intel® Matrix Storage Manager

Java Auto Updater

Java 6 Update 33

Java 6 Update 6

K-Lite Codec Pack 5.6.1 (Standard)

LiveUpdate (Symantec Corporation)

Malwarebytes Anti-Malware version 1.62.0.1300

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft XML Parser

Mozilla Firefox 14.0.1 (x86 en-US)

Mozilla Firefox 4.0b6 (x86 en-US)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB973685)

Music Manager

Napster Download Manager

NetZero Internet Access Installer

Norton 360

Norton 360 (Symantec Corporation)

Norton 360 HTMLHelp

Norton Confidential Core

OGA Notifier 2.0.0048.0

Picasa 2

QuickBooks Financial Center

QuickTime

RapidShare Manager

Realtek 8169 8168 8101E 8102E Ethernet Driver

Realtek High Definition Audio Driver

RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.02

Security Update for 2007 Microsoft Office System (KB2277947)

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for 2007 Microsoft Office System (KB982312)

Security Update for 2007 Microsoft Office System (KB982331)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB982308)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office Outlook 2007 (KB2288953)

Security Update for Microsoft Office PowerPoint 2007 (KB982158)

Security Update for Microsoft Office Publisher 2007 (KB982124)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2251419)

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

SPBBC 32bit

Symantec Real Time Storage Protection Component

Symantec Technical Support Controls

SymNet

Synaptics Pointing Device Driver

TOSHIBA Application Disc Creator

TOSHIBA Assist

TOSHIBA ConfigFree

TOSHIBA Desktop Links

TOSHIBA Disc Creator

TOSHIBA DVD PLAYER

TOSHIBA Extended Tiles for Windows Mobility Center

TOSHIBA Face Recognition

TOSHIBA Hardware Setup

TOSHIBA PowerCinema Helper

Toshiba Registration

TOSHIBA SD Memory Utilities

TOSHIBA Service Station

TOSHIBA Software Modem

TOSHIBA Speech System Applications

TOSHIBA Speech System SR Engine(U.S.) Version1.0

TOSHIBA Speech System TTS Engine(U.S.) Version1.0

TOSHIBA Supervisor Password

TOSHIBA Value Added Package

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 (KB980729)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update for Outlook 2007 Junk Email Filter (kb2291599)

VC80CRTRedist - 8.0.50727.4053

WildTangent Games

Windows Media Encoder 9 Series

Windows Media Player Firefox Plugin

Windows Mobile Device Center

Windows Mobile Device Center Driver Update

WinRAR archiver

WinZip 14.5

Yahoo! Detect

Yahoo! SiteBuilder

YouTube Downloader 2.5.4

.

==== End Of File ===========================

ROGUEKILLER

RogueKiller V7.6.6 [08/10/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User: Owner [Admin rights]

Mode: Scan -- Date: 08/20/2012 16:20:42

¤¤¤ Bad processes: 1 ¤¤¤

[sUSP PATH] MusicManager.exe -- C:\Users\Owner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 7 ¤¤¤

[sUSP PATH] HKCU\[...]\Run : MusicManager ("C:\Users\Owner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe") -> FOUND

[sUSP PATH] HKCU\[...]\Run : 307537703 (C:\Users\Owner\AppData\Local\Temp\tmph5745375836265147951.tmp) -> FOUND

[sUSP PATH] HKUS\S-1-5-21-1038527918-3062837077-4051479591-1000[...]\Run : MusicManager ("C:\Users\Owner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe") -> FOUND

[sUSP PATH] HKUS\S-1-5-21-1038527918-3062837077-4051479591-1000[...]\Run : 307537703 (C:\Users\Owner\AppData\Local\Temp\tmph5745375836265147951.tmp) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

SSDT[13] : NtAlertResumeThread @ 0x82E9951D -> HOOKED (Unknown @ 0x93BD32B0)

SSDT[14] : NtAlertThread @ 0x82E121E5 -> HOOKED (Unknown @ 0x93BD3370)

SSDT[21] : NtAlpcConnectPort @ 0x82DF081F -> HOOKED (Unknown @ 0x93AA6B08)

SSDT[67] : NtCreateMutant @ 0x82E267BC -> HOOKED (Unknown @ 0x93B6DF00)

SSDT[78] : NtCreateThread @ 0x82E97B98 -> HOOKED (Unknown @ 0x93BD54F8)

SSDT[116] : NtDebugActiveProcess @ 0x82E6ACE2 -> HOOKED (Unknown @ 0x93B6DCC0)

SSDT[156] : NtImpersonateAnonymousToken @ 0x82DC0EE2 -> HOOKED (Unknown @ 0x93B6DFD0)

SSDT[158] : NtImpersonateThread @ 0x82DD64E4 -> HOOKED (Unknown @ 0x93BD31F0)

SSDT[177] : NtMapViewOfSection @ 0x82E1682A -> HOOKED (Unknown @ 0x93B60F30)

SSDT[184] : NtOpenEvent @ 0x82DFFD5F -> HOOKED (Unknown @ 0x93B6DE40)

SSDT[195] : NtOpenProcessToken @ 0x82E079BE -> HOOKED (Unknown @ 0x93BD5480)

SSDT[202] : NtOpenThreadToken @ 0x82E22258 -> HOOKED (Unknown @ 0x93B60CD0)

SSDT[282] : NtResumeThread @ 0x82E21AF5 -> HOOKED (Unknown @ 0x93B7FA88)

SSDT[289] : NtSetContextThread @ 0x82E98867 -> HOOKED (Unknown @ 0x93B60C10)

SSDT[305] : NtSetInformationProcess @ 0x82E1A858 -> HOOKED (Unknown @ 0x93B60DA0)

SSDT[306] : NtSetInformationThread @ 0x82DFF23D -> HOOKED (Unknown @ 0x93BD35F8)

SSDT[330] : NtSuspendProcess @ 0x82E99457 -> HOOKED (Unknown @ 0x93B6DD80)

SSDT[331] : NtSuspendThread @ 0x82DA092D -> HOOKED (Unknown @ 0x93BD3478)

SSDT[335] : NtTerminateThread @ 0x82E224DF -> HOOKED (Unknown @ 0x93BD3538)

SSDT[348] : NtUnmapViewOfSection @ 0x82E16AED -> HOOKED (Unknown @ 0x93B60E70)

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD2500BEVT-00ZCT0 +++++

--- User ---

[MBR] 5f577f3690278f6ef3b9d57cbfd5bb42

[bSP] 7271b13cbf72c5313a8bdaf1ff7d50b5 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 236974 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

ubigred · August 21, 2012

Did I post this in the correct forum? If not, my apologies and please instruct me to the proper forum. Thanks.

screen317 · August 30, 2012

Hi and welcome to Malwarebytes.

Please see:

Forum Piracy Policy

We will not assist users that are obviously using illegal software.

If any such evidence is found you will be given the benefit of the doubt and the opportunity to completely uninstall and delete any such data from your system.

During the scanning process if any further evidence shows up your topic will be closed and no further assistance will be provided.

If you're using Peer 2 Peer software such as uTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

It's likely why your issue began in the first place.

ubigred · September 4, 2012

Hello,

I thought my thread was left for dead.

I deleted the Vuse software. I downloaded it to watch NFL games when I was out of the country.

screen317 · September 5, 2012

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

If after ComboFix reboots you get a message about an "Invalid Option Registry Key Marked for Deletion," please reboot again and the error will go away.

-screen317

ubigred · September 5, 2012

ComboFix ran for over 2hrs. Not sure if it saying led out or if it was still going through the process. I went to bed and woke up this morning. A message popped saying I'm infected with the Zero Access virus.

ubigred · September 5, 2012

Took a while ,but ComboFix ran its course.

dds.tx

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_33

Run by Owner at 12:16:35 on 2012-09-05

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1687 [GMT -5:00]

.

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Norton 360 *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\agrsmsvc.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Windows\System32\tcpsvcs.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

C:\Program Files\Toshiba\SmoothView\SmoothView.exe

C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Toshiba\ConfigFree\NDSTray.exe

C:\Program Files\Toshiba\TOSHIBA Service Station\TSS.exe

C:\Program Files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe

C:\Program Files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe

C:\Program Files\CinemaNow\CinemaNow Media Manager\CNRpc.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe

C:\Windows\ehome\ehtray.exe

C:\Users\Owner\AppData\Local\Programs\Google\MusicManager\MusicManager.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Windows\System32\mobsync.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wuauclt.exe