winrscmde an infection? svchost?

meisnerman · November 9, 2012

I believe i have a malware infection. Here are the basic stats for my machine:

Windows 7 Home Premium

Hewlett-Packard

HP Pavilion dv7 Notebook PC

Processor: AMD Turion II Ultra

Dual-Core Mobile M600 2.40 GHz

Installed memory (RAM): 400GB (3.75 GB usable)

64-bit Operating System

I am running Norton Security Suite - provided by my ISP (All definitions are updated, but Norton finds nothing)

The Problem:

For several months now, I have had unsolicited audio advertisements pop up spontaneously whenever I start-up. A new slider (sometimes several) opens in my sound mixer (labeled "name not available" or sometimes "winrscmde" of it's own accord and begins playing ads for several minutes. Sometimes another will open later, and then another. I ran my scan through Norton and got no results. I also chatted online with a Norton rep who tried several fixes and resolved nothing. He said I needed to contact my driver manufacturers - whatever that means. While al this goes on, I frequently get messages from Windows warning of "High CPU Usage by winrscmde". After striking out with Norton help (a couple of months ago), I have mostly just managed this by muting each new slider that appears, and restarting as little as possible. Usually after an hour or so, the activity abates.

What I've Done:

This morning I downloaded the free version of Malwarebytes, and ran the quick scan. I found and removed 2 items (I saved the report,) then rebooted as requested. The following startup was worse. In adition to the ads, My Explorer opened on it's own, opened my gmail (veeeeeery slowly) and created a "compose" folder with a spam message. Also, Norton just notified me of a blocked attack from Exploit Toolkit Wbsite 38.

I have also run DDS and saved both files.

Advice?

gringo_pr · November 9, 2012

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I need to get some reports to get a base to start from so I need you to run these programs first.

-DeFogger-

Please download

DeFogger to your desktop.
Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

Please download DDS from one of the links below and save it to your desktop:

Download DDS and save it to your desktop

Link1
Link2
Link3

Double-Click on dds.scr and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
[*]A window will open instructing you save & post the logs
[*]Save the logs to a convenient place such as your desktop
[*]Copy the contents of both logs & post in your next reply

information and logs

In your next post I need the following

both reports from DDS
report from security check
let me know of any problems you may have had

Gringo

meisnerman · November 9, 2012

Gringo,

Thank you so much for responding and for your help. I have followed all the steps you listed. here are the reports you asked for:

SECURITY CHECK

Results of screen317's Security Check version 0.99.54

Windows 7 x64 (UAC is enabled)

Out of date service pack!!

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Norton Security Suite

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

Java 6 Update 37

Java version out of Date!

Adobe Reader 9 Adobe Reader out of Date!

````````Process Check: objlist.exe by Laurent````````

Norton ccSvcHst.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 8%

````````````````````End of Log``````````````````````

DDS

DDS (Ver_2012-11-07.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16421

Run by Justin at 14:57:37 on 2012-11-09

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3836.1606 [GMT -7:00]

.

AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\Hpservice.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe

C:\Program Files\LSI SoftModem\agr64svc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe

C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe

C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\taskeng.exe

c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe

c:\Program Files (x86)\Hewlett-Packard\Media\Live TV\TVAgent.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\wuauclt.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Ask.com\Updater\Updater.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msntask.exe

C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\system32\SndVol.exe

C:\Users\Justin\Desktop\SecurityCheck.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\svchost.exe -k defragsvc

-netsvcs

C:\Windows\SysWOW64\notepad.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.jesusandmo.net/

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

uURLSearchHooks: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

mWinlogon: Userinit = userinit.exe,

BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ips\ipsbho.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: hpBHO Class: {ABD3B5E1-B268-407B-A150-2641DAB8D898} - C:\Program Files (x86)\Common Files\Homepage Protection\HomepageProtection.dll

BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll

BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\coieplg.dll

TB: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\coieplg.dll

TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll

uRun: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW

uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

uRun: [Wisdom-soft ScreenHunter 5.1 Free] 0

uRun: [iSUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"

mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

mRun: [updatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\AMAZON~1.LNK - C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

uPolicies-System: WallpaperStyle = 2

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: WallpaperStyle = 2

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 155.101.201.10 155.101.115.10

TCP: Interfaces\{102856CE-9E40-4746-A615-D405A7E78B1F} : DHCPNameServer = 155.101.201.10 155.101.115.10

TCP: Interfaces\{102856CE-9E40-4746-A615-D405A7E78B1F}\14340223 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{102856CE-9E40-4746-A615-D405A7E78B1F}\35C41434F5055726C69636 : DHCPNameServer = 10.0.0.204 198.60.22.2

TCP: Interfaces\{102856CE-9E40-4746-A615-D405A7E78B1F}\D6569637E65627D616E6 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{102856CE-9E40-4746-A615-D405A7E78B1F}\E49656C63756E6 : DHCPNameServer = 192.168.1.1 75.75.76.76 75.75.75.75

SSODL: WebCheck - <orphaned>

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

x64-mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

x64-mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [smartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background

x64-Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

x64-DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\0604000.009\symds64.sys [2012-10-24 451192]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\0604000.009\symefa64.sys [2012-10-24 1129120]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20121030.002\BHDrvx64.sys [2012-11-6 1385632]

R1 ccSet_N360;Norton Security Suite Settings Manager;C:\Windows\System32\drivers\N360x64\0604000.009\ccsetx64.sys [2012-10-24 167072]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121108.001\IDSviA64.sys [2012-11-9 513184]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\0604000.009\ironx64.sys [2012-10-24 190072]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\0604000.009\symnets.sys [2012-10-24 405624]

R2 {55662437-DA8C-40c0-AADA-2C816A897A49};Power Control [2010/12/08 23:22:11];C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [2010-12-8 146928]

R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe [2010-10-14 89600]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-7-2 203264]

R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]

R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-5-13 30520]

R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccsvchst.exe [2012-10-24 138272]

R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-8-14 227896]

R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2009-6-29 70656]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-21 138912]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2009-11-26 216576]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-11-26 215040]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2009-11-26 36408]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-4-4 1255736]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]

.

=============== Created Last 30 ================

.

2012-11-09 19:02:14 -------- d-----w- C:\Program Files (x86)\Ask.com

2012-11-09 19:02:13 -------- d-----w- C:\Firefox

2012-11-09 18:46:37 -------- d-----w- C:\ProgramData\Ask

2012-11-09 18:28:13 -------- d-----w- C:\Users\Justin\AppData\Roaming\Malwarebytes

2012-11-09 18:27:56 -------- d-----w- C:\ProgramData\Malwarebytes

2012-11-09 18:27:55 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-11-09 18:27:55 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-10-25 04:18:22 737952 ----a-w- C:\Windows\System32\drivers\N360x64\0604000.009\srtsp64.sys

2012-10-25 04:18:22 451192 ----a-r- C:\Windows\System32\drivers\N360x64\0604000.009\symds64.sys

2012-10-25 04:18:22 405624 ----a-r- C:\Windows\System32\drivers\N360x64\0604000.009\symnets.sys

2012-10-25 04:18:22 37536 ----a-w- C:\Windows\System32\drivers\N360x64\0604000.009\srtspx64.sys

2012-10-25 04:18:22 190072 ----a-r- C:\Windows\System32\drivers\N360x64\0604000.009\ironx64.sys

2012-10-25 04:18:22 167072 ----a-w- C:\Windows\System32\drivers\N360x64\0604000.009\ccsetx64.sys

2012-10-25 04:18:22 1129120 ----a-w- C:\Windows\System32\drivers\N360x64\0604000.009\symefa64.sys

2012-10-25 04:18:03 -------- d-----w- C:\Windows\System32\drivers\N360x64\0604000.009

.

==================== Find3M ====================

.

2012-10-10 17:55:25 310984 ----a-w- C:\Windows\System32\drivers\atksgt.sys

2012-10-10 17:55:24 42696 ----a-w- C:\Windows\System32\drivers\lirsgt.sys

2012-09-24 22:32:24 477168 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll

2012-09-24 22:32:20 473072 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-08-21 17:14:24 175736 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2012-08-21 16:47:48 73416 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-21 16:47:48 696520 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

.

============= FINISH: 14:57:58.48 ===============

ATTACH

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 4/9/2010 1:31:27 PM

System Uptime: 11/9/2012 1:43:30 PM (1 hours ago)

.

Motherboard: Hewlett-Packard | | 3638

Processor: AMD Turion II Ultra Dual-Core Mobile M600 | Socket S1G3 | 1584/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 450 GiB total, 357.392 GiB free.

D: is FIXED (NTFS) - 15 GiB total, 2.519 GiB free.

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP114: 9/28/2012 9:01:30 AM - HPSF Restore Point

RP115: 9/28/2012 4:26:51 PM - HPSF Restore Point

RP116: 10/7/2012 4:55:08 PM - Scheduled Checkpoint

RP117: 10/10/2012 11:43:56 AM - Installed Sherlock Holmes Nemesis

RP118: 10/10/2012 11:44:23 AM - Installed Sherlock Holmes Nemesis

RP119: 10/17/2012 5:46:02 PM - Scheduled Checkpoint

RP120: 10/28/2012 2:06:34 PM - HPSF Restore Point

RP121: 10/28/2012 3:56:45 PM - HPSF Restore Point

RP122: 11/9/2012 11:43:51 AM - Installed Java 6 Update 37

RP123: 11/9/2012 11:46:11 AM - Installed Java Runtime Environment

.

==== Installed Programs ======================

.

64 Bit HP CIO Components Installer

Acrobat.com

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader 9.5.2 MUI

AGEIA PhysX v7.11.13

Amazon MP3 Downloader 1.0.10

Amazon Unbox Video

AMD USB Filter Driver

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Ask Toolbar

Ask Toolbar Updater

Atheros Driver Installation Program

ATI Catalyst Install Manager

Audacity 1.3.12 (Unicode)

Bonjour

BufferChm

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Celtx (2.9.1)

Choice Guard

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Compatibility Pack for the 2007 Office system

Copy

CyberLink DVD Suite

Destinations

DeviceDiscovery

DJ_AIO_05_F4400_Software_Min

ENE CIR Receiver Driver

F4400

Google Gmail Notifier

GPBaseService2

Hewlett-Packard ACLM.NET v1.1.2.0

Homepage Protection

HP 3D DriveGuard

HP Advisor

HP Customer Experience Enhancements

HP Customer Participation Program 13.0

HP Deskjet F4400 Printer Driver Software 13.0 Rel .5

HP Games

HP Imaging Device Functions 13.0

HP MediaSmart DVD

HP MediaSmart Internet TV

HP MediaSmart Live TV

HP MediaSmart Movie Themes

HP MediaSmart Music/Photo/Video

HP MediaSmart SlingPlayer

HP MediaSmart SmartMenu

HP MediaSmart Software Notebook Demo

HP MediaSmart Webcam

HP Print Projects 1.0

HP Quick Launch Buttons

HP Setup

HP Smart Web Printing 4.60

HP Solution Center 13.0

HP Support Assistant

HP Update

HP User Guides 0153

HP Wireless Assistant

HPPhotoGadget

hpPrintProjects

HPProductAssistant

HPSSupply

hpWLPGInstaller

IDT Audio

iTunes

Java Auto Updater

Java 6 Update 14 (64-bit)

Java 6 Update 37

Junk Mail filter update

LabelPrint

LAME v3.98.2 for Audacity

LightScribe System Software

LSI HDA Modem

Malwarebytes Anti-Malware version 1.65.1.1000

MarketResearch

Microsoft Application Error Reporting

Microsoft Live Search Toolbar

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 60 day trial

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Standard Edition 2003

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Works

Move Media Player

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Norton Security Suite

PhotoNow!

Plants vs. Zombies

Power2Go

PowerDirector

PowerRecover

PrimoPDF -- brought to you by Nitro PDF Software

QLBCASL

QuickTime

Realtek 8136 8168 8169 Ethernet Driver

Realtek USB 2.0 Card Reader

Sam and Max - 101, 102, and 103

Scan

Sherlock Holmes Nemesis

Shop for HP Supplies

SmartWebPrinting

SolutionCenter

Status

Switch Sound File Converter

Synaptics Pointing Device Driver

The Golden Years: Way Out West

Toolbox

TrayApp

Update Installer for WildTangent Games App

Vampires vs. Zombies

WebReg

WildTangent Games App (HP Games)

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Sign-in Assistant

Windows Live Upload Tool

Windows Live Writer

Windows Media Encoder 9 Series

World of Warcraft

Yahoo! Toolbar

.

==== Event Viewer Messages From Past Week ========

.

11/9/2012 11:36:19 AM, Error: Service Control Manager [7000] - The atksgt service failed to start due to the following error: This driver has been blocked from loading

11/9/2012 11:36:19 AM, Error: Application Popup [875] - Driver atksgt.sys has been blocked from loading.

11/9/2012 10:15:31 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Amazon Unbox Video Service service to connect.

11/8/2012 8:10:24 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

11/6/2012 8:29:39 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.

.

==== End Of File ===========================

I am still getting occaisional "High CPU usage from winrscmde" messages, and also "winrscmde has stopped working." I simply dismiss these when they arise. My Internet Explorer seems slow, especially loading gmail. I also now remember that I have been getting popup requests to "login" to my google account at start up. I now assume these are attempts to fish my password. I am positive I have NOT logged into these.

Sorry for the delay in my response, I had to work for a bit. I should be online now for a couple of hours.

Thanks Again,

meisnerman

gringo_pr · November 9, 2012

Hello

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

meisnerman · November 9, 2012

Done. I'll paste all reports below. Rougue Killer actually generated 2 reports. (I had to start it twice, my Norton stopped it the first time.) I'll paste both reports, thought they may be the same. Here ya go:

ADW CLEANER

# AdwCleaner v2.007 - Logfile created 11/09/2012 at 15:25:21

# Updated 06/11/2012 by Xplode

# Operating system : Windows 7 Home Premium (64 bits)

# User : Justin - JUSTIN-LAPTOP2

# Boot Mode : Normal

# Running from : C:\Users\Justin\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Ask.com

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

File Deleted : C:\Users\Public\Desktop\eBay.lnk

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\Users\Justin\AppData\LocalLow\AskToolbar

Folder Deleted : C:\Users\Justin\AppData\Roaming\iWin

Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Deleted : HKCU\Software\APN

Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar

Key Deleted : HKCU\Software\Ask.com

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Deleted : HKLM\Software\APN

Key Deleted : HKLM\Software\AskToolbar

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[s1].txt - [4382 octets] - [09/11/2012 15:25:21]

########## EOF - C:\AdwCleaner[s1].txt - [4442 octets] ##########

ROUGUE KILLER 1

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating

System: Windows 7 (6.1.7600 ) 64 bits version

Started in : Normal mode

User : Justin [Admin rights]

Mode : Scan -- Date : 11/09/2012 15:40:49

¤¤¤ Bad processes : 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 8 ¤¤¤

[services][ROGUE ST] HKLM\[...]\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49} (C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl) -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet002\Services\{55662437-DA8C-40c0-AADA-2C816A897A49} (C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl) -> FOUND

[TASK][ROGUE ST] 1739092456 : \\?\globalroot\Device\HarddiskVolume2\Users\Justin\AppData\Local\Temp\p9pl2749318782308917087.tmp -> FOUND

[TASK][ROGUE ST] 3368900632 : \\?\globalroot\Device\HarddiskVolume2\Users\Justin\AppData\Local\Temp\p9pl860198994353437909.tmp -> FOUND

[TASK][sUSP PATH] winupd : C:\Users\Justin\AppData\Local\Temp:winupd.exe -> FOUND

[TASK][sUSP PATH] Update Check : C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe /s /p 1 -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9500420AS ATA Device +++++

--- User ---

[MBR] 55fbb8eea1cea67b72112ab181aa5720

[bSP] 7642e7a786131a3ca407809e18555274 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 198 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 407552 | Size: 460936 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 944404480 | Size: 15700 Mo

3 - [XXXXXX] FAT16-LBA (0x0e) [VISIBLE] Offset (sectors): 976558080 | Size: 104 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] faec2e39f7eaea577ba535e03ca4efad

[bSP] 03d5098cded44e6f7fff9741ab3ab419 : PiHar MBR Code!

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 198 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 407552 | Size: 460936 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 944404480 | Size: 15700 Mo

3 - [XXXXXX] FAT16-LBA (0x0e) [VISIBLE] Offset (sectors): 976558080 | Size: 104 Mo

+++++ PhysicalDrive1: Generic- Multi-Card USB Device +++++

--- User ---

[MBR] a3781c9945fa0592afc57a3193a9ca7b

[bSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown

Partition table:

0 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 47 | Size: 124 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_11092012_02d1540.txt >>

RKreport[1]_S_11092012_02d1540.txt

ROUGUE KILLER 2

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating

System: Windows 7 (6.1.7600 ) 64 bits version

Started in : Normal mode

User : Justin [Admin rights]

Mode : Remove -- Date : 11/09/2012 15:43:06

¤¤¤ Bad processes : 1 ¤¤¤

[sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 8 ¤¤¤

[services][ROGUE ST] HKLM\[...]\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49} (C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl) -> DELETED

[services][ROGUE ST] HKLM\[...]\ControlSet002\Services\{55662437-DA8C-40c0-AADA-2C816A897A49} (C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl) -> DELETED

[TASK][ROGUE ST] 1739092456 : \\?\globalroot\Device\HarddiskVolume2\Users\Justin\AppData\Local\Temp\p9pl2749318782308917087.tmp -> DELETED

[TASK][ROGUE ST] 3368900632 : \\?\globalroot\Device\HarddiskVolume2\Users\Justin\AppData\Local\Temp\p9pl860198994353437909.tmp -> DELETED

[TASK][sUSP PATH] winupd : C:\Users\Justin\AppData\Local\Temp:winupd.exe -> DELETED

[TASK][sUSP PATH] Update Check : C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe /s /p 1 -> DELETED

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9500420AS ATA Device +++++

--- User ---

[MBR] 55fbb8eea1cea67b72112ab181aa5720

[bSP] 7642e7a786131a3ca407809e18555274 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 198 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 407552 | Size: 460936 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 944404480 | Size: 15700 Mo

3 - [XXXXXX] FAT16-LBA (0x0e) [VISIBLE] Offset (sectors): 976558080 | Size: 104 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] faec2e39f7eaea577ba535e03ca4efad

[bSP] 03d5098cded44e6f7fff9741ab3ab419 : PiHar MBR Code!

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 198 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 407552 | Size: 460936 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 944404480 | Size: 15700 Mo

3 - [XXXXXX] FAT16-LBA (0x0e) [VISIBLE] Offset (sectors): 976558080 | Size: 104 Mo

+++++ PhysicalDrive1: Generic- Multi-Card USB Device +++++

--- User ---

[MBR] a3781c9945fa0592afc57a3193a9ca7b

[bSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown

Partition table:

0 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 47 | Size: 124 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[2]_D_11092012_02d1543.txt >>

RKreport[1]_S_11092012_02d1540.txt ; RKreport[2]_D_11092012_02d1543.txt

Norton Blocked a malicious attack a while back from a website, the notice disappeared before I could jot down the full info. Not sure if there is any improvement as yet, since the attacks seem intermittent.

Thanks,

Justin

gringo_pr · November 9, 2012

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

meisnerman · November 10, 2012

Ran combofix. I'll post the log below. I robooted a couple of times and I still get the audio ads popping up shortly after booting. I haven't had the attack where a gmail window opens with a pre-written spam message. Not sure if it's gone or not, since that has been intermittent. Here's the log:

ComboFix 12-11-09.02 - Justin 11/09/2012 17:03:19.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3836.2298 [GMT -7:00]

Running from: c:\users\Justin\Desktop\Malware removal\ComboFix.exe

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Public\videos\HP MediaSmart Demo.exe

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-10 to 2012-11-10 )))))))))))))))))))))))))))))))

.

2012-11-10 00:11 . 2012-11-10 00:11 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-09 23:55 . 2012-11-09 23:55 -------- d-----w- c:\users\Justin\AppData\Roaming\HPAppData

2012-11-09 19:20 . 2012-11-09 19:20 -------- d-----w- c:\users\Default\AppData\Roaming\Yahoo!

2012-11-09 19:20 . 2012-11-09 19:20 -------- d-----w- c:\users\Default\AppData\Roaming\HPAppData

2012-11-09 19:02 . 2012-11-09 19:02 -------- d-----w- C:\Firefox

2012-11-09 18:47 . 2012-11-09 18:47 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-11-09 18:28 . 2012-11-09 18:28 -------- d-----w- c:\users\Justin\AppData\Roaming\Malwarebytes

2012-11-09 18:27 . 2012-11-09 18:27 -------- d-----w- c:\programdata\Malwarebytes

2012-11-09 18:27 . 2012-11-09 18:28 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-11-09 18:27 . 2012-09-30 02:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-10-25 20:16 . 2012-10-25 20:16 -------- d-----w- c:\program files (x86)\Google

2012-10-25 04:18 . 2012-11-01 03:30 -------- d-----w- c:\windows\system32\drivers\N360x64\0604000.009

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-10 17:55 . 2012-10-10 17:55 310984 ----a-w- c:\windows\system32\drivers\atksgt.sys

2012-10-10 17:55 . 2012-10-10 17:55 42696 ----a-w- c:\windows\system32\drivers\lirsgt.sys

2012-09-24 22:32 . 2012-07-07 18:38 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2012-09-24 22:32 . 2010-05-27 17:35 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-08-28 01:25 . 2012-08-28 01:25 96256 ----a-w- c:\windows\system32\mshtmled.dll

2012-08-28 01:25 . 2012-08-28 01:25 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2012-08-28 01:25 . 2012-08-28 01:25 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2012-08-28 01:25 . 2012-08-28 01:25 89088 ----a-w- c:\windows\system32\ie4uinit.exe

2012-08-28 01:25 . 2012-08-28 01:25 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll

2012-08-28 01:25 . 2012-08-28 01:25 85504 ----a-w- c:\windows\system32\jsproxy.dll

2012-08-28 01:25 . 2012-08-28 01:25 85504 ----a-w- c:\windows\system32\iesetup.dll

2012-08-28 01:25 . 2012-08-28 01:25 82432 ----a-w- c:\windows\system32\icardie.dll

2012-08-28 01:25 . 2012-08-28 01:25 818176 ----a-w- c:\windows\system32\jscript.dll

2012-08-28 01:25 . 2012-08-28 01:25 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2012-08-28 01:25 . 2012-08-28 01:25 76800 ----a-w- c:\windows\system32\tdc.ocx

2012-08-28 01:25 . 2012-08-28 01:25 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe

2012-08-28 01:25 . 2012-08-28 01:25 74752 ----a-w- c:\windows\SysWow64\iesetup.dll

2012-08-28 01:25 . 2012-08-28 01:25 697344 ----a-w- c:\windows\system32\msfeeds.dll

2012-08-28 01:25 . 2012-08-28 01:25 65024 ----a-w- c:\windows\system32\pngfilt.dll

2012-08-28 01:25 . 2012-08-28 01:25 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2012-08-28 01:25 . 2012-08-28 01:25 603648 ----a-w- c:\windows\system32\vbscript.dll

2012-08-28 01:25 . 2012-08-28 01:25 55296 ----a-w- c:\windows\system32\msfeedsbs.dll

2012-08-28 01:25 . 2012-08-28 01:25 534528 ----a-w- c:\windows\system32\ieapfltr.dll

2012-08-28 01:25 . 2012-08-28 01:25 49664 ----a-w- c:\windows\system32\imgutil.dll

2012-08-28 01:25 . 2012-08-28 01:25 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2012-08-28 01:25 . 2012-08-28 01:25 48640 ----a-w- c:\windows\system32\mshtmler.dll

2012-08-28 01:25 . 2012-08-28 01:25 452608 ----a-w- c:\windows\system32\dxtmsft.dll

2012-08-28 01:25 . 2012-08-28 01:25 448512 ----a-w- c:\windows\system32\html.iec

2012-08-28 01:25 . 2012-08-28 01:25 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2012-08-28 01:25 . 2012-08-28 01:25 403248 ----a-w- c:\windows\system32\iedkcs32.dll

2012-08-28 01:25 . 2012-08-28 01:25 39936 ----a-w- c:\windows\system32\iernonce.dll

2012-08-28 01:25 . 2012-08-28 01:25 3695416 ----a-w- c:\windows\system32\ieapfltr.dat

2012-08-28 01:25 . 2012-08-28 01:25 367104 ----a-w- c:\windows\SysWow64\html.iec

2012-08-28 01:25 . 2012-08-28 01:25 35840 ----a-w- c:\windows\SysWow64\imgutil.dll

2012-08-28 01:25 . 2012-08-28 01:25 30720 ----a-w- c:\windows\system32\licmgr10.dll

2012-08-28 01:25 . 2012-08-28 01:25 282112 ----a-w- c:\windows\system32\dxtrans.dll

2012-08-28 01:25 . 2012-08-28 01:25 267776 ----a-w- c:\windows\system32\ieaksie.dll

2012-08-28 01:25 . 2012-08-28 01:25 249344 ----a-w- c:\windows\system32\webcheck.dll

2012-08-28 01:25 . 2012-08-28 01:25 248320 ----a-w- c:\windows\system32\ieui.dll

2012-08-28 01:25 . 2012-08-28 01:25 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2012-08-28 01:25 . 2012-08-28 01:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2012-08-28 01:25 . 2012-08-28 01:25 236544 ----a-w- c:\windows\system32\url.dll

2012-08-28 01:25 . 2012-08-28 01:25 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll

2012-08-28 01:25 . 2012-08-28 01:25 2303488 ----a-w- c:\windows\system32\jscript9.dll

2012-08-28 01:25 . 2012-08-28 01:25 222208 ----a-w- c:\windows\system32\msls31.dll

2012-08-28 01:25 . 2012-08-28 01:25 2136064 ----a-w- c:\windows\system32\iertutil.dll

2012-08-28 01:25 . 2012-08-28 01:25 197120 ----a-w- c:\windows\system32\msrating.dll

2012-08-28 01:25 . 2012-08-28 01:25 1797632 ----a-w- c:\windows\SysWow64\jscript9.dll

2012-08-28 01:25 . 2012-08-28 01:25 17773056 ----a-w- c:\windows\system32\mshtml.dll

2012-08-28 01:25 . 2012-08-28 01:25 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2012-08-28 01:25 . 2012-08-28 01:25 165888 ----a-w- c:\windows\system32\iexpress.exe

2012-08-28 01:25 . 2012-08-28 01:25 163840 ----a-w- c:\windows\system32\ieakui.dll

2012-08-28 01:25 . 2012-08-28 01:25 161792 ----a-w- c:\windows\SysWow64\msls31.dll

2012-08-28 01:25 . 2012-08-28 01:25 160256 ----a-w- c:\windows\system32\wextract.exe

2012-08-28 01:25 . 2012-08-28 01:25 160256 ----a-w- c:\windows\system32\ieakeng.dll

2012-08-28 01:25 . 2012-08-28 01:25 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2012-08-28 01:25 . 2012-08-28 01:25 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2012-08-28 01:25 . 2012-08-28 01:25 149504 ----a-w- c:\windows\system32\occache.dll

2012-08-28 01:25 . 2012-08-28 01:25 1492992 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-28 01:25 . 2012-08-28 01:25 145920 ----a-w- c:\windows\system32\iepeers.dll

2012-08-28 01:25 . 2012-08-28 01:25 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2012-08-28 01:25 . 2012-08-28 01:25 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2012-08-28 01:25 . 2012-08-28 01:25 1389056 ----a-w- c:\windows\system32\wininet.dll

2012-08-28 01:25 . 2012-08-28 01:25 135168 ----a-w- c:\windows\system32\IEAdvpack.dll

2012-08-28 01:25 . 2012-08-28 01:25 1344000 ----a-w- c:\windows\system32\urlmon.dll

2012-08-28 01:25 . 2012-08-28 01:25 12288 ----a-w- c:\windows\system32\mshta.exe

2012-08-28 01:25 . 2012-08-28 01:25 11776 ----a-w- c:\windows\SysWow64\mshta.exe

2012-08-28 01:25 . 2012-08-28 01:25 114176 ----a-w- c:\windows\system32\admparse.dll

2012-08-28 01:25 . 2012-08-28 01:25 1126912 ----a-w- c:\windows\SysWow64\wininet.dll

2012-08-28 01:25 . 2012-08-28 01:25 111616 ----a-w- c:\windows\system32\iesysprep.dll

2012-08-28 01:25 . 2012-08-28 01:25 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2012-08-28 01:25 . 2012-08-28 01:25 10884096 ----a-w- c:\windows\system32\ieframe.dll

2012-08-28 01:25 . 2012-08-28 01:25 10752 ----a-w- c:\windows\system32\msfeedssync.exe

2012-08-28 01:25 . 2012-08-28 01:25 103936 ----a-w- c:\windows\system32\inseng.dll

2012-08-28 01:25 . 2012-08-28 01:25 101888 ----a-w- c:\windows\SysWow64\admparse.dll

2012-08-21 17:14 . 2012-08-21 17:14 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2012-08-21 16:47 . 2012-08-21 16:47 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-08-21 16:47 . 2011-09-28 17:24 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{ABD3B5E1-B268-407B-A150-2641DAB8D898}]

2009-06-08 21:41 120104 ----a-w- c:\program files (x86)\Common Files\Homepage Protection\HomepageProtection.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Wisdom-soft ScreenHunter 5.1 Free"="0" [X]

"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-10-26 1668664]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-02-22 2363392]

"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-08-09 221184]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-02 98304]

"HPCam_Menu"="c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]

"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640]

"UpdatePRCShortCut"="c:\program files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]

"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160]

"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files (x86)\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Amazon Unbox.lnk - c:\program files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe [2010-9-13 97384]

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]

"WallpaperStyle"= 2

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-03 1255736]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0604000.009\SYMDS64.SYS [2011-08-16 451192]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0604000.009\SYMEFA64.SYS [2012-05-22 1129120]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20121030.002\BHDrvx64.sys [2012-10-05 1385632]

S1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\N360x64\0604000.009\ccSetx64.sys [2012-06-07 167072]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20121108.001\IDSvia64.sys [2012-10-24 513184]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0604000.009\Ironx64.SYS [2011-11-17 190072]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0604000.009\SYMNETS.SYS [2011-11-17 405624]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe [2009-03-02 89600]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-02 203264]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-10 86072]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-29 94264]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-14 30520]

S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe [2012-06-16 138272]

S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-02-25 227896]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2009-06-29 70656]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-21 138912]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 216576]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-23 215040]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-03-09 36408]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2010-02-22 17:38 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-01 c:\windows\Tasks\HPCeeScheduleForJustin.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-07-21 610872]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-15 171520]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.jesusandmo.net/

uLocal Page = c:\windows\system32\blank.htm

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\OFFICE11\EXCEL.EXE/3000

Trusted Zone: actorsequity.org\www

TCP: DhcpNameServer = 155.101.201.10 155.101.115.10

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-Sam and Max - Season One - c:\program files (x86)\The Adventure Company\Sam and Max - 101

AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]

"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{1E61ED7C-7CB8-49D6-B9E9-AB4C880C8414}"=hex:51,66,7a,6c,4c,1d,38,12,12,ee,72,

1a,8a,32,b8,0c,c6,ff,e8,0c,8d,52,c0,00

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,

eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c

"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,38,12,8d,ec,f8,

7b,2b,25,27,06,e7,c4,bc,f0,98,15,0d,de

"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,

d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54

"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,

06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64

"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,

07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,38,12,60,d8,39,

64,cd,04,79,07,f5,b7,d6,9a,c1,81,e0,1c

"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,38,12,ea,ef,40,

69,9c,24,e9,02,d1,f8,b7,22,8a,5f,45,18

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{ABD3B5E1-B268-407B-A150-2641DAB8D898}"=hex:51,66,7a,6c,4c,1d,38,12,8f,b6,c0,

af,5a,fc,15,05,de,46,65,01,df,e6,9c,8c

"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,

d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,

f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95

"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,

fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42

"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,

51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:f9,75,92,39,af,be,cd,01

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-11-09 17:19:14

ComboFix-quarantined-files.txt 2012-11-10 00:19

.

Pre-Run: 385,380,315,136 bytes free

Post-Run: 385,454,350,336 bytes free

.

- - End Of File - - 3F40A434AC9E4D2F6166D9551C49F639

Thanks again for your help.

gringo_pr · November 10, 2012

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

meisnerman · November 10, 2012

Good Morning!

Okay, so upon boot up this morning everything was running very slow and I had multiple channels of streaming audio ads. Also, my Norton blocked a "Web attack: Fake AV download 2" which originated from a .ru IP. I also got 2 High CPU usage warnings, 1 from werfault.exe in my Windows/SysWOW64 folder and another from winrscmde in svchost.exe

I then ran tdskiller which found something and did a "cure." Immediately before I could reboot I got 3 rapid notices from Norton about blocked attacks. While looking at my Norton settings, I notice an option to change my "boot Time Protection" from "Normal" to "Agressive". I did so and then rebooted. tdskiller generated 2 separate report files. I will paste them below.

Since that reboot there is a noticable improvement in speed, and I haven't yet had any streaming audio ads pop up. Fingers crossed.

I then ran aswMBR. The report will be pasted below.

I have to go into work now, so I may not be able to see your response until this evening.

Thanks again for your help.

TDSKILLER - 1ST LOG

08:31:03.0913 8528 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

08:31:04.0842 8528 ============================================================

08:31:04.0842 8528 Current date / time: 2012/11/10 08:31:04.0842

08:31:04.0842 8528 SystemInfo:

08:31:04.0842 8528

08:31:04.0842 8528 OS Version: 6.1.7600 ServicePack: 0.0

08:31:04.0842 8528 Product type: Workstation

08:31:04.0842 8528 ComputerName: JUSTIN-LAPTOP2

08:31:04.0842 8528 UserName: Justin

08:31:04.0842 8528 Windows directory: C:\Windows

08:31:04.0842 8528 System windows directory: C:\Windows

08:31:04.0842 8528 Running under WOW64

08:31:04.0842 8528 Processor architecture: Intel x64

08:31:04.0842 8528 Number of processors: 2

08:31:04.0842 8528 Page size: 0x1000

08:31:04.0842 8528 Boot type: Normal boot

08:31:04.0842 8528 ============================================================

08:31:07.0564 8528 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

08:31:07.0570 8528 ============================================================

08:31:07.0570 8528 \Device\Harddisk0\DR0:

08:31:07.0570 8528 MBR partitions:

08:31:07.0570 8528 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63000

08:31:07.0570 8528 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x63800, BlocksNum 0x38444000

08:31:07.0571 8528 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x384A7800, BlocksNum 0x1EAA000

08:31:07.0571 8528 \Device\Harddisk0\DR0\Partition4: MBR, Type 0xE, StartLBA 0x3A351800, BlocksNum 0x34030

08:31:07.0571 8528 ============================================================

08:31:07.0593 8528 C: <-> \Device\Harddisk0\DR0\Partition2

08:31:07.0636 8528 D: <-> \Device\Harddisk0\DR0\Partition3

08:31:07.0636 8528 ============================================================

08:31:07.0636 8528 Initialize success

08:31:07.0636 8528 ============================================================

08:31:28.0370 3320 ============================================================

08:31:28.0370 3320 Scan started

08:31:28.0370 3320 Mode: Manual;

08:31:28.0370 3320 ============================================================

08:31:34.0231 3320 ================ Scan system memory ========================

08:31:34.0231 3320 System memory - ok

08:31:34.0232 3320 ================ Scan services =============================

08:31:34.0429 3320 [ 1B00662092F9F9568B995902F0CC40D5 ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys

08:31:34.0434 3320 1394ohci - ok

08:31:34.0464 3320 [ 5C368F4B04ED2A923E6AFCA2D37BAFF5 ] Accelerometer C:\Windows\system32\DRIVERS\Accelerometer.sys

08:31:34.0467 3320 Accelerometer - ok

08:31:34.0489 3320 [ 6F11E88748CDEFD2F76AA215F97DDFE5 ] ACPI C:\Windows\system32\DRIVERS\ACPI.sys

08:31:34.0496 3320 ACPI - ok

08:31:34.0510 3320 [ 63B05A0420CE4BF0E4AF6DCC7CADA254 ] AcpiPmi C:\Windows\system32\DRIVERS\acpipmi.sys

08:31:34.0521 3320 AcpiPmi - ok

08:31:34.0555 3320 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys

08:31:34.0572 3320 adp94xx - ok

08:31:34.0589 3320 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys

08:31:34.0596 3320 adpahci - ok

08:31:34.0611 3320 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys

08:31:34.0616 3320 adpu320 - ok

08:31:34.0718 3320 [ 7233688FC422EF657E082309E6180142 ] ADVService C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe

08:31:34.0728 3320 ADVService - ok

08:31:34.0748 3320 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll

08:31:34.0748 3320 AeLookupSvc - ok

08:31:34.0818 3320 [ A6FB9DB8F1A86861D955FD6975977AE0 ] AESTFilters C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_70dacb64382a61a7\AESTSr64.exe

08:31:34.0828 3320 AESTFilters - ok

08:31:34.0878 3320 [ DB9D6C6B2CD95A9CA414D045B627422E ] AFD C:\Windows\system32\drivers\afd.sys

08:31:34.0878 3320 AFD - ok

08:31:34.0948 3320 [ B65F8DBA54F251906BBE8611B5A0E7AB ] AgereModemAudio C:\Program Files\LSI SoftModem\agr64svc.exe

08:31:34.0948 3320 AgereModemAudio - ok

TDS KILLER - 2ND LOG

08:39:58.0903 1552 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

08:39:59.0500 1552 ============================================================

08:39:59.0500 1552 Current date / time: 2012/11/10 08:39:59.0500

08:39:59.0500 1552 SystemInfo:

08:39:59.0500 1552

08:39:59.0500 1552 OS Version: 6.1.7600 ServicePack: 0.0

08:39:59.0500 1552 Product type: Workstation

08:39:59.0500 1552 ComputerName: JUSTIN-LAPTOP2

08:39:59.0500 1552 UserName: Justin

08:39:59.0500 1552 Windows directory: C:\Windows

08:39:59.0500 1552 System windows directory: C:\Windows

08:39:59.0500 1552 Running under WOW64

08:39:59.0500 1552 Processor architecture: Intel x64

08:39:59.0500 1552 Number of processors: 2

08:39:59.0500 1552 Page size: 0x1000

08:39:59.0500 1552 Boot type: Normal boot

08:39:59.0500 1552 ============================================================

08:40:07.0315 1552 BG loaded

08:40:07.0768 1552 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

08:40:07.0783 1552 ============================================================

08:40:07.0783 1552 \Device\Harddisk0\DR0:

08:40:07.0783 1552 MBR partitions:

08:40:07.0783 1552 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63000

08:40:07.0783 1552 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x63800, BlocksNum 0x38444000

08:40:07.0783 1552 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x384A7800, BlocksNum 0x1EAA000

08:40:07.0783 1552 \Device\Harddisk0\DR0\Partition4: MBR, Type 0xE, StartLBA 0x3A351800, BlocksNum 0x34030

08:40:07.0783 1552 ============================================================

08:40:07.0799 1552 C: <-> \Device\Harddisk0\DR0\Partition2

08:40:07.0924 1552 D: <-> \Device\Harddisk0\DR0\Partition3

08:40:07.0924 1552 ============================================================

08:40:07.0924 1552 Initialize success

08:40:07.0924 1552 ============================================================

ASWMBR LOG

Run date: 2012-11-10 08:43:11

-----------------------------

08:43:11.731 OS Version: Windows x64 6.1.7600

08:43:11.731 Number of processors: 2 586 0x602

08:43:11.747 ComputerName: JUSTIN-LAPTOP2 UserName: Justin

08:43:18.548 Initialize success

08:44:21.169 AVAST engine defs: 12111001

08:44:35.131 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

08:44:35.131 Disk 0 Vendor: ST9500420AS 0006HPM1 Size: 476940MB BusType: 11

08:44:35.162 Disk 0 MBR read successfully

08:44:35.162 Disk 0 MBR scan

08:44:35.177 Disk 0 unknown MBR code

08:44:35.193 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 198 MB offset 2048

08:44:35.209 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 460936 MB offset 407552

08:44:35.255 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 15700 MB offset 944404480

08:44:35.333 Disk 0 Partition 4 00 0E FAT16 LBA MSWIN4.1 104 MB offset 976558080

08:44:35.396 Disk 0 scanning C:\Windows\system32\drivers

08:44:49.966 Service scanning

08:45:22.851 Modules scanning

08:45:22.867 Disk 0 trace - called modules:

08:45:22.913 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys

08:45:22.913 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004391060]

08:45:22.929 3 CLASSPNP.SYS[fffff8800112343f] -> nt!IofCallDriver -> [0xfffffa8004390a10]

08:45:22.945 5 hpdskflt.sys[fffff880021c7189] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800431b060]

08:45:24.676 AVAST engine scan C:\Windows

08:45:32.788 AVAST engine scan C:\Windows\system32

08:49:47.740 AVAST engine scan C:\Windows\system32\drivers

08:50:15.570 AVAST engine scan C:\Users\Justin

08:54:10.382 AVAST engine scan C:\ProgramData

08:56:46.538 Scan finished successfully

09:01:46.308 Disk 0 MBR has been saved successfully to "C:\Users\Justin\Desktop\Malware removal\MBR.dat"

09:01:46.324 The log file has been saved successfully to "C:\Users\Justin\Desktop\Malware removal\aswMBR.txt"

gringo_pr · November 10, 2012

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

meisnerman · November 11, 2012

Okay. I finally got it. I tried running the Combofix script as instructed twice, and it froze at the point where it was creating a log. I waited about half an hour each time before closing the window, rebooting and trying again. Finally on the third time it ran to completion and generated a log. I'll post it below.

Apart from the problems getting through the script. I haven't noticed any more problems. I've rebooted several times and haven't seen any sign of the push ads I was receiving or any of the other signs of attack. I'm optomistic that the problem has been removed! (I hope.)

As of now the machine seems to be running smoothly. Thanks again for your help.

Here's the report:

ComboFix 12-11-09.02 - Justin 11/10/2012 21:22:51.4.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3836.1966 [GMT -7:00]

Running from: c:\users\Justin\Desktop\Malware removal\ComboFix.exe

Command switches used :: c:\users\Justin\Desktop\Malware removal\CFScript.txt

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-10-11 to 2012-11-11 )))))))))))))))))))))))))))))))

.

2012-11-11 04:37 . 2012-11-11 04:37 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-11 04:37 . 2012-11-11 04:37 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2012-11-11 04:34 . 2012-11-11 04:34 -------- d-----w- c:\windows\system32\SPReview

2012-11-11 04:33 . 2012-11-11 04:33 -------- d-----w- c:\windows\system32\EventProviders

2012-11-10 15:32 . 2012-11-10 15:32 -------- d-----w- C:\TDSSKiller_Quarantine