Jump to content

Help Please - Virus infection

sciguy

By sciguy
in Resolved Malware Removal Logs

 Share

Recommended Posts

sciguy

sciguy

Posted
Posted

Hello. I am helping a friend with a virus on their PC. Malwarebytes detects and tries to remove the infection, but i keeps re-appearing.

Thank you in advance for any help.

Here are log files:

DDS (Ver_2012-11-07.01) - NTFS_x86

Internet Explorer: 9.0.8112.16448 BrowserJavaVersion: 1.6.0_35

Run by Coston Family at 13:04:10 on 2012-11-19

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1620 [GMT -5:00]

.

AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\agrsmsvc.exe

C:\Users\Coston Family\AppData\LocalLow\alotservice\alotservice.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe

C:\Program Files\Ask.com\Updater\Updater.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Users\COSTON~1\AppData\Local\Temp\dssagent.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.ask.com/?l=dis&o=41648106&gct=hp

uSearch Bar = hxxp://www.google.com/ie

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: JetMP3: {134DA043-566E-4572-82E6-8978D0ED03D8} - c:\users\coston family\appdata\local\jetmp3\ie\jetmp3.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

BHO: FBDownloader BHO: {553318DA-D010-469E-84B1-496563CAE1BF} - c:\program files\htto group, ltd\fbdownloader ie add-on\FBDownloader.dll

BHO: NCO 2.0 IE BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll

BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\common files\symantec shared\ids\IPSBHO.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: ALOT Appbar Helper: {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - c:\program files\alotappbar\bin\bho\ALOTHelperBHO.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Plug-In: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Show Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll

TB: Show Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\common files\symantec shared\coshared\browser\2.6\CoIEPlg.dll

TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: ALOT Appbar: {A531D99C-5A22-449b-83DA-872725C6D0ED} - c:\program files\alotappbar\bin\ALOTHelper.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\TOSCDSPD.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [Facebook Update] "c:\users\coston family\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun

uRun: [Raakiflybi] "c:\users\coston family\appdata\roaming\ifug\yrose.exe"

uRun: [GoogleChromeAutoLaunch_15197D526E95D11EC6E3FD9BCFC6D540] "c:\program files\google\chrome\application\chrome.exe" --no-startup-window

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [skytel] Skytel.exe

mRun: [DSS] c:\windows\bbstore\dss\DSSAGENT.EXE

mRun: [Monitor] "c:\program files\leapfrog\leapfrog connect\Monitor.exe"

mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\users\coston~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

LSP: mswsock.dll

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{0A2E6BA9-3B42-4B4C-BBFB-E7D86FD7E9DB} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{C9F947F1-AEF5-43D6-B877-AE0EF28741FD} : DHCPNameServer = 192.168.1.1

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: igfxcui - igfxdev.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\ipsdefs\20091020.001\IDSvix86.sys [2009-10-21 272432]

R2 AlotService;ALOT Update Service;c:\users\coston family\appdata\locallow\alotservice\alotservice.exe [2012-5-10 252264]

R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-4-17 40960]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\common files\symantec shared\CCSVCHST.EXE [2008-2-18 149352]

R2 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2008-8-18 46392]

R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134736]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720]

R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2008-8-18 7168]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2009-6-24 290304]

R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-4-24 73728]

R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-2-19 41008]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608]

S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg2012\avgidsagent.exe" --> c:\program files\avg\avg2012\AVGIDSAgent.exe [?]

S2 avgwd;AVG WatchDog;"c:\program files\avg\avg2012\avgwdsvc.exe" --> c:\program files\avg\avg2012\avgwdsvc.exe [?]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-1-12 23888]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-21 30192]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]

S3 SVRPEDRV;SVRPEDRV;c:\windows\system32\sysprep\PEDRV.SYS [2008-8-21 9216]

S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-8-18 1245064]

.

=============== Created Last 30 ================

.

2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Inyv

2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Cayz

2012-11-19 10:23:56 -------- d-----w- c:\users\coston family\appdata\roaming\Avzuga

2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Zaneub

2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Uxoqur

2012-11-19 02:22:56 -------- d-----w- c:\users\coston family\appdata\roaming\Ucsyos

2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Reviif

2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Ohrena

2012-11-18 14:36:12 -------- d-----w- c:\users\coston family\appdata\roaming\Akdezy

2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Ricyge

2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Ifug

2012-11-15 19:44:05 -------- d-----w- c:\users\coston family\appdata\roaming\Duochu

2012-11-05 02:38:43 96224 ----a-w- c:\program files\mozilla firefox\webapprt-stub.exe

2012-11-05 02:38:43 157272 ----a-w- c:\program files\mozilla firefox\webapp-uninstaller.exe

2012-11-05 02:38:42 91552 ----a-w- c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

2012-11-05 02:38:42 91552 ----a-w- c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

2012-11-05 02:38:41 1148296 ----a-w- c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

2012-11-05 02:38:40 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2012-10-25 01:32:10 -------- d-s---w- c:\users\coston family\appdata\local\Arthur's Math Games

.

==================== Find3M ====================

.

2012-10-11 02:40:38 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-10-11 02:40:38 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-09-30 00:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-08-29 00:24:56 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-08-29 00:24:53 473072 ----a-w- c:\windows\system32\deployJava1.dll

.

============= FINISH: 13:05:30.48 ===============

Attach file:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 6/24/2009 5:42:58 AM

System Uptime: 11/19/2012 12:46:11 PM (1 hours ago)

.

Motherboard: TOSHIBA | | Portable PC

Processor: Pentium® Dual-Core CPU T4200 @ 2.00GHz | CPU | 2000/800mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 289 GiB total, 173.074 GiB free.

D: is CDROM (UDF)

E: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 8.1.2

ALOT Appbar

Amazon Links

Amazon MP3 Downloader 1.0.10

AppCore

Arthur's Camping Adventure

Arthur's Math Games

Arthur's Reading Games

Arthur's Teacher Trouble

Arthur's Thinking Games

Ask Toolbar

Ask Toolbar Updater

AVG 2012

Backup

Camera Assistant Software for Toshiba

Carmen Sandiego Word Detective v1.0.1

ccCommon

CD/DVD Drive Acoustic Silencer

Clifford Reading

Compatibility Pack for the 2007 Office system

Coupon Printer for Windows

DVD MovieFactory for TOSHIBA

Facebook Plug-In

Facebook Video Calling 1.2.0.287

fbDownloader 1.0.2

FBDownloader IE Add-on

GearDrvs

Google Chrome

Google Desktop

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Intel® Graphics Media Accelerator Driver

Intel® Matrix Storage Manager

Java Auto Updater

Java 6 Update 35

Java 6 Update 6

JetMP3

LeapFrog Connect

LeapFrog Leapster2 Plugin

Malwarebytes Anti-Malware version 1.65.1.1000

McAfee Security Scan Plus

Microsoft .NET Framework 3.5 SP1

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2007

Microsoft PowerPoint Viewer 97

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Works

Microsoft XML Parser

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Musicnotes Software Suite 1.4.6

NetZero Internet Access Installer

Norton 360

Norton 360 (Symantec Corporation)

Norton 360 HTMLHelp

Norton Confidential Core

OpenOffice.org 3.2

Picasa 3

Pinball Science Demo

QuickBooks Financial Center

Realtek 8169 8168 8101E 8102E Ethernet Driver

Realtek High Definition Audio Driver

REALTEK RTL8187B Wireless LAN Driver

Realtek USB 2.0 Card Reader

Realtek WiFi Protected Setup Library

Safaricom Broadband

Schoolhouse Rock: Grammar Rock

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

Skype Toolbars

Skype™ 5.10

Slam Dunk Typing

SPBBC 32bit

Symantec Real Time Storage Protection Component

Symantec Technical Support Controls

SymNet

Synaptics Pointing Device Driver

The New Way Things Work

TOSHIBA Assist

TOSHIBA ConfigFree

TOSHIBA Desktop Links

TOSHIBA Disc Creator

TOSHIBA DVD PLAYER

TOSHIBA Extended Tiles for Windows Mobility Center

TOSHIBA Face Recognition

TOSHIBA Hardware Setup

TOSHIBA Recovery Disc Creator

Toshiba Registration

TOSHIBA Service Station

TOSHIBA Software Modem

TOSHIBA Speech System Applications

TOSHIBA Speech System SR Engine(U.S.) Version1.0

TOSHIBA Speech System TTS Engine(U.S.) Version1.0

TOSHIBA Supervisor Password

TOSHIBA Value Added Package

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Word 2007 Help (KB963665)

Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)

Wal-Mart Digital Photo Manager

WildTangent Games

Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)

Windows Media Encoder 9 Series

Yahoo! BrowserPlus 2.9.8

.

==== End Of File ===========================

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

Link to post
Share on other sites
sciguy

sciguy

Posted
  • Author
Posted

Thanks for the quick response.

FYI - I have the flash drive removed now

RK Log:

RogueKiller V8.3.0 [Nov 19 2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Coston Family [Admin rights]

Mode : Scan -- Date : 11/19/2012 14:53:44

¤¤¤ Bad processes : 219 ¤¤¤

[sUSP PATH] alotservice.exe -- C:\Users\Coston Family\AppData\LocalLow\alotservice\alotservice.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[sUSP PATH] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermThr]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

[RESIDUE] dssagent.exe -- C:\Users\Coston Family\AppData\Local\Temp\dssagent.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Raakiflybi ("C:\Users\Coston Family\AppData\Roaming\Ifug\yrose.exe") -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3583727236-292728680-4127779811-1000[...]\Run : Raakiflybi ("C:\Users\Coston Family\AppData\Roaming\Ifug\yrose.exe") -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Windows\Installer\{b88464dc-95b6-b355-ac61-73d41790d6ac}\L --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC\Desktop.ini --> FOUND

[susp.ASLR|Sig - ZeroAccess][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[13] : NtAlertResumeThread @ 0x828A35C3 -> HOOKED (Unknown @ 0x880A2DE0)

SSDT[14] : NtAlertThread @ 0x8281C255 -> HOOKED (Unknown @ 0x880A2EC0)

SSDT[18] : NtAllocateVirtualMemory @ 0x828584FB -> HOOKED (Unknown @ 0x8809FAD8)

SSDT[21] : NtAlpcConnectPort @ 0x827FA887 -> HOOKED (Unknown @ 0x87EFE338)

SSDT[67] : NtCreateMutant @ 0x82830812 -> HOOKED (Unknown @ 0x880A2B30)

SSDT[78] : NtCreateThread @ 0x828A1BE0 -> HOOKED (Unknown @ 0x8809FC68)

SSDT[116] : NtDebugActiveProcess @ 0x82874D22 -> HOOKED (Unknown @ 0x880A2630)

SSDT[147] : NtFreeVirtualMemory @ 0x82694F1D -> HOOKED (Unknown @ 0x8809F710)

SSDT[156] : NtImpersonateAnonymousToken @ 0x827CAF12 -> HOOKED (Unknown @ 0x880A2C20)

SSDT[158] : NtImpersonateThread @ 0x827E054F -> HOOKED (Unknown @ 0x880A2D00)

SSDT[177] : NtMapViewOfSection @ 0x8282089A -> HOOKED (Unknown @ 0x8809F630)

SSDT[184] : NtOpenEvent @ 0x82809DCF -> HOOKED (Unknown @ 0x880A2A50)

SSDT[195] : NtOpenProcessToken @ 0x82811A2E -> HOOKED (Unknown @ 0x8809FBA8)

SSDT[202] : NtOpenThreadToken @ 0x8282C2AD -> HOOKED (Unknown @ 0x8809F3B0)

SSDT[282] : NtResumeThread @ 0x8282BB4A -> HOOKED (Unknown @ 0x88035640)

SSDT[289] : NtSetContextThread @ 0x828A306F -> HOOKED (Unknown @ 0x8809F2D0)

SSDT[305] : NtSetInformationProcess @ 0x828248C8 -> HOOKED (Unknown @ 0x8809F4A0)

SSDT[306] : NtSetInformationThread @ 0x828092AD -> HOOKED (Unknown @ 0x8809F1E0)

SSDT[330] : NtSuspendProcess @ 0x828A34FF -> HOOKED (Unknown @ 0x880A2970)

SSDT[331] : NtSuspendThread @ 0x827AA92B -> HOOKED (Unknown @ 0x880A2008)

SSDT[348] : NtUnmapViewOfSection @ 0x82820B5D -> HOOKED (Unknown @ 0x8809F570)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS543232L9SA00 +++++

--- User ---

[MBR] 0b46a8cc22c38e1565f36dd48c6e190f

[bSP] 0bdde4a1ed5e38f9dae99664337c0a2f : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 296325 Mo

2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 609947648 | Size: 7419 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_11192012_02d1453.txt >>

RKreport[1]_S_11192012_02d1453.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Here you go......

Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please create a new system restore point before running Malwarebytes Anti-Rootkit.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

MrC

Link to post
Share on other sites
sciguy

sciguy

Posted
  • Author
Posted

First scan found several threats. I clean and reran scan. No threats found the second time.

Final Mbar log and system log are below. First Mbar log is attached, if you needed.

Malwarebytes Anti-Rootkit 1.1.0.1009

www.malwarebytes.org

Database version: v2012.11.19.09

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Coston Family :: COSTONFAMILY-PC [administrator]

11/19/2012 6:23:57 PM

mbar-log-2012-11-19 (18-23-57).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: PUP | PUM | P2P

Objects scanned: 28969

Time elapsed: 31 minute(s), 38 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

System log:

Malwarebytes Anti-Rootkit 1.1.0.1009

www.malwarebytes.org

Database version: v2012.11.19.09

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Coston Family :: COSTONFAMILY-PC [administrator]

11/19/2012 6:23:57 PM

mbar-log-2012-11-19 (18-23-57).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: PUP | PUM | P2P

Objects scanned: 28969

Time elapsed: 31 minute(s), 38 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

mbar-log-2012-11-19 (17-16-06).txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK...lets run ComboFix to cleanup any left overs...

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
sciguy

sciguy

Posted
  • Author
Posted

<p>Here is combofix txt.</p>

<p> </p>

<p> </p>

<div>ComboFix 12-11-19.02 - Coston Family 11/19/2012  18:58:03.1.2 - x86</div>

<div>Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.2939.1279 [GMT -5:00]</div>

<div>Running from: c:\users\Coston Family\Desktop\ComboFix.exe</div>

<div>AV: Norton 360 *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}</div>

<div>FW: Norton 360 *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}</div>

<div>SP: Norton 360 *Disabled/Outdated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}</div>

<div>SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>c:\program files\alotappbar</div>

<div>c:\program files\alotappbar\alotUninst.exe</div>

<div>c:\program files\alotappbar\bin\alotappbar.dll</div>

<div>c:\program files\alotappbar\bin\alothelper.dll</div>

<div>c:\program files\alotappbar\bin\alotsettings.exe</div>

<div>c:\program files\alotappbar\bin\alotwidgets.exe</div>

<div>c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll</div>

<div>c:\programdata\0tbpw.pad</div>

<div>c:\users\Coston Family\AppData\Local\jetmp3\ie\jeTMp3.dll</div>

<div>c:\users\Coston Family\AppData\Local\Temp\dssagent.exe</div>

<div>c:\users\Coston Family\AppData\Roaming\Cayz</div>

<div>c:\users\Coston Family\AppData\Roaming\Cayz\fyci.zuq</div>

<div>c:\users\Coston Family\AppData\Roaming\Duochu</div>

<div>c:\users\Coston Family\AppData\Roaming\Duochu\evom.too</div>

<div>c:\users\Coston Family\AppData\Roaming\Ohrena</div>

<div>c:\users\Coston Family\AppData\Roaming\Ohrena\afule.afn</div>

<div>c:\users\Coston Family\AppData\Roaming\Ucsyos</div>

<div>c:\users\Coston Family\AppData\Roaming\Ucsyos\awde.zol</div>

<div>c:\users\COSTON~1\AppData\Local\Temp\dssagent.exe</div>

<div>c:\windows\COUPon~1.ocx</div>

<div>c:\windows\system32\pt</div>

<div>c:\windows\system32\pt\smartfacevcp.dll.mui</div>

<div>c:\windows\system32\pt\toscdspd.cpl.mui</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>-------\Service_AlotService</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((   Files Created from 2012-10-20 to 2012-11-20  )))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>2012-11-20 00:59 . 2012-11-20 01:04<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Local\temp</div>

<div>2012-11-20 00:59 . 2012-11-20 00:59<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Default\AppData\Local\temp</div>

<div>2012-11-19 19:53 . 2012-11-19 19:53<span class="Apple-tab-span" style="white-space:pre"> </span>14336<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\TrueSight.sys</div>

<div>2012-11-19 10:23 . 2012-11-19 10:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Inyv</div>

<div>2012-11-19 10:23 . 2012-11-19 10:23<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Avzuga</div>

<div>2012-11-19 02:22 . 2012-11-19 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Zaneub</div>

<div>2012-11-19 02:22 . 2012-11-19 02:22<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Uxoqur</div>

<div>2012-11-18 14:36 . 2012-11-18 14:36<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Reviif</div>

<div>2012-11-18 14:36 . 2012-11-18 14:36<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Akdezy</div>

<div>2012-11-15 19:44 . 2012-11-19 17:50<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Ricyge</div>

<div>2012-11-15 19:44 . 2012-11-15 19:44<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-----w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Roaming\Ifug</div>

<div>2012-10-25 01:32 . 2012-11-17 01:05<span class="Apple-tab-span" style="white-space:pre"> </span>--------<span class="Apple-tab-span" style="white-space:pre"> </span>d-s---w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\users\Coston Family\AppData\Local\Arthur's Math Games</div>

<div>.</div>

<div>.</div>

<div>.</div>

<div>((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>2012-10-11 02:40 . 2012-07-30 14:26<span class="Apple-tab-span" style="white-space:pre"> </span>696760<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\FlashPlayerApp.exe</div>

<div>2012-10-11 02:40 . 2011-06-08 13:40<span class="Apple-tab-span" style="white-space:pre"> </span>73656<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\FlashPlayerCPLApp.cpl</div>

<div>2012-09-30 00:54 . 2011-12-29 00:43<span class="Apple-tab-span" style="white-space:pre"> </span>22856<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\drivers\mbam.sys</div>

<div>2012-08-29 00:24 . 2012-07-18 17:40<span class="Apple-tab-span" style="white-space:pre"> </span>477168<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\npdeployJava1.dll</div>

<div>2012-08-29 00:24 . 2010-10-30 05:44<span class="Apple-tab-span" style="white-space:pre"> </span>473072<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\system32\deployJava1.dll</div>

<div>2009-11-13 01:32 . 2012-11-05 02:38<span class="Apple-tab-span" style="white-space:pre"> </span>119808<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll</div>

<div>.</div>

<div>.</div>

<div>(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))</div>

<div>.</div>

<div>.</div>

<div>*Note* empty entries & legit default entries are not shown </div>

<div>REGEDIT4</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{553318DA-D010-469E-84B1-496563CAE1BF}]</div>

<div>2012-06-23 05:40<span class="Apple-tab-span" style="white-space:pre"> </span>136192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\HTTO Group, Ltd\FBDownloader IE Add-on\FBDownloader.dll</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]</div>

<div>2012-01-03 21:31<span class="Apple-tab-span" style="white-space:pre"> </span>1514152<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Ask.com\GenericAskToolbar.dll</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]</div>

<div>"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]</div>

<div>.</div>

<div>[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]</div>

<div>[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]</div>

<div>[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]</div>

<div>[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]</div>

<div>.</div>

<div>[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080]</div>

<div>"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-24 39408]</div>

<div>"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]</div>

<div>"Facebook Update"="c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]</div>

<div>"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]</div>

<div>"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17418928]</div>

<div>"Raakiflybi"="c:\users\Coston Family\AppData\Roaming\Ifug\yrose.exe" [2012-03-25 423424]</div>

<div>"GoogleChromeAutoLaunch_15197D526E95D11EC6E3FD9BCFC6D540"="c:\program files\Google\Chrome\Application\chrome.exe" [2012-10-31 1242136]</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]</div>

<div>"RtHDVCpl"="RtHDVCpl.exe" [2008-04-08 6037504]</div>

<div>"Skytel"="Skytel.exe" [2007-11-21 1826816]</div>

<div>"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2011-06-06 251744]</div>

<div>"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-01-03 1391272]</div>

<div>"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]</div>

<div>.</div>

<div>c:\users\Coston Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\</div>

<div>OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]</div>

<div>.</div>

<div>c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\</div>

<div>McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]</div>

<div>"EnableUIADesktopToggle"= 0 (0x0)</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]</div>

<div>"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]</div>

<div>BootExecute<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ   <span class="Apple-tab-span" style="white-space:pre"> </span>autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart</div>

<div>.</div>

<div>[HKLM\~\startupfolder\C:^Users^Coston Family^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]</div>

<div>path=c:\users\Coston Family\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk</div>

<div>backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup</div>

<div>backupExtension=.Startup</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]</div>

<div>2008-05-09 18:49<span class="Apple-tab-span" style="white-space:pre"> </span>716800<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\FlashCards\TCrdMain.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]</div>

<div>2008-04-29 17:33<span class="Apple-tab-span" style="white-space:pre"> </span>417792<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Camera Assistant Software for Toshiba\traybar.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]</div>

<div>2008-10-17 19:52<span class="Apple-tab-span" style="white-space:pre"> </span>51048<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Common Files\Symantec Shared\CCAPP.EXE</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]</div>

<div>2008-01-21 02:25<span class="Apple-tab-span" style="white-space:pre"> </span>125952<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\ehome\ehtray.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]</div>

<div>2009-11-13 01:32<span class="Apple-tab-span" style="white-space:pre"> </span>30192<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Google\Google Desktop Search\GoogleDesktop.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]</div>

<div>2008-06-25 22:05<span class="Apple-tab-span" style="white-space:pre"> </span>170520<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\hkcmd.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]</div>

<div>2008-04-16 00:54<span class="Apple-tab-span" style="white-space:pre"> </span>178712<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]</div>

<div>2008-06-25 22:06<span class="Apple-tab-span" style="white-space:pre"> </span>150040<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\igfxtray.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck]</div>

<div>2008-02-26 07:50<span class="Apple-tab-span" style="white-space:pre"> </span>988512<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Norton 360\osCheck.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]</div>

<div>2008-06-25 22:06<span class="Apple-tab-span" style="white-space:pre"> </span>145944<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\System32\igfxpers.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]</div>

<div>2008-04-08 22:14<span class="Apple-tab-span" style="white-space:pre"> </span>6037504<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\windows\RtHDVCpl.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]</div>

<div>2008-06-02 20:26<span class="Apple-tab-span" style="white-space:pre"> </span>505720<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\SmoothView\SmoothView.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]</div>

<div>2009-06-24 09:37<span class="Apple-tab-span" style="white-space:pre"> </span>39408<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]</div>

<div>2007-12-07 01:12<span class="Apple-tab-span" style="white-space:pre"> </span>1029416<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Synaptics\SynTP\SynTPEnh.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToshibaServiceStation]</div>

<div>2008-08-04 21:46<span class="Apple-tab-span" style="white-space:pre"> </span>1242424<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\TOSHIBA Service Station\TSS.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]</div>

<div>2008-02-06 20:52<span class="Apple-tab-span" style="white-space:pre"> </span>431456<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Toshiba\Power Saver\TPwrMain.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]</div>

<div>2008-01-21 02:23<span class="Apple-tab-span" style="white-space:pre"> </span>1008184<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Windows Defender\MSASCui.exe</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]</div>

<div>2008-01-21 02:25<span class="Apple-tab-span" style="white-space:pre"> </span>202240<span class="Apple-tab-span" style="white-space:pre"> </span>----a-w-<span class="Apple-tab-span" style="white-space:pre"> </span>c:\program files\Windows Media Player\wmpnscfg.exe</div>

<div>.</div>

<div>--- Other Services/Drivers In Memory ---</div>

<div>.</div>

<div>*NewlyCreated* - COMHOST</div>

<div>*NewlyCreated* - WS2IFSL</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]</div>

<div>LocalServiceAndNoImpersonation<span class="Apple-tab-span" style="white-space:pre"> </span>REG_MULTI_SZ   <span class="Apple-tab-span" style="white-space:pre"> </span>FontCache</div>

<div>.</div>

<div>Contents of the 'Scheduled Tasks' folder</div>

<div>.</div>

<div>2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job</div>

<div>- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-30 02:40]</div>

<div>.</div>

<div>2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3583727236-292728680-4127779811-1000Core.job</div>

<div>- c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-02 22:15]</div>

<div>.</div>

<div>2012-11-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3583727236-292728680-4127779811-1000UA.job</div>

<div>- c:\users\Coston Family\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-02 22:15]</div>

<div>.</div>

<div>2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job</div>

<div>- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 23:10]</div>

<div>.</div>

<div>2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job</div>

<div>- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 23:10]</div>

<div>.</div>

<div>2012-11-20 c:\windows\Tasks\User_Feed_Synchronization-{DE72462C-983C-4263-A67F-90EFDF957699}.job</div>

<div>- c:\windows\system32\msfeedssync.exe [2011-09-23 09:48]</div>

<div>.</div>

<div>.</div>

<div>------- Supplementary Scan -------</div>

<div>.</div>

<div>uStart Page = hxxp://www.ask.com/?l=dis&o=41648106&gct=hp</div>

<div>mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB</div>

<div>IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200</div>

<div>IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000</div>

<div>TCP: DhcpNameServer = 192.168.1.1</div>

<div>.</div>

<div>- - - - ORPHANS REMOVED - - - -</div>

<div>.</div>

<div>BHO-{85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} - c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll</div>

<div>Toolbar-{A531D99C-5A22-449b-83DA-872725C6D0ED} - c:\program files\alotappbar\bin\ALOTHelper.dll</div>

<div>MSConfigStartUp-82211620 - c:\programdata\82211620\82211620.exe</div>

<div>MSConfigStartUp-cfFncEnabler - cfFncEnabler.exe</div>

<div>MSConfigStartUp-NDSTray - NDSTray.exe</div>

<div>MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe</div>

<div>AddRemove-alotAppbar - c:\program files\alotappbar\alotUninst.exe</div>

<div>.</div>

<div>.</div>

<div>.</div>

<div>**************************************************************************</div>

<div>.</div>

<div>catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net</div>

<div>Rootkit scan 2012-11-19 20:05</div>

<div>Windows 6.0.6002 Service Pack 2 NTFS</div>

<div>.</div>

<div>scanning hidden processes ...  </div>

<div>.</div>

<div>scanning hidden autostart entries ... </div>

<div>.</div>

<div>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</div>

<div>  TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????? ?m??h????????????????? </div>

<div>.</div>

<div>scanning hidden files ...  </div>

<div>.</div>

<div>scan completed successfully</div>

<div>hidden files: 0</div>

<div>.</div>

<div>**************************************************************************</div>

<div>.</div>

<div>--------------------- LOCKED REGISTRY KEYS ---------------------</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]</div>

<div>@Denied: (A) (Users)</div>

<div>@Denied: (A) (Everyone)</div>

<div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div>

<div>"BlindDial"=dword:00000000</div>

<div>"MSCurrentCountry"=dword:000000b5</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]</div>

<div>@Denied: (A) (Users)</div>

<div>@Denied: (A) (Everyone)</div>

<div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div>

<div>"BlindDial"=dword:00000000</div>

<div>.</div>

<div>[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]</div>

<div>@Denied: (A) (Users)</div>

<div>@Denied: (A) (Everyone)</div>

<div>@Allowed: (B 1 2 3 4 5) (S-1-5-20)</div>

<div>"BlindDial"=dword:00000000</div>

<div>.</div>

<div>--------------------- DLLs Loaded Under Running Processes ---------------------</div>

<div>.</div>

<div>- - - - - - - > 'Explorer.exe'(3736)</div>

<div>c:\windows\System32\NaturalLanguage6.dll</div>

<div>c:\windows\System32\NLSLexicons0009.dll</div>

<div>c:\windows\system32\ieframe.dll</div>

<div>.</div>

<div>------------------------ Other Running Processes ------------------------</div>

<div>.</div>

<div>c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe</div>

<div>c:\program files\Common Files\Symantec Shared\ccSvcHst.exe</div>

<div>c:\windows\system32\agrsmsvc.exe</div>

<div>c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe</div>

<div>c:\program files\LeapFrog\LeapFrog Connect\CommandService.exe</div>

<div>c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe</div>

<div>c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe</div>

<div>c:\windows\system32\TODDSrv.exe</div>

<div>c:\program files\Toshiba\Power Saver\TosCoSrv.exe</div>

<div>c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe</div>

<div>c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe</div>

<div>c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe</div>

<div>c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe</div>

<div>c:\program files\Windows Media Player\wmpnetwk.exe</div>

<div>.</div>

<div>**************************************************************************</div>

<div>.</div>

<div>Completion time: 2012-11-19  20:10:59 - machine was rebooted</div>

<div>ComboFix-quarantined-files.txt  2012-11-20 01:10</div>

<div>.</div>

<div>Pre-Run: 192,523,550,720 bytes free</div>

<div>Post-Run: 194,293,886,976 bytes free</div>

<div>.</div>

<div>- - End Of File - - 25EB4877F3A4C7E189EC5E40F4AE8C9D</div>

<div> </div>

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Using ComboFix......

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

4. If ComboFix wants to update.....please allow it to.

File::

c:\users\Coston Family\AppData\Roaming\Ifug\yrose.exe

Folder::

c:\users\Coston Family\AppData\Roaming\Inyv

c:\users\Coston Family\AppData\Roaming\Avzuga

c:\users\Coston Family\AppData\Roaming\Zaneub

c:\users\Coston Family\AppData\Roaming\Uxoqur

c:\users\Coston Family\AppData\Roaming\Reviif

c:\users\Coston Family\AppData\Roaming\Akdezy

c:\users\Coston Family\AppData\Roaming\Ricyge

c:\users\Coston Family\AppData\Roaming\Ifug

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Raakiflybi"=-

ClearJavaCache::

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

After reboot, (in case it asks to reboot)......

Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.

MrC

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.