Jump to content

Malwarebytes blocked svchost.exe from opening

blindliberal
 Share

Recommended Posts

blindliberal

blindliberal

Posted
Posted

I believe my computer was infected about two weeks ago. During this time, my PC was really laggy. It would take a long time to open a folder or finish loading a page on Chrome. I used factory restore on my computer twice and still have the same problem. I would receive a notification that Malwarebytes has prevented svchost.exe from opening about 30 minutes to and hour after turning on the computer. How do I fix this problem and also how do I produce the DDS log?

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

Here is the DDS log:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16455 BrowserJavaVersion: 10.9.2

Run by Andrew at 1:14:50 on 2012-12-11

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.3420 [GMT -8:00]

.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\Hpservice.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k WbioSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe

C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll

BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

mRun: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe

mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

TCP: NameServer = 164.67.128.1 128.97.128.1 164.67.128.3

TCP: Interfaces\{3FB30535-6367-435B-9B2A-783D888AD4C4} : DHCPNameServer = 164.67.128.1 128.97.128.1 164.67.128.3

TCP: Interfaces\{8DC45964-ED9A-4006-97C2-482BF6C6F8BA} : DHCPNameServer = 164.67.128.1 128.97.128.1 164.67.128.3

TCP: Interfaces\{8DC45964-ED9A-4006-97C2-482BF6C6F8BA}\5534C414F5755424 : DHCPNameServer = 164.67.128.1 128.97.128.1 164.67.128.3

TCP: Interfaces\{8DC45964-ED9A-4006-97C2-482BF6C6F8BA}\5534C414F575946494 : DHCPNameServer = 128.97.128.1 164.67.128.3 164.67.128.1

SSODL: WebCheck - <orphaned>

x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll

x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2012-12-9 984144]

R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2012-12-9 370288]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-12-9 89600]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-9 203776]

R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2012-12-9 25232]

R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2012-12-9 71600]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-12-9 44808]

R2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-2-17 265544]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-2-28 92216]

R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-1-26 30520]

R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-9 26680]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-12-9 13336]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-9 399432]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-9 676936]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-12-9 2656280]

R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2010-7-28 31088]

R3 hpCMSrv;HP Connection Manager 4.0 Service;C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-2-15 1071160]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-12-9 317440]

R3 intelkmd;intelkmd;C:\Windows\System32\drivers\igdpmd64.sys [2012-12-9 12273408]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-12-9 25928]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-12-10 80384]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-12-10 181248]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2012-12-9 333928]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-12-9 428136]

R3 wdkmd;Intel WiDi KMD;C:\Windows\System32\drivers\WDKMD.sys [2011-2-16 42392]

S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2011-1-5 340240]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-12-9 1255736]

.

=============== Created Last 30 ================

.

2012-12-11 01:36:43 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BFDCA99E-16BC-47B6-833F-519067271CEF}\offreg.dll

2012-12-10 22:01:38 -------- d-----w- C:\Users\Andrew\AppData\Roaming\Simply Super Software

2012-12-10 22:01:19 -------- d-----w- C:\ProgramData\Simply Super Software

2012-12-10 22:01:19 -------- d-----w- C:\Program Files (x86)\Trojan Remover

2012-12-10 17:34:55 -------- d-----w- C:\Users\Andrew\jagexcache

2012-12-10 17:33:50 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2012-12-10 17:33:50 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-12-10 17:33:41 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2012-12-10 04:43:08 -------- d-----w- C:\Users\Andrew\AppData\Local\Adobe

2012-12-10 04:16:44 -------- d-----w- C:\Windows\SysWow64\Wat

2012-12-10 04:16:44 -------- d-----w- C:\Windows\System32\Wat

2012-12-10 02:03:09 8199504 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2012-12-10 02:03:06 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BFDCA99E-16BC-47B6-833F-519067271CEF}\mpengine.dll

2012-12-10 01:55:55 81408 ----a-w- C:\Windows\System32\imagehlp.dll

2012-12-10 01:55:55 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys

2012-12-10 01:55:55 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll

2012-12-10 01:55:48 5120 ----a-w- C:\Windows\SysWow64\wmi.dll

2012-12-10 01:55:48 5120 ----a-w- C:\Windows\System32\wmi.dll

2012-12-10 01:51:59 936960 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll

2012-12-10 01:50:47 95744 ----a-w- C:\Windows\System32\synceng.dll

2012-12-10 01:50:47 78336 ----a-w- C:\Windows\SysWow64\synceng.dll

2012-12-10 01:50:46 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe

2012-12-10 01:50:33 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax

2012-12-10 01:50:33 613888 ----a-w- C:\Windows\System32\psisdecd.dll

2012-12-10 01:50:32 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll

2012-12-10 01:50:32 108032 ----a-w- C:\Windows\System32\psisrndr.ax

2012-12-10 01:50:25 498688 ----a-w- C:\Windows\System32\drivers\afd.sys

2012-12-10 01:39:21 77312 ----a-w- C:\Windows\System32\packager.dll

2012-12-10 01:39:21 67072 ----a-w- C:\Windows\SysWow64\packager.dll

2012-12-10 01:06:51 -------- d-----w- C:\Users\Andrew\AppData\Roaming\Malwarebytes

2012-12-10 01:06:43 -------- d-----w- C:\ProgramData\Malwarebytes

2012-12-10 01:06:36 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-12-10 01:06:36 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-12-10 01:04:23 54072 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys

2012-12-10 01:04:21 984144 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

2012-12-10 01:04:21 71600 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys

2012-12-10 01:04:19 -------- d-----w- C:\Users\Andrew\AppData\Local\HP

2012-12-10 01:04:11 -------- d-----w- C:\Users\Andrew\AppData\Local\AuthenTec

2012-12-10 01:04:08 41224 ----a-w- C:\Windows\avastSS.scr

2012-12-10 01:03:55 -------- d-----w- C:\ProgramData\AVAST Software

2012-12-10 01:03:55 -------- d-----w- C:\Program Files\AVAST Software

2012-12-10 00:59:34 -------- d-----w- C:\Users\Andrew\AppData\Local\Google

2012-12-10 00:59:28 -------- d-----w- C:\Users\Andrew\AppData\Local\Deployment

2012-12-10 00:59:28 -------- d-----w- C:\Users\Andrew\AppData\Local\Apps

2012-12-10 00:59:07 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll

2012-12-10 00:59:07 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys

2012-12-10 00:59:07 1031680 ----a-w- C:\Windows\System32\rdpcore.dll

2012-12-10 00:59:01 -------- d-----w- C:\Users\Andrew\AppData\Local\ATI

2012-12-10 00:58:06 -------- d-----w- C:\Users\Andrew\AppData\Roaming\Intel Corporation

2012-12-10 00:58:01 -------- d-----w- C:\Users\Andrew\AppData\Roaming\Synaptics

2012-12-10 00:58:00 -------- d-----w- C:\Users\Andrew\AppData\Roaming\hpqLog

2012-12-10 00:56:18 -------- d-----w- C:\Users\Andrew\AppData\Local\VirtualStore

2012-12-10 00:56:00 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2012-12-10 00:38:26 -------- d-----w- C:\Program Files (x86)\Common Files\Telespree

2012-12-10 00:37:55 -------- d-----w- C:\Program Files (x86)\HP SimplePass 2011

2012-12-10 00:37:50 -------- d-----w- C:\Program Files\Common Files\AuthenTec

2012-12-10 00:37:50 -------- d-----w- C:\Program Files (x86)\Common Files\AuthenTec

2012-12-10 00:37:43 -------- d-----w- C:\ProgramData\Downloaded Installations

2012-12-10 00:37:07 -------- d-----w- C:\Program Files (x86)\Intel Corporation

2012-12-10 00:37:07 -------- d-----w- C:\Program Files (x86)\Common Files\Intel Corporation

2012-12-10 00:32:27 -------- d-----w- C:\ProgramData\{E91883C8-8CDC-46A4-A45F-CB40EB82ED60}

2012-12-10 00:30:14 0 ----a-w- C:\Windows\ativpsrm.bin

2012-12-10 00:29:13 -------- d-----w- C:\Windows\Hewlett-Packard

2012-12-10 00:25:12 -------- d-----w- C:\ProgramData\Roaming

2012-12-10 00:23:10 -------- d-----w- C:\Program Files (x86)\Cisco

2012-12-10 00:22:45 -------- d-----w- C:\Windows\HPQ

2012-12-10 00:22:15 -------- d-----w- C:\Program Files (x86)\Renesas Electronics

2012-12-10 00:21:37 -------- d-----w- C:\Program Files\Validity Sensors

2012-12-10 00:21:24 -------- d-----w- C:\Program Files\Synaptics

2012-12-10 00:19:59 652288 ------w- C:\Windows\System32\stapi64.dll

2012-12-10 00:19:59 521728 ----a-w- C:\Windows\System32\drivers\stwrt64.sys

2012-12-10 00:19:59 431616 ----a-w- C:\Windows\System32\stcplx64.dll

2012-12-10 00:19:59 220160 ----a-w- C:\Windows\System32\staco64.dll

2012-12-10 00:19:59 1500672 ----a-w- C:\Windows\System32\stapo64.dll

2012-12-10 00:19:57 -------- d-----w- C:\Program Files\IDT

2012-12-10 00:19:53 -------- d-----w- C:\Program Files\Common Files\Intel

2012-12-10 00:19:53 -------- d-----w- C:\Program Files (x86)\Common Files\Intel

2012-12-10 00:13:25 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll

2012-12-10 00:12:56 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent

2012-12-10 00:11:41 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll

2012-12-10 00:11:39 -------- d-----w- C:\Intel

2012-12-10 00:02:53 951680 ----a-w- C:\Windows\System32\drivers\ndis.sys

2012-12-09 23:58:13 -------- d-----w- C:\Windows\ehome

.

==================== Find3M ====================

.

2012-10-18 18:25:58 3149824 ----a-w- C:\Windows\System32\win32k.sys

2012-09-14 19:19:29 2048 ----a-w- C:\Windows\System32\tzres.dll

2012-09-14 18:28:53 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

.

============= FINISH: 1:15:58.29 ===============

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

Hey MrCharile,

Here's the report:

RogueKiller V8.3.2 [Dec 10 2012] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Andrew [Admin rights]

Mode : Scan -- Date : 12/11/2012 09:15:34

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK6461GSYN +++++

--- User ---

[MBR] 9a9e8a72eb84600d633607eb4f5bf8e7

[bSP] 020c9e162599a6e0ef6bf64a048703f7 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 595494 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1219981312 | Size: 14682 Mo

3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1250050048 | Size: 103 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 1a6b56e3b8874dbce1e7ab81e4003acf

[bSP] 020c9e162599a6e0ef6bf64a048703f7 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77824 Mo

1 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 159793152 | Size: 400 Mo

Finished : << RKreport[1]_S_12112012_02d0915.txt >>

RKreport[1]_S_12112012_02d0915.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please read the directions carefully so you don't end up deleting something that is good!!

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

Please download the latest version of TDSSKiller from here and save it to your Desktop.

  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
    image000q.png
  • Put a checkmark beside loaded modules.
    2012081514h0118.png
  • A reboot will be needed to apply the changes. Do it.
  • TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  • Then click on Change parameters in TDSSKiller.
  • Check all boxes then click OK.
    clip.jpg
  • Click the Start Scan button.
    19695967.jpg
  • The scan should take no longer than 2 minutes.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
    67776163.jpg
    Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    62117367.jpg
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  • A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
  • Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

MrC

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

This is the log before the scan:

11:15:34.0544 4780 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

11:15:35.0059 4780 ============================================================

11:15:35.0059 4780 Current date / time: 2012/12/11 11:15:35.0059

11:15:35.0059 4780 SystemInfo:

11:15:35.0059 4780

11:15:35.0059 4780 OS Version: 6.1.7601 ServicePack: 1.0

11:15:35.0059 4780 Product type: Workstation

11:15:35.0059 4780 ComputerName: ANDREW-HP

11:15:35.0059 4780 UserName: Andrew

11:15:35.0059 4780 Windows directory: C:\Windows

11:15:35.0059 4780 System windows directory: C:\Windows

11:15:35.0059 4780 Running under WOW64

11:15:35.0059 4780 Processor architecture: Intel x64

11:15:35.0059 4780 Number of processors: 8

11:15:35.0059 4780 Page size: 0x1000

11:15:35.0059 4780 Boot type: Normal boot

11:15:35.0059 4780 ============================================================

11:15:41.0330 4780 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

11:15:41.0330 4780 ============================================================

11:15:41.0330 4780 \Device\Harddisk0\DR0:

11:15:41.0330 4780 MBR partitions:

11:15:41.0330 4780 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800

11:15:41.0330 4780 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x48B13000

11:15:41.0330 4780 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x48B77000, BlocksNum 0x1CAD000

11:15:41.0330 4780 \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x4A824000, BlocksNum 0x33AB0

11:15:41.0330 4780 ============================================================

11:15:41.0361 4780 C: <-> \Device\Harddisk0\DR0\Partition2

11:15:41.0439 4780 D: <-> \Device\Harddisk0\DR0\Partition3

11:15:41.0439 4780 ============================================================

11:15:41.0439 4780 Initialize success

11:15:41.0439 4780 ============================================================

11:16:01.0532 6656 Deinitialize success

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

They look OK........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

I didn't turn off Windows Defender so I don't know if it worked, but here's the log:

ComboFix 12-12-10.01 - Andrew 12/11/2012 11:53:06.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4586 [GMT -8:00]

Running from: c:\users\Andrew\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

c:\programdata\Roaming

.

.

((((((((((((((((((((((((( Files Created from 2012-11-11 to 2012-12-11 )))))))))))))))))))))))))))))))

.

.

2012-12-11 19:58 . 2012-12-11 19:58 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-10 22:01 . 2012-12-10 22:01 -------- d-----w- c:\program files (x86)\Trojan Remover

2012-12-10 22:01 . 2012-12-10 22:01 -------- d-----w- c:\programdata\Simply Super Software

2012-12-10 17:34 . 2012-12-10 17:34 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-12-10 17:33 . 2012-12-10 17:33 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2012-12-10 17:33 . 2012-12-10 17:33 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-12-10 17:33 . 2012-12-10 17:33 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-12-10 17:33 . 2012-12-10 17:33 -------- d-----w- c:\program files (x86)\Java

2012-12-10 17:32 . 2012-12-10 17:32 -------- d-----w- c:\programdata\McAfee

2012-12-10 04:16 . 2012-12-10 04:16 -------- d-----w- c:\windows\SysWow64\Wat

2012-12-10 04:16 . 2012-12-10 04:16 -------- d-----w- c:\windows\system32\Wat

2012-12-10 02:03 . 2012-11-19 09:01 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BFDCA99E-16BC-47B6-833F-519067271CEF}\mpengine.dll

2012-12-10 01:57 . 2012-10-30 05:04 66395536 ----a-w- c:\windows\system32\MRT.exe

2012-12-10 01:55 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys

2012-12-10 01:55 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll

2012-12-10 01:55 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll

2012-12-10 01:55 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll

2012-12-10 01:55 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll

2012-12-10 01:53 . 2012-12-10 01:54 -------- d-----w- c:\program files (x86)\Common Files\Adobe

2012-12-10 01:51 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2012-12-10 01:50 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll

2012-12-10 01:50 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll

2012-12-10 01:50 . 2011-02-12 11:34 267776 ----a-w- c:\windows\system32\FXSCOVER.exe

2012-12-10 01:50 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll

2012-12-10 01:50 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax

2012-12-10 01:50 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax

2012-12-10 01:50 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll

2012-12-10 01:50 . 2011-12-28 03:59 498688 ----a-w- c:\windows\system32\drivers\afd.sys

2012-12-10 01:39 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll

2012-12-10 01:39 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll

2012-12-10 01:06 . 2012-12-10 01:06 -------- d-----w- c:\programdata\Malwarebytes

2012-12-10 01:06 . 2012-12-10 01:06 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-12-10 01:06 . 2012-09-30 03:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-12-10 01:04 . 2012-10-30 23:51 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-12-10 01:04 . 2012-10-30 23:51 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-12-10 01:04 . 2012-10-15 16:59 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2012-12-10 01:04 . 2012-10-30 23:51 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-12-10 01:04 . 2012-10-30 23:51 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-12-10 01:04 . 2012-10-30 23:51 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2012-12-10 01:04 . 2012-10-30 23:50 285328 ----a-w- c:\windows\system32\aswBoot.exe

2012-12-10 01:04 . 2012-10-30 23:51 41224 ----a-w- c:\windows\avastSS.scr

2012-12-10 01:04 . 2012-10-30 23:50 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe

2012-12-10 01:03 . 2012-12-10 01:03 -------- d-----w- c:\programdata\AVAST Software

2012-12-10 01:03 . 2012-12-10 01:03 -------- d-----w- c:\program files\AVAST Software

2012-12-10 00:59 . 2012-12-10 00:59 -------- d-----w- c:\program files (x86)\Google

2012-12-10 00:59 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll

2012-12-10 00:59 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll

2012-12-10 00:59 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2012-12-10 00:56 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe

2012-12-10 00:56 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll

2012-12-10 00:56 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll

2012-12-10 00:56 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll

2012-12-10 00:55 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll

2012-12-10 00:55 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll

2012-12-10 00:55 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll

2012-12-10 00:55 . 2012-12-10 17:34 -------- d-----w- c:\users\Andrew

2012-12-10 00:55 . 2012-06-02 23:19 186752 ----a-w- c:\windows\system32\wuwebv.dll

2012-12-10 00:55 . 2012-06-02 23:15 36864 ----a-w- c:\windows\system32\wuapp.exe

2012-12-10 00:47 . 2012-12-10 00:47 -------- d-----w- c:\programdata\ATI

2012-12-10 00:39 . 2012-12-10 00:39 -------- d-----w- c:\windows\SysWow64\Macromed

2012-12-10 00:38 . 2012-12-10 00:38 -------- d-----w- c:\program files (x86)\Common Files\Telespree

2012-12-10 00:37 . 2012-12-10 00:37 -------- d-----w- c:\program files (x86)\HP SimplePass 2011

2012-12-10 00:23 . 2012-12-10 00:23 -------- d-----w- c:\program files (x86)\Cisco

2012-12-10 00:23 . 2012-12-10 00:23 -------- d-----w- c:\program files\Intel

2012-12-10 00:22 . 2012-12-10 00:26 -------- d-----w- c:\windows\HPQ

2012-12-10 00:22 . 2012-12-10 00:46 -------- d-----w- c:\programdata\Hewlett-Packard

2012-12-10 00:22 . 2012-12-10 00:38 -------- d-----w- c:\program files (x86)\Hewlett-Packard

2012-12-10 00:22 . 2012-12-10 00:22 -------- d-----w- c:\program files (x86)\Renesas Electronics

2012-12-10 00:21 . 2012-12-10 00:21 -------- d-----w- c:\program files\Validity Sensors

2012-12-10 00:21 . 2012-12-10 00:21 -------- d-----w- c:\program files\Synaptics

2012-12-10 00:19 . 2011-03-11 10:23 652288 ------w- c:\windows\system32\stapi64.dll

2012-12-10 00:19 . 2011-03-11 10:23 521728 ----a-w- c:\windows\system32\drivers\stwrt64.sys

2012-12-10 00:19 . 2011-03-11 10:23 431616 ----a-w- c:\windows\system32\stcplx64.dll

2012-12-10 00:19 . 2011-03-11 10:23 220160 ----a-w- c:\windows\system32\staco64.dll

2012-12-10 00:19 . 2011-03-11 10:23 1500672 ----a-w- c:\windows\system32\stapo64.dll

2012-12-10 00:19 . 2012-12-10 00:20 -------- d-----w- c:\program files\IDT

2012-12-10 00:19 . 2012-12-10 00:36 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information

2012-12-10 00:19 . 2012-12-10 00:23 -------- d-----w- c:\program files\Common Files\Intel

2012-12-10 00:19 . 2012-12-10 00:19 -------- d-----w- c:\program files (x86)\Common Files\Intel

2012-12-10 00:13 . 2010-12-22 20:06 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll

2012-12-10 00:12 . 2012-12-10 00:12 -------- d-----w- c:\program files (x86)\Common Files\postureAgent

2012-12-10 00:11 . 2012-12-10 00:19 -------- d-----w- c:\program files (x86)\Intel

2012-12-10 00:11 . 2010-12-23 19:09 53248 ----a-w- c:\windows\SysWow64\CSVer.dll

2012-12-10 00:11 . 2012-12-10 00:11 -------- d-----w- C:\Intel

2012-12-10 00:02 . 2012-12-10 00:02 951680 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-12-09 23:58 . 2012-12-10 04:16 -------- d-----w- c:\windows\ehome

2012-12-09 23:58 . 2012-12-09 23:58 -------- d-----w- c:\users\Default\AppData\Roaming\Media Center Programs

2012-12-09 23:58 . 2012-12-09 23:58 -------- d-----r- c:\users\Public\Recorded TV

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-03-15 336384]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]

"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-01-27 318520]

"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-02-15 94264]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936]

R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-02-15 1071160]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-01-05 340240]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-12-10 1255736]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-03-15 203776]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]

S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-02-18 265544]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-02-28 92216]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-01-27 30520]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-13 13336]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-22 2656280]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2011-01-27 12273408]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]

S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-01-13 333928]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-17 428136]

S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2011-02-17 42392]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-10 00:59]

.

2012-12-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-10 00:59]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-10-30 23:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-01-27 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-01-27 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-01-27 418328]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-11 1128448]

"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 164.67.128.1 128.97.128.1 164.67.128.3

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

SafeBoot-56301332.sys

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-{E92D47A1-D27D-430A-8368-0BAFD956507D} - c:\program files (x86)\InstallShield Installation Information\{E92D47A1-D27D-430A-8368-0BAFD956507D}\setup.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10n.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2012-12-11 11:59:54

ComboFix-quarantined-files.txt 2012-12-11 19:59

.

Pre-Run: 592,139,702,272 bytes free

Post-Run: 591,875,047,424 bytes free

.

- - End Of File - - 1F69D763C111E42995AC71C8A1F28A18

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

There's no need to have 2 anti-virus programs running.

Turn off Windows Defender:

http://www.howtogeek...ow-turn-it-off/

~~~~~~~~~~~~~~~~~

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

# AdwCleaner v2.100 - Logfile created 12/11/2012 at 12:22:57

# Updated 09/12/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Andrew - ANDREW-HP

# Boot Mode : Normal

# Running from : C:\Users\Andrew\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16455

[OK] Registry is clean.

-\\ Google Chrome v23.0.1271.95

File : C:\Users\Andrew\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [660 octets] - [11/12/2012 12:22:57]

########## EOF - C:\AdwCleaner[R1].txt - [719 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassociates.com/OT-Tools/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please do this:

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in bold:

:OTL

SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

O4 - HKLM..\Run: [] File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:CB0AACC9

:Commands

[EMPTYJAVA]

[emptytemp]

[EMPTYFLASH]

[*]Then click the Run Fix button at the top

[*]Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"

[*]Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

MrC

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

All processes killed

========== OTL ==========

Service WinDefend stopped successfully!

Service WinDefend deleted successfully!

File move failed. C:\Program Files\Windows Defender\MpSvc.dll scheduled to be moved on reboot.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.

ADS C:\ProgramData\Temp:CB0AACC9 deleted successfully.

========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Andrew

->Java cache emptied: 1628029 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 2.00 mb

[EMPTYTEMP]

User: All Users

User: Andrew

->Temp folder emptied: 1634340 bytes

->Temporary Internet Files folder emptied: 3401037 bytes

->Java cache emptied: 0 bytes

->Google Chrome cache emptied: 353295657 bytes

->Flash cache emptied: 562 bytes

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Public

->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 4086 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes

RecycleBin emptied: 50 bytes

Total Files Cleaned = 342.00 mb

[EMPTYFLASH]

User: All Users

User: Andrew

->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 12112012_144454

Files\Folders moved on Reboot...

File move failed. C:\Program Files\Windows Defender\MpSvc.dll scheduled to be moved on reboot.

C:\Users\Andrew\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!

MrC

Link to post
Share on other sites
blindliberal

blindliberal

Posted
  • Author
Posted

Results of screen317's Security Check version 0.99.56

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

avast! Antivirus

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Trojan Remover 6.8.5

Malwarebytes Anti-Malware version 1.65.1.1000

Java 7 Update 9

Adobe Flash Player 10 Flash Player out of Date!

Adobe Reader XI

Google Chrome 23.0.1271.95

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

AVAST Software Avast AvastSvc.exe

AVAST Software Avast AvastUI.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1%

````````````````````End of Log``````````````````````

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted
Adobe Flash Player 10 Flash Player out of Date! <----please check for an update

You have out dated programs on the system which are vulnerable to malware.

Please update or uninstall them

Info on doing that can be found in my Preventive Maintenance

~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.