Malawarebytes affects windows licensing authentification

LucDuran · January 5, 2013

Hello to the Malaware team,

I have proceeded as requested and I have posted an new topic here.

I have also copied my previous correspondance which details what I did previously.

I also installed the latest version of MalawareBytes. I tried to perform a complete scan and

the software completely freezes my computer when scanning the following file.

C:\Program Files\Common Files\Microsoft Shared\MODI\12.0\MSPFILT.DLL

I do not know if this file has a problem but the application forced a hard reset which is not too good in any case.

I then performed a quick scan. Here is the log.

Malawarebyte log

Malwarebytes Anti-Malware (Trial) 1.70.0.1100

www.malwarebytes.org

Database version: v2013.01.05.05

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 8.0.6001.18943

Luc Duranleau :: LEONIDAS [administrator]

Protection: Disabled

2013-01-05 13:20:22

mbam-log-2013-01-05 (13-20-22).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 228485

Time elapsed: 8 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

DDS

As requested, I performed a DDS scan.

Here are the 2 log files.

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 10.10.2

Run by Luc Duranleau at 13:33:04 on 2013-01-05

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.2.1036.18.2046.978 [GMT -5:00]

.

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Windows\system32\dllhost.exe

C:\Program Files\Juniper Networks\Common Files\dsNcService.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Program Files\Nitro PDF\Converter\NitroPDFDriverService.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\TOSHIBA\TOSHIBA HD DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Windows\System32\vds.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\iashost.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\TOSHIBA\reminder\reminder.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\notepad.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k regsvc

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k wcssvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.iciwave.com/

uProxyServer = fpro.rtss.qc.ca:8080

uProxyOverride = *.rtss;*.gmf.qc.ca;*.mtl.rtss.qc.ca;*.rtss.qc.ca*;10.*;<local>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

uRun: [toscdspd] TOSCDSPD.EXE

uRun: [reminder] c:\program files\toshiba\reminder\reminder.exe

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

mRun: [synTPStart] c:\program files\synaptics\syntp\SynTPStart.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [MaxtorOneTouch] c:\program files\maxtor\onetouch\utils\Onetouch.exe

mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:153

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xporter vers Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://secure.universitas.ca/dana-cached/sc/JuniperSetupClient.cab

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{40B794FC-DF11-4363-AA35-A887F298643D} : DHCPNameServer = 192.168.0.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\luc duranleau\appdata\roaming\mozilla\firefox\profiles\h1myzu6n.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: network.proxy.ftp - fpro.rtss.qc.ca

FF - prefs.js: network.proxy.ftp_port - 8080

FF - prefs.js: network.proxy.gopher - fpro.rtss.qc.ca

FF - prefs.js: network.proxy.gopher_port - 8080

FF - prefs.js: network.proxy.http - fpro.rtss.qc.ca

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.socks - fpro.rtss.qc.ca

FF - prefs.js: network.proxy.socks_port - 8080

FF - prefs.js: network.proxy.ssl - fpro.rtss.qc.ca

FF - prefs.js: network.proxy.ssl_port - 8080

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.50401.0\npctrlui.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll

FF - ExtSQL: 2012-12-25 02:50; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:\users\luc duranleau\appdata\roaming\mozilla\firefox\profiles\h1myzu6n.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-3-20 171064]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-10-30 47640]

R2 NitroDriverReadSpool;NitroPDFDriverCreatorReadSpool;c:\program files\nitro pdf\converter\NitroPDFDriverService.exe [2009-12-16 188736]

R3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-10-10 21504]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-1-5 40776]

S2 E2ECAM;ICI Wave Desktop;c:\windows\system32\drivers\wavedt.sys [2009-7-2 89984]

S2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-1-5 398184]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-1-5 682344]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-1-5 21104]

S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2012-3-20 74112]

S3 NisSrv;Inspection du réseau Microsoft;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952]

S3 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [2009-12-16 65856]

.

=============== File Associations ===============

.

FileExt: .ini: Applications\WordPad.exe="c:\program files\windows nt\accessories\WORDPAD.EXE" "%1" [userChoice]

.

=============== Created Last 30 ================

.

2013-01-05 17:30:46 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-01-05 16:42:15 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-01-05 16:42:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-01-05 14:21:08 -------- d-----w- c:\programdata\RegSERVO

2013-01-05 14:21:00 -------- d-----w- c:\program files\REGSERVO

2013-01-05 12:13:49 -------- d-----w- c:\users\luc duranleau\appdata\local\{4D322DC6-38D4-4404-AE5E-AA8CEA28CB51}

2013-01-05 03:56:46 -------- d-----w- c:\program files\ESET

2013-01-05 00:11:29 -------- d-----w- c:\users\luc duranleau\appdata\local\{695DC359-97FD-45DE-AFC4-4D5D75BC709C}

2013-01-04 22:28:25 -------- d-----w- c:\windows\pss

2013-01-04 20:32:08 -------- d-----w- c:\users\luc duranleau\appdata\local\LogMeIn Rescue Applet

2013-01-04 19:05:52 -------- d-----w- c:\users\luc duranleau\appdata\roaming\PC Cleaners

2013-01-04 19:05:49 4729224 ----a-w- c:\windows\uninst.exe

2013-01-04 19:05:45 -------- d-----w- c:\users\luc duranleau\appdata\roaming\PCPro

2013-01-04 19:05:45 -------- d-----w- c:\programdata\PC1Data

2013-01-04 16:37:13 -------- d-----w- c:\users\luc duranleau\appdata\local\Macromedia

2013-01-04 16:36:57 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-01-04 16:25:37 93640 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-01-04 08:10:19 -------- d-sh--w- C:\$RECYCLE.BIN

2013-01-04 04:07:13 -------- d-----w- c:\users\luc duranleau\appdata\local\temp

2013-01-03 22:58:40 -------- d-----w- C:\TDSSKiller_Quarantine

2013-01-03 21:13:36 96224 ----a-w- c:\program files\mozilla firefox\webapprt-stub.exe

2013-01-03 21:13:36 157272 ----a-w- c:\program files\mozilla firefox\webapp-uninstaller.exe

2013-01-03 07:56:34 -------- d-----w- c:\users\luc duranleau\appdata\local\{32FA5ED4-70BA-40EC-A81D-066B19C3E061}

2013-01-02 19:54:36 -------- d-----w- c:\users\luc duranleau\appdata\local\{ACCEE121-81E8-4930-B594-8887DACF7984}

2013-01-02 07:52:37 -------- d-----w- c:\users\luc duranleau\appdata\local\{2B906212-FDAB-46A0-AF23-FEFF18D8749D}

2013-01-01 19:50:39 -------- d-----w- c:\users\luc duranleau\appdata\local\{73915535-1E03-46ED-9314-1A25CB2AEA27}

2012-12-29 11:13:18 -------- d-----w- c:\users\luc duranleau\appdata\local\{76D123F2-DB31-41A8-B9DD-B06A1292FE8C}

2012-12-28 23:11:19 -------- d-----w- c:\users\luc duranleau\appdata\local\{EC9AA581-08D1-4673-97A4-7A484B03A6F0}

2012-12-28 11:09:21 -------- d-----w- c:\users\luc duranleau\appdata\local\{936AE10A-319C-492B-B7AF-5F3FD1041E83}

2012-12-27 23:07:23 -------- d-----w- c:\users\luc duranleau\appdata\local\{31FBB0FB-37DF-4C60-88E8-2B0F393E1B2E}

2012-12-27 11:05:25 -------- d-----w- c:\users\luc duranleau\appdata\local\{F105DEFC-4BC5-464A-909B-7CCA243C0A27}

2012-12-26 23:03:26 -------- d-----w- c:\users\luc duranleau\appdata\local\{C684496C-3ECB-45C5-9400-074B8E51EDC3}

2012-12-26 11:01:28 -------- d-----w- c:\users\luc duranleau\appdata\local\{0E861D7D-E0B3-44EF-A2DE-E7340C16DAF6}

2012-12-25 22:59:30 -------- d-----w- c:\users\luc duranleau\appdata\local\{0D38D434-01E3-4481-A0DE-0C11BD61FA49}

2012-12-25 10:57:32 -------- d-----w- c:\users\luc duranleau\appdata\local\{141969F6-0CAD-4229-AAC6-E799F5197547}

2012-12-25 07:53:31 -------- d-----w- c:\users\luc duranleau\dwhelper

2012-12-24 22:55:33 -------- d-----w- c:\users\luc duranleau\appdata\local\{10FFFB29-75FD-4832-8B2F-A75F89E8BBCB}

2012-12-24 10:53:23 -------- d-----w- c:\users\luc duranleau\appdata\local\{646B7131-BFAA-47B0-B558-C869B155BFE2}

2012-12-23 22:51:25 -------- d-----w- c:\users\luc duranleau\appdata\local\{D07EE08D-6575-4D32-A8F3-FED14ED4BBF2}

2012-12-23 10:49:27 -------- d-----w- c:\users\luc duranleau\appdata\local\{10499DB8-EFCF-4A60-B843-B23F6238D1A1}

2012-12-22 22:47:28 -------- d-----w- c:\users\luc duranleau\appdata\local\{5F1A493E-25DE-446A-94B9-AA1FAAA598B6}

2012-12-22 10:45:30 -------- d-----w- c:\users\luc duranleau\appdata\local\{EB32B67B-FAB4-4B0F-A3E4-0F275CCD27A8}

2012-12-21 22:43:32 -------- d-----w- c:\users\luc duranleau\appdata\local\{1DAD070F-820F-40CF-B01C-1DFB3FB8C2E7}

2012-12-21 10:41:34 -------- d-----w- c:\users\luc duranleau\appdata\local\{553BB569-103B-42DC-B1F6-7F1B43317159}

2012-12-20 22:39:36 -------- d-----w- c:\users\luc duranleau\appdata\local\{3B54FB98-1B55-4D86-898B-FCBC3645748E}

2012-12-20 10:37:38 -------- d-----w- c:\users\luc duranleau\appdata\local\{F1549B44-FA56-43EA-90F7-36239662375A}

2012-12-19 22:35:40 -------- d-----w- c:\users\luc duranleau\appdata\local\{62953F73-8502-4198-A67E-0E8E2BCD34B3}

2012-12-19 10:33:42 -------- d-----w- c:\users\luc duranleau\appdata\local\{6B49B4A3-DEBE-4CF5-B234-2C564BD1B322}

2012-12-18 22:31:44 -------- d-----w- c:\users\luc duranleau\appdata\local\{A74AFE14-6DBE-4DF0-8520-B3CE724AA98C}

2012-12-18 10:29:45 -------- d-----w- c:\users\luc duranleau\appdata\local\{CE466F09-2CB8-481B-A3E0-F983A4C5F130}

2012-12-17 22:27:47 -------- d-----w- c:\users\luc duranleau\appdata\local\{266C33E9-9743-4047-8E38-CB204CBABEE5}

2012-12-17 10:25:49 -------- d-----w- c:\users\luc duranleau\appdata\local\{9C69ECC8-4556-4B93-B015-73FFE858D219}

2012-12-16 22:23:50 -------- d-----w- c:\users\luc duranleau\appdata\local\{D1B1D32E-56B8-49EF-B8E2-A00E2330D350}

2012-12-14 11:40:09 -------- d-----w- c:\users\luc duranleau\appdata\local\{2D9E7AF6-734C-491E-AA61-6494852B826A}

2012-12-13 23:38:11 -------- d-----w- c:\users\luc duranleau\appdata\local\{AC7A7BE0-A1EA-4B99-A715-A4E1088EAC9B}

2012-12-13 11:36:12 -------- d-----w- c:\users\luc duranleau\appdata\local\{092FEA48-7B5A-4B4F-8392-F5A3F33F026E}

2012-12-12 23:34:13 -------- d-----w- c:\users\luc duranleau\appdata\local\{68A39303-2272-48B7-BD49-73FD94D6A464}

2012-12-12 09:38:50 -------- d-----w- c:\users\luc duranleau\appdata\local\{20D30901-60E4-43A3-882B-440555C76865}

2012-12-11 21:36:51 -------- d-----w- c:\users\luc duranleau\appdata\local\{8EC65803-55FD-4401-8FAD-77E2770DBF97}

2012-12-11 09:34:54 -------- d-----w- c:\users\luc duranleau\appdata\local\{722802F1-6830-40EA-AB08-C5B2ECB7F63D}

2012-12-10 21:32:55 -------- d-----w- c:\users\luc duranleau\appdata\local\{FA7D0A31-9295-436A-BCBF-112DFCB33175}

2012-12-10 09:30:57 -------- d-----w- c:\users\luc duranleau\appdata\local\{E75802C7-D850-4604-AADE-8A3D6D8F5F07}

2012-12-09 21:28:58 -------- d-----w- c:\users\luc duranleau\appdata\local\{6A55EE3B-B9D5-4439-BE34-231AB84DA53E}

2012-12-09 09:27:00 -------- d-----w- c:\users\luc duranleau\appdata\local\{39A06CBD-5045-4FA7-A8CC-856797DEFD6D}

2012-12-08 21:25:02 -------- d-----w- c:\users\luc duranleau\appdata\local\{3EE74A49-6E03-4CB4-8011-3AD8A756BACE}

2012-12-08 09:23:04 -------- d-----w- c:\users\luc duranleau\appdata\local\{25B68417-46E3-4FB5-AE49-7C4F03B8E552}

2012-12-07 21:21:06 -------- d-----w- c:\users\luc duranleau\appdata\local\{FE4524C0-74E1-4805-8DAA-8BD8A68ABC4D}

2012-12-07 09:19:06 -------- d-----w- c:\users\luc duranleau\appdata\local\{DE7BA250-8693-43E4-845A-5186259CFBC2}

2012-12-06 21:17:07 -------- d-----w- c:\users\luc duranleau\appdata\local\{F0CBD7CB-D33F-4519-9CA8-BC0B04468960}

.

==================== Find3M ====================

.

2013-01-04 16:36:57 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-01-03 23:00:55 279552 ----a-w- c:\windows\system32\services.exe

.

============= FINISH: 13:34:14,30 ===============

ATTACH

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft® Windows Vista™ Édition Familiale Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 2007-12-02 06:53:14

System Uptime: 2013-01-05 13:15:00 (0 hours ago)

.

Motherboard: TOSHIBA | | ISRAA

Processor: Intel® Core™2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1000/mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 220 GiB total, 31,699 GiB free.

D: is FIXED (NTFS) - 5 GiB total, 4,369 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

==== Installed Programs ======================

.

Adobe Anchor Service CS3

Adobe Asset Services CS3

Adobe Bridge CS3

Adobe Bridge Start Meeting

Adobe Camera Raw 4.0

Adobe CMaps

Adobe Color Common Settings

Adobe Color EU Recommended Settings

Adobe Color JA Extra Settings

Adobe Color NA Extra Settings

Adobe Device Central CS3

Adobe ExtendScript Toolkit 2

Adobe Flash CS3

Adobe Flash CS3 Professional

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Flash Video Encoder

Adobe Help Viewer CS3

Adobe Linguistics CS3

Adobe PDF Library Files

Adobe Photoshop CS

Adobe Reader X (10.1.4) - Français

Adobe Setup

Adobe Type Support

Adobe Update Manager CS3

Adobe Version Cue CS3 Client

Adobe WinSoft Linguistics Plugin

Alamoon Watermark v1.4

Apple Software Update

ATI Catalyst Install Manager

AVS Update Manager 1.0

AVS Video Converter 6

AVS4YOU Software Navigator 1.4

Bluetooth Stack for Windows by Toshiba

Canon Auto Update Service

Canon DIGITAL CAMERA Solution Disk - Guide d'utilisation des logiciels

Canon G.726 WMP-Decoder

Canon MOV Decoder

Canon MOV Encoder

Canon MovieEdit Task for ZoomBrowser EX

Canon PowerShot SX40 HS Guide d'utilisation de l'appareil photo

Canon Utilities CameraWindow DC 8

Canon Utilities CameraWindow Launcher

Canon Utilities Movie Uploader for YouTube

Canon Utilities MyCamera

Canon Utilities PhotoStitch

Canon Utilities ZoomBrowser EX

Canon ZoomBrowser EX Memory Card Utility

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center Localization Chinese Standard

Catalyst Control Center Localization Chinese Traditional

Catalyst Control Center Localization Czech

Catalyst Control Center Localization Danish

Catalyst Control Center Localization Dutch

Catalyst Control Center Localization Finnish

Catalyst Control Center Localization French

Catalyst Control Center Localization German

Catalyst Control Center Localization Greek

Catalyst Control Center Localization Hungarian

Catalyst Control Center Localization Italian

Catalyst Control Center Localization Japanese

Catalyst Control Center Localization Korean

Catalyst Control Center Localization Norwegian

Catalyst Control Center Localization Polish

Catalyst Control Center Localization Portuguese

Catalyst Control Center Localization Russian

Catalyst Control Center Localization Spanish

Catalyst Control Center Localization Swedish

Catalyst Control Center Localization Thai

Catalyst Control Center Localization Turkish

ccc-core-static

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Codeur Windows Media Série 9

Compatibility Pack for the 2007 Office system

D3DX10

Diablo II

DVD MovieFactory for TOSHIBA

ESET Online Scanner v3

Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)

GoToMeeting 4.8.0.723

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

ImgBurn

Intel Matrix Storage Manager

Java 7 Update 10

Java Auto Updater

Juniper Networks Network Connect 6.5.0

Juniper Networks Setup Client

Logiciel Intel® PROSet/Wireless

Malwarebytes Anti-Malware version 1.70.0.1100

Maxtor Backup

Maxtor OneTouch III

mCore

mHelp

Microsoft .NET Framework 3.5 SP1

Microsoft Application Error Reporting

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (French) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (French) 2007

Microsoft Office Groove MUI (French) 2007

Microsoft Office InfoPath MUI (French) 2007

Microsoft Office OneNote MUI (French) 2007

Microsoft Office Outlook Connector

Microsoft Office Outlook MUI (French) 2007

Microsoft Office PowerPoint MUI (French) 2007

Microsoft Office Professional Edition 2003

Microsoft Office Proof (Arabic) 2007

Microsoft Office Proof (Dutch) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing (French) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (French) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared MUI (French) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Visio 2007 Service Pack 2 (SP2)

Microsoft Office Visio MUI (English) 2007

Microsoft Office Visio Professional 2007

Microsoft Office Word MUI (French) 2007

Microsoft Office Word Viewer 2003

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft SQL Server Native Client

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft XML Parser

Mise à jour Microsoft Office Excel 2007 Help (KB963678)

Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669)

Mise à jour Microsoft Office Word 2007 Help (KB963665)

mMHouse

Mozilla Firefox 17.0.1 (x86 fr)

Mozilla Maintenance Service

mPfMgr

MSVCRT

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nitro PDF Professional

PDF Settings

PrimoPDF -- brought to you by Nitro PDF Software

Programme de gestion Camera de Logitech®

QuickTime

Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista

RecoveryFix For Windows ver 7.06.01

REGSERVO

reminder

Réducteur de bruit lect. CD/DVD

Screen-Cut

Security Update for 2007 Microsoft Office System (KB2277947)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for 2007 Microsoft Office System (KB982312)

Security Update for 2007 Microsoft Office System (KB982331)

Security Update for CAPICOM (KB931906)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB982308)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office Outlook 2007 (KB980376)

Security Update for Microsoft Office PowerPoint 2007 (KB982158)

Security Update for Microsoft Office Publisher 2007 (KB982124)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio 2007 (KB982127)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2251419)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

Segoe UI

Skins

SUPERAntiSpyware

Sybase PowerAMC 11.0

Synaptics Pointing Device Driver

Texas Instruments PCIxx21/x515/xx12 drivers.

TIPCI

TOSHIBA Assist

TOSHIBA ConfigFree

TOSHIBA Disc Creator

TOSHIBA Extended Tiles for Windows Mobility Center

TOSHIBA Flash Cards Support Utility

TOSHIBA Hardware Setup

TOSHIBA HD DVD PLAYER

TOSHIBA Mot de passe responsable

TOSHIBA Recovery Disc Creator

Toshiba Registration

TOSHIBA SD Memory Utilities

TOSHIBA Software Modem

TOSHIBA Supervisor Password

TOSHIBA Value Added Package

UltraEdit-32 Uninstall

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office OneNote 2007 (KB980729)

Update for Microsoft Office Outlook 2007 Help (KB957246)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Visio 2007 Help (KB963666)

Update for Outlook 2007 Junk Email Filter (kb2279264)

Utility Common Driver

VLC media player 2.0.2

wavedesktop_1_5

Windows Live

Windows Live Communications Platform

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Messenger

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

.

==== End Of File ===========================

===============================================

Previous correspondance

Part 1

Hello to the Malwarebytes team,

I have come across a serious problem after running the Malwarebytes application.

It detected the following trojans in the seperate sequences.

1) Exploit.Drop.GS and Trojan.Ransom.SuGen

I simply executed the cleaning MalwareBytes suggested. It then rebooted.

Here is the log.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 913010306

Windows 6.0.6002 Service Pack 2 (Safe Mode)

Internet Explorer 8.0.6001.18943

2013-01-03 16:11:28

mbam-log-2013-01-03 (16-11-28).txt

Scan type: Quick scan

Objects scanned: 240398

Time elapsed: 8 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Luc Duranleau\AppData\Local\Temp\wlsidten.dll (Exploit.Drop.GS) -> Quarantined and deleted successfully.

C:\Users\Luc Duranleau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk (Trojan.Ransom.SUGen) -> Quarantined and deleted successfully.

2) Running Malwarebytes again, it found RootKit.0Access

Again, I simply executed the cleaning MalwareBytes suggested. It then rebooted.

Here is the log.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 913010306

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

2013-01-03 16:32:15

mbam-log-2013-01-03 (16-32-15).txt

Scan type: Quick scan

Objects scanned: 242891

Time elapsed: 12 minute(s), 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Windows\assembly\GAC\Desktop.ini (Rootkit.0access) -> Delete on reboot.

Problem

At this time, the windows licensing processus have been corrupted and the OS continuously asks me to authenticate my OS with my product key.

All attempts to activate fail. Even Microsoft support failed to reactivate my OS.

Is there something Malwarebytes did that can be recovered so that my licensing processus function proporly?

Thanks for your support,

Luc

Part 2

Hello,

Thanks for your reply.

I have since cleaned the computer and no longer have the trojans. Used TDSKiller, RogueKiller, ESET and Malwarebytes. Computer is clean.

I have looked at the application event logs and warnings and errors for winlogon occur at around the same time Malwarebytes was executed and the logs

were generated. My guess is that Malwarebytes cleaned an infection but in so doing provoked or indirectly provoked a modification as indicated in this event error.

-

<Channel>Application</Channel>

<Computer>LEONIDAS</Computer>

</System>

</EventData>

</Event>

Hope this helps.

Luc

============================================================================

1972vet · January 6, 2013

Greetings LucDuran and Welcome to the Forums,

I am looking over your logs and will have some suggestions for you in a short while. Thanks for your patience!

1972vet · January 6, 2013

QUOTE ...First Quote:

I tried to perform a complete scan and

the software completely freezes my computer when scanning the following file.

C:\Program Files\Common Files\Microsoft Shared\MODI\12.0\MSPFILT.DLL

I do not know if this file has a problem but the application forced a hard reset which is not too good in any case.

...Next Quote:

Files Infected:

C:\Windows\assembly\GAC\Desktop.ini (Rootkit.0access) -> Delete on reboot.

Problem

At this time, the windows licensing processus have been corrupted and the OS continuously asks me to authenticate my OS with my product key.

All attempts to activate fail. Even Microsoft support failed to reactivate my OS.

Is there something Malwarebytes did that can be recovered so that my licensing processus function proporly?

As to the first quote above...that file you reference is harmless. It's part of Microsoft Office's Image Filter library for document Imaging. The freeze issue may be totally unrelated.

As to the second quote above...possibly. One way to find out is simply to open MalwareBytes, click the "Quarantine" tab and restore the file that MBAM removed which caused your Microsoft Authentication issue. Please be sure to restore ONLY that one file (referenced in the quote above labeled "Problem") that was removed just prior to this becoming an issue.

One big problem I noticed first is the packed drive. Your operating system needs a bit more breathing room. According to the size of your hard disk, your Windows drive partition needs at the minimum, 33 gigs of free space...keep in mind, this is minimum. More than that is ideal, but you have in fact, 2 gigs less. To remedy this, you would need to uninstall/remove/delete things you KNOW with certainty that you don't need. I would suggest that if you have files/folders/documents that you created, please consider placing them on removable media. Such things as music and video can be huge files that would be good candidates for removal.

Did you install, and do you use LogMeIn and GoToMeeting? They're fine to use if you did, just be certain to use strong passwords...but if you did not, uninstalling them is the best idea.

Backup software can quickly add up so keeping an eye on this is most important. If you create backup copies using such software, look into the prospect of keeping these on removal media.

I can also suggest removing these:

SUPERAntiSpyware

ESET Online Scanner v3

...they are fine to use but for your purposes at this point, they can be removed to help free up needed disk space.

On your next reply, please post a fresh DDS scan log. Tell us what issues remain and please answer if you created this proxy setup:

uProxyServer = fpro.rtss.qc.ca:8080

Thanks!

LucDuran · January 6, 2013

Hello,

Thanks for responding.

1) Malawarebytes freezing on a Windows file.

It is true that it may totally unrelated, however the application reacts identically at all times. It does not react randomly.

As everything freezes (even the cursor), I must hard boot. I am therefore relunctant to use the application with this option

until the application can recover from whatever it is trying to do at this point.

2) Restore Malawarebytes quarantined file.

At this moment, I am also relunctant to try this. The main reason is that I feel that Malawarebytes did not directly cause

the problem. I fear that the virus reacted to being dislodged and on reboot, it acted upon the licensing components

or registry. I would prefer trying to figure out what corrupted the licensing components. Undoing the Malawarebytes

quarantine may have more dangerous results and I doubt it would recover the authentication components if it was

unaware of the viruses capability to act on being deleted. Besides, I ran the 1.4 version of the application and now

have the newest version. Not sure the new version can unquarantine files from prior versions.

3) I have freed space. The C drive now has 32 GB. I will further liberate more space later.

4) I've uninstalled GoToMeeting. LogmeIn is a client used by Microsoft support. I will leave there for now. There are no passwords involved.

5) I have removed ESET and SuperAntiSpyware

6) The proxy setup was done by one of my government clients. Completely legitimate and I believe disactivated.

7) At the moment, the authentication problem remains.

Here is the DDS log :

DDS

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 10.10.2

Run by Luc Duranleau at 12:35:22 on 2013-01-06

Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.2.1036.18.2046.903 [GMT -5:00]

.

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Juniper Networks\Common Files\dsNcService.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe

C:\Windows\System32\msdtc.exe

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Program Files\Nitro PDF\Converter\NitroPDFDriverService.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\TOSHIBA\TOSHIBA HD DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Windows\System32\vds.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\iashost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Maxtor\OneTouch Status\MaxMenuMgr.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

C:\Program Files\TOSHIBA\reminder\reminder.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k regsvc

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k wcssvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.iciwave.com/

uProxyServer = fpro.rtss.qc.ca:8080

uProxyOverride = *.rtss;*.gmf.qc.ca;*.mtl.rtss.qc.ca;*.rtss.qc.ca*;10.*;<local>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll