how to make sure threats are gone

kearbear · January 16, 2013

I just ran Malwarebytes in safe mode with networking. It found 7 threats. One trojan and some pup installers. I selected to remove them. It said they were removed. How do I know they actually were?

Maniac · January 16, 2013

Hello kearbear and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please open Malwarebytes' Anti-Malware, open Logs tab and double click on the line which is realted to your last scan (check the date). Post the entire content of the log in your next reply here.

Also, follow the instructions here and post the log files from DDS:

http://forums.malwarebytes.org/index.php?showtopic=9573

kearbear · January 17, 2013

btw I'm still going slow after removing those 7 files.

Here is the log:

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.01.14.10

Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking)

Internet Explorer 9.0.8112.16421

kearbear :: KEARBEAR-LT [administrator]

1/15/2013 8:35:09 PM

mbam-log-2013-01-15 (20-35-09).txt

Scan type: Full scan (C:\|D:\|E:\|)

Scan options disabled: P2P

Objects scanned: 584573

Time elapsed: 3 hour(s), 24 minute(s), 18 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\Software\AppDataLow\Software\MyWebSearch (PUP.MyWebsearch) -> Quarantined and deleted successfully.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\Users\kearbear\Documents\carrie.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\kearbear\Downloads\DownloadManager_Setup.exe (PUP.Bundle.Installer.OI) -> Quarantined and deleted successfully.

C:\Users\kearbear\Downloads\video_downloader (1).exe (PUP.BundleInstaller.VG) -> Quarantined and deleted successfully.

C:\Users\kearbear\Downloads\video_downloader (2).exe (PUP.BundleInstaller.VG) -> Quarantined and deleted successfully.

C:\Users\kearbear\Downloads\video_downloader.exe (PUP.BundleInstaller.VG) -> Quarantined and deleted successfully.

C:\Users\kearbear\Downloads\plugins\IWONSetup2.3.50.42.ZLfox000.exe (PUP.MyWebSearch) -> Quarantined and deleted successfully.

(end)

Here is the DDS:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.11.2

Run by kearbear at 20:51:56 on 2013-01-16

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3453.1128 [GMT -5:00]

.

AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\System32\WLTRYSVC.EXE

C:\Windows\System32\bcmwltry.exe

C:\Windows\system32\brsvc01a.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\brss01a.exe

C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\aestsrv.exe

C:\Program Files\ATI\WebPAM\jetty\extra\win32\Wrapper.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\CSHelper.exe

C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe

C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe

C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_JT50RP.EXE

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\ATI\WebPAM\_jvm\bin\java.exe

C:\Windows\system32\lxdicoms.exe

C:\Program Files\Maxtor\Sync\SyncServices.exe

C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe

C:\Program Files\OpenCASE\OpenCASE Media Agent\MediaAgent.exe

C:\Program Files\Common Files\Motive\pcCMService.exe

C:\Program Files\Common Files\Motive\pcServiceHost.exe

C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe

C:\Program Files\Samsung\AllShare\AllShareDMS\AllShareDMS.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\STacSV.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Wavexpress\TVTonic\WXRSS.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Common Files\Dell\apache\bin\httpd.exe

C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe

C:\Program Files\Common Files\Dell\apache\bin\httpd.exe

C:\Windows\System32\alg.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\Comcast\pcTrayApp.exe

C:\Program Files\Epson Software\Event Manager\EEventManager.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\spool\drivers\w32x86\3\E_TATIHWA.EXE

C:\Program Files\Constant Guard Protection Suite\IDVault.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\Southwest Airlines\Ding\Ding.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Users\kearbear\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehRecvr.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Users\kearbear\Downloads\msert.exe

C:\Windows\System32\cleanmgr.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uWindow Title = Windows Internet Explorer provided by Qwest

uDefault_Page_URL = hxxp://qwest.live.com

mStart Page = hxxp://qwest.live.com

mDefault_Page_URL = hxxp://qwest.live.com

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\norton security suite\norton security suite\engine\6.4.0.9\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\norton security suite\norton security suite\engine\6.4.0.9\ips\ipsbho.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll

BHO: Constant Guard Protection Suite: {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - c:\programdata\white sky, inc\id vault\iebho1.12.1012.1\NativeBHO.dll

BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton security suite\norton security suite\engine\6.4.0.9\coieplg.dll

uRun: [EPLTarget\P0000000000000000] c:\windows\system32\spool\drivers\w32x86\3\e_tatihwa.exe /ept "epltarget\P0000000000000000" /M "WorkForce 545"

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [LTCM Client] c:\program files\ltcm client\ltcmClient.exe /startup

mRun: [Comcast_McciTrayApp] "c:\program files\comcast\pcTrayApp.exe"

mRun: [EEventManager] "c:\program files\epson software\event manager\EEventManager.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

StartupFolder: c:\users\kearbear\appdata\roaming\micros~1\windows\startm~1\programs\startup\ding!.lnk - c:\program files\southwest airlines\ding\Ding.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\consta~1.lnk - c:\program files\constant guard protection suite\IDVault.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\program files\dell\quickset\quickset.exe

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB

DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - hxxp://www.infospace.com/mypoints.main/tbar/mypointsSetup.exe

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

TCP: NameServer = 192.168.15.1 192.168.1.1

TCP: Interfaces\{A45A3AFA-B775-453B-885D-48AF076411EC} : DHCPNameServer = 192.168.15.1 192.168.1.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: GoToAssist - c:\program files\citrix\gotoassist\508\G2AWinLogon.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0604000.009\symds.sys [2012-10-9 340088]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0604000.009\symefa.sys [2012-10-9 924320]

R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_6.0.0.145\definitions\bashdefs\20130111.001\BHDrvx86.sys [2013-1-15 995488]

R1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\n360\0604000.009\ccsetx86.sys [2012-10-9 132768]

R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_6.0.0.145\definitions\ipsdefs\20130116.002\IDSvix86.sys [2013-1-16 386720]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0604000.009\ironx86.sys [2012-10-9 149624]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\n360\0604000.009\symtdiv.sys [2012-10-9 345208]

R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\common files\abbyy\finereadersprint\9.00\licensing\NetworkLicenseServer.exe [2009-5-14 759048]

R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2011-8-20 73728]

R2 Apache2.2;Remote Access Media Server;c:\program files\common files\dell\apache\bin\httpd.exe [2007-9-21 15872]

R2 ATIWebPAM;ATI WebPAM;c:\program files\ati\webpam\jetty\extra\win32\Wrapper.exe [2003-9-29 110592]

R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2009-2-6 266240]

R2 dsl-db;Remote Access DB;c:\program files\common files\dell\mysql\bin\mysqld.exe [2007-9-14 5730304]

R2 dsl-fs-sync;Remote Access File Sync Service;c:\program files\common files\dell\remote access file sync service\dsl_fs_sync.exe [2009-4-13 189680]

R2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\common files\epson\epw!3 ssrp\E_JT50RP.EXE [2012-2-26 130944]

R2 EpsonCustomerParticipation;EpsonCustomerParticipation;c:\program files\epson\epsoncustomerparticipation\EPCP.exe [2011-6-9 521600]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-15 21504]

R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]

R2 N360;Norton Security Suite;c:\program files\norton security suite\norton security suite\engine\6.4.0.9\ccsvchst.exe [2012-10-9 138272]

R2 OpenCASE Media Agent;OpenCASE Media Agent;c:\program files\opencase\opencase media agent\MediaAgent.exe [2008-3-17 765576]

R2 pcCMService;pcCMService;c:\program files\common files\motive\pcCMService.exe [2012-5-31 368640]

R2 pcServiceHost;pcServiceHost;c:\program files\common files\motive\pcServiceHost.exe [2012-6-22 342016]

R2 SamsungAllShareV2.0;Samsung AllShare PC;c:\program files\samsung\allshare\allsharedms\AllShareDMS.exe [2011-7-16 24992]

R2 WXRSS;TVTonic RSS;c:\program files\wavexpress\tvtonic\WXRSS.exe [2008-8-2 142336]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2013-1-15 106656]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-1-16 40776]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 IDVaultSvc;CGPS Service;c:\program files\constant guard protection suite\IDVaultSvc.exe [2012-10-16 61552]

S3 AllShare;SAMSUNG AllShare Service;c:\program files\samsung\samsung pc share manager\WiselinkPro.exe [2010-7-16 6638080]

S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2012-6-6 39272]

S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2012-3-8 1492840]

S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it center\Matsvc.exe [2011-6-13 267568]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2007-6-20 17920]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2007-1-23 7680]

S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2007-5-7 42112]

S3 PCDSRVC{E9D79540-57D5953E-06020200}_0;PCDSRVC{E9D79540-57D5953E-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc.pkms [2012-8-17 22640]

S3 SimpleSlideShowServer;SimpleSlideShowServer;c:\program files\samsung\allshare\AllShareSlideShowService.exe [2011-7-16 27584]

S3 WaveATSC;Lumanate Wave NTSC/ATSC Combo Device;c:\windows\system32\drivers\WaveATSC.sys [2007-9-4 441600]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]

.

=============== Created Last 30 ================

.

2013-01-17 01:47:22 40776 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-01-15 19:34:44 -------- dc--a-w- c:\users\kearbear\appdata\local\{242130AA-AF78-4095-9810-266AED1DDB99}

2013-01-15 07:09:11 6812136 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b1ced686-1122-41ef-8c7d-db0b538cf239}\mpengine.dll

2013-01-14 17:59:35 94112 -c--a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-01-13 09:55:05 -------- dcsh--w- C:\$RECYCLE.BIN

2013-01-13 09:42:10 -------- dc----w- c:\program files\Microsoft ATS

2013-01-13 08:55:30 -------- dc----w- c:\windows\MATS

2013-01-13 08:55:24 -------- dc----w- c:\program files\Microsoft Fix it Center

2013-01-09 18:03:32 2048000 -c--a-w- c:\windows\system32\win32k.sys

2013-01-09 18:02:26 204288 -c--a-w- c:\windows\system32\ncrypt.dll

2013-01-09 17:53:48 1400832 -c--a-w- c:\windows\system32\msxml6.dll

2013-01-01 20:42:24 -------- dc----w- c:\users\kearbear\appdata\local\{5765F828-7E0A-4DCC-9173-4FEFF71087EE}

2012-12-22 01:39:43 -------- dc--a-w- c:\users\kearbear\appdata\local\{5B418265-DBFB-41D9-AC14-CEA01421BDEA}

2012-12-20 23:26:18 34304 -c--a-w- c:\windows\system32\atmlib.dll

2012-12-20 23:26:18 293376 -c--a-w- c:\windows\system32\atmfd.dll

2012-12-20 13:03:15 -------- dc----w- c:\users\kearbear\appdata\local\{A18CAC8A-D3C9-45A1-A3FB-E3DF58528FDE}

2012-12-20 11:19:44 7450888 -c--a-w- c:\program files\common files\windows live\.cache\d6aab6801cddea302\bingbarsetup.exe

2012-12-20 11:18:43 15712 -c--a-w- c:\program files\common files\windows live\.cache\c50336501cddea301\MeshBetaRemover.exe

2012-12-20 09:16:57 -------- dc----w- c:\users\kearbear\appdata\local\{43039300-2920-4E63-9633-152AD63C48BA}

2012-12-18 14:28:14 186584 -c--a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll

2012-12-18 14:28:14 186584 -c--a-w- c:\program files\internet explorer\plugins\nppdf32.dll

.

==================== Find3M ====================

.

2013-01-09 03:06:25 697864 -c--a-w- c:\windows\system32\FlashPlayerApp.exe

2013-01-09 03:06:24 74248 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-14 21:49:28 21104 -c--a-w- c:\windows\system32\drivers\mbam.sys

2012-11-14 02:09:22 1800704 -c--a-w- c:\windows\system32\jscript9.dll

2012-11-14 01:58:15 1427968 -c--a-w- c:\windows\system32\inetcpl.cpl

2012-11-14 01:57:37 1129472 -c--a-w- c:\windows\system32\wininet.dll

2012-11-14 01:49:25 142848 -c--a-w- c:\windows\system32\ieUnatt.exe

2012-11-14 01:48:27 420864 -c--a-w- c:\windows\system32\vbscript.dll

2012-11-14 01:44:42 2382848 -c--a-w- c:\windows\system32\mshtml.tlb

2012-11-13 01:29:51 2048 -c--a-w- c:\windows\system32\tzres.dll

2012-11-02 10:18:17 376320 -c--a-w- c:\windows\system32\dpnet.dll

2012-11-02 08:26:06 23040 -c--a-w- c:\windows\system32\dpnsvr.exe

2012-10-27 01:56:48 821736 -c--a-w- c:\windows\system32\npdeployJava1.dll

2012-10-27 01:56:47 746984 -c--a-w- c:\windows\system32\deployJava1.dll

.

============= FINISH: 20:58:55.62 ===============

Maniac · January 17, 2013

Where is the content of Attach.txt?

kearbear · January 17, 2013

Sorry about that.

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume3

Install Date: 9/4/2007 2:04:04 AM

System Uptime: 1/16/2013 8:13:40 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0RT951

Processor: AMD Turion 64 X2 Mobile Technology TL-56 | Microprocessor | 1800/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 136 GiB total, 11.895 GiB free.

D: is FIXED (NTFS) - 10 GiB total, 5.632 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

7-Zip 9.22beta

ABBYY FineReader 6.0 Sprint

ABBYY FineReader 9.0 Sprint

Acrobat.com

Actiontec Gateway

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Player

Adobe Reader X (10.1.5)

Adobe Shockwave Player 11.6

Advanced Audio FX Engine

Advanced Video FX Engine

Amazon Kindle

Amazon Unbox Video

ArcSoft MediaConverter 2

ArcSoft MediaConverter 7

ArtistScope Plugin FX 42

ATI PCI Express (3GIO) Filter Driver

Auto Care

AVerMedia MCE Encoder x86 3.0.1.0

AVS Update Manager 1.0

AVS Video Converter 6

AVS Video Converter 8

AVS4YOU Software Navigator 1.4

Banctec Service Agreement

BitTorrent

Bonjour

Boxee

Broadcom 440x 10/100 Integrated Controller

Broadcom Management Programs

Catalyst Control Center Localization Chinese Standard

Catalyst Control Center Localization Chinese Traditional

Catalyst Control Center Localization Dutch

Catalyst Control Center Localization Finnish

Catalyst Control Center Localization French

Catalyst Control Center Localization German

Catalyst Control Center Localization Italian

Catalyst Control Center Localization Japanese

Catalyst Control Center Localization Korean

Catalyst Control Center Localization Norwegian

Catalyst Control Center Localization Portuguese

Catalyst Control Center Localization Russian

Catalyst Control Center Localization Spanish

Catalyst Control Center Localization Swedish

ccc-Branding

ccc-core-static

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCleaner

Cisco Connect

Client ActiveX Components

CNET TechTracker

Combined Community Codec Pack 2008-09-21 16:18

Comcast Access

Conexant HDA D330 MDC V.92 Modem

Constant Guard Protection Suite

D3DX10

Dell DataSafe Online

Dell Driver Download Manager

Dell Remote Access

Dell Support Center

Dell System Customization Wizard

Dell Touchpad

DELL Webcam Center

DELL Webcam Manager

Dell Wireless WLAN Card

Dell WUSB

DellSupport

Digital Line Detect

DING!

DivX Converter

DivX Plus DirectShow Filters

DivX Setup

DivX Version Checker

Double Solitaire 2.00

Driver Detective

EasySolve

eMule

Epson Connect

Epson Customer Participation

Epson Download Navigator

Epson Event Manager

Epson FAX Utility

Epson PC-FAX Driver

EPSON Scan

EPSON WorkForce 545 Series Printer Uninstall

EpsonNet Print

Games, Music, & Photos Launcher

Garmin Communicator Plugin

Garmin POI Loader

Garmin USB Drivers

Garmin WebUpdater

Google Chrome

Google Update Helper

GoToAssist 8.0.0.508

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

HyperLoad - Mah Jongg

IrfanView (remove only)

Java 7 Update 11

Java Auto Updater

Junk Mail filter update

K-Lite Mega Codec Pack 4.2.5

Laptop Integrated Webcam Driver (1.04.01.1011)

Live! Cam Avatar v1.0

LTCM Client

Malwarebytes Anti-Malware version 1.70.0.1100

Map Button (Windows Live Toolbar)

Maxtor Manager

Media Player Codec Pack 4.0.2

MediaDirect

Mesh Runtime

Messenger Companion

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Automated Troubleshooting Services Shim

Microsoft Fix it Center

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office Live Add-in 1.5

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Professional 2007

Microsoft Office Professional 2007 Trial

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable - KB2467175

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Modem Diagnostic Tool

Move Media Player

MP3 Rocket

MSVCRT

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Netflix in Windows Media Center

Norton Security Suite

OGA Notifier 2.0.0048.0

OpenCASE Media Agent

OutlookAddinSetup

Picture Package Music Transfer

Pie Auto Updater 1.0

Plex Media Server

PopCap Browser Plugin

Product Documentation Launcher

QuickConnect

QuickSet

RealNetworks - Microsoft Visual C++ 2005 Runtime

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

RealUpgrade 1.1

Revo Uninstaller 1.93

Roxio Creator Audio

Roxio Creator BDAV Plugin

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Drag-to-Disc

Roxio Express Labeler

Roxio MyDVD DE

Roxio Update Manager

Samsung AllShare

SAMSUNG PC Share Manager

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Segoe UI

SigmaTel Audio

Singlesnet

SIW version 2011.09.16

Smart Menus (Windows Live Toolbar)

Sonic Activation Module

Sony Picture Utility

Spotify

Starz Play

swMSM

System Checkup 3.3

The Weather Channel App

The Weather Channel Desktop 6

Trillian

TVTonic

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760586) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

URL Assistant

User's Guides

VC80CRTRedist - 8.0.50727.6195

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

Vuze

Web Games Player Plugin

WebPAM

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live Favorites for Windows Live Toolbar

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Messenger Companion Core

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live OneCare safety scanner

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live Toolbar Extension (Windows Live Toolbar)

Windows Live Toolbar Feed Detector (Windows Live Toolbar)

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Media Player Firefox Plugin

Windows Resource Kit Tools - SubInAcl.exe

WinRAR 4.01 (32-bit)

Wise Disk Cleaner 6.15

Wise PC Engineer 6.4.2

WLTB Custom Buttons

Wootalyzer!

Xfinity TV Downloads Media Manager 2.1.0.97

Xvid MPEG-4 Video Codec

Zoosk Messenger

Zultrax P2P

.

==== End Of File ===========================

Maniac · January 17, 2013

BitTorrent
eMule
Vuze
Zultrax P2P

Please read our policy:

http://forums.malwarebytes.org/index.php?showtopic=97700

kearbear · January 18, 2013

Ok I've unistalled the above programs. What's next?

Maniac · January 18, 2013

Please generate a new fresh DDS log files.

kearbear · January 18, 2013

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.11.2

Run by kearbear at 17:46:21 on 2013-01-18

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3453.1381 [GMT -5:00]

.

AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\System32\WLTRYSVC.EXE

C:\Windows\System32\bcmwltry.exe

C:\Windows\system32\brsvc01a.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\brss01a.exe

C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\aestsrv.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\ATI\WebPAM\jetty\extra\win32\Wrapper.exe

C:\Windows\Explorer.EXE

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\CSHelper.exe

C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe

C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\lxdicoms.exe

C:\Program Files\Maxtor\Sync\SyncServices.exe

C:\Program Files\ATI\WebPAM\_jvm\bin\java.exe

C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\OpenCASE\OpenCASE Media Agent\MediaAgent.exe

C:\Program Files\Comcast\pcTrayApp.exe

C:\Program Files\Epson Software\Event Manager\EEventManager.exe

C:\Program Files\Norton Security Suite\Norton Security Suite\Engine\6.4.0.9\ccSvcHst.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Constant Guard Protection Suite\IDVault.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\Southwest Airlines\Ding\Ding.exe

C:\Program Files\Common Files\Motive\pcCMService.exe

C:\Program Files\Common Files\Motive\pcServiceHost.exe

C:\Windows\system32\STacSV.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Wavexpress\TVTonic\WXRSS.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Common Files\Dell\apache\bin\httpd.exe

C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe

C:\Program Files\Common Files\Dell\apache\bin\httpd.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\UI0Detect.exe

C:\Windows\system32\DllHost.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehRecvr.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Users\kearbear\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe

C:\Windows\System32\calc.exe