Flyer Posted March 14, 2013 ID:656865 Share Posted March 14, 2013 Thank you in advance for the help!! My computer problems started with Microsoft Malicious Software Removal Tool indicating a Trojan in DOS/Alureon.A. Norton scan showed nothing. The first full scan by Malwarebytes showed Trojan.Ransom, two Trojan.Agent, and Heuristics.Reserved.Word.Exploit. After removing them, Malwarebytes quick scan still has the two Trojan.Agent infections. Here are my logs: Malwarebytes Anti-Malware 1.70.0.1100www.malwarebytes.orgDatabase version: v2013.03.13.11Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16521Doug :: DOUG-PC [administrator]3/13/2013 9:52:34 PMmbam-log-2013-03-13 (21-52-34).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 207238Time elapsed: 2 minute(s), 21 second(s)Memory Processes Detected: 1C:\Windows\svchost.exe (Trojan.Agent) -> 3632 -> Delete on reboot.Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 1C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.(end)************************************************************************UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2012-11-20.01).Microsoft Windows 7 Home PremiumBoot Device: \Device\HarddiskVolume2Install Date: 11/25/2011 12:15:31 PMSystem Uptime: 3/13/2013 9:39:58 PM (1 hours ago).Motherboard: ASUSTeK Computer Inc. | | K53EProcessor: Intel® Core i5-2430M CPU @ 2.40GHz | CPU 1 | 2401/100mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 238 GiB total, 167.075 GiB free.D: is FIXED (NTFS) - 333 GiB total, 332.02 GiB free.E: is CDROM ().==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP96: 2/27/2013 12:28:38 PM - Scheduled CheckpointRP97: 2/27/2013 10:47:37 PM - Windows UpdateRP98: 3/7/2013 10:21:19 AM - Scheduled CheckpointRP99: 3/13/2013 10:49:37 AM - Restore OperationRP100: 3/13/2013 11:17:18 AM - Windows UpdateRP101: 3/13/2013 1:26:45 PM - Installed Java 7 Update 17RP102: 3/13/2013 2:12:16 PM - Windows UpdateRP103: 3/13/2013 5:21:35 PM - Installed MSXML 4.0 SP3 ParserRP104: 3/13/2013 9:51:03 PM - Windows Update.==== Installed Programs ======================.??????? Windows Live Mesh ActiveX ??(????)??????? Windows Live Mesh ActiveX ???Adobe AIRAdobe Flash Player 11 ActiveXAdobe Flash Player 11 PluginAdobe Reader X (10.1.6)Adobe Shockwave Player 12.0Alcor Micro USB Card ReaderAnswerWorks 5.0 English RuntimeAntiLogger SDK version 1.4.6.637Apple Application SupportApple Mobile Device SupportApple Software UpdateAsmedia ASM104x USB 3.0 Host Controller DriverASUS AI RecoveryASUS FaceLogonASUS FancyStartASUS LifeFrame3ASUS Live UpdateASUS Power4Gear HybridASUS Splendid Video Enhancement TechnologyASUS Virtual CameraASUS WebStorageAsusScr_K3 Series_ENGAsusVibe2.0Atheros Driver Installation ProgramATK PackageAvanquest updateBing BarBonjourCCleanerConstant Guard Protection SuiteContrôle ActiveX Windows Live Mesh pour connexions à distanceControl ActiveX de Windows Live Mesh para conexiones remotasControlo ActiveX do Windows Live Mesh para Ligações RemotasCyberLink LabelPrintCyberLink Power2GoD3DX10Definition Update for Microsoft Office 2010 (KB982726) 32-Bit EditionFast BootGaleria de Fotografias do Windows LiveGalerie de photos Windows LiveGalería fotográfica de Windows LiveGoogle Toolbar for Internet ExplorerGoogle Update HelperieSpellIntel® Control CenterIntel® Management Engine ComponentsIntel® Processor GraphicsIntel® Turbo Boost Technology Monitor 2.6iTunesJava 7 Update 17Java Auto UpdaterJavaFX 2.1.1Junk Mail filter updateLexmark Pro910 Series UninstallerMalwarebytes Anti-Malware version 1.70.0.1100Mesh RuntimeMicrosoft .NET Framework 4 Client ProfileMicrosoft Application Error ReportingMicrosoft Office 2010Microsoft Office 2010 Service Pack 1 (SP1)Microsoft Office Access MUI (English) 2010Microsoft Office Access Setup Metadata MUI (English) 2010Microsoft Office Excel MUI (English) 2010Microsoft Office Groove MUI (English) 2010Microsoft Office InfoPath MUI (English) 2010Microsoft Office Office 64-bit Components 2010Microsoft Office OneNote MUI (English) 2010Microsoft Office Outlook MUI (English) 2010Microsoft Office PowerPoint MUI (English) 2010Microsoft Office Professional Plus 2010Microsoft Office Proof (English) 2010Microsoft Office Proof (French) 2010Microsoft Office Proof (Spanish) 2010Microsoft Office Proofing (English) 2010Microsoft Office Publisher MUI (English) 2010Microsoft Office Shared 64-bit MUI (English) 2010Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010Microsoft Office Shared MUI (English) 2010Microsoft Office Shared Setup Metadata MUI (English) 2010Microsoft Office Word MUI (English) 2010Microsoft SilverlightMicrosoft SQL Server 2005 Compact Edition [ENU]Microsoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2005 Redistributable (x64)Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319MotoHelper 2.0.51 Driver 5.1.0MotoHelper MergeModulesMotorola Mobile Drivers Installation 5.1.0MSVCRTMSVCRT_amd64MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MSXML 4.0 SP3 ParserMSXML 4.0 SP3 Parser (KB2758694)MyMailList & AddressBookNorton Security SuiteNuance PDF ReaderQuicken 2011Realtek High Definition Audio DriverSavings Bond WizardSecunia PSI (3.0.0.6005)Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit EditionSecurity Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit EditionSecurity Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit EditionSecurity Update for Microsoft InfoPath 2010 (KB2687436) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2553091)Security Update for Microsoft Office 2010 (KB2553096)Security Update for Microsoft Office 2010 (KB2553371) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2553447) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2589320) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2598243) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2687501) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2687510) 32-Bit EditionSecurity Update for Microsoft OneNote 2010 (KB2760600) 32-Bit EditionSecurity Update for Microsoft Visio 2010 (KB2760762) 32-Bit EditionSecurity Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit EditionSecurity Update for Microsoft Word 2010 (KB2760410) 32-Bit EditionSkype™ 5.10Sonic FocusswMSMSynaptics Pointing Device Driversyncables desktop SETurboTax 2011TurboTax 2011 WinPerFedFormsetTurboTax 2011 WinPerReleaseEngineTurboTax 2011 WinPerTaxSupportTurboTax 2011 wpaiperTurboTax 2011 wrapperUpdate for Microsoft .NET Framework 4 Client Profile (KB2468871)Update for Microsoft .NET Framework 4 Client Profile (KB2533523)Update for Microsoft .NET Framework 4 Client Profile (KB2600217)Update for Microsoft Office 2010 (KB2494150)Update for Microsoft Office 2010 (KB2553065)Update for Microsoft Office 2010 (KB2553092)Update for Microsoft Office 2010 (KB2553181) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2553267) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2553310) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2553378) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2566458)Update for Microsoft Office 2010 (KB2596964) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2598242) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2687503) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2687509) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2760631) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2767886) 32-Bit EditionUpdate for Microsoft OneNote 2010 (KB2553290) 32-Bit EditionUpdate for Microsoft Outlook 2010 (KB2597090) 32-Bit EditionUpdate for Microsoft Outlook 2010 (KB2687623) 32-Bit EditionUpdate for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit EditionUpdate for Microsoft PowerPoint 2010 (KB2598240) 32-Bit EditionUpdate for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit EditionWBid 3.2WebExWindows LiveWindows Live ???Windows Live ????Windows Live Communications PlatformWindows Live EssentialsWindows Live Family SafetyWindows Live ID Sign-in AssistantWindows Live InstallerWindows Live Language SelectorWindows Live MailWindows Live MeshWindows Live Mesh ActiveX Control for Remote ConnectionsWindows Live MessengerWindows Live MIME IFilterWindows Live Movie MakerWindows Live Photo CommonWindows Live Photo GalleryWindows Live PIMT PlatformWindows Live Remote ClientWindows Live Remote Client ResourcesWindows Live Remote ServiceWindows Live Remote Service ResourcesWindows Live SOXEWindows Live SOXE DefinitionsWindows Live UX PlatformWindows Live UX Platform Language PackWindows Live WriterWindows Live Writer ResourcesWinFlashWireless Console 3.==== Event Viewer Messages From Past Week ========.3/9/2013 9:21:51 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer CAROL-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C0169C22-33C2-41BA-9751-7F8B714FCAD1}. The master browser is stopping or an election is being forced.3/9/2013 2:04:47 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MACBOOKPRO-73AD that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C0169C22-33C2-41BA-9751-7F8B714FCAD1}. The master browser is stopping or an election is being forced.3/9/2013 11:20:14 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer BOB-NETBOOK that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C0169C22-33C2-41BA-9751-7F8B714FCAD1}. The master browser is stopping or an election is being forced.3/7/2013 5:59:56 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the N360 service.3/7/2013 10:44:30 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer PC116878316169 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C0169C22-33C2-41BA-9751-7F8B714FCAD1}. The master browser is stopping or an election is being forced.3/13/2013 9:43:18 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.3/13/2013 9:41:02 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the CGPS Service service to connect.3/13/2013 9:41:02 PM, Error: Service Control Manager [7000] - The CGPS Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.3/13/2013 4:54:54 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.3/13/2013 4:54:54 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.3/13/2013 12:01:56 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} and APPID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Doug-PC\Doug SID (S-1-5-21-3448050219-1623176915-1739974279-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.3/13/2013 11:57:40 AM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.3/13/2013 11:56:15 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..3/13/2013 11:31:15 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.3/10/2013 1:27:58 AM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10..==== End Of File ===========================DDS (Ver_2012-11-20.01) - NTFS_AMD64Internet Explorer: 10.0.9200.16521 BrowserJavaVersion: 10.17.2Run by Doug at 22:06:34 on 2013-03-13Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5921.3520 [GMT -4:00].AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}.============== Running Processes ===============.C:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k GPSvcGroupC:\Windows\system32\svchost.exe -k NetworkServiceC:\Program Files (x86)\ASUS\FaceLogon\smartlogon.exeC:\Windows\system32\FBAgent.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exeC:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exeC:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXEC:\Windows\system32\taskeng.exeC:\Program Files\ASUS\P4G\BatteryLife.exeC:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exeC:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exeC:\Windows\system32\taskeng.exeC:\Program Files (x86)\Secunia\PSI\PSIA.exeC:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exeC:\Program Files (x86)\ASUS\Splendid\ACMON.exeC:\Windows\SysWOW64\ACEngSvr.exeC:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exeC:\Windows\AsScrPro.exeC:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe\\.\globalroot\systemroot\svchost.exe -netsvcsC:\Windows\System32\rundll32.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exeC:\Program Files\Realtek\Audio\HDA\RAVBg64.exeC:\Program Files (x86)\Lexmark Pro910 Series\LMADJmon.exeC:\Windows\System32\igfxtray.exeC:\Windows\System32\hkcmd.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files (x86)\Lexmark\ErrorApp\lmab1err.exeC:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exeC:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exeC:\Program Files (x86)\Secunia\PSI\psi_tray.exeC:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exeC:\Program Files\Intel\TurboBoost\SignalIslandUi.exeD:\iTunesHelper.exeC:\Windows\system32\SearchIndexer.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Program Files\Intel\TurboBoost\TurboBoost.exeC:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\Macromed\Flash\FlashUtil64_11_6_602_180_ActiveX.exeC:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\System32\cscript.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.foxnews.com/uDefault_Page_URL = hxxp://asus.msn.commWinlogon: Userinit = userinit.exe,BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dllBHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ips\ipsbho.dllBHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLLBHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dllBHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLLBHO: Constant Guard Protection Suite: {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.13.111.1\NativeBHO.dllBHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dllTB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dlluRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunuRun: [LMab1err] "C:\Program Files (x86)\Lexmark\ErrorApp\LMab1err.exe"uRun: [LMADJmon] "C:\Program Files (x86)\Lexmark Pro910 Series\LMADJmon.exe"mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe /SmRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exemRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exemRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exemRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServicesmRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exemRun: [LMADJmon] "C:\Program Files (x86)\Lexmark Pro910 Series\LMADJmon.exe"mRun: [iTunesHelper] "D:\iTunesHelper.exe"mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"StartupFolder: C:\Users\Doug\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\INTEL(~1.LNK - C:\Program Files\Intel\TurboBoost\SignalIslandUi.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CONSTA~1.LNK - C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SECUNI~1.LNK - C:\Program Files (x86)\Secunia\PSI\psi_tray.exeuPolicies-Explorer: NoDriveAutoRun = dword:0mPolicies-Explorer: NoActiveDesktop = dword:1mPolicies-Explorer: NoActiveDesktopChanges = dword:1mPolicies-System: ConsentPromptBehaviorAdmin = dword:5mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableUIADesktopToggle = dword:0IE: &ieSpell Options - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTMIE: Check &Spelling - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTMIE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000IE: Lookup on Merriam Webster - C:\Program Files (x86)\ieSpell\Merriam Webster.HTMIE: Lookup on Wikipedia - C:\Program Files (x86)\ieSpell\wikipedia.HTMIE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTMIE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTMIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllDPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cabDPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabTCP: NameServer = 75.75.76.76 75.75.75.75TCP: Interfaces\{C0169C22-33C2-41BA-9751-7F8B714FCAD1} : DHCPNameServer = 75.75.76.76 75.75.75.75TCP: Interfaces\{C0169C22-33C2-41BA-9751-7F8B714FCAD1}\132303 : DHCPNameServer = 192.168.2.1 75.75.75.75 75.75.76.76TCP: Interfaces\{C0169C22-33C2-41BA-9751-7F8B714FCAD1}\37771696E6475627E65647 : DHCPNameServer = 12.127.16.68 12.127.17.72TCP: Interfaces\{C0169C22-33C2-41BA-9751-7F8B714FCAD1}\44271676F6E6 : DHCPNameServer = 192.168.2.1Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dllHandler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dllAppInit_DLLs= C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLLSSODL: WebCheck - <orphaned>SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLLx64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllx64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dllx64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLLx64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dllx64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exex64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exex64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exex64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3x64-Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"x64-Run: [LMADJmon] "C:\Program Files (x86)\Lexmark Pro910 Series\LMADJmon.exe"x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exex64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exex64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLx64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>x64-Notify: igfxcui - igfxdev.dllx64-SSODL: WebCheck - <orphaned>.============= SERVICES / DRIVERS ===============.R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1402000.013\symds64.sys [2013-2-12 493216]R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\1402000.013\symefa64.sys [2013-2-12 1133216]R1 AntiLog32;AntiLog32;C:\Windows\System32\drivers\AntiLog64.sys [2013-1-29 45968]R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-5-25 17536]R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [2013-3-5 1388120]R1 ccSet_N360;Norton Security Suite Settings Manager;C:\Windows\System32\drivers\N360x64\1402000.013\ccsetx64.sys [2013-2-12 168096]R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130312.001_301\IDSviA64.sys [2013-3-12 513184]R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1402000.013\ironx64.sys [2013-2-12 224416]R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\1402000.013\symnets.sys [2013-2-12 432800]R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-10-30 379520]R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-8-25 13672]R2 MotoHelper;MotoHelper Service;C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-4-26 223088]R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccsvchst.exe [2013-2-12 143928]R2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2013-2-7 1223704]R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2010-11-29 16168]R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-10-30 2656280]R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-10-3 129512]R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-10-3 394728]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-13 138912]R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-7-6 317440]R3 keycrypt;keycrypt;C:\Windows\System32\drivers\KeyCrypt64.sys [2013-1-29 26448]R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-7-6 169584]R3 PSI;PSI;C:\Windows\System32\drivers\psi_mf_amd64.sys [2013-2-7 18456]R3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.6;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2012-5-30 149544]R3 WSDScan;WSD Scan Support via UMB;C:\Windows\System32\drivers\WSDScan.sys [2009-7-13 25088]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 IDVaultSvc;CGPS Service;C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe [2013-1-14 66600]S2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2013-2-7 660504]S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-3-2 183560]S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-4-2 48488]S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-3-13 19456]S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-3-13 57856]S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-3-13 30208]S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-11-29 1255736]S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184].=============== Created Last 30 ================.2013-03-14 01:41:28 20480 ------w- C:\Windows\svchost.exe2013-03-13 19:21:28 -------- d-----w- C:\Users\Doug\AppData\Roaming\Malwarebytes2013-03-13 19:20:36 -------- d-----w- C:\ProgramData\Malwarebytes2013-03-13 19:20:35 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys2013-03-13 19:20:35 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2013-03-13 19:20:13 -------- d-----w- C:\Users\Doug\AppData\Local\Programs2013-03-13 19:07:56 -------- d-----w- C:\Users\Doug\AppData\Local\Secunia PSI2013-03-13 19:07:50 -------- d-----w- C:\Program Files (x86)\Secunia2013-03-13 18:15:06 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui2013-03-13 18:15:04 15360 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll2013-03-13 18:15:04 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll2013-03-13 18:15:04 13312 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe2013-03-13 18:03:09 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys2013-03-13 17:28:00 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll2013-03-13 15:51:10 -------- d-----w- C:\Users\Doug\AppData\Local\NPE2013-03-13 03:00:23 7680 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\A14D.tmp2013-03-13 03:00:23 7680 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\A14C.tmp2013-02-22 16:16:49 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF692013-02-22 16:16:49 -------- d-----w- C:\Program Files\iTunes2013-02-22 16:16:49 -------- d-----w- C:\Program Files\iPod2013-02-13 03:27:55 25600 ----a-w- C:\Windows\SysWow64\setup16.exe2013-02-13 03:27:55 215040 ----a-w- C:\Windows\System32\winsrv.dll2013-02-13 03:27:55 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll2013-02-13 03:27:54 7680 ----a-w- C:\Windows\SysWow64\instnm.exe2013-02-13 03:27:54 5120 ----a-w- C:\Windows\SysWow64\wow32.dll2013-02-13 03:27:54 2048 ----a-w- C:\Windows\SysWow64\user.exe2013-02-13 03:27:46 5553512 ----a-w- C:\Windows\System32\ntoskrnl.exe2013-02-13 03:27:46 3967848 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe2013-02-13 03:27:44 3913064 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe2013-02-13 03:27:42 288088 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS2013-02-13 03:27:42 1913192 ----a-w- C:\Windows\System32\drivers\tcpip.sys2013-02-13 03:27:41 3153408 ----a-w- C:\Windows\System32\win32k.sys2013-02-12 16:03:31 432800 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\symnets.sys2013-02-12 16:03:31 23448 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\symelam.sys2013-02-12 16:03:30 776864 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\srtsp64.sys2013-02-12 16:03:30 493216 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\symds64.sys2013-02-12 16:03:30 37496 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\srtspx64.sys2013-02-12 16:03:30 224416 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\ironx64.sys2013-02-12 16:03:30 168096 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\ccsetx64.sys2013-02-12 16:03:30 1133216 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\symefa64.sys2013-02-12 16:03:05 -------- d-----w- C:\Windows\System32\drivers\N360x64\1402000.013.==================== Find3M ====================.2013-03-14 01:40:37 45056 ----a-w- C:\Windows\SysWow64\acovcnt.exe2013-03-13 17:59:09 73432 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2013-03-13 17:59:09 693976 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe2013-03-13 17:27:45 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll2013-03-13 17:27:45 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll2013-02-12 05:45:24 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll2013-02-12 05:45:22 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll2013-02-12 05:45:22 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll2013-02-12 05:45:22 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll2013-02-12 04:48:31 474112 ----a-w- C:\Windows\apppatch\AcSpecfc.dll2013-02-12 04:48:26 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll2013-02-10 19:12:56 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS2013-02-07 12:15:22 18456 ----a-w- C:\Windows\System32\drivers\psi_mf_amd64.sys2013-01-29 16:59:23 45968 ----a-w- C:\Windows\System32\drivers\AntiLog64.sys2013-01-13 21:17:03 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll2013-01-13 21:17:02 2560 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll2013-01-13 21:16:42 10752 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll2013-01-13 21:12:46 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll2013-01-13 21:11:21 4096 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll2013-01-13 21:11:08 5632 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll2013-01-13 21:11:07 5632 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll2013-01-13 21:11:07 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll2013-01-13 21:11:07 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll2013-01-13 20:35:31 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll2013-01-13 20:35:31 2560 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll2013-01-13 20:35:18 10752 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll2013-01-13 20:32:07 3584 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll2013-01-13 20:31:48 4096 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll2013-01-13 20:31:41 5632 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll2013-01-13 20:31:40 5632 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll2013-01-13 20:31:40 3072 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll2013-01-13 20:31:40 3072 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll2013-01-13 20:31:00 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll2013-01-13 20:22:22 1988096 ----a-w- C:\Windows\SysWow64\d3d10warp.dll2013-01-13 20:20:31 293376 ----a-w- C:\Windows\SysWow64\dxgi.dll2013-01-13 20:09:00 249856 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll2013-01-13 20:08:43 220160 ----a-w- C:\Windows\SysWow64\d3d10core.dll2013-01-13 20:08:35 1504768 ----a-w- C:\Windows\SysWow64\d3d11.dll2013-01-13 19:59:04 1643520 ----a-w- C:\Windows\System32\DWrite.dll2013-01-13 19:58:28 1175552 ----a-w- C:\Windows\System32\FntCache.dll2013-01-13 19:54:01 604160 ----a-w- C:\Windows\SysWow64\d3d10level9.dll2013-01-13 19:53:58 207872 ----a-w- C:\Windows\SysWow64\WindowsCodecsExt.dll2013-01-13 19:53:14 187392 ----a-w- C:\Windows\SysWow64\UIAnimation.dll2013-01-13 19:51:30 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll2013-01-13 19:49:17 363008 ----a-w- C:\Windows\System32\dxgi.dll2013-01-13 19:48:47 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll2013-01-13 19:46:25 1080832 ----a-w- C:\Windows\SysWow64\d3d10.dll2013-01-13 19:43:21 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll2013-01-13 19:38:39 333312 ----a-w- C:\Windows\System32\d3d10_1core.dll2013-01-13 19:38:32 1887232 ----a-w- C:\Windows\System32\d3d11.dll2013-01-13 19:38:21 296960 ----a-w- C:\Windows\System32\d3d10core.dll2013-01-13 19:37:57 3419136 ----a-w- C:\Windows\SysWow64\d2d1.dll2013-01-13 19:25:04 245248 ----a-w- C:\Windows\System32\WindowsCodecsExt.dll2013-01-13 19:24:33 648192 ----a-w- C:\Windows\System32\d3d10level9.dll2013-01-13 19:24:30 221184 ----a-w- C:\Windows\System32\UIAnimation.dll2013-01-13 19:20:42 194560 ----a-w- C:\Windows\System32\d3d10_1.dll2013-01-13 19:20:04 1238528 ----a-w- C:\Windows\System32\d3d10.dll2013-01-13 19:15:40 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll2013-01-13 19:10:36 3928064 ----a-w- C:\Windows\System32\d2d1.dll2013-01-13 19:02:06 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll2013-01-13 18:34:58 364544 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll2013-01-13 18:32:43 465920 ----a-w- C:\Windows\System32\WMPhoto.dll2013-01-13 18:09:52 522752 ----a-w- C:\Windows\System32\XpsGdiConverter.dll2013-01-13 17:26:42 1158144 ----a-w- C:\Windows\SysWow64\XpsPrint.dll2013-01-13 17:05:09 1682432 ----a-w- C:\Windows\System32\XpsPrint.dll2013-01-06 01:39:44 7369552 ----a-w- C:\Windows\SysWow64\ZALSDKCore.dll2013-01-06 01:39:40 26448 ----a-w- C:\Windows\System32\drivers\KeyCrypt64.sys2013-01-04 06:11:21 2284544 ----a-w- C:\Windows\SysWow64\msmpeg2vdec.dll2013-01-04 06:11:13 2776576 ----a-w- C:\Windows\System32\msmpeg2vdec.dll2013-01-04 04:43:21 44032 ----a-w- C:\Windows\apppatch\acwow64.dll2012-12-16 17:11:22 46080 ----a-w- C:\Windows\System32\atmlib.dll2012-12-16 14:45:03 367616 ----a-w- C:\Windows\System32\atmfd.dll2012-12-16 14:13:28 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll2012-12-16 14:13:20 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll.============= FINISH: 22:06:55.35 =============== Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:656871 Share Posted March 14, 2013 Welcome to the forum.Please remove any usb or external drives from the computer before you run this scan!Please download and run RogueKiller to your desktop.RogueKiller<---use this one for 64 bit systemsQuit all running programs.For Windows XP, double-click to start.For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.Click Scan to scan the system.When the scan completes > Close out the program > Don't Fix anything!Don't run any other options, they're not all bad!!!!!!!Post back the report which should be located on your desktop.(please don't put logs in code or quotes)P2P Warning:If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.MrCNote:Removing malware can be unpredictable...things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.<+>The removal of malware isn't instantaneous, please be patient.<+>Please stick with me until I give you the "all clear".------->Your topic will be closed if you haven't replied within 3 days!<--------(If I don't respond within 24 hours, please send me a PM) Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:656880 Share Posted March 14, 2013 MrC, I have run RogueKiller twice but each time it stopped working at about 80% through the scan. Suggestions? Thank you! Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:656966 Share Posted March 14, 2013 Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.Download Malwarebytes Anti-Rootkit from HEREUnzip the contents to a folder in a convenient location.Open the folder where the contents were unzipped and run mbar.exeFollow the instructions in the wizard to update and allow the program to scan your computer for threats.Click on the Cleanup button to remove any threats and reboot if prompted to do so.Wait while the system shuts down and the cleanup process is performed.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txtTo attach a log if needed:Bottom right corner of this page.New window that comes up.~~~~~~~~~~~~~~~~~~~~~~~Note:If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:Internet accessWindows UpdateWindows FirewallIf there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.Verify that your system is now functioning normally.MrC Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:656991 Share Posted March 14, 2013 MrC, I ran Malwarebytes AntiRootKit through and it found 5 issues. After cleanup, the scan went through clean. Thank You!! Here are the logs: Malwarebytes Anti-Rootkit BETA 1.01.0.1021www.malwarebytes.orgDatabase version: v2013.03.14.06Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16521Doug :: DOUG-PC [administrator]3/14/2013 9:18:56 AMmbar-log-2013-03-14 (09-18-56).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2PScan options disabled:Objects scanned: 30256Time elapsed: 7 minute(s), 54 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end) ---------------------------------------Malwarebytes Anti-Rootkit BETA 1.01.0.1021© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16521File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.394000 GHzMemory total: 6208765952, free: 3947778048------------ Kernel report ------------ 03/14/2013 08:48:28------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\drivers\compbatt.sys\SystemRoot\system32\drivers\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\system32\drivers\pciide.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\DRIVERS\iaStor.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\N360x64\1402000.013\SYMDS64.SYS\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\system32\drivers\N360x64\1402000.013\SYMEFA64.SYS\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\drivers\disk.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\system32\drivers\N360x64\1402000.013\ccSetx64.sys\SystemRoot\system32\drivers\N360x64\1402000.013\Ironx64.SYS\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\drivers\afd.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\DRIVERS\termdd.sys\SystemRoot\System32\Drivers\N360x64\1402000.013\SYMNETS.SYS\??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS\SystemRoot\system32\drivers\N360x64\1402000.013\SRTSPX64.SYS\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\DRIVERS\mssmbios.sys\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130312.001_301\IDSvia64.sys\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys\??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys\??\C:\Windows\system32\drivers\AntiLog64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\DRIVERS\HECIx64.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\DRIVERS\HDAudBus.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\asmtxhci.sys\SystemRoot\system32\DRIVERS\L1C62x64.sys\SystemRoot\system32\DRIVERS\i8042prt.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\kbfiltr.sys\SystemRoot\system32\DRIVERS\KeyCrypt64.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\wmiacpi.sys\SystemRoot\system32\DRIVERS\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\swenum.sys\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\system32\DRIVERS\asmthub3.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\DRIVERS\TurboB.sys\??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\DRIVERS\psi_mf_amd64.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\system32\DRIVERS\WSDScan.sys\SystemRoot\system32\DRIVERS\WSDPrint.sys\SystemRoot\system32\drivers\spsys.sys\SystemRoot\System32\Drivers\N360x64\1402000.013\SRTSP64.SYS\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130313.034_327\EX64.SYS\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130313.034_327\ENG64.SYS\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8008862060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa8006150050Lower Device Driver Name: \00000385\Driver name found: iaStorInitialization returned 0x0Load Function returned 0x0Downloaded database version: v2013.03.14.06Initializing...Done!<<<2>>>Device number: 0, partition: 2Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8008862060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8008862b90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8008862060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800614c950, DeviceName: Unknown, DriverName: \Driver\ACPI\DevicePointer: 0xfffffa8006150050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \00000385\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a0115fae40, 0xfffffa8008862060, 0xfffffa8009f65790Lower DeviceData: 0xfffff8a00390bed0, 0xfffffa8006150050, 0xfffffa800b356b40<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...MBR buffers are not equalMBR is forged! [5b875a22f8ce39ec096216471c83be3f]Inspecting partition table:MBR Signature: 55AADisk Signature: 496B9619Partition information: Partition 0 type is Empty (0x0) Partition is ACTIVE. Partition starts at LBA: 49 Numsec = 0 Partition is not bootableInfected: VBR on Empty active partition --> [Rootkit.Pihar.c.MBR]Changing partition to empty and not active. New active partition is 1 on drive 0 ... Partition 0 type is Other (0x1c) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 52428800 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 52430848 Numsec = 500105216 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 552536064 Numsec = 697724928 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0MBR infection found on drive 0Disk Size: 640135028736 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-48-1250243728-1250263728)...Done!Performing system, memory and registry scan...Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\instance.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\wbs32r4.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{B6F51C26-F607-4368-B770-CC88664AFAF3}\installedupdates.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\instance.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\wbs32r4.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{B6F51C26-F607-4368-B770-CC88664AFAF3}\installedupdates.dat" is compressed (flags = 1)Infected: c:\Windows\svchost.exe --> [Trojan.Agent]Infected: c:\Windows\svchost.exe --> [Trojan.Agent]Done!Scan finishedCreating System Restore point...Scheduling clean up...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesBCD Entry for BOOTEMS is missingMalicious Entry 26000022 for BOOTEMS present!Removal scheduling successful. System shutdown needed.System shutdown occurred=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.01.0.1021© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16521File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.394000 GHzMemory total: 6208765952, free: 4733620224Removal queue found; removal startedRemoving c:\Windows\svchost.exe...Removal finished=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.01.0.1021© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16521File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.394000 GHzMemory total: 6208765952, free: 4154159104------------ Kernel report ------------ 03/14/2013 09:10:50------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\drivers\compbatt.sys\SystemRoot\system32\drivers\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\system32\drivers\pciide.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\DRIVERS\iaStor.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\N360x64\1402000.013\SYMDS64.SYS\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\system32\drivers\N360x64\1402000.013\SYMEFA64.SYS\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\drivers\disk.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\system32\drivers\N360x64\1402000.013\ccSetx64.sys\SystemRoot\system32\drivers\N360x64\1402000.013\Ironx64.SYS\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\drivers\afd.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\DRIVERS\termdd.sys\SystemRoot\System32\Drivers\N360x64\1402000.013\SYMNETS.SYS\??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS\SystemRoot\system32\drivers\N360x64\1402000.013\SRTSPX64.SYS\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\DRIVERS\mssmbios.sys\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130312.001_301\IDSvia64.sys\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys\??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys\??\C:\Windows\system32\drivers\AntiLog64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\DRIVERS\HECIx64.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\DRIVERS\HDAudBus.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\asmtxhci.sys\SystemRoot\system32\DRIVERS\L1C62x64.sys\SystemRoot\system32\DRIVERS\i8042prt.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\kbfiltr.sys\SystemRoot\system32\DRIVERS\KeyCrypt64.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\wmiacpi.sys\SystemRoot\system32\DRIVERS\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\swenum.sys\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\system32\DRIVERS\asmthub3.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\DRIVERS\TurboB.sys\??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\DRIVERS\psi_mf_amd64.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\System32\Drivers\N360x64\1402000.013\SRTSP64.SYS\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130313.034_327\EX64.SYS\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130313.034_327\ENG64.SYS\SystemRoot\system32\DRIVERS\WSDScan.sys\SystemRoot\system32\DRIVERS\WSDPrint.sys\SystemRoot\system32\drivers\spsys.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\rpcrt4.dll\Windows\System32\sechost.dll\Windows\System32\oleaut32.dll\Windows\System32\ole32.dll\Windows\System32\gdi32.dll\Windows\System32\shlwapi.dll\Windows\System32\imagehlp.dll\Windows\System32\shell32.dll\Windows\System32\user32.dll\Windows\System32\comdlg32.dll\Windows\System32\normaliz.dll\Windows\System32\ws2_32.dll\Windows\System32\difxapi.dll\Windows\System32\clbcatq.dll\Windows\System32\imm32.dll\Windows\System32\urlmon.dll\Windows\System32\psapi.dll\Windows\System32\lpk.dll\Windows\System32\Wldap32.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8008845060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa80062af050Lower Device Driver Name: \Driver\iaStor\Driver name found: iaStorInitialization returned 0x0Load Function returned 0x0Initializing...Done!<<<2>>>Device number: 0, partition: 2Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8008845060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8006471960, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8008845060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8006129430, DeviceName: Unknown, DriverName: \Driver\ACPI\DevicePointer: 0xfffffa80062af050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a01908d9f0, 0xfffffa8008845060, 0xfffffa800634a790Lower DeviceData: 0xfffff8a0193b4710, 0xfffffa80062af050, 0xfffffa8008822d40<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 496B9619Partition information: Partition 0 type is Other (0x1c) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 52428800 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 52430848 Numsec = 500105216 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 552536064 Numsec = 697724928 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 640135028736 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-2047-1250243728-1250263728)...Done!Performing system, memory and registry scan...Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\instance.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\wbs32r4.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{B6F51C26-F607-4368-B770-CC88664AFAF3}\installedupdates.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\instance.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{1507AEB7-F358-4CEC-912F-4591044CC7FC}\wbs32r4.dat" is compressed (flags = 1)Read File: File "c:\ProgramData\{B6F51C26-F607-4368-B770-CC88664AFAF3}\installedupdates.dat" is compressed (flags = 1)Done!Scan finished======================================= Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:656992 Share Posted March 14, 2013 OK, we have more to do, this should come up clean:Please read the directions carefully so you don't end up deleting something that is good!!If in doubt about an entry....please ask or choose Skip!!!!Don't Delete anything unless instructed to!If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on ContinueIf a suspicious object is detected, the default action will be Skip, click on ContinuePlease note that TDSSKiller can be run in safe mode if needed.Here's a video that explains how to run it if needed: Please download the latest version of TDSSKiller from here and save it to your Desktop.Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.Put a checkmark beside loaded modules.A reboot will be needed to apply the changes. Do it.TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.Then click on Change parameters in TDSSKiller.Check all boxes then click OK.Click the Start Scan button.The scan should take no longer than 2 minutes.If a suspicious object is detected, the default action will be Skip, click on Continue.Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.If in doubt about an entry....please ask or choose SkipIf malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.Here's a summary of what to do if you would like to print it out:If in doubt about an entry....please ask or choose SkipDon't Delete anything unless instructed to!If a suspicious object is detected, the default action will be Skip, click on ContinueIf you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please chooseSkip and click on ContinueAny entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.If malicious objects are found, they will show in the Scan results and offer three (3) options.Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.~~~~~~~~~~~~~~~~~~~~You can attach the logs if they're too long:Bottom right corner of this page.New window that comes up.MrC Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:657019 Share Posted March 14, 2013 MrC, I ran the scan as directed and it did not find any problems...clean scan. Here are the two logs (second one is attached due to its size): 09:56:33.0611 6324 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:4209:56:34.0135 6324 ============================================================09:56:34.0135 6324 Current date / time: 2013/03/14 09:56:34.013509:56:34.0135 6324 SystemInfo:09:56:34.0135 632409:56:34.0135 6324 OS Version: 6.1.7601 ServicePack: 1.009:56:34.0135 6324 Product type: Workstation09:56:34.0135 6324 ComputerName: DOUG-PC09:56:34.0138 6324 UserName: Doug09:56:34.0138 6324 Windows directory: C:\Windows09:56:34.0138 6324 System windows directory: C:\Windows09:56:34.0138 6324 Running under WOW6409:56:34.0138 6324 Processor architecture: Intel x6409:56:34.0138 6324 Number of processors: 409:56:34.0138 6324 Page size: 0x100009:56:34.0138 6324 Boot type: Normal boot09:56:34.0138 6324 ============================================================09:56:34.0569 6324 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x0000004009:56:34.0571 6324 ============================================================09:56:34.0571 6324 \Device\Harddisk0\DR0:09:56:34.0571 6324 MBR partitions:09:56:34.0571 6324 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3200800, BlocksNum 0x1DCF000009:56:34.0571 6324 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x20EF0800, BlocksNum 0x2996700009:56:34.0571 6324 ============================================================09:56:34.0619 6324 C: <-> \Device\Harddisk0\DR0\Partition109:56:34.0659 6324 D: <-> \Device\Harddisk0\DR0\Partition209:56:34.0659 6324 ============================================================09:56:34.0659 6324 Initialize success09:56:34.0659 6324 ============================================================09:59:42.0554 6312 Deinitialize successTDSSKiller.2.8.16.0_14.03.2013_10.02.48_log.txt Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:657022 Share Posted March 14, 2013 Well Done, lets run ComboFix to clear up any leftovers.Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingcomputer.com/combofix/how-to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:657041 Share Posted March 14, 2013 MrC, ComboFix is complete. I don't think it found any problems. Here is the log file: ComboFix 13-03-14.02 - Doug 03/14/2013 10:48:01.1.4 - x64Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5921.3914 [GMT -4:00]Running from: c:\users\Doug\Desktop\ComboFix.exeAV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\programdata\Microsoft\Windows\DRM\A14C.tmpc:\programdata\Microsoft\Windows\DRM\A14D.tmpc:\windows\msvcr71.dll..((((((((((((((((((((((((( Files Created from 2013-02-14 to 2013-03-14 )))))))))))))))))))))))))))))))..2013-03-14 14:51 . 2013-03-14 14:51 -------- d-----w- c:\users\Default\AppData\Local\temp2013-03-13 19:21 . 2013-03-13 19:21 -------- d-----w- c:\users\Doug\AppData\Roaming\Malwarebytes2013-03-13 19:20 . 2013-03-13 19:20 -------- d-----w- c:\programdata\Malwarebytes2013-03-13 19:20 . 2013-03-13 19:20 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware2013-03-13 19:20 . 2012-12-14 20:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys2013-03-13 19:20 . 2013-03-13 19:20 -------- d-----w- c:\users\Doug\AppData\Local\Programs2013-03-13 19:07 . 2013-03-13 19:07 -------- d-----w- c:\users\Doug\AppData\Local\Secunia PSI2013-03-13 19:07 . 2013-03-13 19:07 -------- d-----w- c:\program files (x86)\Secunia2013-03-13 18:15 . 2012-08-23 15:09 3072 ----a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui2013-03-13 18:15 . 2012-08-23 13:41 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe2013-03-13 18:15 . 2012-08-23 13:40 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll2013-03-13 18:15 . 2012-08-23 13:24 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll2013-03-13 18:03 . 2013-02-12 04:12 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys2013-03-13 17:28 . 2013-03-13 17:27 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll2013-03-13 17:27 . 2013-03-13 17:27 -------- d-----w- c:\program files (x86)\Java2013-03-13 15:51 . 2013-03-13 16:06 -------- d-----w- c:\users\Doug\AppData\Local\NPE2013-03-13 15:20 . 2013-03-13 15:20 -------- d-----w- c:\program files\Microsoft Silverlight2013-03-13 15:20 . 2013-03-13 15:20 -------- d-----w- c:\program files (x86)\Microsoft Silverlight2013-02-22 16:16 . 2013-02-22 16:17 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF692013-02-22 16:16 . 2013-02-22 16:16 -------- d-----w- c:\program files\iTunes2013-02-22 16:16 . 2013-02-22 16:16 -------- d-----w- c:\program files\iPod2013-02-13 03:27 . 2013-01-04 05:46 215040 ----a-w- c:\windows\system32\winsrv.dll2013-02-13 03:27 . 2013-01-04 02:47 25600 ----a-w- c:\windows\SysWow64\setup16.exe2013-02-13 03:27 . 2013-01-04 02:47 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll2013-02-13 03:27 . 2013-01-04 04:51 5120 ----a-w- c:\windows\SysWow64\wow32.dll2013-02-13 03:27 . 2013-01-04 02:47 7680 ----a-w- c:\windows\SysWow64\instnm.exe2013-02-13 03:27 . 2013-01-04 02:47 2048 ----a-w- c:\windows\SysWow64\user.exe2013-02-13 03:27 . 2013-01-05 05:53 5553512 ----a-w- c:\windows\system32\ntoskrnl.exe2013-02-13 03:27 . 2013-01-05 05:00 3967848 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe2013-02-13 03:27 . 2013-01-05 05:00 3913064 ----a-w- c:\windows\SysWow64\ntoskrnl.exe2013-02-13 03:27 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys2013-02-13 03:27 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS2013-02-13 03:27 . 2013-01-04 03:26 3153408 ----a-w- c:\windows\system32\win32k.sys2013-02-12 16:03 . 2013-02-13 03:37 -------- d-----w- c:\windows\system32\drivers\N360x64\1402000.013...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-03-14 13:01 . 2011-11-25 17:16 45056 ----a-w- c:\windows\SysWow64\acovcnt.exe2013-03-13 17:59 . 2012-04-11 12:48 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2013-03-13 17:59 . 2011-12-06 13:56 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2013-03-13 17:27 . 2012-07-12 13:05 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll2013-03-13 17:27 . 2012-01-02 17:34 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll2013-03-13 15:25 . 2011-11-29 18:00 72013344 ----a-w- c:\windows\system32\MRT.exe2013-02-12 05:45 . 2013-03-13 16:50 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll2013-02-12 05:45 . 2013-03-13 16:50 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll2013-02-12 05:45 . 2013-03-13 16:50 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll2013-02-12 05:45 . 2013-03-13 16:50 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll2013-02-12 04:48 . 2013-03-13 16:50 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll2013-02-12 04:48 . 2013-03-13 16:50 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll2013-02-10 19:12 . 2011-11-25 20:02 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS2013-02-07 12:15 . 2013-02-07 12:15 18456 ----a-w- c:\windows\system32\drivers\psi_mf_amd64.sys2013-01-29 16:59 . 2013-01-29 16:59 45968 ----a-w- c:\windows\system32\drivers\AntiLog64.sys2013-01-06 01:39 . 2013-01-29 16:59 7369552 ----a-w- c:\windows\SysWow64\ZALSDKCore.dll2013-01-06 01:39 . 2013-01-29 16:59 26448 ----a-w- c:\windows\system32\drivers\KeyCrypt64.sys2013-01-04 04:43 . 2013-02-13 03:27 44032 ----a-w- c:\windows\apppatch\acwow64.dll2012-12-16 17:11 . 2012-12-22 14:53 46080 ----a-w- c:\windows\system32\atmlib.dll2012-12-16 14:45 . 2012-12-22 14:53 367616 ----a-w- c:\windows\system32\atmfd.dll2012-12-16 14:13 . 2012-12-22 14:53 295424 ----a-w- c:\windows\SysWow64\atmfd.dll2012-12-16 14:13 . 2012-12-22 14:53 34304 ----a-w- c:\windows\SysWow64\atmlib.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]"LMab1err"="c:\program files (x86)\Lexmark\ErrorApp\LMab1err.exe" [2012-08-07 645296]"LMADJmon"="c:\program files (x86)\Lexmark Pro910 Series\LMADJmon.exe" [2012-09-07 952496].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-02 2018032]"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-10-18 2319536]"LMADJmon"="c:\program files (x86)\Lexmark Pro910 Series\LMADJmon.exe" [2012-09-07 952496]"iTunesHelper"="D:\iTunesHelper.exe" [2013-02-20 152392]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848].c:\users\Doug\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.6.lnk - c:\program files\Intel\TurboBoost\SignalIslandUi.exe [2012-5-30 207400].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Constant Guard.lnk - c:\program files (x86)\Constant Guard Protection Suite\IDVault.exe [2013-1-14 3982376]FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe [2011-10-30 12862]Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-2-7 575000].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1)"AppInit_DLLs"=c:\progra~2\KEYCRY~1\KeyCrypt32(1).dll.R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-29 1255736]R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1402000.013\SYMDS64.SYS [2012-10-04 493216]S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1402000.013\SYMEFA64.SYS [2012-10-04 1133216]S1 AntiLog32;AntiLog32;c:\windows\system32\drivers\AntiLog64.sys [2013-01-29 45968]S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-05-26 17536]S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [2013-01-16 1388120]S1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\N360x64\1402000.013\ccSetx64.sys [2012-10-04 168096]S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130312.001_301\IDSvia64.sys [2013-03-12 513184]S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1402000.013\Ironx64.SYS [2012-07-28 224416]S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1402000.013\SYMNETS.SYS [2012-07-23 432800]S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2011-03-03 379520]S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]S2 IDVaultSvc;CGPS Service;c:\program files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe [2013-01-14 66600]S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2011-08-25 13672]S2 MotoHelper;MotoHelper Service;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2011-04-26 223088]S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe [2012-10-11 143928]S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2013-02-07 1223704]S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2013-02-07 660504]S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2012-05-30 16168]S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-10-03 129512]S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-10-03 394728]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-09 138912]S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]S3 keycrypt;keycrypt;c:\windows\system32\DRIVERS\KeyCrypt64.sys [2013-01-06 26448]S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-04-20 169584]S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys [2013-02-07 18456]S3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.6;c:\program files\Intel\TurboBoost\TurboBoost.exe [2012-05-30 149544]S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - 37979833*NewlyCreated* - 55115228*Deregistered* - 37979833*Deregistered* - 55115228.Contents of the 'Scheduled Tasks' folder.2013-03-14 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 17:59].2013-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-10 16:11].2013-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-12-10 16:11]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]@="{64174815-8D98-4CE6-8646-4C039977D808}"[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]"LMADJmon"="c:\program files (x86)\Lexmark Pro910 Series\LMADJmon.exe" [2012-09-07 952496]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"=c:\progra~2\KEYCRY~1\KeyCrypt64(1).dll.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceFontCache.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://www.foxnews.com/mLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.local;192.168.*.*IE: &ieSpell Options - c:\program files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTMIE: Check &Spelling - c:\program files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTMIE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000IE: Lookup on Merriam Webster - file://c:\program files (x86)\ieSpell\Merriam Webster.HTMIE: Lookup on Wikipedia - file://c:\program files (x86)\ieSpell\wikipedia.HTMTrusted Zone: intuit.com\ttlcTCP: DhcpNameServer = 75.75.76.76 75.75.75.75.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)SafeBoot-55115228.sysHKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - startToolbar-Locked - (no file)HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exeHKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe...[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\diMaster.dll\" /prefetch:1".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]@Denied: (A) (Everyone)"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]@Denied: (A) (Everyone).[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]"Key"="ActionsPane3""Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd".[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2013-03-14 10:53:34ComboFix-quarantined-files.txt 2013-03-14 14:53.Pre-Run: 178,468,864,000 bytes freePost-Run: 178,113,863,680 bytes free.- - End Of File - - 36CB5A32A21FFD5C920CDFFE810A7882 Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:657049 Share Posted March 14, 2013 OK...Next:Please download AdwCleaner from here and save it on your Desktop.AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.AdwCleaner is a tool that deletes :· Adwares (software ads)· PUP/LPI (Potentially Undesirable Program)· Toolbars· Hijacker (Hijack of the browser's homepage)It works with a Search and Deletion methode. It can be easily uninstalled using the "Uninstall" mode. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.Now click on the Search tab.Please post the contents of the log-file created in your next post.Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.Note:Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.MrC Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:657058 Share Posted March 14, 2013 MrC. I ran AdwCleaner. Here is the log file: # AdwCleaner v2.114 - Logfile created 03/14/2013 at 11:42:59# Updated 05/03/2013 by Xplode# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)# User : Doug - DOUG-PC# Boot Mode : Normal# Running from : C:\Users\Doug\Desktop\adwcleaner.exe# Option [search]***** [services] ********** [Files / Folders] *****Folder Found : C:\ProgramData\Partner***** [Registry] *****Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}***** [internet Browsers] *****-\\ Internet Explorer v10.0.9200.16521[OK] Registry is clean.*************************AdwCleaner[R1].txt - [648 octets] - [14/03/2013 11:42:59]########## EOF - C:\AdwCleaner[R1].txt - [707 octets] ########## Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:657066 Share Posted March 14, 2013 Some adware found....lets clear it out.....Please re-run AdwCleanerClick on Delete button.Confirm each time with OK if asked.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.Then......Lets check your computers security before you go and we have a little cleanup to do also:Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:657073 Share Posted March 14, 2013 MrC, I ran both programs. Here are the log files: # AdwCleaner v2.114 - Logfile created 03/14/2013 at 12:04:35# Updated 05/03/2013 by Xplode# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)# User : Doug - DOUG-PC# Boot Mode : Normal# Running from : C:\Users\Doug\Desktop\adwcleaner.exe# Option [Delete]***** [services] ********** [Files / Folders] *****Folder Deleted : C:\ProgramData\Partner***** [Registry] *****Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}***** [internet Browsers] *****-\\ Internet Explorer v10.0.9200.16521[OK] Registry is clean.*************************AdwCleaner[R1].txt - [775 octets] - [14/03/2013 11:42:59]AdwCleaner[R2].txt - [834 octets] - [14/03/2013 12:04:26]AdwCleaner[s1].txt - [770 octets] - [14/03/2013 12:04:35]########## EOF - C:\AdwCleaner[s1].txt - [829 octets] ########## Results of screen317's Security Check version 0.99.61 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Norton Security Suite WMI entry may not exist for antivirus; attempting automatic update.`````````Anti-malware/Other Utilities Check:````````` Secunia PSI (3.0.0.6005) Malwarebytes Anti-Malware version 1.70.0.1100 JavaFX 2.1.1 Java 7 Update 17 Adobe Flash Player 11.6.602.180 Adobe Reader 10.1.6 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe`````````````````System Health check````````````````` Total Fragmentation on Drive C: 1%````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:657075 Share Posted March 14, 2013 Adobe Reader 10.1.6 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe.----------------------------------------You have out dated programs on the system which are vulnerable to malware.Please update or uninstall themInfo on doing that can be found in my Preventive Maintenance~~~~~~~~~~~~~~~~~~~~~A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)---------------------------------Please download OTL from one of the links below: (you may already have OTL on the system)http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.comhttp://www.itxassoci...T-Tools/OTL.exeSave it to your desktop.Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)Any other programs or logs you can manually delete.IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
Flyer Posted March 14, 2013 Author ID:657115 Share Posted March 14, 2013 MrC, Cleanup is complete. Thank you very much for your help! I will look into Foxit Reader. Awesome!! Doug Link to post Share on other sites More sharing options...
MrCharlie Posted March 14, 2013 ID:657120 Share Posted March 14, 2013 OK Take Care MrC Link to post Share on other sites More sharing options...
LDTate Posted March 17, 2013 ID:657980 Share Posted March 17, 2013 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts