Cant remove System Care Antivirus

captainron19 · May 13, 2013

Had the system care antivirus appear on our Fire Department computer the other day and thought I removed it but when i returned to work today found it was back.

I started in Safe Modewith netwoking and ran chamelon - did a scan found 5 threats ...same removed. Computer ran fine that day but little slow and was getting an ocassional pop up window that Malwarebytes blocked an outgoing from port 52056 Process svchost.exe

Today saw the system care antivires icon is back and now the outgoing block bubble is appearing about every 3-5 seconds.

Here is the hijack this log I just generated.

Any help would e appreciated.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 8:13:51 AM, on 5/13/2013

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v9.00 (9.00.8112.16476)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\RtHDVCpl.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Common Files\aol\1222973355\ee\aolsoftware.exe

C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Windows\ehome\ehtray.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Kyocera Mita\FileUtility\NsCatCom.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Users\Capt\Downloads\mbar-1.05.0.1001\mbar\mbar.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.grovevillefire.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (file missing)

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

R3 - URLSearchHook: (no name) - {03a13e92-bfed-419a-9b3b-072b6a1534a2} - (no file)

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (file missing)

O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.7\youtubedownloaderToolbarIE.dll (file missing)

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1222973355\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [rorvck] "C:\Windows\System32\rundll32.exe" "C:\Users\Capt\AppData\Roaming\rorvck.dll",CollObjectMethod

O4 - HKLM\..\Run: [trcazc] "C:\Windows\System32\rundll32.exe" "C:\Users\Capt\AppData\Roaming\trcazc.dll",ParseFile

O4 - HKLM\..\RunOnce: [Z1] cmd /c "C:\Users\Capt\Downloads\mbar-1.05.0.1001\mbar\mbar.exe" /cleanup /s

O4 - HKCU\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKCU\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Google Update] "C:\Users\Capt\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [opisaevh] "C:\Users\Capt\AppData\Local\jmrgburj.exe"

O4 - HKCU\..\Run: [uledtpvf] "C:\Users\Capt\AppData\Local\becsjqkw.exe"

O4 - HKCU\..\Run: [dapdbxql] "C:\Users\Capt\AppData\Local\sishlrgg.exe"

O4 - Global Startup: Scanner File Utility.lnk = C:\Program Files\Kyocera Mita\FileUtility\NsCatCom.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

O16 - DPF: {1663ED61-23EB-11D2-B92F-008048FDD814} (MeadCo ScriptX) - https://www.emscharts.com/cab/scriptx.cab

O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/US/TechConsole/x86/RescueControl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab

O16 - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} (PPLive Lite Class) - http://download.pplive.com/config/pplite/pluginsetup.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100

O17 - HKLM\System\CCS\Services\Tcpip\..\{34B0462B-1D50-43EA-86F5-1F21AE1475EA}: NameServer = 167.206.245.129,167.206.245.130

O17 - HKLM\System\CS1\Services\Tcpip\..\{34B0462B-1D50-43EA-86F5-1F21AE1475EA}: NameServer = 167.206.245.129,167.206.245.130

O17 - HKLM\System\CS2\Services\Tcpip\..\{34B0462B-1D50-43EA-86F5-1F21AE1475EA}: NameServer = 167.206.245.129,167.206.245.130

O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe

O23 - Service: WebEx Service Host for Support Center (atashost) - Cisco WebEx LLC - C:\Windows\system32\atashost.exe

O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe

O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)

O23 - Service: lmab_device - - C:\Windows\system32\LMabcoms.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: SFUSVC - KYOCERA MITA CORPORATION - C:\Program Files\Kyocera Mita\FileUtility\SFUSVC.exe

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--

End of file - 12054 bytes

MrCharlie · May 13, 2013

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic:

Click on the

Follow This Topic Button

(at the top right of this page), make sure that the

Receive notification

box is checked and that it is set to

Instantly

Removing malware can be unpredictable

...things can go very wrong!

Backup

any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>

Please stick with me until I give you the "all clear" and

Please don't waste my time by leaving before that

.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

captainron19 · May 13, 2013

Here is the DDS File

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.17.2

Run by Capt at 9:00:33 on 2013-05-13

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3060.1373 [GMT -4:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\SLsvc.exe

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Application Updater\ApplicationUpdater.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\atashost.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Common Files\aol\1222973355\ee\aolsoftware.exe

C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Kyocera Mita\FileUtility\NsCatCom.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Microsoft SQL Server\MSSQL10_50.IRON_COMPASS\MSSQL\Binn\sqlservr.exe

C:\Windows\ehome\ehmsas.exe

c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files\Kyocera Mita\FileUtility\SFUSVC.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\Program Files\Kyocera Mita\FileUtility\nsCatCom.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

c:\Program Files\Microsoft Security Client\NisSrv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\SearchProtocolHost.exe

c:\Program Files\Microsoft Security Client\MpCmdRun.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.grovevillefire.com/

mStart Page = hxxp://www.yahoo.com

uProxyOverride = <local>

uURLSearchHooks: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} -

uURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - <orphaned>

uURLSearchHooks: {03a13e92-bfed-419a-9b3b-072b6a1534a2} - <orphaned>

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll

BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\dell\bae\BAE.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} -

TB: YouTube Downloader Toolbar: {F3FEE66E-E034-436a-86E4-9690573BEE8A} -

uRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -startup

uRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [Google Update] "c:\users\capt\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [uledtpvf] "c:\users\capt\appdata\local\becsjqkw.exe"

uRun: [dapdbxql] "c:\users\capt\appdata\local\sishlrgg.exe"

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter

mRun: [HostManager] c:\program files\common files\aol\1222973355\ee\AOLSoftware.exe

mRun: [searchSettings] "c:\program files\common files\spigot\search settings\SearchSettings.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [rorvck] "c:\windows\system32\rundll32.exe" "c:\users\capt\appdata\roaming\rorvck.dll",CollObjectMethod

mRun: [trcazc] "c:\windows\system32\rundll32.exe" "c:\users\capt\appdata\roaming\trcazc.dll",ParseFile

mRunOnce: [Z1] cmd /c "c:\users\capt\downloads\mbar-1.05.0.1001\mbar\mbar.exe" /cleanup /s

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\scanne~1.lnk - c:\program files\kyocera mita\fileutility\NsCatCom.exe

uPolicies-Explorer: NoDrives = dword:0

uPolicies-Explorer: HideSCAHealth = dword:1

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre7\bin\jp2iexp.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: Photobucket Publisher - hxxp://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {1663ED61-23EB-11D2-B92F-008048FDD814} - hxxps://www.emscharts.com/cab/scriptx.cab

DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/US/TechConsole/x86/RescueControl.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} - hxxp://www.photodex.com/pxplay.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-us.cab

DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} - hxxp://download.pplive.com/config/pplite/pluginsetup.cab

DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100

TCP: Interfaces\{34B0462B-1D50-43EA-86F5-1F21AE1475EA} : NameServer = 167.206.245.129,167.206.245.130

Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll

Notify: igfxcui - igfxdev.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\capt\appdata\roaming\mozilla\firefox\profiles\tgjctg7v.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.grovevillefire.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll

FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - plugin: c:\users\capt\appdata\local\google\update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: c:\users\capt\appdata\roaming\facebook\npfbplugin_1_0_1.dll

FF - plugin: c:\users\capt\appdata\roaming\facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\users\capt\appdata\roaming\move networks\plugins\npqmp071706000001.dll

FF - plugin: c:\users\capt\appdata\roaming\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\users\capt\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\users\capt\appdata\roaming\mozilla\plugins\npo1d.dll

FF - plugin: c:\users\capt\appdata\roaming\mozilla\plugins\npPxPlay.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll

FF - plugin: c:\windows\system32\npdeployJava1.dll

FF - plugin: c:\windows\system32\npmproxy.dll

FF - ExtSQL: !HIDDEN! 2009-11-27 02:32; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - ExtSQL: !HIDDEN! 2013-05-13 07:15; {13af13c1-b982-11e2-8275-b8ac6f996f26}; c:\users\capt\appdata\roaming\mozilla\firefox\profiles\tgjctg7v.default\extensions\{13af13c1-b982-11e2-8275-b8ac6f996f26}.xpi

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R0 AFS;AFS;c:\windows\system32\drivers\AFS.SYS [2008-10-6 79052]

R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-1-20 195296]

R2 Application Updater;Application Updater;c:\program files\application updater\ApplicationUpdater.exe [2011-9-27 745880]

R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2012-2-1 133944]

R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2008-5-2 161048]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-11-27 47640]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-21 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-16 701512]

R2 MSSQL$IRON_COMPASS;SQL Server (IRON_COMPASS);c:\program files\microsoft sql server\mssql10_50.iron_compass\mssql\binn\sqlservr.exe [2010-4-3 42884448]

R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 100328]

R2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt60.sys [2008-9-26 27648]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-16 22856]

R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2013-1-27 295232]

S1 vnonhgei;vnonhgei;c:\windows\system32\drivers\vnonhgei.sys [2013-5-13 43600]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" --> c:\program files\lavasoft\ad-aware\AAWService.exe [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2010-4-3 44896]

S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [2010-4-3 240608]

S4 SQLAgent$IRON_COMPASS;SQL Server Agent (IRON_COMPASS);c:\program files\microsoft sql server\mssql10_50.iron_compass\mssql\binn\SQLAGENT.EXE [2010-4-3 367456]

.

=============== Created Last 30 ================

.

2013-05-13 12:13:24 43600 ----a-w- c:\windows\system32\drivers\vnonhgei.sys

2013-05-13 12:12:57 60872 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{9f65d220-e72c-4464-ad5c-7ff264691fdb}\offreg.dll

2013-05-13 11:25:06 6906960 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{9f65d220-e72c-4464-ad5c-7ff264691fdb}\mpengine.dll

2013-05-11 13:05:38 97885 ----a-w- c:\users\capt\appdata\local\dldnsict.exe

2013-05-10 17:42:30 -------- d-----w- c:\programdata\EA74F275A26259980000EA7408065E5C

2013-05-10 14:58:47 372736 ----a-w- c:\users\capt\appdata\roaming\trcazc.dll

2013-05-10 14:58:38 667648 ----a-w- c:\users\capt\appdata\roaming\rorvck.dll

2013-05-07 20:13:43 6906960 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2013-04-24 20:14:16 706640 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{d6ff8868-67ef-4efc-90b0-2d143c41c8ee}\gapaengine.dll

.

==================== Find3M ====================

.

2013-05-02 15:28:50 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-24 00:10:23 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-24 00:10:23 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-04 18:50:42 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-14 13:17:43 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-03-14 13:17:40 861088 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-03-14 13:17:40 782240 ----a-w- c:\windows\system32\deployJava1.dll

2013-03-11 13:25:50 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-11 13:25:50 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-09 03:45:04 49152 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-09 01:28:08 64000 ----a-w- c:\windows\system32\smss.exe

2013-03-08 03:53:50 376320 ----a-w- c:\windows\system32\winsrv.dll

2013-03-08 03:52:22 2067968 ----a-w- c:\windows\system32\mstscax.dll

2013-03-05 01:40:56 2049024 ----a-w- c:\windows\system32\win32k.sys

2013-03-03 19:07:52 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-02-22 03:46:00 1800704 ----a-w- c:\windows\system32\jscript9.dll

2013-02-22 03:38:00 1129472 ----a-w- c:\windows\system32\wininet.dll

2013-02-22 03:37:50 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2013-02-22 03:34:17 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2013-02-22 03:34:03 420864 ----a-w- c:\windows\system32\vbscript.dll

2013-02-22 03:31:46 2382848 ----a-w- c:\windows\system32\mshtml.tlb

.

============= FINISH: 9:05:20.51 ===============

Here attach file

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume3

Install Date: 9/25/2008 8:17:18 PM

System Uptime: 5/13/2013 7:14:12 AM (2 hours ago)

.

Motherboard: Dell Inc. | | 0K068D

Processor: Intel® Core2 Duo CPU E7200 @ 2.53GHz | Socket 775 | 2534/266mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 283 GiB total, 177.463 GiB free.

D: is FIXED (NTFS) - 15 GiB total, 9.945 GiB free.

E: is CDROM ()

F: is FIXED (NTFS) - 233 GiB total, 177.273 GiB free.

.

==== Disabled Device Manager Items =============

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

7-Zip 4.42

Acrobat.com

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.5.4

Allok AVI MPEG Converter 1.5.4

AOL Mail and AIM Gadget

AOL Uninstaller (Choose which Products to Remove)

Apple Software Update

Astro Gemini Screensaver Manager 2.0

Audacity 1.2.6

AviSynth 2.5

AVS Update Manager 1.0

AVS Video Converter 8

AVS4YOU Software Navigator 1.4

BitPim 1.0.6

Brother P-touch Editor 5.0

Browser Address Error Redirector

Carbonite Online Backup Setup

Christmas Time 3D Screensaver 1.0

CoffeeCup Flash FireStarter

CoffeeCup Flash Menu Builder

CoffeeCup GIF Animator

CoffeeCup HTML Editor

CoffeeCup Image Mapper

CoffeeCup Web Form Builder

CoffeeCup Web Form Builder - Registered

CoffeeCup Web Video Player - Registered

Corel Graphics - Windows Shell Extension

CorelDRAW Graphics Suite X3

CorelDRAW Graphics Suite X5

CorelDRAW Graphics Suite X5 - BR

CorelDRAW Graphics Suite X5 - Capture

CorelDRAW Graphics Suite X5 - Common

CorelDRAW Graphics Suite X5 - Connect

CorelDRAW Graphics Suite X5 - Custom Data

CorelDRAW Graphics Suite X5 - Draw

CorelDRAW Graphics Suite X5 - EN

CorelDRAW Graphics Suite X5 - ES

CorelDRAW Graphics Suite X5 - Extra Content

CorelDRAW Graphics Suite X5 - Filters

CorelDRAW Graphics Suite X5 - FontNav

CorelDRAW Graphics Suite X5 - FR

CorelDRAW Graphics Suite X5 - IPM

CorelDRAW Graphics Suite X5 - PHOTO-PAINT

CorelDRAW Graphics Suite X5 - Photozoom Plugin

CorelDRAW Graphics Suite X5 - Redist

CorelDRAW Graphics Suite X5 - Setup Files

CorelDRAW Graphics Suite X5 - VBA

CorelDRAW Graphics Suite X5 - VideoBrowser

CorelDRAW Graphics Suite X5 - VSTA

CorelDRAW Graphics Suite X5 - WT

CorelDRAW® Graphics Suite X5

Crystal Reports Basic Runtime for Visual Studio 2008

CutePDF Writer 2.6

Dell Dock

Dell Getting Started Guide

Dell Support Center (Support Software)

DHTML Editing Component

DVD Decrypter (Remove Only)

EDocs

EN

ESRI MapObjects 2 Runtime

Facebook Plug-In

FH Sketch v5

FIREHOUSE Software 7

FIREHOUSE Software 7 Documentation

FontNav

Free Christmas Tree 3D Screensaver

Free Convert to DIVX AVI WMV MP4 MPEG Converter 5.8

Free MP4 Video Converter version 5.0.3.1206

Free YouTube Downloader 3.5.126

FTP Commander

Google Chrome

Google Earth

Google Talk Plugin

Google Update Helper

Google Updater

GoToAssist 8.0.0.514

GoToMeeting 4.0.0.320

GraphixCALC Pro 2.0

HiJackThis

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)

Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)

Image Plugin

IrfanView (remove only)

Java 7 Update 17

Java Auto Updater

Java 6 Update 7

K-Lite Codec Pack 4.0.0 (Full)

Kyocera Address Book for Network FAX

Kyocera Product Library

Kyocera Scanner File Utility

Kyocera TWAIN Driver

LAME v3.98.2 for Audacity

Lexmark Software Uninstall

LG USB Modem driver

Light-O-Rama

Light-O-Rama Demo

LogMeIn

Macromedia Shockwave Player

Magic DVD Ripper V5.4.2

Malwarebytes Anti-Malware version 1.75.0.1300

MediaDirect

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2742597)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access Runtime (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Visio 2007 Service Pack 3 (SP3)

Microsoft Office Visio MUI (English) 2007

Microsoft Office Visio Professional 2007

Microsoft Office Word MUI (English) 2007

Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft SQL Server 2008 R2

Microsoft SQL Server 2008 R2 Native Client

Microsoft SQL Server 2008 R2 RsFx Driver

Microsoft SQL Server 2008 R2 Setup (English)

Microsoft SQL Server 2008 Setup Support Files

Microsoft SQL Server Browser

Microsoft SQL Server VSS Writer

Microsoft VC9 runtime libraries

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual Studio Tools for Applications 2.0 - ENU

Microsoft Visual Studio Tools for Applications 2.0 Runtime

Microsoft Web Publishing Wizard 1.52

MOV to AVI MPEG WMV Converter 2.0.0

Move Media Player

Mozilla Firefox 20.0.1 (x86 en-US)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB2758694)

MSXML 4.0 SP3 Parser (KB973685)

MWSnap 3

Netflix Movie Viewer

Night Before Christmas 3D Screensaver

OfficeSharedAddInSetup

OGA Notifier 2.0.0048.0

OnScene Xplorer

PASW Statistics Student Version 18.0

PDF-XChange 3

Photodex Presenter

PPLite 1.0.0.0016

PrintMaster Platinum 17

QuickTime

Realtek Ethernet Network Card Diagnostic tool for Windows Vista

Realtek High Definition Audio Driver

Roxio Creator Audio

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Express Labeler 3

Roxio Update Manager

RTC Client API v1.2

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Shareaza 2.4.0.0

Shipping Assistant 3.5

Smart PDF Converter 6.0.0.422

Spelling Dictionaries Support For Adobe Reader 9

SQL Server 2008 R2 Common Files

SQL Server 2008 R2 Database Engine Services

SQL Server 2008 R2 Database Engine Shared

Sql Server Customer Experience Improvement Program

TestDrive Client

TextMessagePLUS

Uninstall AOL Emergency Connect Utility 1.0

Uninstall Dual Mode Camera

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Visio 2007 Help (KB963666)

Update for Microsoft Office Word 2007 Help (KB963665)

Update Manager

VBA

Viewpoint Media Player

Visual Basic for Applications ® Core

Visual Basic for Applications ® Core - English

Visual C++ 2008 x86 Runtime - (v9.0.30729)

Visual C++ 2008 x86 Runtime - v9.0.30729.01

VSSPRO4 32

VZAccess Manager for RIM

WebEx

Windows Live OneCare safety scanner

Windows Media Player Firefox Plugin

Yahoo! Install Manager

Yahoo! Messenger

Yahoo! Software Update

YouTube Downloader 3.4

YouTube Downloader Toolbar v4.7

.

==== End Of File ===========================

captainron19 · May 13, 2013

Here is the report gnraed by Rogue Killer

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Capt [Admin rights]

Mode : Scan -- Date : 05/13/2013 09:25:23

| ARK || FAK || MBR |

¤¤¤ Bad processes : 4 ¤¤¤

[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Capt\AppData\Roaming\rorvck.dll [x] -> KILLED [TermProc]

[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Capt\AppData\Roaming\trcazc.dll [x] -> KILLED [TermProc]

[sVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]

¤¤¤ Registry Entries : 15 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : uledtpvf ("C:\Users\Capt\AppData\Local\becsjqkw.exe") [x] -> FOUND

[RUN][sUSP PATH] HKCU\[...]\Run : dapdbxql ("C:\Users\Capt\AppData\Local\sishlrgg.exe") [x] -> FOUND

[RUN][sUSP PATH] HKLM\[...]\Run : rorvck ("C:\Windows\System32\rundll32.exe" "C:\Users\Capt\AppData\Roaming\rorvck.dll",CollObjectMethod) [7] -> FOUND

[RUN][sUSP PATH] HKLM\[...]\Run : trcazc ("C:\Windows\System32\rundll32.exe" "C:\Users\Capt\AppData\Roaming\trcazc.dll",ParseFile) [7] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-584753501-3716771045-2223077493-1000[...]\Run : uledtpvf ("C:\Users\Capt\AppData\Local\becsjqkw.exe") [x] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-584753501-3716771045-2223077493-1000[...]\Run : dapdbxql ("C:\Users\Capt\AppData\Local\sishlrgg.exe") [x] -> FOUND

[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{34B0462B-1D50-43EA-86F5-1F21AE1475EA} : NameServer (167.206.245.129,167.206.245.130) -> FOUND

[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{34B0462B-1D50-43EA-86F5-1F21AE1475EA} : NameServer (167.206.245.129,167.206.245.130) -> FOUND

[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJPOL] HKCU\[...]\System : DisableCMD (0) -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

-> D:\windows\system32\config\SOFTWARE

-> D:\windows\system32\config\SYSTEM

-> D:\Users\Default\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDP725032GLA360 ATA Device +++++

--- User ---

[MBR] 6744d72bd8f52109e893771859a61527

[bSP] 1443d842b4cab0996f235e857ef3b6bd : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 47 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 98304 | Size: 15360 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31555584 | Size: 289836 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: Seagate FreeAgentDesktop USB Device +++++

--- User ---

[MBR] dcde733048f6c26f6697649797f55902

[bSP] 5cab7fac78b6fe5301595cea6da44b25 : Empty MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238472 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[1]_S_05132013_02d0925.txt >>

RKreport[1]_S_05132013_02d0925.txt

MrCharlie · May 13, 2013

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKCU\[...]\Run : uledtpvf ("C:\Users\Capt\AppData\Local\becsjqkw.exe") [x] -> FOUND
[RUN][sUSP PATH] HKCU\[...]\Run : dapdbxql ("C:\Users\Capt\AppData\Local\sishlrgg.exe") [x] -> FOUND
[RUN][sUSP PATH] HKLM\[...]\Run : rorvck ("C:\Windows\System32\rundll32.exe" "C:\Users\Capt\AppData\Roaming\rorvck.dll",CollObjectMethod) [7] -> FOUND
[RUN][sUSP PATH] HKLM\[...]\Run : trcazc ("C:\Windows\System32\rundll32.exe" "C:\Users\Capt\AppData\Roaming\trcazc.dll",ParseFile) [7] -> FOUND
[RUN][sUSP PATH] HKUS\S-1-5-21-584753501-3716771045-2223077493-1000[...]\Run : uledtpvf ("C:\Users\Capt\AppData\Local\becsjqkw.exe") [x] -> FOUND
[RUN][sUSP PATH] HKUS\S-1-5-21-584753501-3716771045-2223077493-1000[...]\Run : dapdbxql ("C:\Users\Capt\AppData\Local\sishlrgg.exe") [x] -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Processes tab and put a check next to these and uncheck the rest. (if found)

[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Capt\AppData\Roaming\rorvck.dll [x] -> KILLED [TermProc]
[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Capt\AppData\Roaming\trcazc.dll [x] -> KILLED [TermProc]
[sVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]
[sVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]

Now click Delete on the right hand column under Options

-------------

If in doubt about an entry....please ask or choose Skip!!!!

Don't Delete anything unless instructed to!

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If a suspicious object is detected, the default action will be Skip, click on Continue

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

<p>Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

Put a checkmark beside loaded modules.

A reboot will be needed to apply the changes. Do it.

TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.

Then click on Change parameters in TDSSKiller.

Check all boxes then click OK.

Click the Start Scan button.

The scan should take no longer than 2 minutes.

If a suspicious object is detected, the default action will be Skip, click on Continue.

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If in doubt about an entry....please ask or choose Skip

If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.

Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.

Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If in doubt about an entry....please ask or choose Skip

Don't Delete anything unless instructed to!

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

New window that comes up.

MrC

captainron19 · May 13, 2013

Thank you very much....so far so good- Ran the TDS Killer and found 4 threats (one of which was \device\harddisko\DRo (TDSS File System) which i chose "Skip" on the rest I originally quarantined then did a re-boot and scanned again but they appeared again so I re-did the scan, chose delete this time. Computer started up fine (a lot faster) and did not receive and more pop ups from Malwarebytes letting me know of a blocked outgoing process.

MrCharlie · May 13, 2013

Can you please post or attach all the logs.

Next.....

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

captainron19 · May 13, 2013

ok.... will download and run combofix now..... do you want any other logs other than the combofix one posted right now?

MrCharlie · May 13, 2013

The logs from TDSSKiller. MrC

captainron19 · May 13, 2013

Ran the TDSSKILLER and 1 threat found which was the \device\harddisko\DRo (TDSS File System) which i chose "Skip"

Here is the log from combofix

ComboFix 13-05-12.01 - Capt 05/13/2013 13:27:52.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3060.1665 [GMT -4:00]

Running from: c:\users\Capt\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Amazon.ico

c:\programdata\MercadoLivre.ico

c:\users\Capt\AppData\Local\dldnsict.exe

c:\users\Capt\AppData\Roaming\rorvck.dll

c:\users\Capt\AppData\Roaming\trcazc.dll

c:\windows\Downloaded Program Files\Install.inf

c:\windows\system32\.txt

c:\windows\system32\ccrpTmr6.dll

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\regtlib.exe

c:\windows\vcredist_x86.exe

.

---- Previous Run -------

.

c:\users\Capt\AppData\Local\{67CFAE8E-A7F2-43CD-A9B9-7936DE11B871}\chrome.manifest

c:\users\Capt\AppData\Local\{67CFAE8E-A7F2-43CD-A9B9-7936DE11B871}\chrome\content\_cfg.js

c:\users\Capt\AppData\Local\{67CFAE8E-A7F2-43CD-A9B9-7936DE11B871}\chrome\content\overlay.xul

c:\users\Capt\AppData\Local\{67CFAE8E-A7F2-43CD-A9B9-7936DE11B871}\install.rdf

c:\users\Capt\AppData\Local\Bron.tok.A10.em.bin

c:\users\Capt\AppData\Local\BronFoldNetDomList.txt

c:\users\Capt\AppData\Local\Kosong.Bron.Tok.txt

c:\users\Capt\AppData\Local\ListHost10.txt

c:\users\Capt\AppData\Roaming\Microsoft\Windows\Recent\ftp.trentonems.pif

c:\windows\system\VEN2232.OLB

c:\windows\system32\config\systemprofile\AppData\Local\Bron.tok.A10.em.bin

c:\windows\system32\config\systemprofile\AppData\Local\Kosong.Bron.Tok.txt

c:\windows\system32\config\systemprofile\AppData\Local\ListHost10.txt

c:\windows\system32\setup.ini

.

-- Previous Run --

.

Infected copy of c:\windows\system32\drivers\mountmgr.sys was found and disinfected

Restored copy from - Kitty had a snack

c:\windows\system32\wininit.exe . . . is infected!!

.

--------

.

((((((((((((((((((((((((( Files Created from 2013-04-13 to 2013-05-13 )))))))))))))))))))))))))))))))

.

2013-05-13 17:35 . 2013-05-13 17:35 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp

2013-05-13 17:35 . 2013-05-13 17:35 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-05-13 14:18 . 2013-05-13 14:18 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9F65D220-E72C-4464-AD5C-7FF264691FDB}\MpKsla7b0e411.sys

2013-05-13 14:17 . 2013-05-13 14:17 60872 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9F65D220-E72C-4464-AD5C-7FF264691FDB}\offreg.dll

2013-05-13 14:13 . 2013-05-13 14:16 -------- d-----w- C:\TDSSKiller_Quarantine

2013-05-13 11:25 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9F65D220-E72C-4464-AD5C-7FF264691FDB}\mpengine.dll

2013-05-07 20:13 . 2013-04-10 03:08 6906960 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-04-24 20:14 . 2013-04-24 20:13 706640 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D6FF8868-67EF-4EFC-90B0-2D143C41C8EE}\gapaengine.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-02 15:28 . 2009-11-22 19:49 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-24 00:10 . 2012-05-11 10:32 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-24 00:10 . 2011-06-17 07:25 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-04 18:50 . 2011-11-16 12:10 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-14 13:17 . 2013-03-14 13:17 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-03-14 13:17 . 2012-08-16 13:47 861088 ----a-w- c:\windows\system32\npdeployJava1.dll

2013-03-14 13:17 . 2010-11-05 13:38 782240 ----a-w- c:\windows\system32\deployJava1.dll

2013-03-11 13:25 . 2013-04-10 02:43 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-11 13:25 . 2013-04-10 02:43 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-09 03:45 . 2013-04-10 02:43 49152 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-09 01:28 . 2013-04-10 02:43 64000 ----a-w- c:\windows\system32\smss.exe

2013-03-08 03:53 . 2013-04-10 02:43 376320 ----a-w- c:\windows\system32\winsrv.dll

2013-03-08 03:52 . 2013-04-10 02:43 2067968 ----a-w- c:\windows\system32\mstscax.dll

2013-03-05 01:40 . 2013-04-10 02:43 2049024 ----a-w- c:\windows\system32\win32k.sys

2013-03-03 19:07 . 2013-04-10 02:43 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-02-22 03:46 . 2013-04-10 07:04 1800704 ----a-w- c:\windows\system32\jscript9.dll

2013-02-22 03:38 . 2013-04-10 07:04 1129472 ----a-w- c:\windows\system32\wininet.dll

2013-02-22 03:37 . 2013-04-10 07:04 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2013-02-22 03:34 . 2013-04-10 07:04 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2013-02-22 03:34 . 2013-04-10 07:04 420864 ----a-w- c:\windows\system32\vbscript.dll

2013-02-22 03:31 . 2013-04-10 07:04 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2013-04-11 23:02 . 2013-04-11 23:02 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-03-06 4706304]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-06 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-06 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-06 133656]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"HostManager"="c:\program files\Common Files\AOL\1222973355\ee\AOLSoftware.exe" [2010-03-08 41800]

"SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2011-09-28 894304]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Scanner File Utility.lnk - c:\program files\Kyocera Mita\FileUtility\NsCatCom.exe [2008-10-2 397312]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]

2008-09-26 04:37 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-12-19 14:39 41208 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]

2008-06-03 05:35 50528 ----a-w- c:\program files\AOL 9.1\aol.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CarboniteSetupLite]

2010-11-24 06:50 283792 ----a-w- c:\program files\Carbonite\CarbonitePreinstaller.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]

2009-05-21 15:13 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]

2008-03-11 16:44 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

2010-03-08 07:27 41800 ----a-w- c:\program files\Common Files\aol\1222973355\ee\aolsoftware.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LMab1err]

2007-02-16 16:11 713648 ----a-w- c:\program files\Lexmark\ErrorApp\LMab1err.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]

2008-01-14 14:13 132392 ------w- c:\program files\Dell\MediaDirect\PCMService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPAP]

2010-04-06 05:31 185800 ----a-w- c:\program files\Common Files\PPLiveNetwork\PPAP.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-584753501-3716771045-2223077493-1000]

"EnableNotifications"=dword:00000001

"EnableNotificationsRef"=dword:00000001

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - 40885370

*NewlyCreated* - 60902017

*NewlyCreated* - MPKSLA7B0E411

*Deregistered* - 40885370

*Deregistered* - 60902017

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-11 03:52 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-05-13 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-11 00:10]

.

2013-05-13 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-09-12 04:22]

.

2013-05-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-12 15:27]

.

2013-05-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-12 15:27]

.

2013-05-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-584753501-3716771045-2223077493-1000Core.job

- c:\users\Capt\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-19 18:47]

.

2013-05-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-584753501-3716771045-2223077493-1000UA.job

- c:\users\Capt\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-19 18:47]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.grovevillefire.com/

mStart Page = hxxp://www.yahoo.com

uInternet Settings,ProxyOverride = <local>

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: Interfaces\{34B0462B-1D50-43EA-86F5-1F21AE1475EA}: NameServer = 167.206.245.129,167.206.245.130

DPF: Photobucket Publisher - hxxp://pic.photobucket.com/plugins/csve/photobucket_publisher.CAB

DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} - hxxp://download.pplive.com/config/pplite/pluginsetup.cab

FF - ProfilePath - c:\users\Capt\AppData\Roaming\Mozilla\Firefox\Profiles\tgjctg7v.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.grovevillefire.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=

FF - prefs.js: network.proxy.type - 4

FF - ExtSQL: 2013-05-13 07:15; {13af13c1-b982-11e2-8275-b8ac6f996f26}; c:\users\Capt\AppData\Roaming\Mozilla\Firefox\Profiles\tgjctg7v.default\extensions\{13af13c1-b982-11e2-8275-b8ac6f996f26}.xpi

FF - ExtSQL: !HIDDEN! 2009-11-27 02:32; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - user.js: yahoo.homepage.dontask - true

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{03a13e92-bfed-419a-9b3b-072b6a1534a2} - (no file)

WebBrowser-{03A13E92-BFED-419A-9B3B-072B6A1534A2} - (no file)

SafeBoot-40885370.sys

SafeBoot-79838951.sys

SafeBoot-WudfPf

SafeBoot-WudfRd

SafeBoot-mcmscsvc

SafeBoot-MCODS

MSConfigStartUp-Ozozohujehokon - c:\users\Capt\AppData\Local\acilajunazile.dll

MSConfigStartUp-Xtepuvahohilofej - c:\users\Capt\AppData\Local\KBDGFWM.dll

AddRemove-FTP Commander - c:\program files\FTP Commander\uninstall.exe

AddRemove-{1a413f37-ed88-4fec-9666-5c48dc4b7bb7} - c:\program files\YouTube Downloader\uninstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-05-13 13:37

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Completion time: 2013-05-13 13:40:49

ComboFix-quarantined-files.txt 2013-05-13 17:40

.

Pre-Run: 190,635,577,344 bytes free

Post-Run: 192,328,765,440 bytes free

.

- - End Of File - - FBC605A4C46A5AFEF1A30EE87F217C57

MrCharlie · May 13, 2013

Ran the TDSSKILLER and 1 threat found which was the \device\harddisko\DRo (TDSS File System) which i chose "Skip"

That has to be Deleted.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

c:\windows\system32\wininit.exe . . . is infected!!

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:Filefind
wininit.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

MrC

captainron19 · May 13, 2013

ok - ran the tdsskiller again and deleted that last threat . Ran system look as per your instructions..... this is all that appeared in the log that was created...

SystemLook 30.07.11 by jpshortstuff

Log created at 14:09 on 13/05/2013 by Capt

Administrator - Elevation successful

========== Filefind ==========

Searching for "wininit.exe"

MrCharlie · May 13, 2013

It wasn't done scanning, try it again and wait until the log pops-up.

MrC

captainron19 · May 13, 2013

OK I will try it again.... It did create the log file on the desktop. I did run combofix again after that step and it did not show the infected file any more. Here is the last log from combofix

ComboFix 13-05-12.01 - Capt 05/13/2013 14:17:14.3.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3060.1942 [GMT -4:00]

Running from: c:\users\Capt\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2013-04-13 to 2013-05-13 )))))))))))))))))))))))))))))))

.

2013-05-13 18:24 . 2013-05-13 18:24 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2013-05-13 18:24 . 2013-05-13 18:24 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp

2013-05-13 18:24 . 2013-05-13 18:24 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-05-13 14:13 . 2013-05-13 18:08 -------- d-----w- C:\TDSSKiller_Quarantine