I'm infected by Brontok.A[18].Norbet

Dimaj · March 2, 2014

Hello i'm infected by this virus,

every time i want to download something the computer restart,

when it restart, a green page pops up.

I used dds.scr and that's what it gave to me:

DDS.txt:

DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK

Internet Explorer: 11.0.9600.16518

Run by z at 14:50:29 on 2014-03-02

Microsoft Windows 7 Starter 6.1.7601.1.1252.33.1033.18.1012.582 [GMT 1:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Users\z\AppData\Local\winlogon.exe

C:\Users\z\AppData\Local\services.exe

C:\Windows\system32\ctfmon.exe

C:\Users\z\AppData\Local\lsass.exe

C:\Windows\explorer.exe

C:\Windows\system32\DllHost.exe

C:\Users\z\AppData\Local\csrss.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\svchost.exe -k secsvcs

.

============== Pseudo HJT Report ===============

.

mWinlogon: Shell = Explorer.exe "c:\windows\sembako-cfzjmij.exe"

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - c:\program files\bluetooth suite\IEPlugIn.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - c:\program files\hewlett-packard\hp support framework\resources\hpnetworkcheck\HPNetworkCheckPlugin.dll

uRun: [Google Update] "c:\users\z\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [NextLive] c:\windows\system32\rundll32.exe "c:\users\z\appdata\roaming\newnext.me\nengine.dll",EntryPoint -m l

uRun: [Tok-Cirrhatus-639] "c:\users\z\appdata\local\br2301on.exe"

uRun: [Tok-Cirrhatus] <no file>

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [iAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe

mRun: [GfxServiceInstall] c:\windows\system32\GfxCUIServiceInstall.vbs

mRun: [AtherosBtStack] "c:\program files\bluetooth suite\BtvStack.exe"

mRun: [AthBtTray] "c:\program files\bluetooth suite\AthBtTray.exe"

mRun: [setDefault] c:\program files\hewlett-packard\hp launchbox\SetDefault.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [HPOSD] c:\program files\hewlett-packard\hp on screen display\HPOSD.exe

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [4StoryPrePatch] c:\4story\4story_fr\PrePatch.exe

mRun: [Athan] c:\program files\athan\Athan.exe

mRun: [igfxTray] c:\windows\system32

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [sysTrayApp] c:\program files\idt\wdm\sttray.exe

mRun: [HP Quick Launch] c:\program files\hewlett-packard\hp quick launch\HPMSGSVC.exe

mRun: [mobilegeni daemon] c:\program files\mobogenie\DaemonProcess.exe

mRun: [bron-Spizaetus] <no file>

mRunOnce: [NCPluginUpdater] "c:\program files\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update

StartupFolder: c:\users\z\appdata\roaming\microsoft\windows\start menu\programs\startup\Empty.pif

StartupFolder: c:\users\z\appdata\roaming\microsoft\windows\start menu\programs\startup\Startup.exe

uPolicies-Explorer: NoFolderOptions = dword:1

uPolicies-System: DisableRegistryTools = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - c:\program files\hewlett-packard\hp support framework\resources\hpnetworkcheck\NCLauncherFromIE.exe

IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - c:\program files\bluetooth suite\IEPlugIn.dll

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{22D03ABC-ACC7-4A68-B486-37378FC80756} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{22D03ABC-ACC7-4A68-B486-37378FC80756}\356425027596649602055726C69636 : DHCPNameServer = 109.0.66.20 109.0.66.10

TCP: Interfaces\{22D03ABC-ACC7-4A68-B486-37378FC80756}\57E69667562737964756D2071627963713 : DHCPNameServer = 193.55.96.84 193.55.97.4

TCP: Interfaces\{D24BDFE0-87E0-4667-962F-30737B637B43} : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: igfxcui - igfxdev.dll

AppInit_DLLs= c:\progra~2\browse~1\261095~1.52\{c16c1~1\browse~1.dll

SSODL: WebCheck - <orphaned>

mASetup: {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} - msiexec /fu {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} /qn

.

============= SERVICES / DRIVERS ===============

.

R3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys [2011-10-22 25248]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2011-12-21 197224]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-12-21 394856]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\idt\wdm\AEstSrv.exe [2013-2-10 81920]

S2 AtherosSvc;AtherosSvc;c:\program files\bluetooth suite\AdminService.exe [2011-10-22 85152]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2013-4-22 822504]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\hewlett-packard\hp support framework\HPSA_Service.exe [2012-9-27 86528]

S2 HPClientSvc;HP Client Services;c:\program files\hewlett-packard\hp client services\HPClientServices.exe [2010-10-11 246840]

S2 HPWMISVC;HPWMISVC;c:\program files\hewlett-packard\hp quick launch\HPWMISVC.exe [2012-3-5 35200]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [2011-12-21 13336]

S2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2013-6-26 523944]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]

S2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files\bluetooth suite\Ath_CoexAgent.exe [2011-10-22 158880]

S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2011-5-13 30312]

S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\drivers\btath_flt.sys [2011-10-22 35488]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-10-22 290976]

S3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2011-10-22 97440]

S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys [2011-10-22 147616]

S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\drivers\btath_lwflt.sys [2011-10-22 60064]

S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys [2011-10-22 263968]

S3 BtFilter;BtFilter;c:\windows\system32\drivers\btfilter.sys [2011-10-22 445088]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\drivers\clwvd.sys [2010-7-28 27632]

S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2010-10-12 206072]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\ieetwcollector.exe [2014-3-2 108032]

S3 igddim32;igddim32;c:\windows\system32\drivers\igddim32.sys [2012-10-22 1349120]

S3 igdkmd32;igdkmd32;c:\windows\system32\drivers\igdkmd32.sys [2012-10-22 435200]

S3 libusb0;LibUsb-Win32 - Kernel Driver 11/20/2005, 20051120;c:\windows\system32\drivers\libusb0.sys [2006-5-31 29184]

S3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2013-6-26 583848]

S3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2013-6-26 197800]

S3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2013-6-26 24232]

S3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2013-6-26 20136]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2013-6-26 207528]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]

S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-5-13 121064]

S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2011-5-13 12776]

S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2011-5-13 136808]

S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [2011-5-13 114280]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-20 52224]

S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]

S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]

.

=============== Created Last 30 ================

.

2014-03-02 03:11:11 62576 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f1f3ccfa-39a4-46bc-80df-0d03854fcfd5}\offreg.dll

2014-03-02 03:10:46 2048 ----a-w- c:\windows\system32\msxml3r.dll

2014-03-02 03:10:45 1237504 ----a-w- c:\windows\system32\msxml3.dll

2014-03-02 03:07:58 553472 ----a-w- c:\windows\system32\jscript9diag.dll

2014-03-02 00:25:05 -------- d-----w- c:\program files\AVG

2014-03-01 23:28:57 -------- d-----w- C:\0bc4e36ea3b6c293d394eca8

2014-03-01 23:23:51 7947048 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f1f3ccfa-39a4-46bc-80df-0d03854fcfd5}\mpengine.dll

2014-02-28 13:15:04 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-28

2014-02-27 10:20:10 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-27

2014-02-26 11:44:36 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-26

2014-02-25 14:52:51 -------- d-----w- C:\e9f041d51337775efdfd

2014-02-25 14:51:32 454656 ----a-w- c:\windows\system32\vbscript.dll

2014-02-25 14:31:45 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-25

2014-02-22 23:00:01 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-23

2014-02-22 22:39:56 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-22

2014-02-21 13:42:55 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-21

2014-02-20 08:48:56 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-20

2014-02-18 23:00:01 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-19

2014-02-17 23:00:01 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-18

2014-02-17 21:04:08 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-17

2014-02-14 06:42:50 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-14

2014-02-13 22:04:38 3419136 ----a-w- c:\windows\system32\d2d1.dll

2014-02-13 22:04:38 1987584 ----a-w- c:\windows\system32\d3d10warp.dll

2014-02-13 22:04:22 594944 ----a-w- c:\windows\system32\RMActivate_isv.exe

2014-02-13 22:04:21 572416 ----a-w- c:\windows\system32\RMActivate.exe

2014-02-13 22:04:21 508928 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe

2014-02-13 22:04:20 87040 ----a-w- c:\windows\system32\secproc_ssp.dll

2014-02-13 22:04:20 510976 ----a-w- c:\windows\system32\RMActivate_ssp.exe

2014-02-13 22:04:20 428032 ----a-w- c:\windows\system32\secproc.dll

2014-02-13 22:04:20 423936 ----a-w- c:\windows\system32\secproc_isv.dll

2014-02-13 22:04:20 390144 ----a-w- c:\windows\system32\msdrm.dll

2014-02-13 22:04:19 87040 ----a-w- c:\windows\system32\secproc_ssp_isv.dll

2014-02-12 23:00:01 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-13

2014-02-12 11:45:10 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-12

2014-02-11 12:16:57 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-11

2014-02-10 07:09:19 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-10

2014-02-09 14:23:19 -------- d-----w- c:\users\z\appdata\local\ElevatedDiagnostics

2014-02-08 23:09:38 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-9

2014-02-08 14:00:37 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-8

2014-02-06 23:00:01 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-7

2014-02-06 10:17:10 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-6

2014-02-05 09:07:09 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-5

2014-02-04 12:13:25 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-4

2014-02-03 07:59:23 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-3

2014-02-01 23:00:01 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-2

2014-02-01 11:41:32 -------- d-----w- c:\users\z\appdata\local\Bron.tok-18-1

.

==================== Find3M ====================

.

2014-02-06 10:20:26 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2014-02-06 10:19:55 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll

2014-02-06 10:01:36 61952 ----a-w- c:\windows\system32\iesetup.dll

2014-02-06 10:00:46 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll

2014-02-06 09:47:22 112128 ----a-w- c:\windows\system32\ieUnatt.exe

2014-02-06 09:47:18 108032 ----a-w- c:\windows\system32\ieetwcollector.exe

2014-02-06 09:25:36 4244480 ----a-w- c:\windows\system32\jscript9.dll

2014-02-06 09:09:30 1964032 ----a-w- c:\windows\system32\inetcpl.cpl

2014-02-06 08:41:35 1820160 ----a-w- c:\windows\system32\wininet.dll

2014-01-30 22:12:06 10 --sh--r- c:\windows\system32\sistem.sys

2014-01-21 16:28:54 18776 ----a-w- c:\windows\system32\roboot.exe

2014-01-01 17:39:09 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2014-01-01 17:39:08 194048 ----a-w- c:\windows\system32\elshyph.dll

2014-01-01 17:39:03 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2014-01-01 17:39:03 645120 ----a-w- c:\windows\system32\jsIntl.dll

2014-01-01 17:39:03 182272 ----a-w- c:\windows\system32\msls31.dll

2014-01-01 17:39:01 62464 ----a-w- c:\windows\system32\tdc.ocx

2014-01-01 17:39:01 34816 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll

2014-01-01 17:39:00 337408 ----a-w- c:\windows\system32\html.iec

2014-01-01 17:38:57 1051136 ----a-w- c:\windows\system32\mshtmlmedia.dll

2014-01-01 17:38:55 24576 ----a-w- c:\windows\system32\licmgr10.dll

2014-01-01 17:38:54 151552 ----a-w- c:\windows\system32\iexpress.exe

2014-01-01 17:38:54 139264 ----a-w- c:\windows\system32\wextract.exe

2014-01-01 17:38:52 13312 ----a-w- c:\windows\system32\mshta.exe

2014-01-01 17:38:50 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2014-01-01 17:38:50 61952 ----a-w- c:\windows\system32\MshtmlDac.dll

2014-01-01 17:38:50 36352 ----a-w- c:\windows\system32\imgutil.dll

2014-01-01 17:38:50 111616 ----a-w- c:\windows\system32\IEAdvpack.dll

2014-01-01 17:38:49 86016 ----a-w- c:\windows\system32\iesysprep.dll

2014-01-01 17:38:49 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-12-18 05:13:56 231584 ------w- c:\windows\system32\MpSigStub.exe

.

============= FINISH: 14:50:58,64 ===============

And for ATTACH.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Starter

Boot Device: \Device\HarddiskVolume1

Install Date: 29/01/2012 07:45:20

System Uptime: 02/03/2014 14:34:18 (0 hours ago)

.

Motherboard: Hewlett-Packard | | 338D

Processor: Intel® Atom CPU N2600 @ 1.60GHz | CPU | 1600/400mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 281 GiB total, 214,313 GiB free.

D: is FIXED (NTFS) - 17 GiB total, 1,801 GiB free.

E: is FIXED (FAT32) - 0 GiB total, 0,085 GiB free.

F: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: ACPI\HPQ0004\3&11583659&0

Manufacturer:

Name:

PNP Device ID: ACPI\HPQ0004\3&11583659&0

Service:

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: Security Processor Loader Driver

Device ID: ROOT\LEGACY_SPLDR\0000

Manufacturer:

Name: Security Processor Loader Driver

PNP Device ID: ROOT\LEGACY_SPLDR\0000

Service: spldr

.

==== System Restore Points ===================

.

RP202: 21/01/2014 10:15:51 - Windows Update

RP203: 25/01/2014 09:59:48 - Windows Update

RP204: 28/01/2014 11:46:40 - Windows Update

RP205: 31/01/2014 23:14:33 - Windows Update

RP206: 06/02/2014 21:39:03 - Windows Update

RP207: 13/02/2014 23:01:09 - Windows Update

RP208: 17/02/2014 22:20:07 - Windows Update

RP209: 25/02/2014 15:33:47 - Windows Update

RP210: 26/02/2014 22:36:23 - Windows Update

RP211: 02/03/2014 00:22:38 - Windows Update

RP212: 02/03/2014 00:28:22 - Windows Update

RP213: 02/03/2014 03:53:43 - Windows Update

.

==== Installed Programs ======================

.

7-Zip 9.20

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.4) MUI

Adobe Shockwave Player 11.6

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Athan Basic 4.1

Atheros Bluetooth Suite

Atheros Driver Installation Program

Chuzzle Deluxe

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Coffret de pilotes Logitech QuickCam

CyberLink YouCam

D3DX10

Dora's World Adventure

ESU for Microsoft Windows 7 SP1

Farm Frenzy

Galerie de photos Windows Live

Google Chrome

Hewlett-Packard ACLM.NET v1.2.1.1

Hoyle Card Games

HP Auto

HP Client Services

HP Customer Experience Enhancements

HP Documentation

HP Games

HP Launch Box

HP On Screen Display

HP Power Manager

HP Quick Launch

HP Recovery Manager

HP Security Assistant

HP Setup

HP Setup Manager

HP Software Framework

HP Support Assistant

Insaniquarium Deluxe

Intel® Control Center

Intel® Graphics Media Accelerator Driver

Intel® Rapid Storage Technology

iTunes

Junk Mail filter update

Letters from Nowhere 2

Logitech Webcam Software

Luxor HD

Mah Jong Medley

Mesh Runtime

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft PowerPoint Viewer

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

MSVCRT

opensource

PDF Creator

PDF Writer Packages

Realtek Ethernet Controller Driver

Realtek USB 2.0 Card Reader

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2901110v2)

Skip-Bo - Castaway Caper

Skype™ 6.3

swMSM

Synaptics TouchPad Driver

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)

Update Installer for WildTangent Games App

VLC media player 2.0.4

Vuze

WildTangent Games App (HP Games)

Windows Live

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

.

==== Event Viewer Messages From Past Week ========

.

27/02/2014 12:36:12, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 172.16.114.170. The computer with the IP address 172.16.125.181 did not allow the name to be claimed by this computer.

27/02/2014 12:31:51, Error: NetBT [4319] - A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.

26/02/2014 19:58:37, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

02/03/2014 14:47:44, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.

02/03/2014 14:36:34, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

02/03/2014 14:35:12, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

02/03/2014 14:35:12, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

02/03/2014 14:35:10, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

02/03/2014 14:35:04, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

02/03/2014 14:34:54, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\athihvs.dll Error Code: 21

02/03/2014 14:34:37, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom discache spldr Wanarpv6

02/03/2014 14:34:36, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 14:32:04, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom

02/03/2014 04:31:50, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:29:55, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:29:39, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

02/03/2014 04:29:39, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

02/03/2014 04:28:38, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD cdrom DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

02/03/2014 04:28:37, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

02/03/2014 04:13:13, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HP Support Assistant Service service.

02/03/2014 04:10:49, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 4.5.1 for Windows 7 (KB2858725).

02/03/2014 03:36:57, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

02/03/2014 01:04:01, Error: Service Control Manager [7023] - The Windows Time service terminated with the following error: A system shutdown is in progress.

02/03/2014 00:16:10, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147467243

.

==== End Of File ===========================

Please help me !

Maniac · March 2, 2014

Hello Dimaj and :welcome: ! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as Vuze or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Please generate a new fresh DDS log file and post it here.

Dimaj · March 2, 2014

As you recommended I uninstalled Vuze.

These are the new fresh dds log files:

DDS:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 11.0.9600.16428

Run by z at 17:59:52 on 2014-03-02

Microsoft Windows 7 Starter 6.1.7601.1.1252.33.1033.18.1012.330 [GMT 1:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Program Files\IDT\WDM\STacSV.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\IDT\WDM\aestsrv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bluetooth Suite\adminservice.exe

C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe

C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\System32\rundll32.exe

C:\Users\z\AppData\Local\winlogon.exe

C:\Users\z\AppData\Local\services.exe

C:\Users\z\AppData\Local\lsass.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\CyberLink\YouCam\YCMMirage.exe

C:\Windows\explorer.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files\Bluetooth Suite\BtvStack.exe

C:\Program Files\Bluetooth Suite\AthBtTray.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Hewlett-Packard\HP On Screen Display\HPOSD.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Athan\Athan.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\IDT\WDM\sttray.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Users\z\AppData\Local\Google\Update\GoogleUpdate.exe

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\z\AppData\Local\csrss.exe

C:\Windows\System32\WUDFHost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation