Desmond Posted January 12, 2010 ID:183102 Share Posted January 12, 2010 Hi,Just want to say thanks in advance and hope you can help me out.Long story short, my brother was using my PC and decided to download some pirated program with a keygen from uTorrent (i guess you can see where this is going here).Later when I got home from work I noticed that MBAM IP protection kept blocking IP's even when I was just typing out documents and not surfing nor connected to any P2P programs. When I asked him if he was messing around with my PC he said the keygen.exe turned out to be a Trojan.Downloaded which was caught by MBAM. According to him it was detected, quarantined and he then deleted it. Did a full MBAM & SUPERAntiSpyware scan which came out fine as well as a Kaspersky 2010 scan but the problem seems to still persist. Had an error initially upon opening TrendMicro Hijack This but managed to proceed with the scan and get the log files.I'd appreciate it if you could help take a look and let me know if there are any critical problems. I have all my personal/banking info in this PC and after running the tests I've disconnected it from my network until further advice.Please view the attached log files below:Malwarebytes' Anti-Malware Log Fileprotection-log-2010-01-11Malwarebytes' Anti-Malware Log Fileprotection-log-2010-01-1109:39:27 Admin MESSAGE Protection started successfully09:39:30 Admin MESSAGE IP Protection started successfully12:17:41 Admin IP-BLOCK 85.159.233.23312:17:41 Admin IP-BLOCK 85.159.233.23312:17:51 Admin IP-BLOCK 85.159.233.23312:18:31 Admin IP-BLOCK 81.177.23.6812:18:31 Admin IP-BLOCK 81.177.23.6812:18:41 Admin IP-BLOCK 81.177.23.6812:20:41 Admin IP-BLOCK 67.212.76.14112:20:51 Admin IP-BLOCK 67.212.76.14112:20:51 Admin IP-BLOCK 67.212.76.14112:38:12 Admin IP-BLOCK 58.241.182.3012:55:23 Admin IP-BLOCK 121.8.21.12512:57:13 Admin DETECTION I:\[RNL] Sothink SWF Decompiler v5.3 (Build 526)\Keygen.exe Trojan.Downloader QUARANTINE12:57:13 Admin DETECTION I:\[RNL] Sothink SWF Decompiler v5.3 (Build 526)\Keygen.exe Trojan.Downloader DENY12:57:13 Admin DETECTION I:\[RNL] Sothink SWF Decompiler v5.3 (Build 526)\Keygen.exe Trojan.Downloader DENY13:07:34 Admin IP-BLOCK 95.211.12.14013:07:34 Admin IP-BLOCK 95.211.12.14013:07:34 Admin IP-BLOCK 95.211.12.14013:07:34 Admin IP-BLOCK 95.211.12.14013:07:34 Admin IP-BLOCK 95.211.12.14013:07:34 Admin IP-BLOCK 95.211.12.14013:17:05 Admin IP-BLOCK 218.8.50.17213:24:45 Admin IP-BLOCK 195.161.25.8313:25:25 Admin IP-BLOCK 221.5.8.11513:42:57 Admin IP-BLOCK 221.5.8.11513:55:17 Admin IP-BLOCK 222.76.58.17113:56:38 Admin IP-BLOCK 89.28.82.8113:57:28 Admin MESSAGE IP Protection stopped13:57:30 Admin MESSAGE Database updated successfully13:57:30 Admin MESSAGE IP Protection started successfully13:59:30 Admin MESSAGE IP Protection stopped13:59:30 Admin MESSAGE IP Protection started successfully13:59:40 Admin MESSAGE IP Protection stopped13:59:41 Admin MESSAGE IP Protection started successfully14:10:41 Admin IP-BLOCK 89.28.121.7514:26:22 Admin IP-BLOCK 195.161.7.6614:26:53 Admin IP-BLOCK 89.149.244.8914:41:04 Admin IP-BLOCK 220.248.163.15514:41:14 Admin IP-BLOCK 218.9.8.1114:41:35 Admin IP-BLOCK 58.240.247.20514:41:45 Admin IP-BLOCK 222.71.207.21814:48:55 Admin IP-BLOCK 222.70.207.22314:55:16 Admin IP-BLOCK 94.96.23.2715:13:49 Admin MESSAGE IP Protection stopped15:13:49 Admin MESSAGE IP Protection started successfully15:13:59 Admin MESSAGE IP Protection stopped15:13:59 Admin MESSAGE IP Protection started successfully15:38:22 Admin IP-BLOCK 69.31.86.6615:38:22 Admin IP-BLOCK 69.31.86.6615:38:32 Admin IP-BLOCK 69.31.86.6615:38:42 Admin IP-BLOCK 204.124.182.11915:38:42 Admin IP-BLOCK 222.186.88.3415:38:42 Admin IP-BLOCK 204.124.182.11915:38:52 Admin IP-BLOCK 204.124.182.11915:39:03 Admin MESSAGE IP Protection stopped15:39:04 Admin MESSAGE Added 204.124.182.119 to ignore list15:39:18 Admin MESSAGE IP Protection started successfully15:39:38 Admin MESSAGE IP Protection stopped15:39:38 Admin MESSAGE IP Protection started successfully15:48:59 Admin IP-BLOCK 58.241.131.19915:49:19 Admin IP-BLOCK 58.241.131.19915:49:19 Admin IP-BLOCK 58.241.131.19915:55:10 Admin IP-BLOCK 220.189.253.3815:55:10 Admin IP-BLOCK 222.65.130.1816:04:10 Admin IP-BLOCK 94.96.222.21716:06:00 Admin IP-BLOCK 221.5.8.11516:08:20 Admin IP-BLOCK 221.5.8.11516:10:11 Admin IP-BLOCK 218.10.214.24216:10:21 Admin IP-BLOCK 194.165.0.7416:16:21 Admin IP-BLOCK 221.5.8.11516:26:02 Admin IP-BLOCK 222.69.26.13916:27:02 Admin IP-BLOCK 203.93.208.4416:36:23 Admin IP-BLOCK 94.75.209.22516:36:23 Admin IP-BLOCK 94.75.209.22516:36:33 Admin IP-BLOCK 94.75.209.22516:40:53 Admin IP-BLOCK 222.71.151.10516:41:24 Admin IP-BLOCK 89.28.44.4116:49:14 Admin IP-BLOCK 94.96.41.14816:51:05 Admin MESSAGE IP Protection stopped16:51:05 Admin MESSAGE IP Protection started successfully16:52:05 Admin MESSAGE IP Protection stopped16:52:05 Admin MESSAGE IP Protection started successfully16:55:25 Admin IP-BLOCK 222.70.214.23516:55:25 Admin IP-BLOCK 121.11.48.2317:03:36 Admin IP-BLOCK 94.96.196.12217:09:26 Admin IP-BLOCK 58.240.253.517:10:57 Admin IP-BLOCK 94.96.72.4017:13:47 Admin IP-BLOCK 221.5.8.11517:39:28 Admin IP-BLOCK 89.28.43.6517:40:28 Admin IP-BLOCK 67.212.92.22417:40:38 Admin IP-BLOCK 89.28.8.13117:54:59 Admin IP-BLOCK 94.96.24.13718:08:19 Admin IP-BLOCK 222.186.31.22818:10:30 Admin IP-BLOCK 89.28.113.1318:24:20 Admin IP-BLOCK 218.10.235.11818:24:50 Admin IP-BLOCK 218.9.156.21019:35:54 Admin IP-BLOCK 94.96.72.20720:37:54 Admin MESSAGE Protection started successfully20:37:58 Admin MESSAGE IP Protection started successfully20:58:54 Admin MESSAGE Protection started successfully20:58:57 Admin MESSAGE IP Protection started successfully23:21:14 Admin IP-BLOCK 213.174.141.7123:21:24 Admin IP-BLOCK 213.174.141.7123:21:24 Admin IP-BLOCK 213.174.141.7123:27:14 Admin IP-BLOCK 213.174.149.21123:27:24 Admin IP-BLOCK 213.174.149.21123:27:24 Admin IP-BLOCK 213.174.149.21123:27:44 Admin IP-BLOCK 213.174.149.21123:27:44 Admin IP-BLOCK 213.174.149.21123:27:54 Admin IP-BLOCK 213.174.149.21123:28:25 Admin IP-BLOCK 95.211.112.14723:28:25 Admin IP-BLOCK 95.211.112.14723:28:35 Admin IP-BLOCK 95.211.112.14723:29:45 Admin IP-BLOCK 213.174.149.21123:29:45 Admin IP-BLOCK 213.174.149.21123:29:52 Admin MESSAGE Added 213.174.149.211 to ignore list23:29:55 Admin IP-BLOCK 213.174.149.21123:29:55 Admin MESSAGE IP Protection stopped23:29:55 Admin MESSAGE IP Protection started successfullyDDS.txtDDS.txtDDS (Ver_09-12-01.01) - NTFSx86 Run by Admin at 10:46:36.99 on Tue 01/12/2010Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_17Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3063.2027 [GMT 8:00]============== Running Processes ===============C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\AUDIODG.EXEC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\xampplite\apache\bin\httpd.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files\Input Director\IDWinService.exeC:\Program Files\Input Director\InputDirectorSessionHelper.exeC:\xampplite\mysql\bin\mysqld.exeC:\Program Files\Sandboxie\SbieSvc.exeC:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exeC:\xampplite\apache\bin\httpd.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXEC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Program Files\VIA\VIAudioi\VDeck\VDeck.exeC:\Program Files\Razer\Lachesis\razerhid.exeC:\Program Files\Input Director\InputDirector.exeC:\Program Files\Razer\Lachesis\OSD.exeC:\Program Files\Input Director\IDVistaService.exeC:\Program Files\Digsby\lib\digsby-app.exeC:\Program Files\Razer\Lachesis\razerofa.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\Windows\system32\sppsvc.exeC:\Windows\System32\svchost.exe -k secsvcsC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\servicing\TrustedInstaller.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Users\Admin\Desktop\dds.scrC:\Windows\system32\conhost.exe============== Pseudo HJT Report ===============uStart Page = hxxp://google.comBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\ievkbd.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dllTB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dlluRun: [inputDirector] "c:\program files\input director\InputDirector.exe" /hideuRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exeuRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /backgroundmRun: [HDAudDeck] c:\program files\via\viaudioi\vdeck\VDeck.exe -rmRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exemRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe"mRun: [Lachesis] c:\program files\razer\lachesis\razerhid.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digsby.lnk - c:\program files\digsby\digsby.exemPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)mPolicies-system: PromptOnSecureDesktop = 0 (0x0)mPolicies-system: SoftwareSASGeneration = 3 (0x3)IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.htmlIE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.htmlIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dllIE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dllIE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dllDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabNotify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dllNotify: klogon - c:\windows\system32\klogon.dllAppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dllSTS: FencesShlExt Class: {1984dd45-52cf-49cd-ab77-18f378fea264} - c:\program files\stardock\fences\FencesMenu.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL================= FIREFOX ===================FF - ProfilePath - c:\users\admin\appdata\roaming\mozilla\firefox\profiles\o4y52qe6.default\FF - prefs.js: browser.search.selectedEngine - Thesaurus - Reference.comFF - prefs.js: browser.startup.homepage - hxxp://www.google.com/FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=FF - component: c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dllFF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dllFF - component: c:\users\admin\appdata\roaming\mozilla\firefox\profiles\o4y52qe6.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dllFF - plugin: c:\program files\java\jre6\bin\npdeploytk.dllFF - plugin: c:\program files\java\jre6\bin\npjpi160_17.dllFF - plugin: c:\program files\java\jre6\bin\npoji610.dllFF - plugin: c:\users\admin\appdata\local\google\update\1.2.183.13\npGoogleOneClick8.dllFF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}---- FIREFOX POLICIES ----c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);============= SERVICES / DRIVERS ===============R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-12-15 33808]R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2009-5-15 21008]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-1-5 9968]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-1-5 74480]R2 Apache2.2;Apache2.2;c:\xampplite\apache\bin\httpd.exe [2009-12-31 29416]R2 AVP;Kaspersky Anti-Virus;c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe [2009-5-25 303376]R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-1-9 12672]R2 InputDirector;Input Director Service;c:\program files\input director\IDWinService.exe [2009-6-19 32768]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-1-8 236368]R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2009-9-27 240232]R3 IDVistaService;Input Director Vista Service;c:\program files\input director\IDVistaService.exe [2009-2-8 13824]R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-5-16 19472]R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2009-12-4 12032]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-10-23 19160]R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-12-19 249888]R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2009-12-1 119296]R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2002-1-1 1067008]S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-1-11 16456]S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-1-11 11088]=============== Created Last 30 ================2010-01-12 02:39:53 0 ----a-w- c:\users\admin\defogger_reenable2010-01-11 12:30:53 585 ----a-w- c:\windows\pwnativedev.bak2010-01-11 12:29:10 1352 ----a-w- c:\windows\pwcmdlist.bak2010-01-11 12:09:16 461368 ----a-w- c:\windows\system32\pwNative.exe2010-01-11 12:09:16 16456 ----a-w- c:\windows\system32\pwdrvio.sys2010-01-11 12:09:16 11088 ----a-w- c:\windows\system32\pwdspio.sys2010-01-11 11:15:56 0 d-----w- c:\programdata\Spybot - Search & Destroy2010-01-11 08:27:26 0 d-----w- c:\program files\VirusTotalUploader22010-01-11 04:36:09 0 d-----w- c:\program files\uTorrent2010-01-11 04:24:53 0 d-----w- c:\users\admin\appdata\roaming\uTorrent2010-01-10 16:23:52 0 d-----w- c:\program files\Input Director2010-01-10 13:09:09 0 d-----w- c:\users\admin\appdata\roaming\Malwarebytes2010-01-10 13:00:38 0 d-----w- c:\users\admin\appdata\roaming\OpenOffice.org2010-01-10 12:51:51 0 d-----r- C:\Sandbox2010-01-10 08:09:57 0 d-----w- c:\windows\pss2010-01-10 05:55:56 0 d-----w- c:\program files\SystemRequirementsLab2010-01-10 05:20:13 0 d-----w- c:\programdata\Innovative Solutions2010-01-10 03:03:56 0 d-----w- c:\users\admin\appdata\roaming\GlarySoft2010-01-10 02:57:48 0 d-----w- c:\program files\Glary Utilities2010-01-10 02:09:55 33 ----a-w- c:\users\admin\.gtkrc-2.02010-01-08 19:56:17 773120 ----a-w- c:\windows\system32\NEROINSTAEC43759.DB2010-01-08 19:56:17 1414440 ----a-w- c:\windows\system32\ShellManager310E2D762.dll2010-01-08 19:49:06 0 d-----w- c:\users\admin\appdata\roaming\KC Softwares2010-01-08 19:43:16 0 d-----w- c:\program files\KC Softwares2010-01-08 19:42:53 1882 ----a-w- c:\windows\Sandboxie.ini2010-01-08 19:42:45 0 d-----w- c:\program files\Sandboxie2010-01-08 19:42:07 0 d-----w- c:\program files\Trend Micro2010-01-08 19:41:55 12672 ----a-w- c:\windows\system32\drivers\cpuz132_x32.sys2010-01-08 19:41:55 0 d-----w- c:\program files\CPUID2010-01-08 19:38:56 0 d-----w- c:\programdata\SUPERAntiSpyware.com2010-01-08 19:38:39 0 d-----w- c:\users\admin\appdata\roaming\SUPERAntiSpyware.com2010-01-08 19:38:39 0 d-----w- c:\program files\SUPERAntiSpyware2010-01-08 18:05:12 0 d-----w- c:\program files\Secunia2010-01-08 17:23:04 0 d-----w- c:\users\admin\appdata\roaming\Digsby2010-01-08 17:23:04 0 d-----w- c:\programdata\Digsby2010-01-08 17:21:22 0 d-----w- c:\program files\Digsby2010-01-08 16:16:50 0 d-----w- c:\users\admin\appdata\roaming\Stardock2010-01-08 16:16:48 0 dc-h--w- c:\programdata\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}2010-01-08 16:16:47 0 d-----w- c:\program files\Stardock2010-01-08 15:35:22 0 d-----w- c:\users\admin\appdata\roaming\XnView2010-01-08 15:31:15 0 d-----w- c:\program files\XnView2010-01-08 15:31:03 0 d-----w- c:\program files\CCleaner2010-01-08 15:31:02 0 d-----w- c:\program files\VS Revo Group2010-01-08 15:02:28 0 d-----w- c:\users\admin\appdata\roaming\GoodSync2010-01-08 14:48:51 0 d-----w- c:\users\admin\appdata\roaming\Jarte2010-01-08 14:45:07 2370766 ----a-w- c:\users\admin\Migrated Documents Report.csv2010-01-08 13:26:00 0 d-----w- c:\users\admin\appdata\roaming\Razer2010-01-08 02:53:39 0 d-----w- c:\program files\Jarte2009-12-30 22:54:23 0 d---a-w- C:\xampplite2009-12-22 04:15:09 0 d-----w- c:\program files\JoseNet2009-12-21 12:30:01 0 d-----w- c:\program files\Windows Live Writer2009-12-21 11:06:06 0 d-----w- c:\users\admin\appdata\roaming\Windows Live Writer2009-12-19 01:11:38 249888 ----a-w- c:\windows\system32\drivers\Rt86win7.sys2009-12-17 02:08:22 0 d-----w- c:\programdata\McAfee2009-12-16 02:47:24 0 d-----w- c:\programdata\McAfee Security Scan==================== Find3M ====================2010-01-07 08:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-01-07 08:07:04 19160 ----a-w- c:\windows\system32\drivers\mbam.sys2009-12-03 01:27:28 80416 ----a-w- c:\windows\system32\RtNicProp32.dll2009-12-03 01:27:28 100896 ----a-w- c:\windows\system32\RTNUninst32.dll2009-11-02 12:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe2009-10-29 07:22:37 2048 ----a-w- c:\windows\system32\tzres.dll2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat2002-01-01 11:28:06 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat2002-01-01 11:22:57 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe============= FINISH: 10:47:02.48 ===============DDS/GMER Log FilesAttach.zipTrend Micro HijackThis v2.0.2Initial error upon opening the program.(Just installed and opened it for the first time)Logfile of Trend Micro HijackThis v2.0.2Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:55:34 AM, on 1/12/2010Platform: Unknown Windows (WinNT 6.01.3504)MSIE: Internet Explorer v8.00 (8.00.7600.16385)Boot mode: NormalRunning processes:C:\Windows\system32\taskhost.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\VIA\VIAudioi\VDeck\VDeck.exeC:\Program Files\Razer\Lachesis\razerhid.exeC:\Program Files\Input Director\InputDirector.exeC:\Program Files\Razer\Lachesis\OSD.exeC:\Program Files\Razer\Lachesis\razerofa.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Program Files\Windows Live\Contacts\wlcomm.exeC:\Program Files\Siber Systems\GoodSync\GoodSync.exeC:\Program Files\Sandboxie\SbieCtrl.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dllO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dllO3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dllO4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -rO4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exeO4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exeO4 - HKCU\..\Run: [inputDirector] "C:\Program Files\Input Director\InputDirector.exe" /hideO4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')O4 - Global Startup: Digsby.lnk = C:\Program Files\Digsby\digsby.exeO9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.htmlO9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.htmlO9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dllO9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.htmlO9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dllO13 - Gopher Prefix: O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dllO20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dllO22 - SharedTaskScheduler: FencesShellExt - {1984DD45-52CF-49cd-AB77-18F378FEA264} - C:\Program Files\Stardock\Fences\FencesMenu.dllO23 - Service: Apache2.2 - Apache Software Foundation - C:\xampplite\apache\bin\httpd.exeO23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exeO23 - Service: Input Director Vista Service (IDVistaService) - Unknown owner - C:\Program Files\Input Director\IDVistaService.exeO23 - Service: Input Director Service (InputDirector) - Unknown owner - C:\Program Files\Input Director\IDWinService.exeO23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeO23 - Service: MySQL - MySQL AB - C:\xampplite\mysql\bin\mysqld.exeO23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exeO23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exeO23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exeO23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe--End of file - 6959 bytesPlease let me know if it looks OK and if there is any other information which you may need.Again, many thanks. Link to post Share on other sites More sharing options...
Recommended Posts