Jump to content

Quarantine Question

dawiba

By dawiba
in Resolved Malware Removal Logs

 Share

Recommended Posts

dawiba

dawiba

Posted
Posted

Hi

I posted a question in the main forum and was advised in the reply to post here and to post the results of various logs.

DDS

DDS (Ver_10-03-17.01) - NTFSX64

Run by David at 13:31:57.02 on 03/10/2010

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_21

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.4087.2310 [GMT 1:00]

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

C:\Windows\system32\dldwcoms.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\SysWOW64\nlssrv32.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Trusteer\Rapport\bin\RapportLaunService64.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Program Files (x86)\Dell V505\dldwmon.exe

C:\Program Files (x86)\Dell V505\dldwMsdMon.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Windows Live\Mesh\WLSync.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Dell\DellDock\DellDock.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe

C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\internet explorer\iexplore.exe

C:\Program Files (x86)\internet explorer\iexplore.exe

C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\mswinext.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10k_ActiveX.exe

C:\Windows\system32\DllHost.exe

C:\Program Files (x86)\internet explorer\iexplore.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Users\David\Desktop\dds.scr

C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

mLocal Page = c:\windows\syswow64\blank.htm

mWinlogon: Userinit=userinit.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files (x86)\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files (x86)\windows live\companion\companioncore.dll

BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files (x86)\msn toolbar\platform\6.3.2322.0\npwinext.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll

TB: @c:\program files (x86)\msn toolbar\platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files (x86)\msn toolbar\platform\6.3.2322.0\npwinext.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

uRun: [Google Update] "c:\users\david\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [WLSync] "c:\program files (x86)\windows live\mesh\WLSync.exe" /background

uRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /background

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [sunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe"

mRun: [shwiconXP9106] c:\program files (x86)\multimedia card reader(9106)\ShwiconXP9106.exe

mRun: [PDVDDXSrv] "c:\program files (x86)\cyberlink\powerdvd dx\PDVDDXSrv.exe"

mRun: [DellSupportCenter] "c:\program files (x86)\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [Dell V505] "c:\program files (x86)\dell v505\fm3032.exe" /s

mRun: [LWS] c:\program files (x86)\logitech\lws\webcam software\LWS.exe -hide

mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime

mRun: [Malwarebytes' Anti-Malware] "c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\users\david\appdata\roaming\micros~1\windows\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files (x86)\windows live\companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files (x86)\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe

mRun-x64: [skytel] c:\program files\realtek\audio\hda\Skytel.exe

mRun-x64: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey

mRun-x64: [dldwmon.exe] "c:\program files (x86)\dell v505\dldwmon.exe"

mRun-x64: [dldwamon] "c:\program files (x86)\dell v505\dldwamon.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\users\david\appdata\roaming\mozilla\firefox\profiles\c9r5xu6v.default\

FF - plugin: c:\program files (x86)\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files (x86)\nvidia corporation\3d vision\npnv3dv.dll

FF - plugin: c:\program files (x86)\nvidia corporation\3d vision\npnv3dvstreaming.dll

FF - plugin: c:\program files (x86)\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\david\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2010-1-7 55280]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 173984]

R1 RapportKE64;RapportKE64;c:\program files (x86)\trusteer\rapport\bin\RapportKE64.sys [2010-8-31 62960]

R1 RapportPG64;RapportPG64;c:\program files (x86)\trusteer\rapport\bin\RapportPG64.sys [2010-8-31 56816]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv64.sys [2010-2-17 14920]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\saskutil64.sys [2010-2-17 12360]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore64.exe [2010-6-29 128752]

R2 AERTFilters;Andrea RT Filters Service;c:\program files\realtek\audio\hda\AERTSr64.exe [2010-1-7 92160]

R2 dldw_device;dldw_device;c:\windows\system32\dldwcoms.exe -service --> c:\windows\system32\dldwcoms.exe -service [?]

R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2009-6-9 155648]

R2 HMuKstOO;Kensington TrackballWorks Orbit Optical USB HID Device Filter Driver;c:\windows\system32\drivers\HMuKstOO.sys [2010-5-20 51024]

R2 MBAMService;MBAMService;c:\program files (x86)\malwarebytes' anti-malware\mbamservice.exe [2010-9-28 304464]

R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\syswow64\nlssrv32.exe [2010-6-14 63488]

R2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\trusteer\rapport\bin\RapportMgmtService.exe [2010-8-31 767208]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-7-9 248936]

R3 ffSaffireLE_1394;ffSaffireLE_1394;c:\windows\system32\drivers\ffSaffireLE_1394_x64.sys [2010-9-21 189440]

R3 ffSaffireLE_avs;ffSaffireLE_avs;c:\windows\system32\drivers\ffSaffireLE_avs_x64.sys [2010-9-21 65024]

R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60a.sys [2010-1-7 317480]

R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\drivers\lvrs64.sys [2010-7-27 339040]

R3 LVUVC64;Logitech Webcam 200(UVC);c:\windows\system32\drivers\lvuvc64.sys [2010-7-27 6465632]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-9-21 24664]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-3-25 40832]

R3 RapportLaunService;Rapport Launching Service;c:\program files (x86)\trusteer\rapport\bin\RapportLaunService64.exe [2010-8-31 525808]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 dldwCATSCustConnectService;dldwCATSCustConnectService;c:\windows\system32\spool\drivers\x64\3\dldwserv.exe [2009-7-24 33448]

S2 SessionLauncher;SessionLauncher;c:\users\admini~1\appdata\local\temp\dx9\sessionlauncher.exe --> c:\users\admini~1\appdata\local\temp\dx9\SessionLauncher.exe [?]

S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-9-30 48488]

S3 fsssvc;Windows Live Family Safety Service;c:\program files (x86)\windows live\family safety\fsssvc.exe [2010-9-23 1493352]

S3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\drivers\lvpopf64.sys [2010-7-27 271712]

S3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2009-6-26 1124848]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-9-21 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 57184]

=============== Created Last 30 ================

2010-10-03 12:22:54 0 ----a-w- c:\users\david\defogger_reenable

2010-10-03 10:56:50 0 d-----w- c:\users\david\appdata\roaming\SUPERAntiSpyware.com

2010-10-03 10:56:50 0 d-----w- c:\programdata\SUPERAntiSpyware.com

2010-10-03 10:56:45 0 d-----w- c:\programdata\!SASCORE

2010-10-03 10:56:42 0 d-----w- c:\program files\SUPERAntiSpyware

2010-10-01 22:10:00 0 d-----w- c:\program files\Speccy

2010-10-01 08:52:12 56 ---ha-w- c:\programdata\ezsidmv.dat

2010-10-01 08:51:24 0 d-----r- c:\program files (x86)\Skype

2010-10-01 08:51:15 0 d-----w- c:\programdata\Skype

2010-09-30 22:53:04 0 d-----w- c:\program files (x86)\MSN Toolbar

2010-09-30 22:52:50 0 d-----w- c:\program files (x86)\Bing Bar Installer

2010-09-30 22:45:58 0 d-----w- c:\users\david\Tracing

2010-09-30 22:43:17 0 d-----w- c:\windows\en

2010-09-30 22:28:02 48488 ----a-w- c:\windows\system32\drivers\fssfltr.sys

2010-09-30 22:26:15 0 d-----w- c:\program files\Windows Live

2010-09-30 22:23:57 69464 ----a-w- c:\windows\syswow64\XAPOFX1_3.dll

2010-09-30 22:23:57 523088 ----a-w- c:\windows\system32\d3dx10_42.dll

2010-09-30 22:23:57 515416 ----a-w- c:\windows\syswow64\XAudio2_5.dll

2010-09-30 22:23:57 453456 ----a-w- c:\windows\syswow64\d3dx10_42.dll

2010-09-30 22:22:59 3860992 ----a-w- c:\windows\system32\UIRibbon.dll

2010-09-30 22:22:59 2983424 ----a-w- c:\windows\syswow64\UIRibbon.dll

2010-09-30 22:22:59 1164800 ----a-w- c:\windows\syswow64\UIRibbonRes.dll

2010-09-30 22:22:59 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll

2010-09-30 22:22:04 257024 ----a-w- c:\windows\system32\mfreadwrite.dll

2010-09-30 22:22:04 206848 ----a-w- c:\windows\system32\mfps.dll

2010-09-30 22:22:03 196608 ----a-w- c:\windows\syswow64\mfreadwrite.dll

2010-09-30 22:22:03 1888256 ----a-w- c:\windows\system32\WMVDECOD.DLL

2010-09-30 22:22:03 1619456 ----a-w- c:\windows\syswow64\WMVDECOD.DLL

2010-09-30 22:22:02 4068864 ----a-w- c:\windows\system32\mf.dll

2010-09-30 22:22:02 3181568 ----a-w- c:\windows\syswow64\mf.dll

2010-09-30 11:04:44 0 d-----w- c:\program files (x86)\NVIDIA Corporation

2010-09-30 11:04:24 0 d-----w- c:\programdata\NVIDIA Corporation

2010-09-30 11:04:15 0 d-----w- c:\program files\NVIDIA Corporation

2010-09-28 21:16:50 243712 ----a-w- c:\windows\system32\drivers\ks.sys

2010-09-28 21:10:33 2048 ----a-w- c:\windows\syswow64\tzres.dll

2010-09-28 21:10:33 2048 ----a-w- c:\windows\system32\tzres.dll

2010-09-28 19:37:24 142 ----a-w- c:\users\david\appdata\roaming\wklnhst.dat

2010-09-28 19:29:30 0 d-----w- c:\users\david\appdata\roaming\Windows Live Writer

2010-09-28 19:28:41 0 d-----w- c:\users\david\appdata\roaming\Dell Imaging Toolbox

2010-09-28 18:35:38 0 d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2010-09-26 15:58:50 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

2010-09-24 20:42:09 0 d-----w- c:\users\david\appdata\roaming\Korg

2010-09-24 20:40:27 0 d-----w- c:\program files (x86)\KORG

2010-09-24 20:39:46 0 d-----w- c:\windows\Downloaded Installations

2010-09-24 18:25:33 0 d-----w- c:\programdata\CyberLink

2010-09-24 10:45:53 0 d-----w- c:\program files (x86)\Amazon

2010-09-22 23:47:28 49016 ----a-w- c:\windows\syswow64\sirenacm.dll

2010-09-22 23:32:56 301936 ----a-w- c:\windows\WLXPGSS.SCR

2010-09-22 10:56:59 16 ----a-w- c:\windows\syswow64\w3data.vss

2010-09-22 10:56:59 16 ----a-w- c:\windows\syswow64\msvcsv60.dll

2010-09-22 10:56:59 16 ----a-w- c:\windows\msocreg32.dat

2010-09-22 10:56:36 0 d-----w- c:\program files (x86)\NOTION SLE-Miroslav PLK

2010-09-21 23:24:28 0 d-----w- c:\users\david\appdata\roaming\Dropbox

2010-09-21 22:49:47 28672 --sha-w- c:\users\david\Thumbs.db

2010-09-21 22:06:04 0 d-----w- c:\programdata\Apple Computer

2010-09-21 21:34:32 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys

2010-09-21 20:50:14 0 d-----w- c:\users\david\T-Racks

2010-09-21 20:34:00 0 d--h--w- c:\windows\AxInstSV

2010-09-21 20:29:16 0 d-----w- c:\users\david\appdata\roaming\Trusteer

2010-09-21 20:29:10 0 d-----w- c:\program files (x86)\Trusteer

2010-09-21 20:21:44 0 d-----w- c:\programdata\Trusteer

2010-09-21 20:11:15 0 d-----w- c:\users\david\Reaper

2010-09-21 20:06:50 0 d-----w- c:\users\david\appdata\roaming\REAPER

2010-09-21 20:06:25 0 d-----w- c:\program files\REAPER (x64)

2010-09-21 14:45:48 0 d-----w- c:\programdata\Apple

2010-09-21 13:49:02 252800 ----a-w- c:\windows\system32\LIVESSP.DLL

2010-09-21 13:03:14 208768 ----a-w- c:\windows\syswow64\LIVESSP.DLL

2010-09-21 12:14:59 0 d-----w- c:\programdata\IK Multimedia

2010-09-21 11:57:33 0 d-----w- c:\program files (x86)\common files\DigiDesign

2010-09-21 11:57:32 0 d-----w- c:\program files (x86)\Steinberg

2010-09-21 11:55:54 0 d-----w- c:\program files (x86)\IK Multimedia

2010-09-21 11:14:22 0 d-----w- c:\windows\syswow64\Wat

2010-09-21 11:14:22 0 d-----w- c:\windows\system32\Wat

2010-09-21 11:12:49 9728 ----a-w- c:\windows\system32\ffSaffireLE_coinst.dll

2010-09-21 11:12:49 65024 ----a-w- c:\windows\system32\drivers\ffSaffireLE_avs_x64.sys

2010-09-21 11:12:49 189440 ----a-w- c:\windows\system32\drivers\ffSaffireLE_1394_x64.sys

2010-09-21 11:12:48 0 d-----w- c:\program files (x86)\Focusrite Saffire LE

2010-09-21 11:09:52 0 d-----w- c:\users\david\appdata\roaming\OpenOffice.org

2010-09-21 11:08:35 0 d-----w- c:\program files (x86)\OpenOffice.org 3

2010-09-21 11:07:30 153376 ----a-w- c:\windows\syswow64\javaws.exe

2010-09-21 11:07:30 145184 ----a-w- c:\windows\syswow64\javaw.exe

2010-09-21 11:07:30 145184 ----a-w- c:\windows\syswow64\java.exe

2010-09-21 11:06:39 0 d-----w- c:\users\david\redist

2010-09-21 11:06:39 0 d-----w- c:\users\david\java

2010-09-21 10:00:45 0 d-----w- c:\users\david\appdata\roaming\V505 Series

2010-09-21 09:57:06 2058752 ----a-w- c:\windows\syswow64\iertutil.dll

2010-09-21 09:15:08 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs

2010-09-21 09:14:13 0 d-----w- c:\program files\common files\logishrd

2010-09-21 09:11:52 0 d-----w- c:\program files (x86)\GPLGS

2010-09-21 09:11:03 85504 ----a-w- c:\windows\system32\cpwmon64.dll

2010-09-21 09:11:02 0 d-----w- c:\program files (x86)\Acro Software

2010-09-21 09:09:30 0 d-----w- c:\programdata\Dl_cats

2010-09-21 09:07:36 270208 ------w- c:\windows\system32\MpSigStub.exe

2010-09-21 09:06:27 0 d-----w- c:\programdata\V505 Series

2010-09-21 09:06:27 0 d-----w- c:\programdata\V505

2010-09-21 09:06:22 0 d-----w- c:\program files\Dell V505

2010-09-21 09:06:20 0 d-----w- c:\program files (x86)\Dell V505

2010-09-21 09:03:49 0 d-----w- c:\programdata\Sun

2010-09-21 09:03:39 423656 ----a-w- c:\windows\syswow64\deployJava1.dll

2010-09-21 08:57:42 0 d-----w- c:\users\david\appdata\roaming\Malwarebytes

2010-09-21 08:57:36 24664 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-21 08:57:36 0 d-----w- c:\programdata\Malwarebytes

2010-09-21 08:56:18 0 d-----w- c:\program files (x86)\Microsoft Antimalware

2010-09-21 08:56:13 0 d-----w- c:\program files\Microsoft Security Essentials

2010-09-21 08:55:32 0 d-----w- c:\program files (x86)\CCleaner

2010-09-21 08:26:21 0 d-----w- c:\users\david\My Backup Files

2010-09-21 08:25:45 0 d-----w- c:\program files (x86)\MSXML 4.0

2010-09-21 08:24:47 99176 ----a-w- c:\windows\syswow64\PresentationHostProxy.dll

2010-09-21 08:24:47 49472 ----a-w- c:\windows\syswow64\netfxperf.dll

2010-09-21 08:24:47 48960 ----a-w- c:\windows\system32\netfxperf.dll

2010-09-21 08:24:47 444752 ----a-w- c:\windows\system32\mscoree.dll

2010-09-21 08:24:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe

2010-09-21 08:24:47 297808 ----a-w- c:\windows\syswow64\mscoree.dll

2010-09-21 08:24:47 295264 ----a-w- c:\windows\syswow64\PresentationHost.exe

2010-09-21 08:24:47 1942856 ----a-w- c:\windows\system32\dfshim.dll

2010-09-21 08:24:47 1130824 ----a-w- c:\windows\syswow64\dfshim.dll

2010-09-21 08:24:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2010-09-21 08:24:37 294912 ----a-w- c:\windows\system32\browserchoice.exe

2010-09-21 08:18:51 54272 ----a-w- c:\windows\system32\iyuv_32.dll

2010-09-21 08:16:11 716800 ----a-w- c:\windows\syswow64\jscript.dll

2010-09-21 08:16:10 70656 ----a-w- c:\windows\syswow64\fontsub.dll

2010-09-21 08:16:10 46080 ----a-w- c:\windows\system32\atmlib.dll

2010-09-21 08:16:10 366080 ----a-w- c:\windows\system32\atmfd.dll

2010-09-21 08:16:10 34304 ----a-w- c:\windows\syswow64\atmlib.dll

2010-09-21 08:16:10 293888 ----a-w- c:\windows\syswow64\atmfd.dll

2010-09-21 08:16:10 100864 ----a-w- c:\windows\system32\fontsub.dll

2010-09-21 08:05:02 0 d-----w- c:\users\david\appdata\roaming\Dell

2010-09-21 08:03:38 0 d-sh--w- C:\$RECYCLE.BIN

2010-09-21 08:02:35 220672 ----a-w- c:\windows\system32\wintrust.dll

2010-09-21 08:02:35 172032 ----a-w- c:\windows\syswow64\wintrust.dll

2010-09-21 08:02:34 139264 ----a-w- c:\windows\system32\cabview.dll

2010-09-21 08:02:34 132608 ----a-w- c:\windows\syswow64\cabview.dll

2010-09-21 07:42:14 0 d-----w- c:\windows\SMINST

2010-09-08 10:17:46 94208 ----a-w- c:\windows\syswow64\QuickTimeVR.qtx

2010-09-08 10:17:46 69632 ----a-w- c:\windows\syswow64\QuickTime.qts

==================== Find3M ====================

2010-08-21 06:29:47 558592 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-10 17:33:26 368640 ----a-w- c:\windows\syswow64\ReWire.dll

2010-07-29 06:30:34 82944 ----a-w- c:\windows\syswow64\iccvid.dll

2010-07-27 14:03:24 12867584 ----a-w- c:\windows\syswow64\shell32.dll

2010-07-27 07:14:12 539232 ----a-w- c:\windows\syswow64\LVUI2RC.dll

2010-07-27 07:14:00 543328 ----a-w- c:\windows\syswow64\LVUI2.dll

2010-07-27 07:13:50 559712 ----a-w- c:\windows\system32\LVUIRC64.dll

2010-07-27 07:13:04 771168 ----a-w- c:\windows\system32\LVUI64.dll

2010-07-27 07:08:58 269408 ----a-w- c:\windows\system32\lvco1311021.dll

2010-07-27 07:08:22 398432 ----a-w- c:\windows\system32\lvcod64.dll

2010-07-27 07:07:56 416352 ----a-w- c:\windows\syswow64\lvcodec2.dll

2010-07-27 07:03:20 10829656 ----a-w- c:\windows\syswow64\LogiDPP.dll

2010-07-27 07:03:20 10829656 ----a-w- c:\windows\system32\LogiDPP.dll

2010-07-27 07:03:20 102744 ----a-w- c:\windows\syswow64\LogiDPPApp.exe

2010-07-27 07:03:20 102744 ----a-w- c:\windows\system32\LogiDPPApp.exe

2010-07-27 07:03:18 290648 ----a-w- c:\windows\syswow64\DevManagerCore.dll

2010-07-27 07:03:18 290648 ----a-w- c:\windows\system32\DevManagerCore.dll

2010-07-27 06:55:50 37518 ----a-w- c:\windows\system32\Repository.reg

2010-07-11 14:47:40 453456 ----a-w- c:\windows\syswow64\d3dx10_41.dll

2010-07-11 14:47:40 1846632 ----a-w- c:\windows\syswow64\D3DCompiler_41.dll

2010-07-09 15:17:18 1882216 ----a-w- c:\windows\system32\nvsvcr.dll

2010-07-09 15:17:18 159336 ----a-w- c:\windows\system32\nvvsvc.exe

2010-07-09 15:17:18 1585256 ----a-w- c:\windows\system32\nvsvc64.dll

2010-07-09 15:17:18 15314024 ----a-w- c:\windows\system32\nvcpl.dll

2010-07-09 15:17:18 116328 ----a-w- c:\windows\system32\nvmctray.dll

2010-07-07 12:46:54 660072 ----a-w- c:\windows\system32\nvuninst.exe

2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat

2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat

2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat

2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat

2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini

2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini

2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat

2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe

2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 13:32:07.99 ===============

Malwarebytes

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4735

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

03/10/2010 11:52:29

mbam-log-2010-10-03 (11-52-29).txt

Scan type: Full scan (C:\|I:\|)

Objects scanned: 395568

Time elapsed: 47 minute(s), 11 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

I've also attached the the other files as requested. I hope I've done this correctly!

Many thanks

ark.zip

Attach.zip

Link to post
Share on other sites
  • 4 weeks later...
Maurice Naggar

Maurice Naggar

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.