Jump to content

Trojan Downloader and Fakealert

Zelbar

By Zelbar
in Resolved Malware Removal Logs

 Share

Recommended Posts

Zelbar

Zelbar

Posted
Posted

I have two trojans that keep coming up. Malwarebytes identifies them and says they are deleted but upon reboot they are back.

We are getting some redirect on the web.

Any help would be greatly appreciated.

I have 4 kids that all use my system so who knows where they have gone or done

requested files are below and attached.

I have 4 kids that all use my system so who knows where they have gone or done

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4875

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

1/6/2011 9:52:44 PM

mbam-log-2011-01-06 (21-52-44).txt

Scan type: Quick scan

Objects scanned: 144205

Time elapsed: 7 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

H:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

DDS (Ver_10-12-12.02) - NTFSx86

Run by Earl at 20:38:42.47 on Thu 01/06/2011

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3063.1929 [GMT -7:00]

AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

============== Running Processes ===============

H:\Windows\system32\wininit.exe

H:\Windows\system32\lsm.exe

H:\Windows\system32\svchost.exe -k DcomLaunch

H:\Windows\system32\nvvsvc.exe

H:\Windows\system32\svchost.exe -k RPCSS

H:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

H:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

H:\Windows\system32\svchost.exe -k netsvcs

H:\Program Files\Creative\Shared Files\CTAudSvc.exe

H:\Windows\system32\svchost.exe -k LocalService

H:\Windows\system32\WUDFHost.exe

H:\Windows\system32\WUDFHost.exe

H:\Windows\system32\svchost.exe -k NetworkService

H:\Windows\system32\taskeng.exe

H:\Windows\System32\spoolsv.exe

H:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

H:\Windows\system32\rundll32.exe

H:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

H:\Program Files\Bonjour\mDNSResponder.exe

H:\Program Files\Creative\Shared Files\CTDevSrv.exe

H:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

H:\Program Files\Starfield\offSyncService.exe

H:\Program Files\McAfee\SiteAdvisor\McSACore.exe

H:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe

H:\Windows\system32\rundll32.exe

H:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

H:\Windows\system32\nvvsvc.exe

H:\Windows\system32\taskhost.exe

H:\Windows\Explorer.EXE

H:\Windows\system32\Dwm.exe

H:\Windows\system32\IoctlSvc.exe

H:\Windows\system32\PnkBstrA.exe

H:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

H:\Windows\system32\svchost.exe -k imgsvc

H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

H:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

H:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

H:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

H:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe

H:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe

H:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe

H:\Program Files\McAfee.com\Agent\mcagent.exe

H:\Program Files\Common Files\Java\Java Update\jusched.exe

H:\Windows\system32\WUDFHost.exe

H:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

H:\Program Files\iTunes\iTunesHelper.exe

H:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe

H:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe

H:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe

H:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe

H:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe

H:\Windows\system32\SearchIndexer.exe

H:\Program Files\Windows Media Player\WMPSideShowGadget.exe

H:\Users\Earl\AppData\Local\Temp\Mzh.exe

H:\Program Files\Windows Media Player\wmpnetwk.exe

H:\Windows\system32\taskhost.exe

H:\Program Files\iPod\bin\iPodService.exe

H:\Windows\System32\svchost.exe -k LocalServicePeerNet

H:\Windows\system32\DllHost.exe

H:\Windows\system32\wuauclt.exe

H:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

H:\Windows\System32\svchost.exe -k WerSvcGroup

H:\Program Files\Mozilla Firefox\firefox.exe

H:\Windows\system32\SearchProtocolHost.exe

H:\Windows\system32\SearchFilterHost.exe

H:\Program Files\Windows Media Player\wmplayer.exe

H:\Windows\system32\DllHost.exe

H:\Windows\system32\DllHost.exe

H:\Users\Earl\Downloads\dds.scr

H:\Windows\system32\conhost.exe

H:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - h:\progra~1\mcafee\sitead~1\mcieplg.dll

uURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - h:\program files\xfirexo\tbXfir.dll

mURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - h:\program files\xfirexo\tbXfir.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - h:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - h:\progra~1\mcafee\msk\mskapbho.dll

BHO: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - h:\program files\xfirexo\tbXfir.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - h:\program files\common files\mcafee\systemcore\ScriptSn.20101105182319.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - h:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - h:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - h:\program files\java\jre6\bin\jp2ssv.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - h:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - h:\program files\xfirexo\tbXfir.dll

uRun: [msnmsgr] "h:\program files\msn messenger\MsnMsgr.Exe" /background

uRun: [JP595IR86O] h:\users\earl\appdata\local\temp\Mzh.exe

mRun: [Launch LgDeviceAgent] "h:\program files\logitech\gamepanel software\LgDevAgt.exe"

mRun: [Launch LCDMon] "h:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"

mRun: [Launch LGDCore] "h:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE

mRun: [mcui_exe] "h:\program files\mcafee.com\agent\mcagent.exe" /runkey

mRun: [sunJavaUpdateSched] "h:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "h:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "h:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "h:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

dRun: [wben] "h:\program files\starfield\wben.exe"

StartupFolder: h:\users\earl\appdata\roaming\micros~1\windows\startm~1\programs\startup\imvu.lnk - h:\users\earl\appdata\roaming\imvuclient\IMVUQualityAgent.exe

StartupFolder: h:\users\earl\appdata\roaming\micros~1\windows\startm~1\programs\startup\xfire.lnk - h:\program files\xfire\Xfire.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

Trusted Zone: internet

Trusted Zone: mcafee.com

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {99CAAA27-FA0C-4FA4-B88A-4AB1CC7A17FE} - hxxp://www.netgame.com/mplugin/mglaunch_USAv1005.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - h:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - h:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - h:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

================= FIREFOX ===================

FF - ProfilePath - h:\users\earl\appdata\roaming\mozilla\firefox\profiles\xh1cjk30.default\

FF - prefs.js: browser.search.selectedEngine - Secure Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=

FF - component: h:\program files\mcafee\siteadvisor\components\McFFPlg.dll

FF - plugin: h:\program files\download manager\npfpdlm.dll

FF - plugin: h:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: h:\program files\mcafee\supportability\mvt\NPMVTPlugin.dll

FF - plugin: h:\program files\mozilla firefox\plugins\npBFPlugin.dll

FF - plugin: h:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll

FF - plugin: h:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll

FF - plugin: h:\program files\mozilla firefox\plugins\NPMFireLauncher.dll

FF - plugin: h:\program files\nvidia corporation\3d vision\npnv3dv.dll

FF - plugin: h:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll

FF - plugin: h:\program files\pando networks\media booster\npPandoWebPlugin.dll

FF - plugin: h:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: h:\programdata\nexonus\ngm\npNxGameUS.dll

FF - plugin: h:\users\earl\appdata\local\microsoft\internet explorer\downloaded program files\npsoe.dll

FF - plugin: h:\users\earl\appdata\roaming\mozilla\plugins\npoff.dll

FF - plugin: h:\users\earl\appdata\roaming\mozilla\plugins\npwbe.dll

FF - plugin: h:\users\earl\documents\sparkplay media\sparkplayer (beta)\npSparkPlayerNS.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - h:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - h:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - h:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Starfield Zoom: zoomext@starfield - h:\program files\mozilla firefox\extensions\zoomext@starfield

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - h:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - h:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - h:\program files\mcafee\SiteAdvisor

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;h:\windows\system32\drivers\mfehidk.sys [2010-5-2 386840]

R1 mfenlfk;McAfee NDIS Light Filter;h:\windows\system32\drivers\mfenlfk.sys [2010-5-2 64304]

R1 mfewfpk;McAfee Inc. mfewfpk;h:\windows\system32\drivers\mfewfpk.sys [2010-5-2 164840]

R2 File Backup;File Backup Service;h:\program files\starfield\offSyncService.exe [2010-7-16 1310960]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;h:\program files\mcafee\siteadvisor\McSACore.exe [2011-1-5 88176]

R2 McMPFSvc;McAfee Personal Firewall Service;"h:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-7-7 271480]

R2 McNaiAnn;McAfee VirusScan Announcer;"h:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-7-7 271480]

R2 McProxy;McAfee Proxy Service;"h:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-7-7 271480]

R2 McShield;McShield;h:\program files\common files\mcafee\systemcore\mcshield.exe [2010-5-2 171168]

R2 mfefire;McAfee Firewall Core Service;h:\program files\common files\mcafee\systemcore\mfefire.exe [2010-5-2 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;h:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-5-2 141792]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;h:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-10-16 369256]

R3 cfwids;McAfee Inc. cfwids;h:\windows\system32\drivers\cfwids.sys [2010-5-2 55840]

R3 CT20XUT.SYS;CT20XUT.SYS;h:\windows\system32\drivers\CT20XUT.sys [2009-6-4 171032]

R3 CTEXFIFX.SYS;CTEXFIFX.SYS;h:\windows\system32\drivers\CTEXFIFX.sys [2009-6-4 1324056]

R3 CTHWIUT.SYS;CTHWIUT.SYS;h:\windows\system32\drivers\CTHWIUT.sys [2009-6-4 72728]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;h:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 19720]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;h:\windows\system32\drivers\LGVirHid.sys [2009-11-23 14856]

R3 MBAMSwissArmy;MBAMSwissArmy;h:\windows\system32\drivers\mbamswissarmy.sys [2010-10-18 38224]

R3 mfeavfk;McAfee Inc. mfeavfk;h:\windows\system32\drivers\mfeavfk.sys [2010-5-2 152960]

R3 mfebopk;McAfee Inc. mfebopk;h:\windows\system32\drivers\mfebopk.sys [2010-5-2 52104]

R3 mfefirek;McAfee Inc. mfefirek;h:\windows\system32\drivers\mfefirek.sys [2010-5-2 313288]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;h:\windows\system32\drivers\nvhda32v.sys [2011-1-4 123496]

R3 RTL8167;Realtek 8167 NT Driver;h:\windows\system32\drivers\Rt86win7.sys [2009-12-19 249888]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;h:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 apf001;apf001;h:\program files\softnyxgame\wolfteamis\apf001.sys [2010-10-15 10872]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;h:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;h:\program files\common files\creative labs shared\service\AL6Licensing.exe [2010-1-14 79360]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;h:\program files\common files\creative labs shared\service\CTAELicensing.exe [2010-1-14 79360]

S3 CT20XUT;CT20XUT;h:\windows\system32\drivers\CT20XUT.sys [2009-6-4 171032]

S3 CTEXFIFX;CTEXFIFX;h:\windows\system32\drivers\CTEXFIFX.sys [2009-6-4 1324056]

S3 CTHWIUT;CTHWIUT;h:\windows\system32\drivers\CTHWIUT.sys [2009-6-4 72728]

S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;h:\program files\steam\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe [2010-1-15 25832]

S3 mferkdet;McAfee Inc. mferkdet;h:\windows\system32\drivers\mferkdet.sys [2010-5-2 84264]

S3 npggsvc;nProtect GameGuard Service;h:\windows\system32\gamemon.des -service --> h:\windows\system32\GameMon.des -service [?]

S3 WatAdminSvc;Windows Activation Technologies Service;h:\windows\system32\wat\WatAdminSvc.exe [2010-2-25 1343400]

=============== Created Last 30 ================

2011-01-07 03:02:21 -------- dc----w- h:\progra~2\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}

2011-01-06 18:45:08 229888 ----a-w- h:\windows\Mbicoa.exe

2011-01-06 18:45:02 76800 --sha-r- h:\windows\system32\dpinsty.dll

2011-01-06 13:37:58 -------- d-----w- h:\users\earl\appdata\local\{A35250FA-4569-400B-A435-CF217C1399B9}

2011-01-05 20:39:43 -------- d-----w- h:\users\earl\appdata\local\{6442A907-8D48-4DF2-8E2D-44B4A150F898}

2011-01-04 23:00:27 -------- d-----w- h:\users\earl\appdata\local\{9B160BE0-3782-4553-BDD5-C3516B162B07}

2011-01-04 06:43:14 -------- d-----w- h:\users\earl\appdata\local\{527621CC-9E89-40BF-908F-7982A132B57C}

2011-01-03 13:32:57 -------- d-----w- h:\users\earl\appdata\local\{79F41F97-BF94-48C4-9ED0-818A1405C460}

2011-01-02 17:33:11 -------- d-----w- h:\users\earl\appdata\local\{9871CE69-4E5A-4527-BE26-877C5F25346D}

2011-01-01 21:48:38 -------- d-----w- h:\users\earl\appdata\local\{B10048C1-87DE-4FC1-A946-4A300028330E}

2010-12-31 18:56:46 -------- d-----w- h:\users\earl\appdata\local\{FE4A63ED-DA29-45C0-B7CB-66AC78B192FD}

2010-12-30 23:56:29 -------- d-----w- h:\users\earl\appdata\local\{F530D57F-CA8E-4FCB-9ADE-724A8E5731B9}

2010-12-30 17:28:36 -------- d-----w- h:\users\earl\appdata\local\Electronic Arts

2010-12-30 03:02:40 -------- d-----w- h:\users\earl\appdata\local\{D97043E6-5E90-4F6D-9780-DE26043FB591}

2010-12-29 00:55:54 -------- d-----w- h:\users\earl\appdata\local\{E6539EBB-9526-45EA-BEAA-B6723B928975}

2010-12-28 08:35:37 -------- d-----w- h:\users\earl\appdata\local\{D9B6A2EE-BE5A-4968-B311-AA31786EEABF}

2010-12-28 07:38:03 -------- d-----w- h:\users\earl\appdata\local\{34C68562-C900-4357-BB58-EF73E74AC7AA}

2010-12-27 05:58:12 -------- d-----w- h:\users\earl\appdata\local\{591B796C-B226-4394-B3C3-20A42638DCA4}

2010-12-27 05:58:12 -------- d-----w- h:\users\earl\appdata\local\{0BBB612D-2658-4F3B-8A4C-916486161AAA}

2010-12-26 15:10:21 -------- d-----w- h:\users\earl\appdata\local\{C87FC8B9-E32D-4A50-A157-396CDDD2BEE3}

2010-12-26 03:45:22 -------- d-----w- h:\users\earl\appdata\local\ArmA 2

2010-12-26 03:37:54 -------- d-----w- h:\users\earl\appdata\local\FalloutNV

2010-12-25 19:54:33 -------- d-----w- h:\users\earl\appdata\local\{788A4095-A2FC-4F65-8E74-6AFDC0213BDE}

2010-12-24 18:32:48 -------- d-----w- h:\users\earl\appdata\local\{FC863D30-0EC6-4961-B411-04A3E50184D6}

2010-12-24 06:56:18 -------- d-----w- h:\users\earl\appdata\roaming\Windows Live Writer

2010-12-24 06:56:18 -------- d-----w- h:\users\earl\appdata\local\Windows Live Writer

2010-12-24 03:11:29 -------- d-----w- h:\users\earl\appdata\local\{CA55D7EC-4317-4820-BD02-CF2C9582BAD6}

2010-12-24 03:04:16 -------- d-----w- h:\windows\en

2010-12-24 03:02:36 -------- d-----w- h:\program files\Microsoft SQL Server Compact Edition

2010-12-24 02:58:01 2983424 ----a-w- h:\windows\system32\UIRibbon.dll

2010-12-24 02:58:01 1164800 ----a-w- h:\windows\system32\UIRibbonRes.dll

2010-12-24 02:57:10 3181568 ----a-w- h:\windows\system32\mf.dll

2010-12-24 02:57:10 196608 ----a-w- h:\windows\system32\mfreadwrite.dll

2010-12-24 02:57:10 1619456 ----a-w- h:\windows\system32\WMVDECOD.DLL

2010-12-24 02:56:26 94040 ----a-w- h:\program files\common files\windows live\.cache\272522bd1cba3160c\DSETUP.dll

2010-12-24 02:56:26 525656 ----a-w- h:\program files\common files\windows live\.cache\272522bd1cba3160c\DXSETUP.exe

2010-12-24 02:56:26 1691480 ----a-w- h:\program files\common files\windows live\.cache\272522bd1cba3160c\dsetup32.dll

2010-12-24 02:56:23 94040 ----a-w- h:\program files\common files\windows live\.cache\250150571cba3160b\DSETUP.dll

2010-12-24 02:56:23 525656 ----a-w- h:\program files\common files\windows live\.cache\250150571cba3160b\DXSETUP.exe

2010-12-24 02:56:23 1691480 ----a-w- h:\program files\common files\windows live\.cache\250150571cba3160b\dsetup32.dll

2010-12-24 02:55:47 -------- d-----w- h:\users\earl\appdata\local\Windows Live

2010-12-24 00:43:00 -------- d-----w- h:\users\earl\appdata\local\WMTools Downloaded Files

2010-12-24 00:32:35 -------- d-----w- h:\program files\Movie Maker 2.6

2010-12-22 01:44:59 -------- d-----w- h:\program files\iPod

2010-12-22 01:44:58 -------- d-----w- h:\program files\iTunes

2010-12-22 01:40:30 -------- d-----w- h:\program files\Bonjour

2010-12-14 04:34:29 -------- d-----w- h:\program files\EVGA Precision

2010-12-14 04:33:13 74072 ----a-w- h:\windows\system32\XAPOFX1_5.dll

2010-12-14 04:33:13 527192 ----a-w- h:\windows\system32\XAudio2_7.dll

2010-12-14 04:33:13 239960 ----a-w- h:\windows\system32\xactengine3_7.dll

2010-12-14 04:33:13 2106216 ----a-w- h:\windows\system32\D3DCompiler_43.dll

2010-12-14 04:33:12 470880 ----a-w- h:\windows\system32\d3dx10_43.dll

2010-12-14 04:33:12 248672 ----a-w- h:\windows\system32\d3dx11_43.dll

2010-12-14 04:33:12 1998168 ----a-w- h:\windows\system32\D3DX9_43.dll

2010-12-14 04:33:12 1868128 ----a-w- h:\windows\system32\d3dcsx_43.dll

2010-12-14 04:25:59 16856 ----a-w- h:\program files\mozilla firefox\plugin-container.exe

2010-12-14 04:25:58 719832 ----a-w- h:\program files\mozilla firefox\mozcpp19.dll

2010-12-14 00:45:02 -------- d-----w- h:\users\earl\appdata\roaming\McAfee

2010-12-14 00:34:55 -------- d-----w- h:\progra~2\NVIDIA Corporation

2010-12-13 04:29:38 -------- d-----w- h:\users\earl\appdata\roaming\FreeStone Group

2010-12-13 04:29:35 -------- d-----w- h:\program files\Video Card Stability Test

2010-12-13 04:26:40 -------- d-----w- h:\users\earl\appdata\local\ElevatedDiagnostics

2010-12-12 17:50:35 -------- d-----w- h:\users\earl\appdata\roaming\CoffeeCup Software

==================== Find3M ====================

2011-01-05 18:58:00 270904 ----a-w- h:\windows\system32\PnkBstrB.xtr

2011-01-05 18:58:00 270904 ----a-w- h:\windows\system32\PnkBstrB.exe

2011-01-05 18:56:18 215128 ----a-w- h:\windows\system32\PnkBstrB.ex0

2010-12-02 23:23:17 75136 ----a-w- h:\windows\system32\PnkBstrA.exe

2010-11-30 00:38:30 94208 ----a-w- h:\windows\system32\QuickTimeVR.qtx

2010-11-30 00:38:30 69632 ----a-w- h:\windows\system32\QuickTime.qts

2010-11-10 09:54:18 49016 ----a-w- h:\windows\system32\sirenacm.dll

2010-11-10 09:28:46 301936 ----a-w- h:\windows\WLXPGSS.SCR

2010-10-23 16:24:00 139152 ----a-w- h:\users\earl\appdata\roaming\PnkBstrK.sys

2010-10-23 16:23:34 794408 ----a-w- h:\windows\system32\pbsvc.exe

2010-10-16 19:42:20 600680 ----a-w- h:\windows\system32\nvvsvc.exe

2010-10-16 19:42:20 110696 ----a-w- h:\windows\system32\nvmctray.dll

2010-10-16 19:42:16 3420776 ----a-w- h:\windows\system32\nvcpl.dll

2010-10-16 19:42:12 2079336 ----a-w- h:\windows\system32\nvsvc.dll

2010-10-16 18:55:00 888424 ----a-w- h:\windows\system32\nvdispco322050.dll

2010-10-16 18:55:00 813672 ----a-w- h:\windows\system32\nvgenco322030.dll

2010-10-16 18:55:00 57960 ----a-w- h:\windows\system32\OpenCL.dll

2010-10-16 18:55:00 5473896 ----a-w- h:\windows\system32\nvwgf2um.dll

2010-10-16 18:55:00 4837480 ----a-w- h:\windows\system32\nvcuda.dll

2010-10-16 18:55:00 319080 ----a-w- h:\windows\system32\nvdecodemft.dll

2010-10-16 18:55:00 2912360 ----a-w- h:\windows\system32\nvcuvid.dll

2010-10-16 18:55:00 2666600 ----a-w- h:\windows\system32\nvcuvenc.dll

2010-10-16 18:55:00 1719912 ----a-w- h:\windows\system32\nvapi.dll

2010-10-16 18:55:00 14899816 ----a-w- h:\windows\system32\nvoglv32.dll

2010-10-16 18:55:00 13019752 ----a-w- h:\windows\system32\nvcompiler.dll

2010-10-16 18:55:00 10023528 ----a-w- h:\windows\system32\nvd3dum.dll

2010-10-15 22:06:31 12920 ----a-w- h:\windows\system32\apl001.sys

2010-10-15 22:06:31 10872 ----a-w- h:\windows\system32\apf001.sys

============= FINISH: 20:39:45.84 ===============

ark.txt

Attach.txt

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Hello Zelbar! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

  • The process of cleaning your system may take some time, so please be patient.
  • Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  • Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • If you don't know or can't understand something please ask.
  • Do not install or uninstall any software or hardware, while work on.
  • Keep me informed about any changes.

Your program version and database version of MBAM are old, so:

  • Launch Malwarebytes' Anti-Malware
  • Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  • Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

  1. Malwarebytes' Anti-Malware log
  2. a new fresh DDS log only

Link to post
Share on other sites
Zelbar

Zelbar

Posted
  • Author
Posted

I updated my version of Malwarebytes and did a full scan.

It appears to have removed the items I was having a problem with so I should be good to go.

Thank you for your help

Hello Zelbar! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

  • The process of cleaning your system may take some time, so please be patient.
  • Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  • Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • If you don't know or can't understand something please ask.
  • Do not install or uninstall any software or hardware, while work on.
  • Keep me informed about any changes.

Your program version and database version of MBAM are old, so:

  • Launch Malwarebytes' Anti-Malware
  • Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  • Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

  1. Malwarebytes' Anti-Malware log
  2. a new fresh DDS log only

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.