Am I infected?

VITO · May 31, 2011

I'm new here sorry if I make mistakes.I've had information stolen recently and not sure if it's from my computer. I have Norton IS that gave me a warning about 2 weeks ago about an attempt from a "BLACKHOLE ROOTKIT" it told me it was blocked and no further actioon was required. But a few days ago I had accounts compromised. the logs are as follows:

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 9.0.8112.16421

Run by VIC at 18:13:57 on 2011-05-31

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6143.4539 [GMT -4:00]

.

AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\AERTSr64.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\WUDFHost.exe

C:\Windows\RAVCpl64.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe

C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe

C:\Program Files (x86)\Southwest Airlines\Ding\Ding.exe

C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE

C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpWareSE4.exe

C:\Program Files (x86)\Portrait Displays\HP My Display\DTHtml.exe

C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files (x86)\Portrait Displays\Pivot Software\wpCtrl.exe

C:\Program Files (x86)\Portrait Displays\Pivot Software\floater.exe

C:\Program Files (x86)\ClearCloud\ClearCloud DNS\SBCC_Utility_Tray.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\connect.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Users\VIC\Desktop\dds.scr

C:\Windows\SysWOW64\WSCRIPT.exe

.

============== Pseudo HJT Report ===============

.

uSearch Bar = Preserve

uInternet Settings,ProxyOverride = *.local

mWinlogon: Userinit=C:\Windows\SysWOW64\userinit.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe

uRun: [RoboForm] "C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

mRun: [DT HPW] "C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" -HPW

mRun: [iJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE

mRun: [OpwareSE4] "C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe"

mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

mRun: [PivotSoftware] "C:\Program Files (x86)\Portrait Displays\Pivot Software\wpctrl.exe"

mRun: [sSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [sSClearCloudTrayApp] C:\Program Files (x86)\ClearCloud\ClearCloud DNS\SBCC_Utility_Tray.exe

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [instaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

StartupFolder: C:\Users\VIC\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DING!.lnk - C:\Program Files (x86)\Southwest Airlines\Ding\Ding.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\PHOTOF~1.LNK - C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: &ieSpell Options - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM

IE: Check &Spelling - C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM

IE: Customize Menu - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

IE: Fill Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: Lookup on Merriam Webster - file://C:\Program Files (x86)\ieSpell\Merriam Webster.HTM

IE: Lookup on Wikipedia - file://C:\Program Files (x86)\ieSpell\wikipedia.HTM

IE: Passcards Editor - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditPass.html

IE: RoboForm Toolbar - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: Save Forms - file://C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM

IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM

IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE: {45DB34C3-955C-11D3-ABEF-444553540001} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComEditPass.html

IE: {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} - hxxp://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: {4BEEE773-DECB-4E16-98EF-5AF49F2DE56E} = 74.118.212.1,74.118.212.2,

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

TB-X64: {724D43A0-0D85-11D4-9908-00400523E39A} - No File

TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

mRun-x64: [RtHDVCpl] RAVCpl64.exe

mRun-x64: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

mRun-x64: [CanonSolutionMenu] "C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" /logon

mRun-x64: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

mRun-x64: [WrtMon.exe] C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys --> C:\Windows\system32\DRIVERS\Lbd.sys [?]

R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]

R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [?]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [?]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110518.001\BHDrvx64.sys [2011-5-18 1127032]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110527.001\IDSviA64.sys [2011-5-27 476792]

R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [?]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1206000.01D\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [?]

R2 AERTFilters;Andrea RT Filters Service;C:\Windows\system32\AERTSr64.exe --> C:\Windows\system32\AERTSr64.exe [?]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 Belkin Local Backup Service;Belkin Local Backup Service;C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2010-12-27 181760]

R2 Belkin Network USB Helper;Belkin Network USB Helper;C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2010-12-27 55296]

R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-9-23 155648]

R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe [2011-5-2 130008]

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-3-29 1153368]

R2 sxuptp;SXUPTP Driver;C:\Windows\system32\DRIVERS\sxuptp.sys --> C:\Windows\system32\DRIVERS\sxuptp.sys [?]

R2 TomTomHOMEService;TomTomHOMEService;C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-5-9 136824]

R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;C:\Windows\system32\drivers\HCW85BDA.sys --> C:\Windows\system32\drivers\HCW85BDA.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-5-25 2151128]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-5-28 17152]

S3 OV550I;OVT Scanner;C:\Windows\system32\Drivers\ov550ivx.sys --> C:\Windows\system32\Drivers\ov550ivx.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe --> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [?]

S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]

.

=============== Created Last 30 ================

.

2011-05-31 21:13:04 -------- d-----w- C:\Users\VIC\AppData\Roaming\Malwarebytes

2011-05-31 21:12:57 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-05-31 21:12:57 -------- d-----w- C:\ProgramData\Malwarebytes

2011-05-31 21:12:54 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-05-31 21:12:54 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-05-31 20:26:29 -------- d-----w- C:\Users\VIC\AppData\Local\{1DB590C3-0FE5-4C13-B6D9-D24740DBA1A1}

2011-05-30 22:41:54 -------- d-----w- C:\Users\VIC\AppData\Local\{878F4E0A-BD44-4A6F-AA10-3EB14BA737E6}

2011-05-30 10:41:36 -------- d-----w- C:\Users\VIC\AppData\Local\{4964D7A2-C364-4925-AF68-E82B844148DA}

2011-05-29 22:23:42 -------- d-----w- C:\Users\VIC\AppData\Local\{04552335-708C-42D5-8014-6824643FA94B}

2011-05-29 10:23:37 -------- d-----w- C:\Users\VIC\AppData\Local\{127410E2-A8C1-4490-A97F-99379544E29C}

2011-05-28 22:09:34 -------- d-----w- C:\Users\VIC\AppData\Local\{68D4B8E7-2CDC-4CA8-BE3C-CD3CEF596347}

2011-05-28 21:15:50 -------- d-----w- C:\Users\VIC\AppData\Local\NPE

2011-05-28 17:13:26 16432 ----a-w- C:\Windows\System32\lsdelete.exe

2011-05-28 15:16:02 69376 ----a-w- C:\Windows\System32\drivers\Lbd.sys

2011-05-28 10:09:17 -------- d-----w- C:\Users\VIC\AppData\Local\{146F63D0-3117-47CD-983B-43CD68EF21C3}

2011-05-27 21:06:46 -------- d-----w- C:\Users\VIC\AppData\Local\{7044BE03-C463-49DB-AAD0-FAE19BBBAF2B}

2011-05-27 09:06:29 -------- d-----w- C:\Users\VIC\AppData\Local\{BEBCAD69-2277-4B4A-84FE-5E5D42963353}

2011-05-26 21:06:11 -------- d-----w- C:\Users\VIC\AppData\Local\{1590CEE0-373E-44B0-9595-4AC743AF9317}

2011-05-26 09:05:54 -------- d-----w- C:\Users\VIC\AppData\Local\{6896056D-29E0-43DD-B43B-1B4B9CC34648}

2011-05-25 21:05:36 -------- d-----w- C:\Users\VIC\AppData\Local\{5A075E84-1674-43C2-B106-B00B40886EE6}

2011-05-25 09:05:19 -------- d-----w- C:\Users\VIC\AppData\Local\{572603E7-7EC0-454E-B44B-1C6C652B9853}

2011-05-25 00:07:37 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys

2011-05-24 21:05:02 -------- d-----w- C:\Users\VIC\AppData\Local\{560A903C-5F03-4046-B5F4-BFD13A135DDB}

2011-05-24 09:04:44 -------- d-----w- C:\Users\VIC\AppData\Local\{C3C80663-0C00-4E14-BAD5-13FFF3112EAA}

2011-05-23 21:04:25 -------- d-----w- C:\Users\VIC\AppData\Local\{48CF3D17-FA2B-4E49-8B55-6F7A9FB4EEE9}

2011-05-23 05:45:29 -------- d-----w- C:\Users\VIC\AppData\Local\{19111602-034C-411B-AF2E-39352C04F9E5}

2011-05-22 17:45:24 -------- d-----w- C:\Users\VIC\AppData\Local\{12C3B6D1-F6DD-4B79-98E5-91320B31430C}

2011-05-22 05:45:07 -------- d-----w- C:\Users\VIC\AppData\Local\{32AC8017-12F4-4164-A548-E87D687A36D9}

2011-05-21 17:45:02 -------- d-----w- C:\Users\VIC\AppData\Local\{20103574-00F5-47E5-8FD7-6BB634C2BFEB}

2011-05-20 20:39:54 -------- d-----w- C:\Users\VIC\AppData\Local\{C96D0C05-3211-4958-83F8-D029AA6227C4}

2011-05-20 08:35:48 -------- d-----w- C:\Users\VIC\AppData\Local\{D33D76C3-9A55-4E35-9355-1010F6E58275}

2011-05-19 20:32:48 -------- d-----w- C:\Users\VIC\AppData\Local\{D0A45ACB-30E4-4A84-95C2-3A6282EAB6F4}

2011-05-19 08:32:30 -------- d-----w- C:\Users\VIC\AppData\Local\{EFDED40B-22A7-4C8D-81DE-D7BF80382869}

2011-05-18 20:28:48 -------- d-----w- C:\Users\VIC\AppData\Local\{AD915AD8-E873-46CA-977F-FBB988390813}

2011-05-18 08:28:31 -------- d-----w- C:\Users\VIC\AppData\Local\{587BCE24-F00C-4761-BC05-CAF0C57F1B76}

2011-05-17 20:28:13 -------- d-----w- C:\Users\VIC\AppData\Local\{E9E08004-1EC5-4DB7-9902-848E6D73E23C}

2011-05-17 04:48:12 -------- d-----w- C:\Users\VIC\AppData\Local\{4E5E2EF9-F4F8-4116-B6A5-22F33111664E}

2011-05-16 16:48:06 -------- d-----w- C:\Users\VIC\AppData\Local\{3898F39A-F38C-46A5-8C88-DF92565797DA}

2011-05-15 23:11:59 -------- d-----w- C:\Users\VIC\AppData\Local\{141B44B0-E7F2-4C42-9ADD-36C54A665AD0}

2011-05-15 11:23:30 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-15 11:11:54 -------- d-----w- C:\Users\VIC\AppData\Local\{E6730C85-3D0B-4C4A-BA0D-11915E9BDD88}

2011-05-15 00:13:24 -------- d-----w- C:\Program Files\iTunes

2011-05-15 00:13:24 -------- d-----w- C:\Program Files\iPod

2011-05-15 00:13:24 -------- d-----w- C:\Program Files (x86)\iTunes

2011-05-15 00:11:45 -------- d-----w- C:\Program Files\Bonjour

2011-05-15 00:11:45 -------- d-----w- C:\Program Files (x86)\Bonjour

2011-05-14 20:29:25 -------- d-----w- C:\Users\VIC\AppData\Local\{A7E0EDBC-DA89-40CB-A0B9-E066AB200CBB}

2011-05-13 22:23:13 -------- d-----w- C:\Users\VIC\AppData\Local\{3D16F984-B26B-4B18-8D2D-177569116097}

2011-05-13 10:22:55 -------- d-----w- C:\Users\VIC\AppData\Local\{27D8DE4C-7947-421F-8325-36C47A68B19F}

2011-05-12 22:22:38 -------- d-----w- C:\Users\VIC\AppData\Local\{47FB6177-0307-4DE0-8D5D-63898B5AE28C}

2011-05-12 10:22:33 -------- d-----w- C:\Users\VIC\AppData\Local\{E16D618F-EFE2-4ACD-B620-022942A0BAFE}

2011-05-11 23:44:07 142336 ----a-w- C:\Windows\System32\poqexec.exe

2011-05-11 23:44:07 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe

2011-05-11 22:22:15 -------- d-----w- C:\Users\VIC\AppData\Local\{C49F87AF-857B-4433-AABB-0C65D2B4E88B}

2011-05-11 10:21:58 -------- d-----w- C:\Users\VIC\AppData\Local\{1DB77997-3B51-4F6B-8230-AE36E907AB87}

2011-05-11 08:38:42 5562240 ----a-w- C:\Windows\System32\ntoskrnl.exe

2011-05-11 08:38:41 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2011-05-11 08:38:41 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2011-05-11 08:38:35 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2011-05-11 08:38:35 7936 ----a-w- C:\Windows\System32\drivers\usbd.sys

2011-05-11 08:38:35 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2011-05-11 08:38:35 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2011-05-11 08:38:35 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys

2011-05-11 08:38:35 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2011-05-11 08:38:35 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2011-05-10 22:21:40 -------- d-----w- C:\Users\VIC\AppData\Local\{6E5A6B14-EFB3-44B9-903D-4A478441B4D4}

2011-05-10 10:21:23 -------- d-----w- C:\Users\VIC\AppData\Local\{CA744587-1FE0-4F27-9E2C-3824AF7BF9C9}

2011-05-09 22:21:01 -------- d-----w- C:\Users\VIC\AppData\Local\{E520AD6F-D399-40D3-AC38-D737B19A46D0}

2011-05-08 23:20:16 -------- d-----w- C:\Users\VIC\AppData\Local\{5248B3B2-1046-42C2-AD4A-3C239BCF656D}

2011-05-08 11:20:11 -------- d-----w- C:\Users\VIC\AppData\Local\{7E27BCCD-40F5-472C-9429-3075580E1C8E}

2011-05-07 23:19:50 -------- d-----w- C:\Users\VIC\AppData\Local\{D1CD2DD8-44F2-45FF-A776-48104EC4FDD5}

2011-05-07 00:14:43 -------- d-----w- C:\Users\VIC\AppData\Local\{FC74217D-21AC-4AD9-8FE2-1CCC45200279}

2011-05-05 22:30:39 -------- d-----w- C:\Users\VIC\AppData\Local\{4620F304-DFCD-4805-A63C-A3F887E38ECD}

2011-05-04 22:31:20 -------- d-----w- C:\Users\VIC\AppData\Local\{F88FF09F-AEF7-4D60-A31D-FADE6A323321}

2011-05-04 09:31:56 -------- d-----w- C:\Users\VIC\AppData\Local\{7B900BEE-1AAE-4FD7-8BD2-E7B8D59D36B2}

2011-05-03 21:31:37 -------- d-----w- C:\Users\VIC\AppData\Local\{F0A5FCC3-2115-4E6B-817B-4ECFE2B8C0F7}

2011-05-02 23:18:44 912504 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symefa64.sys

2011-05-02 23:18:44 450680 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symds64.sys

2011-05-02 23:18:44 40568 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\srtspx64.sys

2011-05-02 23:18:44 382584 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\symnets.sys

2011-05-02 23:18:43 744568 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\srtsp64.sys

2011-05-02 23:18:43 171128 ----a-w- C:\Windows\System32\drivers\NISx64\1206000.01D\ironx64.sys

2011-05-02 23:18:36 -------- d-----w- C:\Windows\System32\drivers\NISx64\1206000.01D

2011-05-02 23:14:45 -------- d-----w- C:\Users\VIC\AppData\Local\{A077BD73-3AA6-4784-9661-39104C9D1FAF}

2011-05-01 22:34:56 -------- d-----w- C:\Users\VIC\AppData\Local\{C558EF18-1CA1-4583-ADAD-AF0CD43EAB06}

.

==================== Find3M ====================

.

2011-05-02 23:18:45 174200 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2011-04-06 20:26:58 96544 ----a-w- C:\Windows\System32\dnssd.dll

2011-04-06 20:26:58 69408 ----a-w- C:\Windows\System32\jdns_sd.dll

2011-04-06 20:26:58 237856 ----a-w- C:\Windows\System32\dnssdX.dll

2011-04-06 20:26:58 119584 ----a-w- C:\Windows\System32\dns-sd.exe

2011-04-06 20:20:16 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll

2011-04-06 20:20:16 75040 ----a-w- C:\Windows\SysWow64\jdns_sd.dll

2011-04-06 20:20:16 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll

2011-04-06 20:20:16 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe

2011-03-29 20:58:03 175616 ----a-w- C:\Windows\System32\msclmd.dll

2011-03-29 20:58:03 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll

2011-03-21 17:22:06 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll

2011-03-21 17:22:06 452200 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys

2011-03-21 17:22:06 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll

2011-03-12 12:08:49 1465344 ----a-w- C:\Windows\System32\XpsPrint.dll

2011-03-12 11:23:45 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll

2011-03-11 06:41:37 189824 ----a-w- C:\Windows\System32\drivers\storport.sys

2011-03-11 06:41:34 166272 ----a-w- C:\Windows\System32\drivers\nvstor.sys

2011-03-11 06:41:34 1659776 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2011-03-11 06:41:34 148352 ----a-w- C:\Windows\System32\drivers\nvraid.sys

2011-03-11 06:41:26 410496 ----a-w- C:\Windows\System32\drivers\iaStorV.sys

2011-03-11 06:41:12 27008 ----a-w- C:\Windows\System32\drivers\amdxata.sys

2011-03-11 06:41:12 107904 ----a-w- C:\Windows\System32\drivers\amdsata.sys

2011-03-11 06:34:51 1359872 ----a-w- C:\Windows\System32\mfc42u.dll

2011-03-11 06:34:50 1395712 ----a-w- C:\Windows\System32\mfc42.dll

2011-03-11 06:33:29 2565632 ----a-w- C:\Windows\System32\esent.dll

2011-03-11 06:30:28 96768 ----a-w- C:\Windows\System32\fsutil.exe

2011-03-11 05:33:59 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll

2011-03-11 05:33:59 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll

2011-03-11 05:33:09 1699328 ----a-w- C:\Windows\SysWow64\esent.dll

2011-03-11 05:31:07 74240 ----a-w- C:\Windows\SysWow64\fsutil.exe

2011-03-10 23:38:37 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2011-03-08 06:29:32 976896 ----a-w- C:\Windows\System32\inetcomm.dll

2011-03-08 05:28:29 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll

2011-03-04 06:19:28 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2011-03-04 06:19:27 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

2011-03-03 06:24:16 183296 ----a-w- C:\Windows\System32\dnsrslvr.dll

2011-03-03 06:21:57 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe

2011-03-03 05:36:16 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe

2011-03-03 03:52:08 3135488 ----a-w- C:\Windows\System32\win32k.sys

.

============= FINISH: 18:14:56.33 ===============

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6736

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

5/31/2011 5:54:38 PM

mbam-log-2011-05-31 (17-54-38).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 304493

Time elapsed: 35 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

The GMER came back without a problem.Let me know if you need anything else.Please remember I'm somewhat of a novice.

ark.zip

Attach.zip

screen317 · June 4, 2011

I'm afraid I have bad news.

Your logs reveal a backdoor trojan. A backdoor severely compromises system integrity.

A compromised system may allow illicit network connections, disabling of security software, modifying critical system files and collection and transmiission of personal identifiable information without your consent.

I recommend that you disconnect this PC from the Internet immediately, and only reconnect to download any tools that are required. If you do any banking or other financial transactions on the PC or it if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the Trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. If it were on my PC I would not hesitate for a moment to do so. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

Should you decide not to follow that advice, we will of course do our best to clean the computer of any infections that we can see but, as I already stated, we can in no way guarantee it to be trustworthy.

Should you have any questions, please feel free to ask.

Let me know what you decide.

VITO · June 4, 2011

Thank you for the help. I have windows 7 that I updated from vista. Can I usr control panel-rescue-reinstall waindows or should I just go for a complete change? Can you also tell me where in the logs this shows up I can't find it?

VITO · June 4, 2011

also should I reset my router?

VITO · June 4, 2011

one more question, is it safe to backup files such as pictures music etc?

screen317 · June 7, 2011

Hi,

Resetting your router shouldn't be necessary. Yes feel free to backup pictures and music.

Please use your Windows 7 CD and do a full format and reinstallation of Windows. The detection came from your antivirus. Who knows if it actually blocked it completely..

VITO · June 8, 2011

First of all Thank you for your help, it looks like evryone is very busy here.

Now I have reinstalled windows and got everything up and running again. I've used it a couple days and just now rescanned everything.Let me know if you see anything.

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6813

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

6/8/2011 5:27:45 PM

mbam-log-2011-06-08 (17-27-45).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 295701

Time elapsed: 24 minute(s), 19 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_2011-06-03.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by VICS at 17:33:47 on 2011-06-08

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6143.4772 [GMT -4:00]

.

AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\atieclxx.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\System32\rundll32.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\WUDFHost.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe

C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe

C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe

C:\Program Files (x86)\Southwest Airlines\Ding\Ding.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpWareSE4.exe

C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE

C:\Program Files\Belkin\Belkin USB Print and Storage Center\connect.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\system32\DllHost.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10r_ActiveX.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

mWinlogon: Userinit=userinit.exe