Jump to content

Infected with Scour search.

BlinkyBill01
 Share

Recommended Posts

BlinkyBill01

BlinkyBill01

Posted
Posted

Howdy,

Today I was running IE8 and had multiple tabs open. In one of the tabs, I got some fake scan popup and normally, I'm able to Alt+F4 to close the window then do a scan, but the multiple tabs cause me to not get out in time.

Now I'm getting a Scour search each time I google something.

I downloaded Malwarebytes and ran a scan. It found something right away. I chose to Quarantine it. Now that the scan has finished, i have 14 trojan listings.

What now? I'm a newb to all this and any help would be appreciated.

Thanks,

Bil

Here is my log from this mornings scan, done about 2 minutes ago:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6885

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

6/18/2011 5:40:08 AM

mbam-log-2011-06-18 (05-40-08).txt

Scan type: Quick scan

Objects scanned: 183474

Time elapsed: 11 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 4

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.Gen) -> Delete on reboot.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{4ADC6DFE-4A01-FFD2-562A-D4548A36F854} (Trojan.Tracur.Gen) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4ADC6DFE-4A01-FFD2-562A-D4548A36F854} (Trojan.Tracur.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4ADC6DFE-4A01-FFD2-562A-D4548A36F854} (Trojan.Tracur.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4ADC6DFE-4A01-FFD2-562A-D4548A36F854} (Trojan.Tracur.Gen) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur.Gen) -> Bad: (C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll) Good: () -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\programdata\api-ms-win-core-misc-l1-1-032.dll (Trojan.Tracur.Gen) -> Quarantined and deleted successfully.

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

Link to post
Share on other sites
BlinkyBill01

BlinkyBill01

Posted
  • Author
Posted

About to post the logs. When I just booted up this morning, Microsoft security Essentials caught the program and quarantined and removed it. Just ran a scan with MBAM and DDS and nothing was found. Posting logs anyway incase something slipped through:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6903

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

6/20/2011 12:11:25 PM

mbam-log-2011-06-20 (12-11-25).txt

Scan type: Quick scan

Objects scanned: 176588

Time elapsed: 8 minute(s), 20 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

------

.

DDS (Ver_2011-06-12.02) - NTFSAMD64

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_19

Run by Gaming at 12:12:34 on 2011-06-20

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6143.4497 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\FBAgent.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe

C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\system32\taskhost.exe

C:\PROGRA~1\MAGICM~1\Magic.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\AirPort\APAgent.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\DllHost.exe

C:\Windows\AsScrPro.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk

uDefault_Page_URL = hxxp://asus.msn.com

uInternet Settings,ProxyOverride = *.local

mWinlogon: Userinit=userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: de6f9832: {4046a627-7231-a662-0eea-0eab28609f5b} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {4c8b8784-5ed0-bb15-9deb-d68555bdaa66} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - No File

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: de6f9832: {bd5fdb86-3693-ad0e-064b-bc1d905faa13} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {c2d689fc-0c7a-ef95-f4d8-c1f96805e4d4} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: de6f9832: {e025031b-d136-059f-4f31-bc385e4cd007} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {e7e5b9bc-3483-a042-2047-8e72ce0f02b1} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

uRun: [PlayNC Launcher]

uRun: [Google Update] "C:\Users\Gaming\AppData\Local\Google\Update\GoogleUpdate.exe" /c

mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [AirPort Base Station Agent] "C:\Program Files (x86)\AirPort\APAgent.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\Users\Gaming\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MAGICM~1.LNK - C:\Program Files (x86)\Magic Mail\sample.magic

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

Trusted Zone: aiononline.com

Trusted Zone: aiononline.com\forums

Trusted Zone: aiononline.com\na

Trusted Zone: cinemanow.com

DPF: {01025D1C-BB03-4369-8344-732CD0DCCCF0} - hxxp://www.geforce.com/services_toolkit/ShimGen/1.1.28.1/GPU_Reader.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 24.159.193.40 24.205.224.36 68.190.192.35

TCP: Interfaces\{3567A555-C7BC-4B22-8DFF-7382B8DE973D} : DhcpNameServer = 24.159.193.40 24.205.224.36 68.190.192.35

TCP: Interfaces\{A95A7A12-5FA3-45B3-B714-BF232CE7F617} : DhcpNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{A95A7A12-5FA3-45B3-B714-BF232CE7F617}\D696C6C65627 : DhcpNameServer = 68.87.71.230 68.87.73.246

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs: C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO-X64: 0x1 - No File

BHO-X64: de6f9832: {4046A627-7231-A662-0EEA-0EAB28609F5B} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {4C8B8784-5ED0-BB15-9DEB-D68555BDAA66} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - No File

BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO-X64: Search Helper - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: de6f9832: {BD5FDB86-3693-AD0E-064B-BC1D905FAA13} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {C2D689FC-0C7A-EF95-F4D8-C1F96805E4D4} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: de6f9832: {E025031B-D136-059F-4F31-BC385E4CD007} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {E7E5B9BC-3483-A042-2047-8E72CE0F02B1} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

mRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [AirPort Base Station Agent] "C:\Program Files (x86)\AirPort\APAgent.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

AppInit_DLLs-X64: C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\kSolo\npAVX.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

============= SERVICES / DRIVERS ===============

.

R1 EIO64;EIO Driver;C:\Windows\system32\DRIVERS\EIO64.sys --> C:\Windows\system32\DRIVERS\EIO64.sys [?]

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AFBAgent;AFBAgent;"C:\Windows\system32\FBAgent.exe" --> C:\Windows\system32\FBAgent.exe [?]

R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2009-9-28 14904]

R2 cpuz133;cpuz133;\??\C:\Windows\system32\drivers\cpuz133_x64.sys --> C:\Windows\system32\drivers\cpuz133_x64.sys [?]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-6-17 366640]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\LGBusEnum.sys --> C:\Windows\system32\drivers\LGBusEnum.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 sppsvc32;Software Protection ;C:\Windows\System32\PortableDeviceApi32.exe [2011-6-17 767488]

S3 atillk64;atillk64;C:\Users\Gaming\Downloads\ati_winflash_2.0.1.14\atillk64.sys [2006-7-19 14608]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-9-28 79360]

S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-22 1493352]

S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\system32\drivers\LGVirHid.sys --> C:\Windows\system32\drivers\LGVirHid.sys [?]

S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-4-13 1153368]

S4 WBVGAservice;WB VGA Service;C:\Program Files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\WBVGAservice.exe [2009-9-28 72248]

.

=============== Created Last 30 ================

.

2011-06-20 02:16:55 -------- d-----w- C:\Users\Gaming\AppData\Local\{426B46F2-9006-4F1B-95AA-0D9CB01565B4}

2011-06-19 18:35:24 8718160 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6189087-BB8F-48D5-A9B2-406C61470A3B}\mpengine.dll

2011-06-18 01:47:32 -------- d-----w- C:\Users\Gaming\AppData\Roaming\Malwarebytes

2011-06-18 01:47:28 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-06-18 01:47:27 -------- d-----w- C:\ProgramData\Malwarebytes

2011-06-18 01:47:23 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-06-18 01:47:23 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-06-17 22:52:28 767488 ----a-w- C:\ProgramData\DxpTaskSync32.exe

2011-06-17 22:52:25 767488 ----a-w- C:\Windows\SysWow64\PortableDeviceApi32.exe

2011-06-17 14:28:39 -------- d-----w- C:\Users\Gaming\AppData\Local\{A8A6F851-493E-44CB-8BD2-D8555A581CBB}

2011-06-15 01:56:00 -------- d-----w- C:\Program Files (x86)\AirPort

2011-06-14 14:52:27 -------- d-----w- C:\Users\Gaming\AppData\Local\{F1B73D0A-8DA3-4C26-8C6B-16A70FC035A9}

2011-06-11 03:41:50 -------- d-----w- C:\Users\Gaming\AppData\Local\{E6ACE672-4E85-4098-9B6D-8A87ABCF71AB}

2011-06-10 14:13:37 -------- d-----w- C:\Users\Gaming\AppData\Local\{F2ABE78B-33B2-409F-91C3-ED3A063C0298}

2011-06-10 07:42:16 -------- d-----w- C:\Users\Gaming\AppData\Local\Google

2011-06-09 03:59:43 -------- d-----w- C:\Users\Gaming\AppData\Local\Apple Computer

2011-06-09 03:59:33 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys

2011-06-09 03:59:33 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll

2011-06-09 03:59:33 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll

2011-06-09 03:58:53 -------- d-----w- C:\Program Files\iPod

2011-06-09 03:58:52 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

2011-06-09 03:58:52 -------- d-----w- C:\Program Files\iTunes

2011-06-09 03:58:52 -------- d-----w- C:\Program Files (x86)\iTunes

2011-06-09 03:57:32 -------- d-----w- C:\Program Files\Bonjour

2011-06-09 03:57:32 -------- d-----w- C:\Program Files (x86)\Bonjour

2011-06-09 00:43:42 -------- d-----w- C:\Users\Gaming\AppData\Local\{6942EF52-67F7-46B1-A96A-8945AAAFCCB6}

2011-06-08 00:25:59 -------- d-----w- C:\Users\Gaming\AppData\Local\{E3663BDB-BB2C-4298-81A2-3B2F3DD6140C}

2011-06-05 02:19:34 -------- d-----w- C:\Users\Gaming\AppData\Roaming\TS3Client

2011-06-03 11:13:46 -------- d-----w- C:\Users\Gaming\AppData\Local\{7FC48436-D284-4B26-AC25-EA479256E75A}

2011-06-02 11:16:02 -------- d-----w- C:\Users\Gaming\AppData\Local\{FC3584EE-E9E3-4382-92C9-445B2FDB6827}

2011-06-01 21:50:28 -------- d-----w- C:\Users\Gaming\AppData\Local\{17AD6FA3-F908-4F21-8DC6-ABD5D67CE117}

2011-05-30 01:37:11 -------- d-----w- C:\Users\Gaming\AppData\Local\{9DC16866-38F6-4538-8E87-0CDB94BB83F7}

2011-05-27 15:45:37 -------- d-----w- C:\Users\Gaming\AppData\Local\{E0ADA29A-3D39-4D2D-BE67-21586E282B0C}

2011-05-27 02:19:53 -------- d-----w- C:\Users\Gaming\AppData\Local\{5A6B13DC-849F-42CE-A203-C8D5DF9D3236}

2011-05-26 00:16:34 -------- d-----w- C:\Users\Gaming\AppData\Local\{4545CDD0-DBA1-44C8-8831-44D7FC429245}

2011-05-25 09:17:06 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys

2011-05-23 17:22:00 3138048 ----a-w- C:\Windows\System32\mstscax.dll

2011-05-23 17:22:00 2690560 ----a-w- C:\Windows\SysWow64\mstscax.dll

2011-05-23 17:22:00 1097216 ----a-w- C:\Windows\System32\mstsc.exe

2011-05-23 17:22:00 1034240 ----a-w- C:\Windows\SysWow64\mstsc.exe

2011-05-22 16:48:55 -------- d-----w- C:\Users\Gaming\AppData\Local\{8949B219-3597-4769-890F-2919859F2332}

2011-05-22 07:14:28 -------- d-----w- C:\Users\Gaming\AppData\Roaming\Vara Software

2011-05-22 07:14:20 -------- d-----w- C:\Users\Gaming\AppData\Roaming\Wirecast

2011-05-22 07:14:20 -------- d-----w- C:\ProgramData\Telestream

2011-05-22 07:14:20 -------- d-----w- C:\ProgramData\eSellerate

2011-05-22 07:14:20 -------- d-----w- C:\Program Files (x86)\Common Files\eSellerate

2011-05-22 07:13:41 -------- d-----w- C:\Program Files (x86)\Ustream

.

==================== Find3M ====================

.

2011-06-07 20:17:13 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-28 03:25:16 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2011-05-28 03:07:01 3133952 ----a-w- C:\Windows\System32\win32k.sys

2011-05-28 03:00:02 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-05-22 16:28:40 152064 ----a-w- C:\Windows\SysWow64\msclmd.dll

2011-05-22 16:28:39 175104 ----a-w- C:\Windows\System32\msclmd.dll

2011-05-04 02:51:08 287744 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys

2011-05-04 02:51:08 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys

2011-05-04 02:51:05 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys

2011-05-03 21:33:46 2854504 ----a-w- C:\Windows\System32\drivers\RTKVHD64.sys

2011-05-03 05:21:22 976896 ----a-w- C:\Windows\System32\inetcomm.dll

2011-05-03 04:50:29 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll

2011-05-02 23:03:32 88680 ----a-w- C:\Windows\System32\RCoInst64.dll

2011-04-29 03:13:10 461312 ----a-w- C:\Windows\System32\drivers\srv.sys

2011-04-29 03:12:54 399872 ----a-w- C:\Windows\System32\drivers\srv2.sys

2011-04-29 03:12:37 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys

2011-04-27 02:57:40 102400 ----a-w- C:\Windows\System32\drivers\dfsc.sys

2011-04-25 05:32:22 1896832 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-04-25 02:44:02 499712 ----a-w- C:\Windows\System32\drivers\afd.sys

2011-04-22 20:18:28 1197056 ----a-w- C:\Windows\System32\wininet.dll

2011-04-22 20:14:08 57856 ----a-w- C:\Windows\System32\licmgr10.dll

2011-04-22 19:31:50 981504 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-04-22 19:31:26 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll

2011-04-22 18:49:57 482816 ----a-w- C:\Windows\System32\html.iec

2011-04-22 18:23:59 386048 ----a-w- C:\Windows\SysWow64\html.iec

2011-04-20 19:34:30 3049064 ----a-w- C:\Windows\System32\RtkAPO64.dll

2011-04-20 19:34:30 2393192 ----a-w- C:\Windows\System32\RtPgEx64.dll

2011-04-18 23:50:00 2601816 ----a-w- C:\Windows\System32\WavesGUILib.dll

2011-04-09 06:58:56 142336 ----a-w- C:\Windows\System32\poqexec.exe

2011-04-09 06:45:48 5509504 ----a-w- C:\Windows\System32\ntoskrnl.exe

2011-04-09 06:13:06 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2011-04-09 06:13:06 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2011-04-09 05:56:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe

2011-04-06 21:26:58 96544 ----a-w- C:\Windows\System32\dnssd.dll

2011-04-06 21:26:58 69408 ----a-w- C:\Windows\System32\jdns_sd.dll

2011-04-06 21:26:58 237856 ----a-w- C:\Windows\System32\dnssdX.dll

2011-04-06 21:26:58 119584 ----a-w- C:\Windows\System32\dns-sd.exe

2011-04-06 21:20:16 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll

2011-04-06 21:20:16 75040 ----a-w- C:\Windows\SysWow64\jdns_sd.dll

2011-04-06 21:20:16 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll

2011-04-06 21:20:16 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe

2011-03-25 03:23:22 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2011-03-25 03:23:03 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2011-03-25 03:23:03 324608 ----a-w- C:\Windows\System32\drivers\usbport.sys

2011-03-25 03:22:57 52224 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2011-03-25 03:22:56 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2011-03-25 03:22:55 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2011-03-25 03:22:51 7936 ----a-w- C:\Windows\System32\drivers\usbd.sys

.

============= FINISH: 12:13:57.49 ===============

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi,

Better to double check and be sure.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Link to post
Share on other sites
BlinkyBill01

BlinkyBill01

Posted
  • Author
Posted

Downloading ComboFix right now.

To note: For the past couple of days, when I boot up, Microsoft security essentials finds the same programs and asks me to remove or quarantine them. I choose remove. I update MBAM and it finds the same issue and it asks to quarantine it. I select yes then run a quick scan. It finds nothing. I reboot and it's a continuous loop of the same issue. Security Essentials finds issues, removes them, MBAM finda issues, quarantines them, quick scan finds nothing, reboot... find same issues.

Hoping that combofix will show the real problems so I can finally get back to using my laptop.

Will posts results shortly.

Link to post
Share on other sites
BlinkyBill01

BlinkyBill01

Posted
  • Author
Posted

from c:/ComboFix.txt:

ComboFix 11-06-23.01 - Gaming 06/23/2011 13:33:41.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6143.4644 [GMT -5:00]

Running from: c:\users\Gaming\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\api-ms-win-core-misc-l1-1-032.dll

c:\programdata\DxpTaskSync32.exe

c:\users\Gaming\AppData\Roaming\.#

c:\users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\extensions\{4d555559-e7ec-4f0a-a432-a458d28ef6d3}

c:\users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\extensions\{4d555559-e7ec-4f0a-a432-a458d28ef6d3}\chrome.manifest

c:\users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\extensions\{4d555559-e7ec-4f0a-a432-a458d28ef6d3}\chrome\xulcache.jar

c:\users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\extensions\{4d555559-e7ec-4f0a-a432-a458d28ef6d3}\defaults\preferences\xulcache.js

c:\users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\extensions\{4d555559-e7ec-4f0a-a432-a458d28ef6d3}\install.rdf

c:\users\Gaming\GoToAssistDownloadHelper.exe

c:\windows\security\Database\tmp.edb

.

.

((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))

.

.

2011-06-23 18:42 . 2011-06-17 22:52 767488 ----a-w- c:\programdata\DxpTaskSync32.exe

2011-06-23 18:38 . 2011-06-23 18:38 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-06-23 01:29 . 2011-06-07 17:10 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8D7D74BC-31F6-4DAD-AD2E-9C7DDCD5B280}\mpengine.dll

2011-06-20 02:16 . 2011-06-20 02:17 -------- d-----w- c:\users\Gaming\AppData\Local\{426B46F2-9006-4F1B-95AA-0D9CB01565B4}

2011-06-18 01:47 . 2011-06-18 01:47 -------- d-----w- c:\users\Gaming\AppData\Roaming\Malwarebytes

2011-06-18 01:47 . 2011-05-29 14:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-06-18 01:47 . 2011-06-18 01:47 -------- d-----w- c:\programdata\Malwarebytes

2011-06-18 01:47 . 2011-06-18 10:40 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-06-18 01:47 . 2011-05-29 14:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-17 22:52 . 2011-06-17 22:52 767488 ----a-w- c:\windows\SysWow64\PortableDeviceApi32.exe

2011-06-17 14:28 . 2011-06-17 14:28 -------- d-----w- c:\users\Gaming\AppData\Local\{A8A6F851-493E-44CB-8BD2-D8555A581CBB}

2011-06-15 01:56 . 2011-06-15 01:56 -------- d-----w- c:\program files (x86)\AirPort

2011-06-14 14:52 . 2011-06-14 14:52 -------- d-----w- c:\users\Gaming\AppData\Local\{F1B73D0A-8DA3-4C26-8C6B-16A70FC035A9}

2011-06-11 03:41 . 2011-06-11 03:42 -------- d-----w- c:\users\Gaming\AppData\Local\{E6ACE672-4E85-4098-9B6D-8A87ABCF71AB}

2011-06-10 14:13 . 2011-06-10 14:13 -------- d-----w- c:\users\Gaming\AppData\Local\{F2ABE78B-33B2-409F-91C3-ED3A063C0298}

2011-06-10 07:42 . 2011-06-10 07:42 -------- d-----w- c:\users\Gaming\AppData\Local\Google

2011-06-09 03:59 . 2011-06-09 03:59 -------- d-----w- c:\users\Gaming\AppData\Local\Apple Computer

2011-06-09 03:59 . 2009-05-18 18:17 34152 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2011-06-09 03:59 . 2008-04-17 17:12 126312 ----a-w- c:\windows\system32\GEARAspi64.dll

2011-06-09 03:59 . 2008-04-17 17:12 107368 ----a-w- c:\windows\SysWow64\GEARAspi.dll

2011-06-09 03:58 . 2011-06-09 03:58 -------- d-----w- c:\program files\iPod

2011-06-09 03:58 . 2011-06-09 03:59 -------- d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

2011-06-09 03:58 . 2011-06-09 03:59 -------- d-----w- c:\program files\iTunes

2011-06-09 03:58 . 2011-06-09 03:59 -------- d-----w- c:\program files (x86)\iTunes

2011-06-09 03:57 . 2011-06-09 03:57 -------- d-----w- c:\program files (x86)\Apple Software Update

2011-06-09 03:57 . 2011-06-09 03:57 -------- d-----w- c:\program files\Common Files\Apple

2011-06-09 03:57 . 2011-06-09 03:57 -------- d-----w- c:\program files\Bonjour

2011-06-09 03:57 . 2011-06-09 03:57 -------- d-----w- c:\program files (x86)\Bonjour

2011-06-09 00:43 . 2011-06-09 00:43 -------- d-----w- c:\users\Gaming\AppData\Local\{6942EF52-67F7-46B1-A96A-8945AAAFCCB6}

2011-06-08 00:25 . 2011-06-08 00:26 -------- d-----w- c:\users\Gaming\AppData\Local\{E3663BDB-BB2C-4298-81A2-3B2F3DD6140C}

2011-06-05 02:19 . 2011-06-08 04:09 -------- d-----w- c:\users\Gaming\AppData\Roaming\TS3Client

2011-06-03 11:13 . 2011-06-03 11:14 -------- d-----w- c:\users\Gaming\AppData\Local\{7FC48436-D284-4B26-AC25-EA479256E75A}

2011-06-02 11:16 . 2011-06-02 11:16 -------- d-----w- c:\users\Gaming\AppData\Local\{FC3584EE-E9E3-4382-92C9-445B2FDB6827}

2011-06-01 21:50 . 2011-06-01 21:50 -------- d-----w- c:\users\Gaming\AppData\Local\{17AD6FA3-F908-4F21-8DC6-ABD5D67CE117}

2011-05-30 01:37 . 2011-05-30 01:37 -------- d-----w- c:\users\Gaming\AppData\Local\{9DC16866-38F6-4538-8E87-0CDB94BB83F7}

2011-05-27 15:45 . 2011-05-27 15:45 -------- d-----w- c:\users\Gaming\AppData\Local\{E0ADA29A-3D39-4D2D-BE67-21586E282B0C}

2011-05-27 02:19 . 2011-05-27 02:20 -------- d-----w- c:\users\Gaming\AppData\Local\{5A6B13DC-849F-42CE-A203-C8D5DF9D3236}

2011-05-26 00:16 . 2011-05-26 00:16 -------- d-----w- c:\users\Gaming\AppData\Local\{4545CDD0-DBA1-44C8-8831-44D7FC429245}

2011-05-25 09:17 . 2011-04-22 20:18 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-21 21:40 . 2011-05-16 03:23 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-06-07 17:10 . 2011-01-01 00:25 8873296 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-05-22 16:28 . 2009-07-14 02:36 152064 ----a-w- c:\windows\SysWow64\msclmd.dll

2011-05-22 16:28 . 2009-07-14 02:36 175104 ----a-w- c:\windows\system32\msclmd.dll

2011-05-03 21:33 . 2011-05-13 19:32 2854504 ----a-w- c:\windows\system32\drivers\RTKVHD64.sys

2011-05-02 23:03 . 2011-05-13 19:32 88680 ----a-w- c:\windows\system32\RCoInst64.dll

2011-04-20 19:34 . 2011-05-13 19:32 2393192 ----a-w- c:\windows\system32\RtPgEx64.dll

2011-04-20 19:34 . 2011-05-13 19:32 3049064 ----a-w- c:\windows\system32\RtkAPO64.dll

2011-04-18 23:50 . 2011-05-13 19:33 2601816 ----a-w- c:\windows\system32\WavesGUILib.dll

2011-04-09 06:58 . 2011-05-10 21:09 142336 ----a-w- c:\windows\system32\poqexec.exe

2011-04-09 06:45 . 2011-05-10 21:09 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-04-09 06:13 . 2011-05-10 21:09 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2011-04-09 06:13 . 2011-05-10 21:09 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2011-04-09 05:56 . 2011-05-10 21:09 123904 ----a-w- c:\windows\SysWow64\poqexec.exe

2011-04-06 21:26 . 2011-04-06 21:26 96544 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 21:26 . 2011-04-06 21:26 69408 ----a-w- c:\windows\system32\jdns_sd.dll

2011-04-06 21:26 . 2011-04-06 21:26 237856 ----a-w- c:\windows\system32\dnssdX.dll

2011-04-06 21:26 . 2011-04-06 21:26 119584 ----a-w- c:\windows\system32\dns-sd.exe

2011-04-06 21:20 . 2011-04-06 21:20 91424 ----a-w- c:\windows\SysWow64\dnssd.dll

2011-04-06 21:20 . 2011-04-06 21:20 75040 ----a-w- c:\windows\SysWow64\jdns_sd.dll

2011-04-06 21:20 . 2011-04-06 21:20 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll

2011-04-06 21:20 . 2011-04-06 21:20 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-08-20 170624]

"QuickTime Task"="c:\program files (x86)\QuickTime\qttask.exe" [2010-12-29 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-06-07 421160]

"AirPort Base Station Agent"="c:\program files (x86)\AirPort\APAgent.exe" [2009-11-11 771360]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

.

c:\users\Gaming\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Magic Mail.lnk - c:\program files\Magic Mail\sample.magic [2010-4-10 1556]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 atillk64;atillk64;c:\users\Gaming\Downloads\ati_winflash_2.0.1.14\atillk64.sys [2006-07-19 14608]

R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-09-28 79360]

R3 dump_wmimmc;dump_wmimmc;c:\program files (x86)\NCsoft\Exteel\System\GameGuard\dump_wmimmc.sys [x]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [x]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

R4 WBVGAservice;WB VGA Service;c:\program files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\WBVGAservice.exe [2009-02-06 72248]

S1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]

S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]

S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x64.sys [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]

S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]

2009-07-14 01:14 301568 ----a-w- c:\windows\System32\cmd.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1666259563-2066342653-3403214244-1000Core.job

- c:\users\Gaming\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-10 07:42]

.

2011-06-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1666259563-2066342653-3403214244-1000UA.job

- c:\users\Gaming\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-10 07:42]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

Trusted Zone: aiononline.com

Trusted Zone: aiononline.com\forums

Trusted Zone: aiononline.com\na

TCP: DhcpNameServer = 24.159.193.40 24.205.224.36 68.190.192.35

DPF: {01025D1C-BB03-4369-8344-732CD0DCCCF0} - hxxp://www.geforce.com/services_toolkit/ShimGen/1.1.28.1/GPU_Reader.cab

FF - ProfilePath - c:\users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{0AB44DEB-94DC-2ECE-55BB-E8711CFBA9EC} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{16F82E48-807B-4281-E3BC-B04A4958B4F7} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{3401C5CA-8692-92B0-7FEA-45D2FB039450} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{34392C21-93CD-2102-6EB8-BAC659ABFFDA} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{4046A627-7231-A662-0EEA-0EAB28609F5B} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{4C8B8784-5ED0-BB15-9DEB-D68555BDAA66} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{50022612-D034-4D0F-13EA-DCD3F3386DF0} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{61168FC8-D18D-A5DC-3A9B-4A3C156DEB53} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{A3ED6407-38FB-12A8-1457-3175E4D28854} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{BD5FDB86-3693-AD0E-064B-BC1D905FAA13} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{C2D689FC-0C7A-EF95-F4D8-C1F96805E4D4} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{E025031B-D136-059F-4F31-BC385E4CD007} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

BHO-{E7E5B9BC-3483-A042-2047-8E72CE0F02B1} - c:\programdata\api-ms-win-core-misc-l1-1-032.dll

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-PlayNC Launcher - (no file)

Toolbar-Locked - (no file)

AddRemove-CohMapPack - c:\binds\vm_bind_filesi18.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe

c:\program files\ATKGFNEX\GFNEXSrv.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\ASUS\ATK Hotkey\HControl.exe

c:\program files (x86)\ASUS\ATK Hotkey\ATKOSD.exe

c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe

c:\program files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe

c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe

c:\program files (x86)\ASUS\ATK Hotkey\WDC.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\SysWOW64\portabledeviceapi32.exe

c:\progra~1\MAGICM~1\Magic.exe

c:\windows\AsScrPro.exe

.

**************************************************************************

.

Completion time: 2011-06-23 13:49:19 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-23 18:49

.

Pre-Run: 310,851,231,744 bytes free

Post-Run: 311,095,783,424 bytes free

.

- - End Of File - - 12A40D7134270B41573E1E9D446235CD

From DDS:

.

DDS (Ver_2011-06-12.02) - NTFSAMD64

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_19

Run by Gaming at 13:53:47 on 2011-06-23

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6143.4492 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\FBAgent.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\rundll32.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Microsoft Security Client\msseces.exe

C:\PROGRA~1\MAGICM~1\Magic.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\AirPort\APAgent.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\AsScrPro.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Windows\system32\DllHost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\notepad.exe

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk

uInternet Settings,ProxyOverride = *.local

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: de6f9832: {0ab44deb-94dc-2ece-55bb-e8711cfba9ec} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {16f82e48-807b-4281-e3bc-b04a4958b4f7} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {3401c5ca-8692-92b0-7fea-45d2fb039450} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {34392c21-93cd-2102-6eb8-bac659abffda} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {4046a627-7231-a662-0eea-0eab28609f5b} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {4c8b8784-5ed0-bb15-9deb-d68555bdaa66} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - No File

BHO: de6f9832: {50022612-d034-4d0f-13ea-dcd3f3386df0} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO: de6f9832: {61168fc8-d18d-a5dc-3a9b-4a3c156deb53} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: de6f9832: {a3ed6407-38fb-12a8-1457-3175e4d28854} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {bd5fdb86-3693-ad0e-064b-bc1d905faa13} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {c2d689fc-0c7a-ef95-f4d8-c1f96805e4d4} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: de6f9832: {e025031b-d136-059f-4f31-bc385e4cd007} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO: de6f9832: {e7e5b9bc-3483-a042-2047-8e72ce0f02b1} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [AirPort Base Station Agent] "C:\Program Files (x86)\AirPort\APAgent.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\Users\Gaming\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MAGICM~1.LNK - C:\Program Files (x86)\Magic Mail\sample.magic

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

Trusted Zone: aiononline.com

Trusted Zone: aiononline.com\forums

Trusted Zone: aiononline.com\na

DPF: {01025D1C-BB03-4369-8344-732CD0DCCCF0} - hxxp://www.geforce.com/services_toolkit/ShimGen/1.1.28.1/GPU_Reader.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} - hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 24.159.193.40 24.205.224.36 68.190.192.35

TCP: Interfaces\{3567A555-C7BC-4B22-8DFF-7382B8DE973D} : DhcpNameServer = 24.159.193.40 24.205.224.36 68.190.192.35

TCP: Interfaces\{A95A7A12-5FA3-45B3-B714-BF232CE7F617} : DhcpNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{A95A7A12-5FA3-45B3-B714-BF232CE7F617}\D696C6C65627 : DhcpNameServer = 68.87.71.230 68.87.73.246

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache

BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO-X64: 0x1 - No File

BHO-X64: de6f9832: {0AB44DEB-94DC-2ECE-55BB-E8711CFBA9EC} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {16F82E48-807B-4281-E3BC-B04A4958B4F7} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {3401C5CA-8692-92B0-7FEA-45D2FB039450} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {34392C21-93CD-2102-6EB8-BAC659ABFFDA} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {4046A627-7231-A662-0EEA-0EAB28609F5B} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {4C8B8784-5ED0-BB15-9DEB-D68555BDAA66} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - No File

BHO-X64: de6f9832: {50022612-D034-4D0F-13EA-DCD3F3386DF0} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll

BHO-X64: de6f9832: {61168FC8-D18D-A5DC-3A9B-4A3C156DEB53} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

BHO-X64: Search Helper - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: de6f9832: {A3ED6407-38FB-12A8-1457-3175E4D28854} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {BD5FDB86-3693-AD0E-064B-BC1D905FAA13} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {C2D689FC-0C7A-EF95-F4D8-C1F96805E4D4} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: de6f9832: {E025031B-D136-059F-4F31-BC385E4CD007} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

BHO-X64: de6f9832: {E7E5B9BC-3483-A042-2047-8E72CE0F02B1} - C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

mRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\qttask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [AirPort Base Station Agent] "C:\Program Files (x86)\AirPort\APAgent.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\kSolo\npAVX.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Gaming\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

.

============= SERVICES / DRIVERS ===============

.

R1 EIO64;EIO Driver;C:\Windows\system32\DRIVERS\EIO64.sys --> C:\Windows\system32\DRIVERS\EIO64.sys [?]

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AFBAgent;AFBAgent;"C:\Windows\system32\FBAgent.exe" --> C:\Windows\system32\FBAgent.exe [?]

R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2009-9-28 14904]

R2 cpuz133;cpuz133;\??\C:\Windows\system32\drivers\cpuz133_x64.sys --> C:\Windows\system32\drivers\cpuz133_x64.sys [?]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-6-17 366640]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\system32\drivers\LGBusEnum.sys --> C:\Windows\system32\drivers\LGBusEnum.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 sppsvc32;Software Protection ;C:\Windows\System32\PortableDeviceApi32.exe [2011-6-17 767488]

S3 atillk64;atillk64;C:\Users\Gaming\Downloads\ati_winflash_2.0.1.14\atillk64.sys [2006-7-19 14608]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-9-28 79360]

S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-22 1493352]

S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\system32\drivers\LGVirHid.sys --> C:\Windows\system32\drivers\LGVirHid.sys [?]

S3 npggsvc;nProtect GameGuard Service;C:\Windows\system32\GameMon.des -service --> C:\Windows\system32\GameMon.des -service [?]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-4-13 1153368]

S4 WBVGAservice;WB VGA Service;C:\Program Files (x86)\ASUS\Turbo Gear Enhanced VGA Driver\WBVGAservice.exe [2009-9-28 72248]

.

=============== Created Last 30 ================

.

2011-06-23 18:50:20 8873296 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7C24358E-8CCA-4CF7-9A15-07B9F0D4B863}\mpengine.dll

2011-06-23 18:43:14 -------- d-sh--w- C:\$RECYCLE.BIN

2011-06-23 18:42:55 767488 ----a-w- C:\ProgramData\DxpTaskSync32.exe

2011-06-23 18:31:17 98816 ----a-w- C:\Windows\sed.exe

2011-06-23 18:31:17 518144 ----a-w- C:\Windows\SWREG.exe

2011-06-23 18:31:17 256512 ----a-w- C:\Windows\PEV.exe

2011-06-23 18:31:17 208896 ----a-w- C:\Windows\MBR.exe

2011-06-20 02:16:55 -------- d-----w- C:\Users\Gaming\AppData\Local\{426B46F2-9006-4F1B-95AA-0D9CB01565B4}

2011-06-18 01:47:32 -------- d-----w- C:\Users\Gaming\AppData\Roaming\Malwarebytes

2011-06-18 01:47:28 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-06-18 01:47:27 -------- d-----w- C:\ProgramData\Malwarebytes

2011-06-18 01:47:23 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-06-18 01:47:23 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-06-17 22:52:25 767488 ----a-w- C:\Windows\SysWow64\PortableDeviceApi32.exe

2011-06-17 14:28:39 -------- d-----w- C:\Users\Gaming\AppData\Local\{A8A6F851-493E-44CB-8BD2-D8555A581CBB}

2011-06-15 01:56:00 -------- d-----w- C:\Program Files (x86)\AirPort

2011-06-14 14:52:27 -------- d-----w- C:\Users\Gaming\AppData\Local\{F1B73D0A-8DA3-4C26-8C6B-16A70FC035A9}

2011-06-11 03:41:50 -------- d-----w- C:\Users\Gaming\AppData\Local\{E6ACE672-4E85-4098-9B6D-8A87ABCF71AB}

2011-06-10 14:13:37 -------- d-----w- C:\Users\Gaming\AppData\Local\{F2ABE78B-33B2-409F-91C3-ED3A063C0298}

2011-06-10 07:42:16 -------- d-----w- C:\Users\Gaming\AppData\Local\Google

2011-06-09 03:59:43 -------- d-----w- C:\Users\Gaming\AppData\Local\Apple Computer

2011-06-09 03:59:33 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys

2011-06-09 03:59:33 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll

2011-06-09 03:59:33 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll

2011-06-09 03:58:53 -------- d-----w- C:\Program Files\iPod

2011-06-09 03:58:52 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

2011-06-09 03:58:52 -------- d-----w- C:\Program Files\iTunes

2011-06-09 03:58:52 -------- d-----w- C:\Program Files (x86)\iTunes

2011-06-09 03:57:32 -------- d-----w- C:\Program Files\Bonjour

2011-06-09 03:57:32 -------- d-----w- C:\Program Files (x86)\Bonjour

2011-06-09 00:43:42 -------- d-----w- C:\Users\Gaming\AppData\Local\{6942EF52-67F7-46B1-A96A-8945AAAFCCB6}

2011-06-08 00:25:59 -------- d-----w- C:\Users\Gaming\AppData\Local\{E3663BDB-BB2C-4298-81A2-3B2F3DD6140C}

2011-06-05 02:19:34 -------- d-----w- C:\Users\Gaming\AppData\Roaming\TS3Client

2011-06-03 11:13:46 -------- d-----w- C:\Users\Gaming\AppData\Local\{7FC48436-D284-4B26-AC25-EA479256E75A}

2011-06-02 11:16:02 -------- d-----w- C:\Users\Gaming\AppData\Local\{FC3584EE-E9E3-4382-92C9-445B2FDB6827}

2011-06-01 21:50:28 -------- d-----w- C:\Users\Gaming\AppData\Local\{17AD6FA3-F908-4F21-8DC6-ABD5D67CE117}

2011-05-30 01:37:11 -------- d-----w- C:\Users\Gaming\AppData\Local\{9DC16866-38F6-4538-8E87-0CDB94BB83F7}

2011-05-27 15:45:37 -------- d-----w- C:\Users\Gaming\AppData\Local\{E0ADA29A-3D39-4D2D-BE67-21586E282B0C}

2011-05-27 02:19:53 -------- d-----w- C:\Users\Gaming\AppData\Local\{5A6B13DC-849F-42CE-A203-C8D5DF9D3236}

2011-05-26 00:16:34 -------- d-----w- C:\Users\Gaming\AppData\Local\{4545CDD0-DBA1-44C8-8831-44D7FC429245}

2011-05-25 09:17:06 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys

.

==================== Find3M ====================

.

2011-06-21 21:40:43 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-05-28 03:25:16 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2011-05-28 03:07:01 3133952 ----a-w- C:\Windows\System32\win32k.sys

2011-05-28 03:00:02 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-05-22 16:28:40 152064 ----a-w- C:\Windows\SysWow64\msclmd.dll

2011-05-22 16:28:39 175104 ----a-w- C:\Windows\System32\msclmd.dll

2011-05-04 02:51:08 287744 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys

2011-05-04 02:51:08 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys

2011-05-04 02:51:05 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys

2011-05-03 21:33:46 2854504 ----a-w- C:\Windows\System32\drivers\RTKVHD64.sys

2011-05-03 05:21:22 976896 ----a-w- C:\Windows\System32\inetcomm.dll

2011-05-03 04:50:29 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll

2011-05-02 23:03:32 88680 ----a-w- C:\Windows\System32\RCoInst64.dll

2011-04-29 03:13:10 461312 ----a-w- C:\Windows\System32\drivers\srv.sys

2011-04-29 03:12:54 399872 ----a-w- C:\Windows\System32\drivers\srv2.sys

2011-04-29 03:12:37 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys

2011-04-27 02:57:40 102400 ----a-w- C:\Windows\System32\drivers\dfsc.sys

2011-04-25 05:32:22 1896832 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-04-25 02:44:02 499712 ----a-w- C:\Windows\System32\drivers\afd.sys

2011-04-22 20:18:28 1197056 ----a-w- C:\Windows\System32\wininet.dll

2011-04-22 20:14:08 57856 ----a-w- C:\Windows\System32\licmgr10.dll

2011-04-22 19:31:50 981504 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-04-22 19:31:26 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll

2011-04-22 18:49:57 482816 ----a-w- C:\Windows\System32\html.iec

2011-04-22 18:23:59 386048 ----a-w- C:\Windows\SysWow64\html.iec

2011-04-20 19:34:30 3049064 ----a-w- C:\Windows\System32\RtkAPO64.dll

2011-04-20 19:34:30 2393192 ----a-w- C:\Windows\System32\RtPgEx64.dll

2011-04-18 23:50:00 2601816 ----a-w- C:\Windows\System32\WavesGUILib.dll

2011-04-09 06:58:56 142336 ----a-w- C:\Windows\System32\poqexec.exe

2011-04-09 06:45:48 5509504 ----a-w- C:\Windows\System32\ntoskrnl.exe

2011-04-09 06:13:06 3957632 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2011-04-09 06:13:06 3901824 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2011-04-09 05:56:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe

2011-04-06 21:26:58 96544 ----a-w- C:\Windows\System32\dnssd.dll

2011-04-06 21:26:58 69408 ----a-w- C:\Windows\System32\jdns_sd.dll

2011-04-06 21:26:58 237856 ----a-w- C:\Windows\System32\dnssdX.dll

2011-04-06 21:26:58 119584 ----a-w- C:\Windows\System32\dns-sd.exe

2011-04-06 21:20:16 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll

2011-04-06 21:20:16 75040 ----a-w- C:\Windows\SysWow64\jdns_sd.dll

2011-04-06 21:20:16 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll

2011-04-06 21:20:16 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe

.

============= FINISH: 13:54:18.27 ===============

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi,

Where is Microsoft Security Essentials finding the file?

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

  1. Tick the box next to YES, I accept the Terms of Use.
  2. Click Start
  3. When asked, allow the ActiveX control to install
  4. Click Start
  5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  6. Click Scan
    Wait for the scan to finish
  7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  8. Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

Link to post
Share on other sites
BlinkyBill01

BlinkyBill01

Posted
  • Author
Posted

The trojan that MSE keeps logging upon startup is Tracur.F, the same one that ESET found. No matter how many times MSE deletes it, it pops back up each time.

Here are the logs that you requested:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner64.ocx - registred OK

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)

# OnlineScanner.ocx=1.0.0.6427

# api_version=3.0.2

# EOSSerial=31eb0eaa4b85df4e873620662a8b7317

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-06-27 07:07:16

# local_time=2011-06-27 02:07:16 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=6.1.7600 NT

# compatibility_mode=512 16777215 100 0 22227762 22227762 0 0

# compatibility_mode=5893 16776574 100 94 2150374 60697533 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=188109

# found=8

# cleaned=8

# scan_time=4353

C:\ProgramData\api-ms-win-core-misc-l1-1-032.dll a variant of Win32/Kryptik.OKQ trojan (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C

C:\ProgramData\DxpTaskSync32.exe a variant of Win32/Kryptik.PGS trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\ProgramData\api-ms-win-core-misc-l1-1-032.dll.vir a variant of Win32/Kryptik.OKQ trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\ProgramData\DxpTaskSync32.exe.vir a variant of Win32/Kryptik.PGS trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Users\Gaming\AppData\Roaming\Mozilla\Firefox\Profiles\85hlj83y.default\extensions\{4d555559-e7ec-4f0a-a432-a458d28ef6d3}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Gaming\AppData\Local\Google\Chrome\User Data\Default\Default\phgnjpapiiaoklblfidifkdobfoahagh\contentscript.js Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Gaming\AppData\Local\Temp\NOD9882.tmp a variant of Win32/Kryptik.OKQ trojan (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\PortableDeviceApi32.exe a variant of Win32/Kryptik.PGS trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

SECURITY CHECK

Results of screen317's Security Check version 0.99.16

Windows 7 (UAC is disabled!)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

HijackThis 2.0.2

Java 6 Update 19

Out of date Java installed!

Flash Player Out of Date!

Adobe Flash Player 10.1.85.3

````````````````````````````````

Process Check:

objlist.exe by Laurent

Windows Defender MSMpEng.exe

Malwarebytes' Anti-Malware mbamservice.exe

Malwarebytes' Anti-Malware mbamgui.exe

Microsoft Security Essentials msseces.exe

ESET ESET Online Scanner OnlineCmdLineScanner.exe

Microsoft Security Client Antimalware MsMpEng.exe

Microsoft Security Client Antimalware NisSrv.exe

``````````End of Log````````````

Link to post
Share on other sites
  • 1 month later...
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.