REdirect Virus

raewyn · September 24, 2011

Hope I have followed instructions correctly:

MAlwarebytes log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7786

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

24/09/2011 2:48:55 p.m.

mbam-log-2011-09-24 (14-48-55).txt

Scan type: Quick scan

Objects scanned: 185611

Time elapsed: 13 minute(s), 56 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS Log:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7600.16385

Run by Raewyn at 14:51:59 on 2011-09-24

Microsoft Windows 7 Professional 6.1.7600.0.1252.64.1033.18.2046.789 [GMT 12:00]

.

AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

AV: Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}

AV: Microsoft Security Essentials *Enabled/Updated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}

SP: Microsoft Security Essentials *Enabled/Updated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}

SP: SPYWAREfighter *Disabled/Updated* {2CA2BED9-C3E1-63C9-3FCE-3527C816A7C9}

SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}

FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\CISVC.EXE

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Citrix\GoToMeeting\723\g2mstart.exe

C:\Program Files\Citrix\GoToMeeting\723\g2mcomm.exe

C:\Program Files\Citrix\GoToMeeting\723\g2mlauncher.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

C:\Program Files\PC Tools Security\BDT\FGuard.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Fighters\FighterSuiteService.exe

C:\Program Files\Common Files\Common Toolkit Suite\AVEngine\AVScanningService.exe

C:\Program Files\Common Files\Common Toolkit Suite\AVEngine\AVWatchService.exe

C:\Program Files\Fighters\SPYWAREfighter\SWPROTray.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe

C:\Standard19\Myob.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\LogonUI.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.co.nz/

uURLSearchHooks: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLL

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

uRun: [GBMPro8Agent] c:\program files\genie-soft\gbmpro8\GBMAgent.exe

uRun: [Google Update] "c:\users\raewyn\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [GoToMeeting] "c:\program files\citrix\gotomeeting\723\g2mstart.exe" "/Trigger RunAtLogon"

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe"

uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10w_ActiveX.exe -update activex

mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide

mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"

mRun: [<NO NAME>]

mRun: [GBMPro8Agent] c:\program files\genie-soft\gbmpro8\GBMAgent.exe

mRun: [brMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN

mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun

mRun: [Nikon Message Center 2] c:\program files\nikon\nikon message center 2\NkMC2.exe -s

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [PCTools FGuard] c:\program files\pc tools security\bdt\FGuard.exe

mRun: [sWPROguard] c:\program files\fighters\spywarefighter\SWPROTray.exe

mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~1\office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll

Trusted Zone: softpedia.com

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{D1726423-1A96-4482-9966-9AB28BD9517B} : DhcpNameServer = 192.168.1.254

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\raewyn\appdata\roaming\mozilla\firefox\profiles\drzcq1je.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.co.nz/

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL

FF - plugin: c:\users\raewyn\appdata\local\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\users\raewyn\appdata\roaming\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\users\raewyn\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

.

============= SERVICES / DRIVERS ===============

.

R0 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2011-8-4 50624]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-9-21 326688]

R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-9-21 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2011-9-21 656320]

R1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\drivers\EpfwLWF.sys [2011-8-4 33656]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-26 151216]

R1 MpKsl24f17207;MpKsl24f17207;c:\programdata\microsoft\microsoft antimalware\definition updates\{79cdc7c4-4cfa-4e80-83ce-9bb7c01171d9}\MpKsl24f17207.sys [2011-9-24 28752]

R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [2011-9-21 184536]

R2 AV Engine Scanning Service;AV Engine Scanning Service;c:\program files\common files\common toolkit suite\avengine\AVScanningService.exe [2011-8-17 831000]

R2 AV Watch Service;AV Watch Service;c:\program files\common files\common toolkit suite\avengine\AVWatchService.exe [2011-8-17 142960]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools security\bdt\BDTUpdateService.exe [2011-9-21 337872]

R2 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2011-8-9 163424]

R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2011-8-9 974944]

R2 Suite Service;Suite Service;c:\program files\fighters\FighterSuiteService.exe [2011-8-17 1302152]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-3-26 42368]

R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-10 4640000]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-11 139776]

RUnknown 34130660;34130660; [x]

RUnknown 6056478drv;6056478drv; [x]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 AVFSFilter;AVFSFilter;c:\windows\system32\drivers\avfsfilter.sys [2011-8-17 10264]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-9-21 371472]

S3 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-9-21 1117144]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-11-4 1343400]

.

=============== Created Last 30 ================

.

2011-09-24 02:34:26 -------- d-----w- c:\users\raewyn\appdata\roaming\Malwarebytes

2011-09-24 02:34:05 -------- d-----w- c:\programdata\Malwarebytes

2011-09-24 02:34:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-09-24 02:33:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-09-23 15:37:32 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{79cdc7c4-4cfa-4e80-83ce-9bb7c01171d9}\MpKsl24f17207.sys

2011-09-23 15:37:00 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{79cdc7c4-4cfa-4e80-83ce-9bb7c01171d9}\offreg.dll

2011-09-23 15:36:42 7269712 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{79cdc7c4-4cfa-4e80-83ce-9bb7c01171d9}\mpengine.dll

2011-09-21 10:42:24 -------- d-----w- c:\programdata\Kaspersky Lab

2011-09-21 03:56:59 -------- d-----w- c:\users\raewyn\appdata\roaming\ESET

2011-09-21 03:56:59 -------- d-----w- c:\users\raewyn\appdata\local\ESET

2011-09-21 03:55:03 -------- d-----w- c:\program files\ESET

2011-09-21 03:53:03 -------- d-----w- c:\programdata\clp

2011-09-21 03:52:06 -------- d-----w- c:\programdata\Common Toolkit Suite

2011-09-21 03:52:06 -------- d-----w- c:\program files\Fighters

2011-09-21 03:52:06 -------- d-----w- c:\program files\common files\Common Toolkit Suite

2011-09-21 03:51:53 -------- d-----w- c:\programdata\Fighters

2011-09-21 03:51:16 -------- dc-h--w- c:\programdata\{7AF9B877-7A67-4D6F-9644-806B2CF285EC}

2011-09-21 03:49:39 -------- d-----w- c:\users\raewyn\appdata\roaming\Fighters

2011-09-21 03:49:35 -------- d-----w- c:\users\raewyn\appdata\local\PackageAware

2011-09-21 03:31:44 767952 ----a-w- c:\windows\BDTSupport.dll

2011-09-21 03:31:43 149456 ----a-w- c:\windows\SGDetectionTool.dll

2011-09-21 03:31:41 2189264 ----a-w- c:\windows\PCTBDCore.dll

2011-09-21 03:31:41 1533904 ----a-w- c:\windows\PCTBDRes.dll

2011-09-21 03:29:03 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2011-09-21 03:29:03 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2011-09-21 03:29:01 252712 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2011-09-21 03:29:01 107864 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys

2011-09-21 03:28:52 326688 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2011-09-21 03:28:52 162200 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2011-09-21 03:28:48 184536 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2011-09-21 03:28:41 70664 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2011-09-21 03:28:00 -------- d-----w- c:\program files\common files\PC Tools

2011-09-21 03:27:59 -------- d-----w- c:\program files\PC Tools Security

2011-09-21 03:24:31 -------- d-----w- c:\programdata\PC Tools

2011-09-15 22:18:35 29272 ----a-r- c:\windows\system32\AdobePDF.dll

2011-09-15 22:18:11 95600 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll

2011-09-11 22:30:01 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

==================== Find3M ====================

.

2011-08-17 10:42:07 72080 ----a-w- c:\users\raewyn\g2mdlhlpx.exe

2011-08-16 13:10:00 10264 ----a-w- c:\windows\system32\drivers\avfsfilter.sys

2011-08-09 01:57:10 163424 ----a-w- c:\windows\system32\drivers\eamonm.sys

2011-08-03 21:20:38 50624 ----a-w- c:\windows\system32\drivers\epfwwfp.sys

2011-08-03 21:20:38 33656 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys

2011-08-03 21:20:38 147480 ----a-w- c:\windows\system32\drivers\epfw.sys

2011-08-03 21:20:36 118104 ----a-w- c:\windows\system32\drivers\ehdrv.sys

2011-07-22 04:56:17 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-07-16 04:37:32 169984 ----a-w- c:\windows\system32\winsrv.dll

2011-07-16 04:34:28 290816 ----a-w- c:\windows\system32\KernelBase.dll

2011-07-16 04:31:12 271360 ----a-w- c:\windows\system32\conhost.exe

2011-07-16 02:21:47 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2011-07-16 02:21:47 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2011-07-16 02:21:47 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2011-07-16 02:21:47 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2011-07-09 04:30:52 2048 ----a-w- c:\windows\system32\tzres.dll

2011-07-09 02:26:10 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

.

============= FINISH: 14:53:19.10 ===============

Could someone please confirm I have posted in the right place and someone will respond at some point please

attach.zip

screen317 · September 28, 2011

Hi and welcome to Malwarebytes.

I notice that you are using more than one antivirus program (ESET, Microsoft, and Spyware Doctor). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly into your reply.

raewyn · September 28, 2011

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7813

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

28/09/2011 7:08:32 p.m.

mbam-log-2011-09-28 (19-08-32).txt

Scan type: Quick scan

Objects scanned: 185209

Time elapsed: 9 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7600.16385

Run by Raewyn at 19:13:11 on 2011-09-28

Microsoft Windows 7 Professional 6.1.7600.0.1252.64.1033.18.2046.1134 [GMT 13:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}

SP: Microsoft Security Essentials *Enabled/Updated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\CISVC.EXE

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe

C:\Program Files\Brother\ControlCenter3\brccMCtl.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Citrix\GoToMeeting\723\g2mstart.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Citrix\GoToMeeting\723\g2mcomm.exe

C:\Program Files\Citrix\GoToMeeting\723\g2mlauncher.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroDist.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\conhost.exe

C:\Windows\system32\DllHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.co.nz/

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLL

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File