Trojan SVChost.exe

Riles2003 · October 8, 2011

Hello, our shared network computer recently got a virus on it (it appeared as Guard Security). After trying to use Avast to kill it (MBAM is not killing it), I deleted Avast (as it was causing an O/S system failure). My MBAM log files are below. First scan revealed 13 viruses, etc, and got rid of them. I have run MBAM 3-4 times since and keep getting the Trojansvchost.exe virus. It deletes it but keeps reappearing after restart. MBAM logs, DDS log, and attach and GSEM logs attached.

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7902

Windows 6.1.7600 (Safe Mode)

Internet Explorer 8.0.7600.16385

10/8/2011 10:53:34 AM

mbam-log-2011-10-08 (10-53-34).txt

Scan type: Full scan (C:\|E:\|F:\|G:\|)

Objects scanned: 393603

Time elapsed: 32 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{0DB29AD1-0359-49DE-9A4D-AF817929C90e} (Trojan.SHarpro.Gen) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DB29AD1-0359-49DE-9A4D-AF817929C90E} (Trojan.SHarpro.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0DB29AD1-0359-49DE-9A4D-AF817929C90E} (Trojan.SHarpro.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0DB29AD1-0359-49DE-9A4D-AF817929C90E} (Trojan.SHarpro.Gen) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Symantec Update (Trojan.SHarpro.PGen) -> Value: Symantec Update -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\Mike\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\35JIVPPR\ex[1].htm (Rootkit.TDSS) -> Quarantined and deleted successfully.

c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\0.37946994919636934.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

c:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\0.7662471633851504.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

c:\Users\Mike\AppData\Roaming\ldr.ini (Malware.Trace) -> Quarantined and deleted successfully.

c:\Users\Mike\local settings\application data\explorerwin32.dll (Trojan.SHarpro.Gen) -> Quarantined and deleted successfully.

c:\Users\Mike\AppData\Local\explorerwin32.dll (Trojan.SHarpro.Gen) -> Quarantined and deleted successfully.

c:\Users\Mike\AppData\Local\microsoft\microsoftupdate\microsoftupdt32.dll (Trojan.SHarpro.PGen) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7902

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

10/8/2011 12:20:47 PM

mbam-log-2011-10-08 (12-20-47).txt

Scan type: Quick scan

Objects scanned: 227994

Time elapsed: 6 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7600.16385

Run by Mike at 12:52:20 on 2011-10-08

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6007.3562 [GMT -7:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {BF5CEBDC-F2D3-7540-343C-F0CE11FD6E66}

SP: Microsoft Security Essentials *Enabled/Updated* {043D0A38-D4E9-7ACE-0E8C-CBBC6A7A24DB}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe

C:\Program Files\ocBackup Manager\aua\bin\Aua.exe

C:\Program Files\ocBackup Manager\aua\jvm\bin\auaJW.exe

C:\Program Files\ocBackup Manager\bin\CDPService64.exe

C:\Windows\system32\conhost.exe

C:\Program Files\ocBackup Manager\bin\Scheduler.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\ocBackup Manager\jvm\bin\bschJW.exe

C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe

C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe

C:\Program Files (x86)\TeamViewer\Version4\TeamViewer.exe

C:\Windows\system32\taskhost.exe

C:\OEM\USBDECTION\USBS3S4Detection.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\ocBackup Manager\bin\SystemTray64.exe

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\System32\rundll32.exe

C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe

C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\SysWOW64\rundll32.exe

C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\servicing\TrustedInstaller.exe

-netsvcs

C:\Windows\system32\conhost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2840&r=173606104207p0438v145k4521r272

uDefault_Page_URL = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2840&r=173606104207p0438v145k4521r272

mDefault_Page_URL = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2840&r=173606104207p0438v145k4521r272

mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2840&r=173606104207p0438v145k4521r272

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

uRun: [JavaBackupVerifier] rundll32.exe "C:\ProgramData\JavaBackupVerifier.dll",DllRegisterServer

mRun: [backupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Gateway Photo Frame] C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe -A

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

mRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

StartupFolder: C:\Users\Mike\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\winupd.lnk - C:\Users\Mike\AppData\Local\Temp\winupd.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

Trusted Zone: ocbackup.com\s3

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} - hxxps://tm.sureclose.com/include/xupload.ocx

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{A3180FDA-D242-45C2-9093-FA5857FF4F89} : DhcpNameServer = 192.168.1.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

mRun-x64: [backupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" -h -k

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Gateway Photo Frame] C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe -A

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

mRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

.

---- FIREFOX POLICIES ----

FF - user.js: browser.search.selectedEngine - Search

FF - user.js: browser.search.order.1 - Search

FF - user.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s=

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R2 Greg_Service;GRegService;C:\Program Files (x86)\Gateway\Registration\GregHSRW.exe [2009-8-28 1150496]

R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-8-12 62208]

R2 OBAutoUpdate;AutoUpdateAgent (ocBackup Manager);C:\Program Files\ocBackup Manager\aua\bin\Aua.exe [2011-2-2 73728]

R2 OBCDPService;Continuous Data Protection (ocBackup Manager);C:\Program Files\ocBackup Manager\bin\CDPService64.exe [2011-2-2 366248]

R2 OBScheduler;Online Backup Scheduler (ocBackup Manager);C:\Program Files\ocBackup Manager\bin\Scheduler.exe [2011-2-2 83584]

R2 TeamViewer4;TeamViewer 4;C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2010-3-22 185640]

R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-11-24 2320920]

R2 Updater Service;Updater Service;C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe [2009-11-24 240160]

R2 USBS3S4Detection;USBS3S4Detection;C:\OEM\USBDECTION\USBS3S4Detection.exe [2009-12-13 76320]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;C:\Windows\system32\DRIVERS\e1k62x64.sys --> C:\Windows\system32\DRIVERS\e1k62x64.sys [?]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

R3 QuickBooksDB20;QuickBooksDB20;C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB20 --> C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB20 [?]

R3 teamviewervpn;TeamViewer VPN Adapter;C:\Windows\system32\DRIVERS\teamviewervpn.sys --> C:\Windows\system32\DRIVERS\teamviewervpn.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-3-30 47128]

S4 SQLAgent$MSSMLBIZ;SQL Server Agent (MSSMLBIZ);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [2009-3-30 366936]

.

=============== Created Last 30 ================

.

2011-10-08 19:11:37 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5003D862-B819-4E05-82F4-03CCE00C981B}\offreg.dll

2011-10-07 23:48:17 -------- d-----w- C:\Users\Mike\AppData\Roaming\xvD2onF4pHsJdKg

2011-10-07 23:48:16 -------- d-----w- C:\Users\Mike\AppData\Roaming\NqhYXwkUVlBz0c1

2011-10-07 23:28:35 -------- d-----w- C:\ProgramData\AVAST Software

2011-10-07 23:28:35 -------- d-----w- C:\Program Files\AVAST Software

2011-10-07 22:38:57 -------- d-----w- C:\Users\Mike\AppData\Roaming\helOBtzP0c1v2n4

2011-10-07 22:38:56 -------- d-----w- C:\Users\Mike\AppData\Roaming\gamH5sWJ7E8RqYw

2011-10-07 21:04:21 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

2011-10-07 20:41:44 -------- d-----w- C:\Users\Mike\AppData\Roaming\zG5aQJ6dW8R9TqU

2011-10-07 20:41:43 -------- d-----w- C:\Users\Mike\AppData\Roaming\w1uvS2obFp

2011-10-07 17:09:04 -------- d-----w- C:\Users\Mike\AppData\Roaming\txA0uvS2iFpGaHd

2011-10-07 17:09:04 -------- d-----w- C:\Users\Mike\AppData\Roaming\H7fRL9gTXjCkVzN

2011-10-07 15:54:35 20480 ----a-w- C:\Windows\svchost.exe

2011-10-07 15:53:16 -------- d-----w- C:\Users\Mike\AppData\Roaming\PPNyxA1uv2b3m5Q

2011-10-07 15:53:16 -------- d-----w- C:\Users\Mike\AppData\Roaming\AhTXwjUCe

2011-10-07 15:44:58 -------- d-----w- C:\Users\Mike\AppData\Roaming\YZqqhhYCwkUVr

2011-10-07 15:44:58 -------- d-----w- C:\Users\Mike\AppData\Roaming\GfffELL8gT

2011-10-07 15:44:52 -------- d-----w- C:\Users\Mike\AppData\Roaming\a333pnnG4aQ6sK7

2011-10-07 15:44:51 -------- d-----w- C:\Users\Mike\AppData\Roaming\V99ggTXqjYCekVz

2011-10-07 09:29:54 9049936 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5003D862-B819-4E05-82F4-03CCE00C981B}\mpengine.dll

2011-10-07 00:56:12 -------- d-----w- C:\ProgramData\WSTB

2011-10-06 16:28:43 100352 ----a-w- C:\Windows\SysWow64\srrstr.dll

2011-10-06 16:28:40 100352 ----a-w- C:\ProgramData\JavaBackupVerifier.dll

.

==================== Find3M ====================

.

2011-09-01 00:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-07-22 05:35:08 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2011-07-22 04:56:17 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-07-16 05:26:54 362496 ----a-w- C:\Windows\System32\wow64win.dll

2011-07-16 05:26:53 243200 ----a-w- C:\Windows\System32\wow64.dll

2011-07-16 05:26:53 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

2011-07-16 05:26:18 214528 ----a-w- C:\Windows\System32\winsrv.dll

2011-07-16 05:24:09 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2011-07-16 05:21:32 422400 ----a-w- C:\Windows\System32\KernelBase.dll

2011-07-16 05:17:46 338432 ----a-w- C:\Windows\System32\conhost.exe

2011-07-16 04:36:09 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2011-07-16 04:32:14 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2011-07-16 04:31:50 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2011-07-16 04:30:29 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2011-07-16 04:30:27 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll

2011-07-16 02:26:12 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2011-07-16 02:26:11 2048 ----a-w- C:\Windows\SysWow64\user.exe

2011-07-16 02:21:47 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2011-07-16 02:21:47 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2011-07-16 02:21:47 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2011-07-16 02:21:47 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

.

============= FINISH: 12:52:40.03 ===============

ark.zip

LDTate · October 8, 2011

:welcome:

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Riles2003 · October 8, 2011

Please do not attach the scan results from Combofx. Use copy/paste.
Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")
Download ComboFix from one of these locations:
Link 1
Link 2 If using this link, Right Click and select Save As.
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Give it atleast 20-30 minutes to finish if needed.
Please do not attach the scan results from Combofx. Use copy/paste.
Also please describe how your computer behaves at the moment.

The computer sounds like it is running hard. ComboFix was causing a blue screen of death in normal mode so i ran it in Safe Mode. It seemed to operate properly in safe mode, but it restarted when it was done. The restart went back into normal mode and for some reason MBAM has been trying to start up at that point (I get the MBAM is trying to make changes to your computer warning). I closed the box, but now the ComboFix box appears stalled. It just says "Preparing Log Report" and then "Do not run any programs until ComboFix has finished" Nothing else is running (as far as i can tell...is there a way to check?) how long does the log report take (we are at least 10 minutes) and the computer sounds like it is running really hard. I am typing this from a laptop and not from the infected computer.

LDTate · October 8, 2011

It can take up to 30 mins.

If there's drive activity, let it run.

Riles2003 · October 8, 2011

The log report came back.

ComboFix 11-10-08.04 - Mike 10/08/2011 15:50:05.1.4 - x64 NETWORK

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6007.4670 [GMT -7:00]

Running from: c:\users\Mike\Desktop\ComboFix.exe

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\JavaBackupVerifier.dll

c:\users\gtsadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D58ECA25-DD44-4D64-9E62-8B058508E56C}.xps

c:\users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Guard Online

c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\extensions\{9a1844d8-6c82-42ea-97a6-112c0dbcd742}

c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\extensions\{9a1844d8-6c82-42ea-97a6-112c0dbcd742}\chrome\xulcache.jar

c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\extensions\{9a1844d8-6c82-42ea-97a6-112c0dbcd742}\defaults\preferences\xulcache.js

c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\extensions\{9a1844d8-6c82-42ea-97a6-112c0dbcd742}\install.rdf

c:\windows\assembly\tmp\U

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2011-09-08 to 2011-10-08 )))))))))))))))))))))))))))))))

.

2011-10-08 22:55 . 2011-10-08 22:55 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAB47B64-94F6-4762-ACA6-6F9CD6C65CCA}\offreg.dll

2011-10-08 22:54 . 2011-10-08 22:54 -------- d-----w- c:\users\User\AppData\Local\temp

2011-10-08 22:54 . 2011-10-08 22:54 -------- d-----w- c:\users\QBDataServiceUser20\AppData\Local\temp

2011-10-08 21:56 . 2011-10-08 21:56 -------- d-----w- c:\program files (x86)\ESET

2011-10-08 21:03 . 2011-10-08 21:03 601424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D7EAFA22-255A-4E1F-BD4B-C60DBD8562A0}\gapaengine.dll

2011-10-08 21:03 . 2011-09-13 00:26 9049936 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAB47B64-94F6-4762-ACA6-6F9CD6C65CCA}\mpengine.dll

2011-10-08 20:54 . 2011-10-08 20:54 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2011-10-08 20:54 . 2011-09-13 00:26 9049936 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll

2011-10-08 20:53 . 2011-10-08 20:54 -------- d-----w- c:\program files\Microsoft Security Client

2011-10-08 20:53 . 2010-04-09 11:06 374664 ----a-w- c:\windows\system32\drivers\netio.sys

2011-10-07 23:48 . 2011-10-07 23:48 -------- d-----w- c:\users\Mike\AppData\Roaming\xvD2onF4pHsJdKg

2011-10-07 23:48 . 2011-10-07 23:48 -------- d-----w- c:\users\Mike\AppData\Roaming\NqhYXwkUVlBz0c1

2011-10-07 23:28 . 2011-09-06 20:45 254400 ----a-w- c:\windows\system32\aswBoot.exe

2011-10-07 23:28 . 2011-10-08 21:53 -------- d-----w- c:\programdata\AVAST Software

2011-10-07 23:28 . 2011-10-07 23:28 -------- d-----w- c:\program files\AVAST Software

2011-10-07 22:38 . 2011-10-07 22:38 -------- d-----w- c:\users\Mike\AppData\Roaming\helOBtzP0c1v2n4

2011-10-07 22:38 . 2011-10-07 22:38 -------- d-----w- c:\users\Mike\AppData\Roaming\gamH5sWJ7E8RqYw

2011-10-07 21:04 . 2011-10-07 21:04 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%

2011-10-07 20:41 . 2011-10-07 20:41 -------- d-----w- c:\users\Mike\AppData\Roaming\zG5aQJ6dW8R9TqU

2011-10-07 20:41 . 2011-10-07 20:41 -------- d-----w- c:\users\Mike\AppData\Roaming\w1uvS2obFp

2011-10-07 17:09 . 2011-10-07 17:09 -------- d-----w- c:\users\Mike\AppData\Roaming\H7fRL9gTXjCkVzN

2011-10-07 17:09 . 2011-10-07 17:09 -------- d-----w- c:\users\Mike\AppData\Roaming\txA0uvS2iFpGaHd

2011-10-07 15:54 . 2009-07-14 01:14 20480 ----a-w- c:\windows\svchost.exe

2011-10-07 15:53 . 2011-10-07 15:53 -------- d-----w- c:\users\Mike\AppData\Roaming\PPNyxA1uv2b3m5Q

2011-10-07 15:53 . 2011-10-07 15:53 -------- d-----w- c:\users\Mike\AppData\Roaming\AhTXwjUCe

2011-10-07 15:44 . 2011-10-07 15:44 -------- d-----w- c:\users\Mike\AppData\Roaming\YZqqhhYCwkUVr

2011-10-07 15:44 . 2011-10-07 15:44 -------- d-----w- c:\users\Mike\AppData\Roaming\GfffELL8gT

2011-10-07 15:44 . 2011-10-08 00:35 -------- d-----w- c:\users\Mike\AppData\Roaming\a333pnnG4aQ6sK7

2011-10-07 15:44 . 2011-10-07 15:44 -------- d-----w- c:\users\Mike\AppData\Roaming\V99ggTXqjYCekVz

2011-10-07 00:56 . 2011-10-07 17:06 -------- d-----w- c:\programdata\WSTB

2011-10-06 16:28 . 2011-10-06 16:28 100352 ----a-w- c:\windows\SysWow64\srrstr.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-13 00:26 . 2010-07-28 09:10 9049936 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-09-01 00:00 . 2010-11-23 20:43 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-22 05:35 . 2011-08-10 23:43 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-07-22 04:56 . 2011-08-10 23:43 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-07-16 05:26 . 2011-08-10 23:43 362496 ----a-w- c:\windows\system32\wow64win.dll

2011-07-16 05:26 . 2011-08-10 23:43 243200 ----a-w- c:\windows\system32\wow64.dll

2011-07-16 05:26 . 2011-08-10 23:43 13312 ----a-w- c:\windows\system32\wow64cpu.dll

2011-07-16 05:26 . 2011-08-10 23:43 214528 ----a-w- c:\windows\system32\winsrv.dll

2011-07-16 05:24 . 2011-08-10 23:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll

2011-07-16 05:21 . 2011-08-10 23:43 422400 ----a-w- c:\windows\system32\KernelBase.dll

2011-07-16 05:17 . 2011-08-10 23:43 338432 ----a-w- c:\windows\system32\conhost.exe

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2011-07-16 05:04 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2011-07-16 04:36 . 2011-08-10 23:43 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll

2011-07-16 04:32 . 2011-08-10 23:43 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2011-07-16 04:31 . 2011-08-10 23:43 25600 ----a-w- c:\windows\SysWow64\setup16.exe

2011-07-16 04:30 . 2011-08-10 23:43 5120 ----a-w- c:\windows\SysWow64\wow32.dll

2011-07-16 04:30 . 2011-08-10 23:43 272384 ----a-w- c:\windows\SysWow64\KernelBase.dll

2011-07-16 04:19 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

2011-07-16 04:19 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

2011-07-16 02:26 . 2011-08-10 23:43 7680 ----a-w- c:\windows\SysWow64\instnm.exe

2011-07-16 02:26 . 2011-08-10 23:43 2048 ----a-w- c:\windows\SysWow64\user.exe

2011-07-16 02:21 . 2011-08-10 23:43 6144 ---ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2011-07-16 02:21 . 2011-08-10 23:43 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2011-07-16 02:21 . 2011-08-10 23:43 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2011-07-16 02:21 . 2011-08-10 23:43 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" [2009-08-12 244480]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" [2009-05-27 123904]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Malwarebytes Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2011-09-01 1047208]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2011-09-01 1047208]

.

c:\users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

winupd.lnk - c:\users\Mike\AppData\Local\Temp\winupd.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-03-31 47128]

R4 SQLAgent$MSSMLBIZ;SQL Server Agent (MSSMLBIZ);c:\program files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]

S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-08-12 62208]

S2 OBAutoUpdate;AutoUpdateAgent (ocBackup Manager);c:\program files\ocBackup Manager\aua\bin\Aua.exe [2008-05-09 73728]

S2 OBCDPService;Continuous Data Protection (ocBackup Manager);c:\program files\ocBackup Manager\bin\CDPService64.exe [2010-12-21 366248]

S2 OBScheduler;Online Backup Scheduler (ocBackup Manager);c:\program files\ocBackup Manager\bin\Scheduler.exe [2010-12-21 83584]

S2 TeamViewer4;TeamViewer 4;c:\program files (x86)\TeamViewer\Version4\TeamViewer_Service.exe [2010-03-22 185640]

S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]

S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160]

S2 USBS3S4Detection;USBS3S4Detection;c:\oem\USBDECTION\USBS3S4Detection.exe [2009-12-09 76320]

S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 QuickBooksDB20;QuickBooksDB20;c:\progra~2\Intuit\QUICKB~1\QBDBMgrN.exe [2009-08-18 678912]

S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [x]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-09-02 8098848]

"OBSystemTray"="c:\program files\ocBackup Manager\bin\SystemTray64.exe" [2010-12-21 529032]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2840&r=173606104207p0438v145k4521r272

mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&m=sx2840&r=173606104207p0438v145k4521r272

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

Trusted Zone: ocbackup.com\s3

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - user.js: browser.search.selectedEngine - Search

FF - user.js: browser.search.order.1 - Search

FF - user.js: keyword.URL - hxxp://search.internet-search-results.com/?sid=10101182100&s=

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-JavaBackupVerifier - c:\programdata\JavaBackupVerifier.dll

Toolbar-Locked - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]

@Denied: (A) (Everyone)

"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]

"Key"="ActionsPane"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\program files (x86)\TeamViewer\Version4\TeamViewer.exe

c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\\.\globalroot\systemroot\svchost.exe

.

**************************************************************************

.

Completion time: 2011-10-08 16:07:46 - machine was rebooted

ComboFix-quarantined-files.txt 2011-10-08 23:07

.

Pre-Run: 925,059,850,240 bytes free

Post-Run: 925,845,041,152 bytes free

.

- - End Of File - - F053981BD9E6D43CCFE29A216354170F

Riles2003 · October 8, 2011

I had also run ESET earlier (after MBAM was only reporting one infected file) and ESET came back with 13.

Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\78a7dab-277e985a a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\78a7dab-4851703b a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\78a7dab-50d4ec19 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\78a7dab-6e4512e3 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\78a7dab-72abd013 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\78a7dab-78222619 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\jglqocbu.default\extensions\{9a1844d8-6c82-42ea-97a6-112c0dbcd742}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan cleaned by deleting - quarantined

C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\43b8adf4-4f2aca09 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\43b8adf4-52c9ee38 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\43b8adf4-5a8b6dbe a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\43b8adf4-5cfef960 a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\43b8adf4-66f2aeae a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\43b8adf4-6cfc0c0b a variant of Java/Agent.DT trojan cleaned by deleting - quarantined

LDTate · October 8, 2011

You have 2 anti-virus programs running.

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

Use Add/Remove Programs and uninstall one of them

Do you know what these folders are like this?

2011-10-07 23:48 . 2011-10-07 23:48 -------- d-----w- c:\users\Mike\AppData\Roaming\xvD2onF4pHsJdKg

Riles2003 · October 8, 2011

You have 2 anti-virus programs running.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
Use Add/Remove Programs and uninstall one of them
Do you know what these folders are like this?
2011-10-07 23:48 . 2011-10-07 23:48 -------- d-----w- c:\users\Mike\AppData\Roaming\xvD2onF4pHsJdKg

I have already deleted Avast (it just had not restarted properly prior to running the ComboFix so it wasn't all uninstalled). It is gone now. I have no idea what those folders are. We use logmein to remote access our network...maybe that? Sorry some of this stuff is a little beyond me (if I am not giving you correct answers). Thanks for all your help so far!

LDTate · October 8, 2011

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\users\Mike\AppData\Local\Temp\winupd.exe

Folder::
c:\users\Mike\AppData\Roaming\xvD2onF4pHsJdKg
c:\users\Mike\AppData\Roaming\NqhYXwkUVlBz0c1
c:\users\Mike\AppData\Roaming\helOBtzP0c1v2n4
c:\users\Mike\AppData\Roaming\gamH5sWJ7E8RqYw
c:\users\Mike\AppData\Roaming\zG5aQJ6dW8R9TqU
c:\users\Mike\AppData\Roaming\w1uvS2obFp
c:\users\Mike\AppData\Roaming\H7fRL9gTXjCkVzN
C:\users\Mike\AppData\Roaming\txA0uvS2iFpGaHd
c:\users\Mike\AppData\Roaming\PPNyxA1uv2b3m5Q
c:\users\Mike\AppData\Roaming\AhTXwjUCe
c:\users\Mike\AppData\Roaming\YZqqhhYCwkUVr
c:\users\Mike\AppData\Roaming\GfffELL8gT
c:\users\Mike\AppData\Roaming\a333pnnG4aQ6sK7
c:\users\Mike\AppData\Roaming\V99ggTXqjYCekVz

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

LDTate · October 8, 2011

I'm done for today.

I'll be back on tomorrow

Riles2003 · October 8, 2011

I'm done for today.
I'll be back on tomorrow

No sweat. Have a nice night...attached are the latest combofix results...i noticed some of those roaming apps had the "Guard Online" name on them (which was the fake trojan shield that had been popping up). Computer seems a little more peppy and quiet (although it was loud during combofix). talk to you tommorrow!

ComboFix 11-10-08.05 - Mike 10/08/2011 16:37:15.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6007.4393 [GMT -7:00]

Running from: c:\users\Mike\Desktop\ComboFix.exe

Command switches used :: c:\users\Mike\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\users\Mike\AppData\Local\Temp\winupd.exe"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Mike\AppData\Roaming\a333pnnG4aQ6sK7

c:\users\Mike\AppData\Roaming\AhTXwjUCe

c:\users\Mike\AppData\Roaming\gamH5sWJ7E8RqYw

c:\users\Mike\AppData\Roaming\GfffELL8gT

c:\users\Mike\AppData\Roaming\H7fRL9gTXjCkVzN

c:\users\Mike\AppData\Roaming\H7fRL9gTXjCkVzN\Guard Online .ico

c:\users\Mike\AppData\Roaming\helOBtzP0c1v2n4

c:\users\Mike\AppData\Roaming\helOBtzP0c1v2n4\Guard Online .ico

c:\users\Mike\AppData\Roaming\NqhYXwkUVlBz0c1

c:\users\Mike\AppData\Roaming\PPNyxA1uv2b3m5Q

c:\users\Mike\AppData\Roaming\PPNyxA1uv2b3m5Q\Guard Online .ico

c:\users\Mike\AppData\Roaming\txA0uvS2iFpGaHd

c:\users\Mike\AppData\Roaming\V99ggTXqjYCekVz

c:\users\Mike\AppData\Roaming\w1uvS2obFp

c:\users\Mike\AppData\Roaming\xvD2onF4pHsJdKg

c:\users\Mike\AppData\Roaming\xvD2onF4pHsJdKg\Guard Online .ico

c:\users\Mike\AppData\Roaming\YZqqhhYCwkUVr

c:\users\Mike\AppData\Roaming\YZqqhhYCwkUVr\Guard Online .ico

c:\users\Mike\AppData\Roaming\zG5aQJ6dW8R9TqU

c:\users\Mike\AppData\Roaming\zG5aQJ6dW8R9TqU\Guard Online .ico

c:\windows\svchost.exe

.

((((((((((((((((((((((((( Files Created from 2011-09-08 to 2011-10-08 )))))))))))))))))))))))))))))))

.

2011-10-08 23:41 . 2011-10-08 23:41 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DAB47B64-94F6-4762-ACA6-6F9CD6C65CCA}\offreg.dll

2011-10-08 23:40 . 2011-10-08 23:40 -------- d-----w- c:\users\User\AppData\Local\temp

2011-10-08 23:40 . 2011-10-08 23:40 -------- d-----w- c:\users\QBDataServiceUser20\AppData\Local\temp

2011-10-08 23:40 . 2011-10-08 23:40 -------- d-----w- c:\users\gtsadmin\AppData\Local\temp

2011-10-08 23:40 . 2011-10-08 23:40 -------- d-----w- c:\users\Default\AppData\Local\temp