Computer Help

pooh8840 · October 23, 2011

Having troubles with computer. It used to be infected with cloud protection but i believe i have removed that. under further inspection i found the windup virus and it is messing stuff on the computer. All help is greatly appreciated.

.

DDS (Ver_2011-08-26.01) - NTFSx86 MINIMAL

Internet Explorer: 8.0.6001.19088 BrowserJavaVersion: 1.6.0_23

Run by Thompson at 15:01:44 on 2011-10-22

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1012.679 [GMT -7:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atbroker.exe

C:\Windows\system32\userinit.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\consent.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop

uSearch Bar = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop

uURLSearchHooks: Games.com Toolbar Search Class: {e3dce200-ae96-4a64-9fe7-b5d2d8569768} - c:\program files\games.com toolbar\gamescomtb.dll

uURLSearchHooks: H - No File

mURLSearchHooks: Games.com Toolbar Search Class: {e3dce200-ae96-4a64-9fe7-b5d2d8569768} - c:\program files\games.com toolbar\gamescomtb.dll

mURLSearchHooks: H - No File

BHO: {01d841c5-96f0-40a1-b561-6d1a76b59b00} - c:\users\thompson\appdata\local\ServiceCodec.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: : {11bf46c6-b3de-48bd-bf70-3ad85cab80b5} - c:\progra~1\sitera~1\SiteRank.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: EpicPlay Games: {56e4076b-a42b-4745-ba35-34da8ac4c2f2} - c:\program files\epicplay\epicPlayGames.dll

BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File

BHO: StartNow Toolbar Helper: {6e13d095-45c3-4271-9475-f3b48227dd9f} - c:\program files\startnow toolbar\Toolbar32.dll

BHO: AppGraffiti: {6f6a5334-78e9-4d9b-8182-8b41ea8c39ef} - c:\progra~1\appgra~1\APPGRA~1.DLL

BHO: Games.com Toolbar Loader: {b07040d6-4cb3-4af4-8a5c-038b7cd8a5d8} - c:\program files\games.com toolbar\gamescomtb.dll

BHO: : {ccb69577-088b-4004-9ed8-ff5bcc83a039} - c:\progra~1\rebate~1\RebateI.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

TB: Games.com Toolbar: {9da1bcf1-77f5-41c5-b7c3-c597dc20752c} - c:\program files\games.com toolbar\gamescomtb.dll

TB: StartNow Toolbar: {5911488e-9d1e-40ec-8cbb-06b231cc153f} - c:\program files\startnow toolbar\Toolbar32.dll

TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN

uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent

uRun: [e8f6bfd7f628b3419bec6766a22b7de9] c:\users\thompson\downlo~1\BABYSI~1.EXE /r

uRun: [GoogleManagerVerifier] rundll32.exe "c:\programdata\GoogleManagerVerifier.dll",DllRegisterServer

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [lpc] rundll32.exe "c:\users\thompson\appdata\roaming\remote\iyjg96.dll", RegisterDll

uRun: [0] \\.\globalroot\Device\HarddiskVolume1\Users\Thompson\AppData\Local\Temp\0.48432462896758exe

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe

mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

mRun: [<NO NAME>]

mRun: [EmbarqVALite_McciTrayApp] "c:\program files\embarqvalite\EMBARQHelpHelper.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe

mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

mRun: [lxbkbmgr.exe] "c:\program files\lexmark x1100 series\lxbkbmgr.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [startNowToolbarHelper] "c:\program files\startnow toolbar\ToolbarHelper.exe"

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg"&"inst=NzctNjkzNzAwNTg4LUZMMTArMS1ERFQrMjU3MTAtTFNEKzItVFVHKzMtRk9JKzExLUREMTBGKzEtU1QxMEZBUFArMS1GMTBNMTJBVCszLUYxME0xMkErMS1GMTBNMTJBQisxLVUxMCsxLUYxME0xMkFUQisx"&"prod=90"&"ver=10.0.1410

mRunOnce: [GrpConv] grpconv -o

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

dRun: [volmgr] c:\windows\system32\config\systemprofile\appdata\local\volmgr.exe

StartupFolder: c:\users\thompson\appdata\roaming\micros~1\windows\startm~1\programs\startup\0.lnk - \\globalroot\device\harddiskvolume1\users\thompson\appdata\local\temp\0.48432462896758exe

StartupFolder: c:\users\thompson\appdata\roaming\micros~1\windows\startm~1\programs\startup\winupd.lnk - c:\users\thompson\appdata\local\temp\winupd.exe

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

dPolicies-system: DisableTaskMgr = 1 (0x1)

LSP: mswsock.dll

DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://aolsvc.aol.com/onlinegames/free-trial-doggie-dash/DoggieDash.1.0.0.6.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

TCP: DhcpNameServer = 10.0.0.1

TCP: Interfaces\{770F8B09-192C-4596-A6A9-3CE060E2CFED} : DhcpNameServer = 10.0.0.1

Handler: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - c:\progra~1\rebate~1\RebateI.dll

Notify: igfxcui - igfxdev.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\thompson\appdata\roaming\mozilla\firefox\profiles\b72e9ya5.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-games-chromesbox-en-us&tb_uuid=20110903072650199&tb_oid=08-09-2011&tb_mrud=08-09-2011

FF - prefs.js: browser.search.selectedEngine - AVG Secure Search

FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e4633e2&v=7.007.026.001&i=23&tp=ab&iy=&ychte=us&lng=en-US&q=

FF - component: c:\users\thompson\appdata\roaming\mozilla\firefox\profiles\b72e9ya5.default\extensions\{493b4069-8c4f-4b4a-8f8c-506200c9887a}\components\MailUtil.dll

FF - component: c:\users\thompson\appdata\roaming\mozilla\firefox\profiles\b72e9ya5.default\extensions\textlinks@epicplay.com\components\epicPlayGames.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll

FF - plugin: c:\program files\epicplay\npEpicHost.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\wildtangent games\app\browserintegration\registered\1\NP_wtapp.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Games.com Toolbar: {493b4069-8c4f-4b4a-8f8c-506200c9887a} - %profile%\extensions\{493b4069-8c4f-4b4a-8f8c-506200c9887a}

FF - Ext: EpicPlay Games : textlinks@epicplay.com - %profile%\extensions\textlinks@epicplay.com

FF - Ext: StartNow Toolbar: {5911488E-9D1E-40ec-8CBB-06B231CC153F} - %profile%\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}

FF - Ext: XUL Cache: {1f0129a0-4627-4af0-8297-5d39d91c74f2} - %profile%\extensions\{1f0129a0-4627-4af0-8297-5d39d91c74f2}

FF - Ext: XUL Cache: {372376e1-270c-4e1b-b7e0-36021852dfaa} - %profile%\extensions\{372376e1-270c-4e1b-b7e0-36021852dfaa}

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

============= SERVICES / DRIVERS ===============

.

S1 Teefer3;Symantec Endpoint Protection Firewall;c:\windows\system32\drivers\Teefer3.sys [2011-1-13 43936]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe -service --> c:\windows\system32\lxbkcoms.exe -service [?]

S2 Symantec AntiVirus;Symantec Endpoint Protection;"c:\program files\symantec\symantec endpoint protection\rtvscan.exe" --> c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [?]

S2 Updater Service for StartNow Toolbar;Updater Service for StartNow Toolbar;c:\program files\startnow toolbar\ToolbarUpdaterService.exe [2011-7-27 267488]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-10-20 102448]

S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2010-10-12 206072]

S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-2-21 1245064]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-10-22 22:01:05 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{21dbfdf1-3145-4ed9-9a47-362ef838946d}\offreg.dll

2011-10-22 21:49:42 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-22 02:59:34 35840 ----a-w- c:\windows\system32\drivers\netbios.sys

2011-10-21 00:17:15 -------- d-----w- c:\users\thompson\appdata\local\Symantec

2011-10-21 00:16:36 162048 ----a-w- c:\windows\system32\drivers\wpshelper.sys

2011-10-21 00:13:10 99744 ----a-w- c:\windows\system32\drivers\SysPlant.sys

2011-10-20 23:56:06 357792 ----a-w- c:\windows\system32\Sysfer.dll

2011-10-20 23:55:07 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-10-20 23:42:46 -------- d-----w- c:\windows\pss

2011-10-19 03:34:45 7269712 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{21dbfdf1-3145-4ed9-9a47-362ef838946d}\mpengine.dll

2011-10-19 01:22:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-19 00:52:25 48016 --sha-w- c:\windows\system32\c_60074.nl_

2011-10-18 23:40:13 -------- d-----w- c:\users\thompson\appdata\roaming\x4pmG5sQJdKfZhX

2011-10-18 23:40:13 -------- d-----w- c:\users\thompson\appdata\roaming\cCelIBrzPyAuSoF

2011-10-18 22:59:36 -------- d-----w- c:\users\thompson\appdata\roaming\v66ddWKK8f

2011-10-18 22:52:32 -------- d-----w- c:\users\thompson\appdata\roaming\ZgggRZZqhYXw

2011-10-18 22:52:25 -------- d-----w- c:\users\thompson\appdata\roaming\W6ssWWJ7fEL8

2011-10-18 22:30:29 -------- d-----w- c:\users\thompson\appdata\roaming\GD2onF4pm5Q7E

2011-10-18 22:30:27 -------- d-----w- c:\users\thompson\appdata\roaming\z9gTXqjYCk

2011-10-18 22:30:27 -------- d-----w- c:\users\thompson\appdata\roaming\EibF3pnG5Q6WR

2011-10-17 23:27:14 -------- d-----w- c:\users\thompson\appdata\roaming\CfEL9gTZqYwIrOt

2011-10-17 23:27:13 -------- d-----w- c:\users\thompson\appdata\roaming\QYCekIVrzNx0c2b

2011-10-17 23:21:10 -------- d-----w- c:\users\thompson\appdata\roaming\ynG5aQH6dW7R9Tq

2011-10-17 23:21:10 -------- d-----w- c:\users\thompson\appdata\roaming\hIBrzONyxA0v2b3

2011-10-17 23:17:08 -------- d-----w- c:\windows\PIF

2011-10-17 23:07:45 -------- d-----w- c:\users\thompson\appdata\roaming\v9lyDpJfXl

2011-10-17 23:07:44 -------- d-----w- c:\users\thompson\appdata\roaming\KaECtvH8k0

2011-10-17 22:23:42 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-10-17 18:57:50 -------- d-----w- c:\users\thompson\appdata\roaming\dccSS1iibD3n

2011-10-17 18:57:49 -------- d-----w- c:\users\thompson\appdata\roaming\BCCCwkkIVrlNtx0

2011-10-17 14:19:55 -------- d-----w- c:\users\thompson\appdata\roaming\Remote

2011-10-17 04:47:16 -------- d-----w- c:\users\thompson\appdata\roaming\Y444ammH5s

2011-10-17 04:47:08 -------- d-----w- c:\users\thompson\appdata\roaming\XjjUUeelIBrPN

2011-10-17 04:47:07 -------- d-----w- c:\users\thompson\appdata\roaming\O000yccA1iv2o

2011-10-17 04:47:07 -------- d-----w- c:\users\thompson\appdata\roaming\KYYXXwjjUVeIBzP

2011-10-17 04:41:57 -------- d-----w- c:\users\thompson\appdata\roaming\kxxxA0uuvSibFp

2011-10-17 04:41:57 -------- d-----w- c:\users\thompson\appdata\roaming\HuuvvS2ooF3pm5Q

2011-10-17 04:41:40 -------- d-----w- c:\users\thompson\appdata\roaming\u8TqYkVOx

2011-10-17 04:41:37 -------- d-----w- c:\users\thompson\appdata\roaming\gYYXXwjjUVlIBzP

2011-10-17 04:41:36 -------- d-----w- c:\users\thompson\appdata\roaming\kUUUVeelOBtz0yA

2011-10-14 06:58:13 -------- d-----w- c:\program files\PlayLinc

2011-10-14 06:07:00 452440 ----a-w- c:\windows\system32\d3dx10_40.dll

2011-10-14 06:07:00 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll

2011-10-13 09:24:25 7269712 ----a-w- c:\programdata\microsoft\windows defender\definition updates\backup\mpengine.dll

2011-10-13 09:23:27 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-10-13 02:44:22 267776 ----a-w- c:\users\thompson\appdata\local\ShellCodec.dll

2011-10-12 23:10:50 -------- d-----w- c:\programdata\SugarGames

2011-10-12 00:54:16 -------- d-----w- c:\users\thompson\appdata\roaming\playmink

2011-10-11 06:14:42 101888 ----a-w- c:\programdata\GoogleManagerVerifier.dll

2011-10-11 02:27:00 -------- d-----w- c:\program files\Hobby Farm

2011-10-11 02:12:59 -------- d-----w- c:\programdata\Big Fish Games

2011-10-11 02:12:54 -------- d-----w- c:\program files\bfgclient

2011-10-11 02:10:30 -------- d-----w- C:\BigFishGamesCache

2011-10-11 00:46:26 -------- d-----w- c:\program files\TidyView

2011-10-11 00:45:25 -------- d-----w- c:\program files\EpicPlay

2011-10-11 00:45:08 -------- d-----w- c:\program files\StartNow Toolbar

2011-10-09 03:32:54 -------- d-----w- c:\users\thompson\appdata\roaming\GamesCafe

2011-10-08 18:07:46 -------- d-----w- c:\users\thompson\appdata\roaming\PeaceCraft3

2011-10-06 03:50:46 -------- d-----w- c:\users\thompson\appdata\roaming\aliasworlds

2011-10-03 16:02:40 86016 ----a-w- c:\windows\unvise32.exe

2011-10-03 16:02:03 -------- d-----w- C:\Adams Divorce CD

2011-10-01 19:32:13 -------- d-----w- c:\program files\WildGames

2011-10-01 19:17:13 -------- d-----w- c:\program files\WildTangent Games

2011-09-28 18:46:40 -------- d-----w- c:\users\thompson\appdata\roaming\Blackberry Desktop

2011-09-24 06:44:25 -------- d-----w- c:\program files\HotDish

2011-09-24 04:37:29 -------- d-----w- c:\users\thompson\appdata\roaming\BlamGames

2011-09-24 04:35:47 -------- d-----w- c:\program files\Blam Games

.

==================== Find3M ====================

.

2011-10-22 21:43:34 54784 ----a-w- c:\windows\system32\drivers\i8042prt.sys

2011-10-22 21:41:00 35384 ----a-w- c:\windows\system32\drivers\kbdclass.sys

2011-10-22 03:11:33 43936 ----a-w- c:\windows\system32\drivers\Teefer3.sys

2011-10-21 00:56:23 71680 ----a-w- c:\windows\system32\drivers\tdx.sys

2011-10-20 23:30:34 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-10-19 00:51:56 227896 ----a-w- c:\windows\system32\drivers\volsnap.sys

2011-10-16 21:06:26 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

.

============= FINISH: 15:03:30.26 ===============

attach.txt

mbam-log-2011-10-22 (14-59-52).txt

dds.txt

LDTate · October 26, 2011

:welcome:

Whether you wish to continue with cleaning or not, you should be aware that you may have been infected by a backdoor trojan. This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps
Removing this infection can also disable the ability to connect to the internet.

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

Please post back to let me know how you wish to proceed.

pooh8840 · October 29, 2011

I would like to proceed with cleaning of the computer. Thanks

LDTate · October 29, 2011

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

pooh8840 · October 29, 2011

Should I run combofix in safemode?

LDTate · October 29, 2011

Should I run combofix in safemode?

No.

pooh8840 · October 29, 2011

Sometime during os start up the keyboard disables. It still has power and works prior to the os loading. Before combofix upon explorer startup a winupd####.exe would ask for permission to run. As of now internet is not available due to the dhcp process not running and not being able to startup i believe. That start menu is empty except for my computer.

ComboFix 11-10-29.03 - Thompson 10/29/2011 10:38:30.1.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1012.319 [GMT -7:00]

Running from: c:\users\Thompson\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

c:\program files\EpicPlay\epICplaygames.dll

c:\program files\StartNow Toolbar

c:\program files\StartNow Toolbar\Resources\images\engine_images.png

c:\program files\StartNow Toolbar\Resources\images\engine_maps.png

c:\program files\StartNow Toolbar\Resources\images\engine_news.png

c:\program files\StartNow Toolbar\Resources\images\engine_videos.png

c:\program files\StartNow Toolbar\Resources\images\engine_web.png

c:\program files\StartNow Toolbar\Resources\images\icon_amazon.png

c:\program files\StartNow Toolbar\Resources\images\icon_ebay.png

c:\program files\StartNow Toolbar\Resources\images\icon_facebook.png

c:\program files\StartNow Toolbar\Resources\images\icon_games.png

c:\program files\StartNow Toolbar\Resources\images\icon_msn.png

c:\program files\StartNow Toolbar\Resources\images\icon_shopping.png

c:\program files\StartNow Toolbar\Resources\images\icon_travel.png

c:\program files\StartNow Toolbar\Resources\images\icon_twitter.png

c:\program files\StartNow Toolbar\Resources\images\startnow_logo.png

c:\program files\StartNow Toolbar\Resources\installer.xml

c:\program files\StartNow Toolbar\Resources\protect\index.html

c:\program files\StartNow Toolbar\Resources\protect\NotIE6.css

c:\program files\StartNow Toolbar\Resources\protect\OnlyIE6.css

c:\program files\StartNow Toolbar\Resources\protect\SearchProtectIcon.png

c:\program files\StartNow Toolbar\Resources\protect\window.css

c:\program files\StartNow Toolbar\Resources\protect\window.js

c:\program files\StartNow Toolbar\Resources\reactivate\index.html

c:\program files\StartNow Toolbar\Resources\reactivate\LeftImage.png

c:\program files\StartNow Toolbar\Resources\reactivate\NotIE6.css

c:\program files\StartNow Toolbar\Resources\reactivate\OnlyIE6.css

c:\program files\StartNow Toolbar\Resources\reactivate\window.css

c:\program files\StartNow Toolbar\Resources\reactivate\window.js

c:\program files\StartNow Toolbar\Resources\skin\chevron_button.png

c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_hover.png

c:\program files\StartNow Toolbar\Resources\skin\searchbox_button_normal.png

c:\program files\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png

c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_background.png

c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_left.png

c:\program files\StartNow Toolbar\Resources\skin\searchbox_input_middle.png

c:\program files\StartNow Toolbar\Resources\skin\separator.png

c:\program files\StartNow Toolbar\Resources\skin\splitter.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png

c:\program files\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png

c:\program files\StartNow Toolbar\Resources\toolbar.xml

c:\program files\StartNow Toolbar\Resources\update.xml

c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe

c:\program files\StartNow Toolbar\ToOLbar32.dll

c:\program files\StartNow Toolbar\ToolbarUpdaterService.exe

c:\program files\StartNow Toolbar\uninstall.dat

c:\programdata\GoogleManagerVerifier.dll

c:\users\Thompson\AppData\Local\ShellCodec.dll

c:\users\Thompson\AppData\Local\Temp\0.48432462896758exe

c:\users\Thompson\AppData\Roaming\Adobe\plugs

c:\users\Thompson\AppData\Roaming\Adobe\shed

c:\users\Thompson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore

c:\users\Thompson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore\System Restore.lnk

c:\users\Thompson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore\Uninstall System Restore.lnk

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{1f0129a0-4627-4af0-8297-5d39d91c74f2}

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{1f0129a0-4627-4af0-8297-5d39d91c74f2}\chrome.manifest

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{1f0129a0-4627-4af0-8297-5d39d91c74f2}\chrome\xulcache.jar

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{1f0129a0-4627-4af0-8297-5d39d91c74f2}\defaults\preferences\xulcache.js

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{1f0129a0-4627-4af0-8297-5d39d91c74f2}\install.rdf

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{372376e1-270c-4e1b-b7e0-36021852dfaa}

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{372376e1-270c-4e1b-b7e0-36021852dfaa}\chrome.manifest

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{372376e1-270c-4e1b-b7e0-36021852dfaa}\chrome\xulcache.jar

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{372376e1-270c-4e1b-b7e0-36021852dfaa}\defaults\preferences\xulcache.js

c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\extensions\{372376e1-270c-4e1b-b7e0-36021852dfaa}\install.rdf

c:\users\Thompson\AppData\Roaming\Remote

c:\users\Thompson\AppData\Roaming\Remote\iyjg96.dll

c:\users\Thompson\AppData\Roaming\Remote\iyjg96_shrd

c:\users\Thompson\AppData\Roaming\Remote\mnj.dat

c:\users\Thompson\AppData\Roaming\Remote\mxd1.txt

c:\users\Thompson\AppData\Roaming\Remote\oplk.dat

c:\users\Thompson\AppData\Roaming\Remote\ppkk.dat

c:\users\Thompson\AppData\Roaming\Remote\uuoo.dat

c:\users\Thompson\AppData\Roaming\Remote\whrwos

c:\users\Thompson\AppData\Roaming\Remote\xnhrr.dat

c:\windows\$NtUninstallKB39424$\2668165878

c:\windows\system32\c_60074.nls

c:\windows\System32\config\systemprofile\AppData\Local\b990dc6f\U

c:\windows\System32\config\systemprofile\AppData\Local\b990dc6f\U\800000cb.@

c:\windows\system32\config\systemprofile\AppData\Roaming\Adobe\plugs

c:\windows\system32\config\systemprofile\AppData\Roaming\Adobe\shed

c:\windows\$NtUninstallKB39424$ . . . . Failed to delete

c:\windows\system32\ . . . . Failed to delete

c:\windows\system32\drivers\ . . . . Failed to delete

.

Infected copy of c:\windows\system32\drivers\netbt.sys was found and disinfected

Restored copy from - The cat found it

c:\windows\system32\drivers\cdrom.sys was missing

Restored copy from - c:\windows\SoftwareDistribution\Download\bcfed137e95e2bc1b83ef80262a82b16\x86_cdrom.inf_31bf3856ad364e35_6.0.6002.18005_none_6194d4eea0e93596\cdrom.sys

.

Infected copy of c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe was found and disinfected

Restored copy from - c:\program files\Common Files\Adobe\ARM\1.0\

.

Infected copy of c:\program files\Common Files\Symantec Shared\ccSvcHst.exe was found and disinfected

Restored copy from - c:\program files\Common Files\Symantec Shared\

.

Infected copy of c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe was found and disinfected

Restored copy from - c:\program files\Hewlett-Packard\HP Health Check\

.

Infected copy of c:\program files\Common Files\LightScribe\LSSrvc.exe was found and disinfected

Restored copy from - c:\program files\Common Files\LightScribe\

.

c:\windows\system32\lxbkcoms.exe . . . is infected!!

c:\windows\system32\lxbkcoms.exe . . . was deleted!! You should re-install the program it pertains to

.

Infected copy of c:\program files\Common Files\Motive\McciCMService.exe was found and disinfected

Restored copy from - c:\program files\Common Files\Motive\

.

Infected copy of c:\progra~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe was found and disinfected

Restored copy from - c:\progra~1\COMMON~1\SYMANT~1\CCPD-LC\

.

Infected copy of c:\windows\system32\DRIVERS\xaudio.exe was found and disinfected

Restored copy from - c:\windows\System32\DriverStore\FileRepository\trx200cz.inf_d6d56f45\XAudio.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_.i8042prt

-------\Service_.netbios

-------\Service_.netbt

-------\Service_Updater Service for StartNow Toolbar

.

((((((((((((((((((((((((( Files Created from 2011-09-28 to 2011-10-29 )))))))))))))))))))))))))))))))

.

2011-10-29 17:52 . 2011-10-29 17:52 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-10-29 17:52 . 2011-10-29 17:52 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-10-29 17:50 . 2009-04-11 04:39 67072 ----a-w- c:\windows\system32\drivers\cdrom.sys

2011-10-29 17:27 . 2008-01-21 02:24 184320 ----a-w- c:\windows\system32\drivers\netbt.sys

2011-10-22 21:49 . 2011-09-01 00:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-22 02:59 . 2011-10-22 21:37 35840 ----a-w- c:\windows\system32\drivers\netbios.sys

2011-10-21 00:17 . 2011-10-21 00:17 -------- d-----w- c:\users\Thompson\AppData\Local\Symantec

2011-10-21 00:16 . 2011-10-21 00:15 162048 ----a-w- c:\windows\system32\drivers\wpshelper.sys

2011-10-21 00:13 . 2011-04-28 06:11 99744 ----a-w- c:\windows\system32\drivers\SysPlant.sys

2011-10-20 23:55 . 2011-10-21 00:12 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2011-10-19 01:22 . 2011-10-22 21:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-19 00:52 . 2011-10-22 22:01 48016 --sha-w- c:\windows\system32\c_60074.nl_

2011-10-18 23:40 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\cCelIBrzPyAuSoF

2011-10-18 23:40 . 2011-10-18 23:40 -------- d-----w- c:\users\Thompson\AppData\Roaming\x4pmG5sQJdKfZhX

2011-10-18 22:59 . 2011-10-18 22:59 -------- d-----w- c:\users\Thompson\AppData\Roaming\v66ddWKK8f

2011-10-18 22:52 . 2011-10-18 22:52 -------- d-----w- c:\users\Thompson\AppData\Roaming\ZgggRZZqhYXw

2011-10-18 22:52 . 2011-10-18 22:52 -------- d-----w- c:\users\Thompson\AppData\Roaming\W6ssWWJ7fEL8

2011-10-18 22:30 . 2011-10-18 22:30 -------- d-----w- c:\users\Thompson\AppData\Roaming\GD2onF4pm5Q7E

2011-10-18 22:30 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\z9gTXqjYCk

2011-10-18 22:30 . 2011-10-18 22:30 -------- d-----w- c:\users\Thompson\AppData\Roaming\EibF3pnG5Q6WR

2011-10-17 23:27 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\CfEL9gTZqYwIrOt

2011-10-17 23:27 . 2011-10-17 23:27 -------- d-----w- c:\users\Thompson\AppData\Roaming\QYCekIVrzNx0c2b

2011-10-17 23:21 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\ynG5aQH6dW7R9Tq

2011-10-17 23:21 . 2011-10-17 23:21 -------- d-----w- c:\users\Thompson\AppData\Roaming\hIBrzONyxA0v2b3

2011-10-17 23:17 . 2011-10-17 23:17 -------- d-----w- c:\windows\PIF

2011-10-17 23:07 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\v9lyDpJfXl

2011-10-17 23:07 . 2011-10-17 23:07 -------- d-----w- c:\users\Thompson\AppData\Roaming\KaECtvH8k0

2011-10-17 22:44 . 2011-10-17 22:44 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Games.com Toolbar

2011-10-17 22:23 . 2011-10-17 22:23 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-10-17 22:15 . 2011-10-29 17:48 -------- d-sh--w- c:\windows\system32\config\systemprofile\AppData\Local\b990dc6f

2011-10-17 21:18 . 2011-10-17 21:18 -------- d-----w- c:\windows\Sun

2011-10-17 18:57 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\dccSS1iibD3n

2011-10-17 18:57 . 2011-10-17 18:57 -------- d-----w- c:\users\Thompson\AppData\Roaming\BCCCwkkIVrlNtx0

2011-10-17 04:47 . 2011-10-17 04:47 -------- d-----w- c:\users\Thompson\AppData\Roaming\Y444ammH5s

2011-10-17 04:47 . 2011-10-17 04:47 -------- d-----w- c:\users\Thompson\AppData\Roaming\XjjUUeelIBrPN

2011-10-17 04:47 . 2011-10-19 02:08 -------- d-----w- c:\users\Thompson\AppData\Roaming\KYYXXwjjUVeIBzP

2011-10-17 04:47 . 2011-10-17 04:47 -------- d-----w- c:\users\Thompson\AppData\Roaming\O000yccA1iv2o

2011-10-17 04:41 . 2011-10-18 23:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\kxxxA0uuvSibFp

2011-10-17 04:41 . 2011-10-17 04:41 -------- d-----w- c:\users\Thompson\AppData\Roaming\HuuvvS2ooF3pm5Q

2011-10-17 04:41 . 2011-10-17 04:41 -------- d-----w- c:\users\Thompson\AppData\Roaming\u8TqYkVOx

2011-10-17 04:41 . 2011-10-19 02:08 -------- d-----w- c:\users\Thompson\AppData\Roaming\gYYXXwjjUVlIBzP

2011-10-17 04:41 . 2011-10-17 04:41 -------- d-----w- c:\users\Thompson\AppData\Roaming\kUUUVeelOBtz0yA

2011-10-14 07:18 . 2011-10-14 07:18 -------- d-----w- c:\users\Thompson\AppData\Roaming\acccore

2011-10-14 06:58 . 2011-10-14 06:58 -------- d-----w- c:\program files\PlayLinc

2011-10-14 06:07 . 2008-10-10 11:52 452440 ----a-w- c:\windows\system32\d3dx10_40.dll

2011-10-14 06:07 . 2008-10-10 11:52 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll

2011-10-14 05:46 . 2011-10-14 05:46 -------- d-----w- c:\program files\Ubisoft

2011-10-13 09:23 . 2011-05-25 02:14 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-10-12 23:10 . 2011-10-12 23:10 -------- d-----w- c:\programdata\SugarGames

2011-10-12 00:54 . 2011-10-12 00:54 -------- d-----w- c:\users\Thompson\AppData\Roaming\playmink

2011-10-11 02:27 . 2011-10-11 02:27 -------- d-----w- c:\program files\Hobby Farm

2011-10-11 02:12 . 2011-10-11 02:12 -------- d-----w- c:\programdata\Big Fish Games

2011-10-11 02:12 . 2011-10-11 02:13 -------- d-----w- c:\program files\bfgclient

2011-10-11 02:10 . 2011-10-12 00:53 -------- d-----w- C:\BigFishGamesCache

2011-10-11 00:46 . 2011-10-11 00:46 -------- d-----w- c:\program files\TidyView

2011-10-11 00:45 . 2011-10-29 17:48 -------- d-----w- c:\program files\EpicPlay

2011-10-09 03:32 . 2011-10-09 03:32 -------- d-----w- c:\users\Thompson\AppData\Roaming\GamesCafe

2011-10-08 18:07 . 2011-10-10 07:01 -------- d-----w- c:\users\Thompson\AppData\Roaming\PeaceCraft3

2011-10-06 03:50 . 2011-10-06 03:50 -------- d-----w- c:\users\Thompson\AppData\Roaming\aliasworlds

2011-10-03 16:02 . 1999-12-17 17:13 86016 ----a-w- c:\windows\unvise32.exe

2011-10-03 16:02 . 2011-10-03 17:12 -------- d-----w- C:\Adams Divorce CD

2011-10-01 19:32 . 2011-10-16 21:08 -------- d-----w- c:\program files\WildGames

2011-10-01 19:17 . 2011-10-01 19:18 -------- d-----w- c:\program files\WildTangent Games

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-29 17:55 . 2011-10-29 17:55 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{21DBFDF1-3145-4ED9-9A47-362EF838946D}\offreg.dll

2011-10-29 17:52 . 2008-02-21 15:30 386560 ----a-w- c:\windows\system32\drivers\xaudio.exe

2011-10-22 21:43 . 2008-01-21 02:23 54784 ----a-w- c:\windows\system32\drivers\i8042prt.sys

2011-10-22 21:41 . 2008-01-21 02:23 35384 ----a-w- c:\windows\system32\drivers\kbdclass.sys

2011-10-22 03:11 . 2011-01-13 17:34 43936 ----a-w- c:\windows\system32\drivers\Teefer3.sys

2011-10-21 00:56 . 2008-01-21 02:24 71680 ----a-w- c:\windows\system32\drivers\tdx.sys

2011-10-20 23:30 . 2011-06-24 04:12 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-10-19 00:51 . 2008-01-21 02:23 227896 ----a-w- c:\windows\system32\drivers\volsnap.sys

2011-10-16 21:06 . 2011-07-05 23:52 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-21 16:00 . 2011-10-19 03:34 7269712 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{21DBFDF1-3145-4ED9-9A47-362EF838946D}\mpengine.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]

2011-07-14 06:53 351448 ----a-w- c:\progra~1\SITERA~1\SiteRank.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CCB69577-088B-4004-9ED8-FF5BCC83A039}]

2011-09-12 15:46 832680 ----a-w- c:\progra~1\REBATE~1\RebateI.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472]

"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-01-19 942080]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-01 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-01 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-01 133656]

"EmbarqVALite_McciTrayApp"="c:\program files\EmbarqVALite\EMBARQHelpHelper.exe" [2010-01-04 1575760]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]

"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

"lxbkbmgr.exe"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2008-02-28 74408]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2011-03-31 115624]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-09-01 1047208]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg&inst=NzctNjkzNzAwNTg4LUZMMTArMS1ERFQrMjU3MTAtTFNEKzItVFVHKzMtRk9JKzExLUREMTBGKzEtU1QxMEZBUFArMS1GMTBNMTJBVCszLUYxME0xMkErMS1GMTBNMTJBQisxLVUxMCsxLUYxME0xMkFUQisx∏=90&ver=10.0.1410" [?]

.

c:\users\Thompson\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

0.lnk - \\globalroot\Device\HarddiskVolume1\Users\Thompson\AppData\Local\Temp\0.48432462896758exe [N/A]

winupd.lnk - c:\users\Thompson\AppData\Local\Temp\winupd.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\0]

\\.\globalroot\Device\HarddiskVolume1\Users\Thompson\AppData\Local\Temp\0.48432462896758exe [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\44e248a1fc1683b1d48f21e78627accc]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R0 72903297;72903297;c:\windows\system32\drivers\08537302.sys [x]

R0 81184693;81184693;c:\windows\system32\drivers\42451995.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe [x]

R3 GamesAppService;GamesAppService;c:\program files\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S1 Teefer3;Symantec Endpoint Protection Firewall;c:\windows\system32\DRIVERS\Teefer3.sys [2011-10-22 43936]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-10-29 64952]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-04-18 102448]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop

TCP: DhcpNameServer = 10.0.0.1

Handler: rebinfo - {AF808758-C780-404C-A4EE-4526323FD9B6} - c:\progra~1\REBATE~1\RebateI.dll

DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://aolsvc.aol.com/onlinegames/free-trial-doggie-dash/DoggieDash.1.0.0.6.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab

FF - ProfilePath - c:\users\Thompson\AppData\Roaming\Mozilla\Firefox\Profiles\b72e9ya5.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-games-chromesbox-en-us&tb_uuid=20110903072650199&tb_oid=08-09-2011&tb_mrud=08-09-2011

FF - prefs.js: browser.search.selectedEngine - AVG Secure Search

FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e4633e2&v=7.007.026.001&i=23&tp=ab&iy=&ychte=us&lng=en-US&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Games.com Toolbar: {493b4069-8c4f-4b4a-8f8c-506200c9887a} - %profile%\extensions\{493b4069-8c4f-4b4a-8f8c-506200c9887a}

FF - Ext: EpicPlay Games : textlinks@epicplay.com - %profile%\extensions\textlinks@epicplay.com

FF - Ext: StartNow Toolbar: {5911488E-9D1E-40ec-8CBB-06B231CC153F} - %profile%\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{01D841C5-96F0-40A1-B561-6D1A76B59B00} - c:\users\Thompson\AppData\Local\ServiceCodec.dll

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe

HKCU-Run-e8f6bfd7f628b3419bec6766a22b7de9 - c:\users\Thompson\DOWNLO~1\BABYSI~1.EXE

HKCU-Run-GoogleManagerVerifier - c:\programdata\GoogleManagerVerifier.dll

HKCU-Run-lpc - c:\users\Thompson\AppData\Roaming\Remote\iyjg96.dll

HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

HKLM-Run-StartNowToolbarHelper - c:\program files\StartNow Toolbar\ToolbarHelper.exe

SafeBoot-01322702.sys

SafeBoot-07301479.sys

SafeBoot-19991621.sys

SafeBoot-31480278.sys

SafeBoot-50004600.sys

SafeBoot-61567108.sys

SafeBoot-66038607.sys

SafeBoot-66172602.sys

SafeBoot-69248446.sys

SafeBoot-72903297.sys

SafeBoot-81184693.sys

SafeBoot-84991748.sys

SafeBoot-88454579.sys

SafeBoot-93194489.sys

SafeBoot-93593597.sys

SafeBoot-94928846.sys

SafeBoot-Symantec Antvirus

MSConfigStartUp-6ecd2d42caef4718bfa6692aeccb779d - c:\users\Thompson\DOWNLO~1\DELICI~1.EXE

MSConfigStartUp-isCfgWiz - c:\program files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe

MSConfigStartUp-lpc - c:\users\Thompson\AppData\Roaming\Remote\iyjg96.dll

MSConfigStartUp-winupd - c:\users\Thompson\AppData\Local\Temp\winupd.exe

AddRemove-StartNow Toolbar - c:\program files\StartNow Toolbar\StartNowToolbarUninstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-10-29 10:59

Windows 6.0.6001 Service Pack 1 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.kbdclass]

"ImagePath"="\*"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.tdx]

"ImagePath"="\*"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Teefer3]

"ImagePath"="\*"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DfsC]

"ImagePath"="system32\drivers\tsk9675.tmp"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdx]

"ImagePath"="system32\drivers\tsk8A8.tmp"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Motive\McciCMService.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\windows\system32\WUDFHost.exe

c:\windows\System32\osk.exe

c:\windows\RtHDVCpl.exe

c:\windows\system32\igfxsrvc.exe

c:\windows\System32\rundll32.exe

c:\program files\Lexmark X1100 Series\lxbkbmon.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

.

**************************************************************************

.

Completion time: 2011-10-29 11:07:15 - machine was rebooted

ComboFix-quarantined-files.txt 2011-10-29 18:07

.

Pre-Run: 262,735,986,688 bytes free

Post-Run: 264,952,713,216 bytes free

.

- - End Of File - - 86D26050F445EADB47297E85E7FDB8F4

LDTate · October 29, 2011

That's pretty ugly...

Before combofix upon explorer startup a winupd####.exe would ask for permission to run

Deny that process.

Try running a new combofix and post the results.

pooh8840 · October 29, 2011

I always denied that process. That did not happen after reboot. I was just explaining what was happening. Sorry

LDTate · October 29, 2011

OK.

Run a new combofix scan

pooh8840 · October 30, 2011

ComboFix 11-10-29.03 - Thompson 10/29/2011 15:47:56.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1012.349 [GMT -7:00]

Running from: c:\users\Thompson\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\ . . . . Failed to delete

c:\windows\system32\drivers\ . . . . Failed to delete

.

((((((((((((((((((((((((( Files Created from 2011-09-28 to 2011-10-29 )))))))))))))))))))))))))))))))

.

2011-10-29 22:59 . 2011-10-29 22:59 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{21DBFDF1-3145-4ED9-9A47-362EF838946D}\offreg.dll

2011-10-29 22:57 . 2011-10-29 22:57 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2011-10-29 22:57 . 2011-10-29 22:57 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-10-29 22:57 . 2011-10-29 22:57 -------- d-----w- c:\users\Default\AppData\Local\temp