Infected Computer Links in Startup Menu removed

MPA · November 12, 2011

Unfortunately I had already deleted the temp files before I found this help topic. So I don't know how much of a hindrance it will. Be also a lot of the files were hidden!

Here is the request logs:

DDS.txt

Attach.txt

Maniac · November 13, 2011

Hello MPA! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

Step 1

You have p2p software installed on your system, which is very dangerous and illegal. Please check our rules for piracy and uninstall µTorrent:

http://forums.malwarebytes.org/index.php?showtopic=97700

Step 2

Please follow the instructions here for ComboFix:

bleepingcomputer.com/combofix/how-to-use-combofix#use

When you are ready, please post log.txt and a new fresh DDS log file.

MPA · November 16, 2011

Interesting that I subscribed to this thread but never got a notification that anyone responded. Okay here is the DDS, Attach and log files:

DDS

-----------------

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.1.0

Run by Will at 20:17:04 on 2011-11-15

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3071.1920 [GMT -5:00]

.

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\crypserv.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdnserv.exe

C:\Windows\system32\lxdncoms.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

C:\Windows\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\conhost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/

mStart Page = hxxp://yeppo.net

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Set UA String (BHO): {3ce56db6-fcbe-4422-9454-63c354178985} - c:\program files\uapick\UABtn.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uPolicies-explorer: ForceRunOnStartMenu = 1 (0x1)

uPolicies-explorer: QuickLaunchEnabled = 1 (0x1)

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: {7CD59A63-0815-46D0-B474-2E5BCFCADD7C} - {1E866952-62EA-4161-B97D-4D228CEDF7A0} - c:\program files\uapick\UABtn.dll

Trusted Zone: motive.com\pattta.att

Trusted Zone: motive.com\patttbc.att

DPF: {588031A3-94BF-4CDD-86D0-939F6F93910F} - hxxps://fixit.support.microsoft.com/ActiveX/FixItClient.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{B2F02C79-8312-4F9E-8749-8F2F57392CB8} : DhcpNameServer = 192.168.1.254

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\will\appdata\roaming\mozilla\firefox\profiles\mhl1biwx.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=ce25f49a00000000000000ff031509b7&tlver=1.4.35.10&affID=100842

FF - plugin: c:\program files\common files\motive\npMotive.dll

FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\java\jre7\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\will\appdata\roaming\move networks\plugins\npqmp071505000011.dll

FF - plugin: c:\users\will\appdata\roaming\mozilla\firefox\profiles\mhl1biwx.default\extensions\coralietab@mozdev.org\plugins\npCoralIETab.dll

FF - plugin: c:\windows\system32\tvuax\npTVUAx.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}

FF - Ext: cacaoweb: cacaoweb@cacaoweb.org - %profile%\extensions\cacaoweb@cacaoweb.org

FF - Ext: vShare Plugin: vshareus@toolbar - %profile%\extensions\vshareus@toolbar

FF - Ext: OpenDownload²: {210249CE-F888-11DD-B868-4CB456D89593} - %profile%\extensions\{210249CE-F888-11DD-B868-4CB456D89593}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: IE Tab +: coralietab@mozdev.org - %profile%\extensions\coralietab@mozdev.org

FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\will\appdata\roaming\Move Networks

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-6-29 116608]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-7-28 176128]

R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ati technologies\ati.ace\fuel\Fuel.Service.exe [2011-7-28 291840]

R2 AODDriver4.01;AODDriver4.01;c:\program files\ati technologies\ati.ace\fuel\i386\aoddriver2.sys [2011-6-24 39424]

R2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe -service --> c:\windows\system32\lxdncoms.exe -service [?]

R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdnserv.exe [2009-8-13 98984]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-23 366152]

R3 amdiox86;AMD IO Driver;c:\windows\system32\drivers\amdiox86.sys [2011-1-8 37944]

R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-7-28 8396800]

R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-7-28 247296]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-6-6 211984]

R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\drivers\KMWDFILTER.sys [2009-4-29 25088]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-10-14 22216]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2010-7-15 322848]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2009-11-26 45440]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [2005-7-19 57744]

S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [2005-7-19 8336]

S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [2005-7-19 93328]

S3 cur_serd;Curitel Packet Service Diagnostic Serial Port (WDM);c:\windows\system32\drivers\cur_serd.sys [2005-7-19 73152]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-1-4 14216]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-1-4 8456]

S3 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 20992]

S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2009-11-26 56960]

S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [2009-7-13 35840]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-4-5 15872]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-5 52224]

S3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

S3 VSTHWBS2;VSTHWBS2;c:\windows\system32\drivers\VSTBS23.SYS [2009-7-13 266752]

S4 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe -product hss --> c:\program files\hotspot shield\bin\hsswd.exe -product HSS [?]

.

=============== Created Last 30 ================

.

2011-11-16 01:17:00 607260 ----a-w- c:\program files\dds.scr

2011-11-16 01:08:59 -------- d-sh--w- C:\$RECYCLE.BIN

2011-11-16 00:57:36 98816 ----a-w- c:\windows\sed.exe

2011-11-16 00:57:36 518144 ----a-w- c:\windows\SWREG.exe

2011-11-16 00:57:36 256000 ----a-w- c:\windows\PEV.exe

2011-11-16 00:57:36 208896 ----a-w- c:\windows\MBR.exe

2011-11-13 00:20:00 -------- d-----w- c:\programdata\Avanquest

2011-11-13 00:20:00 -------- d-----w- c:\program files\Avanquest update

2011-11-13 00:18:45 -------- d-----w- c:\users\will\appdata\local\BVRP Software

2011-11-12 23:59:26 -------- d-----w- c:\program files\Motorola Phone Tools

2011-11-10 02:30:22 -------- d-----w- c:\program files\Replay Video Capture

2011-11-08 23:12:41 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-08 23:12:39 708608 ----a-w- c:\program files\common files\system\wab32.dll

2011-11-08 23:12:19 2341888 ----a-w- c:\windows\system32\win32k.sys

2011-11-07 23:58:58 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-11-07 23:53:54 69632 ----a-w- c:\windows\system32\drivers\bowser.sys

2011-10-24 21:27:11 -------- d-----w- c:\users\will\appdata\roaming\GetRightToGo

2011-10-23 22:18:09 -------- d-----w- c:\users\will\appdata\local\Babylon

2011-10-23 22:18:07 -------- d-----w- c:\program files\Easy Downloads

.

==================== Find3M ====================

.

2011-11-13 18:20:15 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-03 07:50:34 544656 ----a-w- c:\windows\system32\deployJava1.dll

2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-27 04:26:27 233472 ----a-w- c:\windows\system32\oleacc.dll

2007-03-09 07:12:32 27648 --sha-w- c:\windows\system32\AVSredirect.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 6.1.7601 Disk: ST3500830AS rev.3.AAD -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: >>UNKNOWN [0x83603000]<< >>UNKNOWN [0x8C28C000]<< >>UNKNOWN [0x8C27B000]<< >>UNKNOWN [0x84361000]<< >>UNKNOWN [0x83A15000]<< >>UNKNOWN [0x861A71F8]<<

_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL; }

1 ntkrnlpa!IofCallDriver[0x8363A52A] -> \Device\Harddisk0\DR0[0x86ECC030]

\Driver\Disk[0x86ED0030] -> IRP_MJ_CREATE -> 0x8C29039F

3 [0x8C29059E] -> ntkrnlpa!IofCallDriver[0x8363A52A] -> [0x86ED0918]

\Driver\ACPI[0x861A2DF8] -> IRP_MJ_CREATE -> 0x8436A4CC

5 [0x8436A3D4] -> ntkrnlpa!IofCallDriver[0x8363A52A] -> \Device\Ide\IdeDeviceP0T0L0-0[0x87017908]

\Driver\atapi[0x86E8D658] -> IRP_MJ_CREATE -> 0x861A71F8

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [bP+0x0], 0x0; }

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 20:17:21.55 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume2

Install Date: 10/25/2009 11:04:49 PM

System Uptime: 11/14/2011 7:30:13 PM (25 hours ago)

.

Motherboard: Acer | | F690GVM

Processor: AMD Phenom 9500 Quad-Core Processor | Socket AM2 | 2200/231mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 425 GiB total, 345.001 GiB free.

D: is FIXED (NTFS) - 12 GiB total, 10.112 GiB free.

E: is CDROM (CDFS)

F: is FIXED (NTFS) - 10 GiB total, 3.442 GiB free.

G: is Removable

H: is Removable

I: is Removable

J: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318}

Description: PS/2 Compatible Mouse

Device ID: ACPI\PNP0F13\3&18D45AA6&0

Manufacturer: Microsoft

Name: PS/2 Compatible Mouse

PNP Device ID: ACPI\PNP0F13\3&18D45AA6&0

Service: i8042prt

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: MpKslb8f1bfd9

Device ID: ROOT\LEGACY_MPKSLB8F1BFD9\0000

Manufacturer:

Name: MpKslb8f1bfd9

PNP Device ID: ROOT\LEGACY_MPKSLB8F1BFD9\0000

Service: MpKslb8f1bfd9

.

==== System Restore Points ===================

.

RP464: 11/7/2011 7:00:26 PM - Windows Update

RP466: 11/7/2011 7:39:35 PM - Windows Update

RP468: 11/8/2011 6:12:51 PM - Windows Update

RP464: 11/10/2011 6:15:56 PM - Windows Update

RP466: 11/12/2011 6:58:14 PM - Installed Motorola Phone Tools

RP468: 11/12/2011 7:02:23 PM - Device Driver Package Install: Motorola Korea, Inc. Universal Serial Bus controllers

RP470: 11/12/2011 7:03:22 PM - Device Driver Package Install: Motorola Korea, Inc. Modems

RP472: 11/12/2011 7:04:46 PM - Device Driver Package Install: Motorola Korea, Inc. Ports (COM & LPT)

RP473: 11/15/2011 7:57:41 PM - ComboFix created restore point

.

==== Installed Programs ======================

.

"Nero SoundTrax Help

7-Zip 4.65

ABBYY FineReader 6.0 Sprint

Adobe Flash Player 11 ActiveX

Adobe Reader 7.0

Adobe Reader 7.0.5

Advertising Center

AMD Catalyst Install Manager

AMD Fuel

AMD VISION Engine Control Center

Apple Application Support

Apple Software Update

Audacity 1.2.6

Avanquest update

Bayden UAPick

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help English

CCC Help Japanese

CCC Help Korean

CCC Help Thai

CD Audio Reader Filter (remove only)

Combined Community Codec Pack 2010-10-10

Compatibility Pack for the 2007 Office system

D3DX10

DC-Bass Source 1.1.1

DirectVobSub (remove only)

DivX Setup

DolbyFiles

DScaler 5 Mpeg Decoders

EASEUS Partition Master 4.1.1 Home Edition

EasyBCD 1.7.2

ffdshow [rev 2527] [2008-12-19]

Foxit PDF Editor

Haali Media Splitter

ImagXpress

Java Auto Updater

Java 6 Update 26

Java 6 Update 27

Java 7 Update 1

Junk Mail filter update

KaraFun Player

Lexmark 2600 Series

Lexmark Fax Solutions

Magic ISO Maker v5.4 (build 0239)

MagicDisc 2.7.106

Malwarebytes' Anti-Malware version 1.51.2.1300

Menu Templates - Starter Kit

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Corporation

Microsoft Office Professional Edition 2003

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable - KB2467175

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

MONOGRAM AMR Splitter/Decoder (remove only)

Motorola Driver Installation 4.5.0

Motorola Phone Tools

Move Media Player

Movie Templates - Starter Kit

Mozilla Firefox (3.6.24)

MSVCRT

Nero 9

Nero BurningROM

Nero BurnRights

Nero ControlCenter

Nero CoverDesigner

Nero CoverDesigner Help

Nero Disc Copy Gadget

Nero Disc Copy Gadget Help

Nero DiscSpeed

Nero DriveSpeed

Nero Express

Nero InfoTool

Nero Installer

Nero PhotoSnap

Nero PhotoSnap Help

Nero Recode

Nero Recode Help

Nero Rescue Agent

Nero RescueAgent Help

Nero ShowTime

Nero StartSmart

Nero StartSmart Help

Nero Vision

Nero WaveEditor

Nero WaveEditor Help

NeroBurningROM

NeroExpress

neroxml

NirSoft WebVideoCap

OpenSource DTS/AC3/DD+ Source Filter (remove only)

OpenSource Flash Video Splitter (remove only)

Oxelon Media Converter 1.1

PCI Soft Data Fax Modem with SmartCP

PDFCreator

PowerISO

QuickTime

Random Dice Roller

RealMedia (remove only)

Replay Converter 3

Replay Video Capture

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

SHOUTcast Source (remove only)

Skype™ 5.5

Snapshot Viewer

SopCast 3.0.3

SoundTrax

SUPERAntiSpyware Free Edition

SysTools DBX Converter

Time Stopper

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

VC80CRTRedist - 8.0.50727.4053

VC80CRTRedist - 8.0.50727.6195

Veetle TV 0.9.18

Veoh Web Player

Virtual Account Numbers

VLC media player 1.1.11

VuRoom

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live OneCare safety scanner

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Media Player Firefox Plugin

WinPcap 4.1.2

WinRAR archiver

Yahoo! Messenger

.

==== Event Viewer Messages From Past Week ========

.

11/9/2011 8:33:34 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).

11/9/2011 12:50:33 AM, Error: Service Control Manager [7003] - The Link-Layer Topology Discovery Mapper service depends the following service: lltdio. This service might not be installed.

11/9/2011 12:50:11 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1075" attempting to start the service lltdsvc with arguments "" in order to run the server: {5BF9AA75-D7FF-4AEE-AA2C-96810586456D}

11/15/2011 8:17:01 PM, Error: Service Control Manager [7000] - The Diagnostic Service Host service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process.

11/15/2011 8:06:49 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

11/14/2011 7:31:03 PM, Error: Service Control Manager [7023] - The Offline Files service terminated with the following error: The system cannot find the path specified.

11/14/2011 7:31:00 PM, Error: Service Control Manager [7000] - The OrangeWare USB Enhanced Host Controller Service service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

11/14/2011 5:26:21 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

11/13/2011 7:01:10 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

11/12/2011 7:28:13 PM, Error: Service Control Manager [7030] - The MotoConnect Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

.

==== End Of File ===========================

ComboFix 11-11-15.06 - Will 11/15/2011 19:59:52.1.4 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3071.1976 [GMT -5:00]

Running from: c:\users\Will\AppData\Local\Temp\mozOpenDownload\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\ErrLog.txt

c:\program files\Mozilla Firefox\components\npclntax.xpt

C:\readme.txt

c:\users\Will\AppData\Local\{F54A9C95-0A91-4C70-BF22-0B66A3B88842}

c:\users\Will\AppData\Local\{F54A9C95-0A91-4C70-BF22-0B66A3B88842}\chrome.manifest

c:\users\Will\AppData\Local\{F54A9C95-0A91-4C70-BF22-0B66A3B88842}\chrome\content\_cfg.js

c:\users\Will\AppData\Local\{F54A9C95-0A91-4C70-BF22-0B66A3B88842}\chrome\content\overlay.xul

c:\users\Will\AppData\Local\{F54A9C95-0A91-4C70-BF22-0B66A3B88842}\install.rdf

c:\users\Will\AppData\Roaming\cacaoweb

c:\users\Will\AppData\Roaming\cacaoweb\cacaoweb.exe

c:\users\Will\AppData\Roaming\cacaoweb\download18GEVG92992033077.cacao

c:\users\Will\AppData\Roaming\cacaoweb\downloadB34J6HTK26974223.cacao

c:\users\Will\AppData\Roaming\cacaoweb\downloadREOA41QZ24672776.cacao

c:\users\Will\AppData\Roaming\cacaoweb\downloadVN7UFDNJ346400790.cacao

c:\users\Will\AppData\Roaming\cacaoweb\npdfile.dat

c:\users\Will\AppData\Roaming\cacaoweb\replicating02854343B25D195D3D313C525C31BB78.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating0748E7AFAC387DF8A98E680F32036898.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating0B540960BE11948CA03669E91C7EB262.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating198F4AA3FAAFC187E5EF5750FB81C4A3.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating1AAE94F97F9A07F373F39631C3D3D0CE.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating1DAA856970E5872ACD084AF7C3A1BFD2.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating1DB84408EAD35EEAC3BD8D5AF8EB6180.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating37918BC217483AC51B872DBD631FA595.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating39AECB667DFD3EBE5337AE0BF73B3B25.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating4EAD8AA1A5AFD73ACF26E024DE64EC56.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating500474666570A1D19855E5852FC69E9D.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating64AE31C608EC76EDD0CE63DF69D747F4.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating65CFA423698D510FB7CCA29C0B3A672D.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating678AABB815E06583201D8D097662C793.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating6F3AA6EFF27C099A61A509E0F6D9CBAD.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating75E5652E759FC4AB3478129C2C1BFC28.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicating8AA2BCC7281D6C6E5C0CEFA989D4F787.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingA5CA650B755A3B5D01F0C7A8F12A8F5C.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingAA41B47D6516AEFF114604B8EDA0EAFD.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingAEBA31274B72E4EF4E4823D442E0FE03.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingBD34DF4950300034746897FA72F8115B.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingCC421BEBBF4489BBE4F9A18FC72A60B8.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingD44684E9E5B5EE748715158E9DCA8321.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingDFAF36B1FD6F54F1919E5586D026640F.cacao

c:\users\Will\AppData\Roaming\cacaoweb\replicatingF78E35DB1FD8BB23F22C911FEFB0FB6D.cacao

c:\users\Will\AppData\Roaming\cacaoweb\storage.db

c:\users\Will\AppData\Roaming\FREEzeFrog

c:\users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore

c:\users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore\System Restore.lnk

c:\users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Restore\Uninstall System Restore.lnk

c:\users\Will\lame_enc_en.dll

c:\users\Will\lametritonus_en.dll

c:\windows\7Loader.TAG

c:\windows\system32\dstfixx.dll

c:\windows\system32\gxvxccount

c:\windows\system32\ntkrlICE.exe

c:\windows\system32\scvideo.dll

c:\windows\system32\spool\prtprocs\w32x86\WFXPNT40.DLL

c:\windows\system32\wrdivin.dll

D:\resycled

.

((((((((((((((((((((((((( Files Created from 2011-10-16 to 2011-11-16 )))))))))))))))))))))))))))))))

.

2011-11-14 10:56 . 2011-11-14 10:56 -------- d-----w- c:\users\Will\AppData\Roaming\Yahoo!

2011-11-13 18:19 . 2011-11-13 18:19 -------- d-----w- c:\windows\Profiles\All Users\Application Data\Yahoo!

2011-11-13 00:20 . 2011-11-13 00:20 -------- d-----w- c:\program files\Avanquest update

2011-11-13 00:18 . 2011-11-13 00:18 -------- d-----w- c:\users\Will\AppData\Local\BVRP Software

2011-11-12 23:59 . 2011-11-13 00:39 -------- d-----w- c:\program files\Motorola Phone Tools

2011-11-12 23:57 . 2011-11-12 23:57 -------- d-----w- c:\users\Will\AppData\Roaming\InstallShield

2011-11-10 02:30 . 2011-11-10 02:30 -------- d-----w- c:\program files\Replay Video Capture

2011-11-08 23:12 . 2011-09-29 16:03 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-08 23:12 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-08 23:12 . 2011-09-29 03:37 2341888 ----a-w- c:\windows\system32\win32k.sys

2011-11-07 23:58 . 2011-08-27 04:26 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-11-07 23:53 . 2011-02-23 04:47 69632 ----a-w- c:\windows\system32\drivers\bowser.sys

2011-10-24 21:27 . 2011-10-24 21:31 -------- d-----w- c:\users\Will\AppData\Roaming\GetRightToGo

2011-10-23 22:18 . 2011-10-23 22:18 -------- d-----w- c:\users\Will\AppData\Local\Babylon

2011-10-23 22:18 . 2011-10-24 02:07 -------- d-----w- c:\program files\Easy Downloads

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-13 18:20 . 2011-06-11 21:01 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-03 07:50 . 2010-04-17 01:02 544656 ----a-w- c:\windows\system32\deployJava1.dll

2011-08-31 22:00 . 2009-10-14 17:37 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2007-03-09 07:12 27648 --sha-w- c:\windows\System32\AVSredirect.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-11-13 4617600]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceRunOnStartMenu"= 1 (0x1)

"QuickLaunchEnabled"= 1 (0x1)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-09-01 113024]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]

2007-12-17 09:55 320168 ----a-w- c:\program files\Lexmark Fax Solutions\fm3032.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]

2011-08-31 22:00 449608 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2011-08-22 06:18 6276408 ----a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-11-10 08:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2011-07-28 22:49 336384 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-05-04 17:59 252136 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]

2011-08-25 11:13 2816328 ----a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

.

R1 MpKslb8f1bfd9;MpKslb8f1bfd9;c:\windows\system32\MpEngineStore\MpKslb8f1bfd9.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2005-06-15 45440]

R3 cpuz134;cpuz134;c:\users\Will\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]

R3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\cur_bus.sys [2005-07-19 57744]

R3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\DRIVERS\cur_mdfl.sys [2005-07-19 8336]

R3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\DRIVERS\cur_mdm.sys [2005-07-19 93328]

R3 cur_serd;Curitel Packet Service Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\cur_serd.sys [2005-07-19 73152]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-08-26 14216]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-09-16 8456]

R3 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 20992]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]

R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x]

R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]

R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\DRIVERS\ousb2hub.sys [2005-06-15 56960]

R3 pmxscan;Visioneer USB Kernel;c:\windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2009-07-13 266752]

R4 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-03 691696]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-09-01 12880]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-09-01 67664]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-09-01 116608]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-07-28 176128]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-28 291840]

S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [2011-06-24 39424]

S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2009-08-13 594600]

S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe [2009-08-13 98984]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-07-28 8396800]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-07-28 247296]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-06-06 211984]

S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2010-04-26 322848]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - ppsio2

*Deregistered* - SASENUM

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc

HsfXAudioService REG_MULTI_SZ HsfXAudioService

LPDService REG_MULTI_SZ LPDSVC

.

Contents of the 'Scheduled Tasks' folder

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

mStart Page = hxxp://yeppo.net

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

IE: {{7CD59A63-0815-46D0-B474-2E5BCFCADD7C} - {1E866952-62EA-4161-B97D-4D228CEDF7A0} - c:\program files\UAPick\UABtn.dll

Trusted Zone: motive.com\pattta.att

Trusted Zone: motive.com\patttbc.att

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\mhl1biwx.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=ce25f49a00000000000000ff031509b7&tlver=1.4.35.10&affID=100842

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}

FF - Ext: cacaoweb: cacaoweb@cacaoweb.org - %profile%\extensions\cacaoweb@cacaoweb.org

FF - Ext: vShare Plugin: vshareus@toolbar - %profile%\extensions\vshareus@toolbar

FF - Ext: OpenDownload²: {210249CE-F888-11DD-B868-4CB456D89593} - %profile%\extensions\{210249CE-F888-11DD-B868-4CB456D89593}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: IE Tab +: coralietab@mozdev.org - %profile%\extensions\coralietab@mozdev.org

FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\Will\AppData\Roaming\Move Networks

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-cacaoweb - c:\users\Will\AppData\Roaming\cacaoweb\cacaoweb.exe

ShellExecuteHooks-{A213B520-C6C2-11d0-AF9D-008029E1027E} - (no file)

SafeBoot-klmdb.sys

MSConfigStartUp-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe

MSConfigStartUp-ATICustomerCare - c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

MSConfigStartUp-HPYpbHtCoK - c:\programdata\HPYpbHtCoK.exe

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe

MSConfigStartUp-TkBellExe - c:\program files\Real\RealPlayer\update\realsched.exe

MSConfigStartUp-wminit - c:\program files\Common Files\System\wminit.exe

AddRemove-Adobe Flash Player Plugin - c:\windows\system32\Macromed\Flash\FlashUtil10x_Plugin.exe

AddRemove-Custody X Change_is1 - c:\program files\Custody X Change\unins000.exe

AddRemove-Replay_Converter_1 - c:\windows\iun6002.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]

@DACL=(02 0000)

@="Folder Redirection"

"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"

"DllName"=expand:"fdeploy.dll"

"NoMachinePolicy"=dword:00000001

"NoSlowLink"=dword:00000001

"PerUserLocalSettings"=dword:00000001

"NoGPOListChanges"=dword:00000000

"NoBackgroundPolicy"=dword:00000000

"GenerateGroupPolicy"="GenerateGroupPolicy"

"EventSources"=multi:"(Folder Redirection,Application)\00\00"

"DisplayName"=expand:"@fdeploy.dll,-261"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]

@DACL=(02 0000)

@="Microsoft Disk Quota"

"DisplayName"=expand:"@%SystemRoot%\\System32\\dskquota.dll,-100"

"NoMachinePolicy"=dword:00000000

"NoUserPolicy"=dword:00000001

"NoSlowLink"=dword:00000001

"NoBackgroundPolicy"=dword:00000001

"NoGPOListChanges"=dword:00000001

"PerUserLocalSettings"=dword:00000000

"RequiresSuccessfulRegistry"=dword:00000001

"EnableAsynchronousProcessing"=dword:00000000

"DllName"=expand:"%SystemRoot%\\System32\\dskquota.dll"

"ProcessGroupPolicy"="ProcessGroupPolicy"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]

@DACL=(02 0000)

@="QoS Packet Scheduler"

"DisplayName"=expand:"@gptext.dll,-201"

"ProcessGroupPolicy"="ProcessPSCHEDPolicy"

"DllName"=expand:"gptext.dll"

"NoUserPolicy"=dword:00000001

"NoGPOListChanges"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}]

@DACL=(02 0000)

@="Remote Desktop USB Redirection"

"DllName"=expand:"%SystemRoot%\\System32\\TsUsbRedirectionGroupPolicyExtension.dll"

"RequiresSuccessfulRegistry"=dword:00000001

"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"

"NoGPOListChanges"=dword:00000001

"NoUserPolicy"=dword:00000001

"DisplayName"=expand:"@%SystemRoot%\\System32\\TsUsbRedirectionGroupPolicyExtension.dll,-100"

"NoBackgroundPolicy"=dword:00000000

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}]

@DACL=(02 0000)

@="Windows Search Group Policy Extension"

"ProcessGroupPolicy"="ProcessGroupPolicy"

"DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll"

"RequiresSuccessfulRegistry"=dword:00000001

"NoSlowLink"=dword:00000000

"NoGPOListChanges"=dword:00000001

"NoUserPolicy"=dword:00000000

"NoMachinePolicy"=dword:00000000

"PerUserLocalSettings"=dword:00000000

"EnableAsynchronousProcessing"=dword:00000001

"NoBackgroundPolicy"=dword:00000000

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}]

@DACL=(02 0000)

@="Deployed Printer Connections"

"DisplayName"=expand:"@%systemroot%\\system32\\gpprnext.dll,-1"

"DllName"=expand:"%systemroot%\\system32\\gpprnext.dll"

"EnableAsynchronousProcessing"=dword:00000001

"ExtensionEventSource"=""

"GenerateGroupPolicy"="PrinterGenerateGroupPolicy"

"MaxNoGPOListChangesInterval"=dword:00000000

"NoBackgroundPolicy"=dword:00000000

"NoGPOListChanges"=dword:00000000

"NoMachinePolicy"=dword:00000000

"NoSlowLink"=dword:00000001

"NotifyLinkTransition"=dword:00000000

"NoUserPolicy"=dword:00000000

"PerUserLocalSettings"=dword:00000000

"ProcessGroupPolicy"="PrinterProcessGroupPolicy"

"ProcessGroupPolicyEx"="PrinterProcessGroupPolicyEx"

"RequiresSuccessfulRegistry"=dword:00000000

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}]

@DACL=(02 0000)

@="TCPIP"

"DisplayName"=expand:"@gptext.dll,-204"

"ProcessGroupPolicy"="ProcessTCPIPPolicy"

"DllName"=expand:"gptext.dll"

"NoUserPolicy"=dword:00000001

"NoGPOListChanges"=dword:00000001

"RequiresSuccessfulRegistry"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]

@DACL=(02 0000)

@="IP Security"

"ProcessGroupPolicyEx"="ProcessIPSECPolicyEx"

"GenerateGroupPolicy"="GenerateIPSECPolicy"

"DllName"=expand:"%SystemRoot%\\System32\\polstore.dll"

"NoUserPolicy"=dword:00000001

"NoGPOListChanges"=dword:00000000

"DisplayName"=expand:"@c:\\Windows\\system32\\polstore.dll,-5012"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}]

@DACL=(02 0000)

@="Audit Policy Configuration"

"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"

"GenerateGroupPolicy"="GenerateGroupPolicy"

"DllName"=expand:"auditcse.dll"

"NoUserPolicy"=dword:00000001

"EnableAsynchronousProcessing"=dword:00000001

"MaxNoGPOListChangesInterval"=dword:000003c0

"ForceRefreshFG"=dword:00000000

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}]

@DACL=(02 0000)

@="Enterprise QoS"

"DisplayName"=expand:"@gptext.dll,-203"

"ProcessGroupPolicy"="ProcessEQoSPolicy"

"DllName"=expand:"gptext.dll"

"RequiresSuccessfulRegistry"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}]

@DACL=(02 0000)

@="CP"

"DisplayName"=expand:"@gptext.dll,-205"

"ProcessGroupPolicy"="ProcessConnectivityPlatformPolicy"

"DllName"=expand:"gptext.dll"

"NoUserPolicy"=dword:00000001

"NoGPOListChanges"=dword:00000001

"RequiresSuccessfulRegistry"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

@DACL=(02 0000)

"DllName"="c:\\Program Files\\SUPERAntiSpyware\\SASWINLO.DLL"

"Logon"="SABWINLOLogon"

"Logoff"="SABWINLOLogoff"

"Startup"="SABWINLOStartup"

"Shutdown"="SABWINLOShutdown"

"Asynchronous"=dword:00000000

"Impersonate"=dword:00000000

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dstfixx]

@DACL=(02 0000)

"DllName"=expand:"dstfixx.dll"

"Startup"="dstfixx\00op"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

"MaxWait"=dword:00000001

"stdmemr"=hex:f8,ef,dc,47,e1,bf,73,1f,47

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wrdivin]

@DACL=(02 0000)

"DllName"=expand:"wrdivin.dll"

"Startup"="wrdivin\00op"

"Impersonate"=dword:00000001

"Asynchronous"=dword:00000001

"MaxWait"=dword:00000001

"rrtguid3"=hex:d4,fa,fe,ce,53,eb,fb,3b,ce

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2011-11-15 20:08:56

ComboFix-quarantined-files.txt 2011-11-16 01:08

.

Pre-Run: 370,144,346,112 bytes free

Post-Run: 370,407,874,560 bytes free

.

- - End Of File - - D1924384F1E35C9A267106F6DEAFCA99

Maniac · November 16, 2011

Open Notepad and copy and paste the text in the code box below into it:

FireFox::
FF - ProfilePath - c:\users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\mhl1biwx.default\
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=ce25f49a00000000000000ff031509b7&tlver=1.4.35.10&affID=100842
FF - Ext: vShare Plugin: vshareus@toolbar - %profile%\extensions\vshareus@toolbar

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

In your next post here, please include ComboFix.txt and let me know how are things there.

MPA · November 16, 2011

ComboFix 11-11-15.06 - Will 11/16/2011 4:50.2.4 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3071.2164 [GMT -5:00]

Running from: c:\users\Will\Desktop\ComboFix.exe

Command switches used :: c:\users\Will\Desktop\CFScript.txt

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Will\AppData\Roaming\cacaoweb

c:\users\Will\AppData\Roaming\cacaoweb\cacaoweb.exe

c:\users\Will\AppData\Roaming\cacaoweb\npdfile.dat

c:\users\Will\AppData\Roaming\cacaoweb\replicatingD4281282805D64DB67D35A797F69CEAE.cacao

c:\users\Will\AppData\Roaming\cacaoweb\storage.db

c:\users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\mhl1biwx.default\extensions\vshareus@toolbar

c:\users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\mhl1biwx.default\extensions\vshareus@toolbar\chrome.manifest

c:\users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\mhl1biwx.default\extensions\vshareus@toolbar\chrome\vshareus.jar

c:\users\Will\AppData\Roaming\Mozilla\Firefox\Profiles\mhl1biwx.default\extensions\vshareus@toolbar\install.rdf

.

((((((((((((((((((((((((( Files Created from 2011-10-16 to 2011-11-16 )))))))))))))))))))))))))))))))

.

2011-11-16 09:55 . 2011-11-16 09:55 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2011-11-16 09:55 . 2011-11-16 09:55 -------- d-----w- c:\users\SYSTEM\AppData\Local\temp

2011-11-16 09:55 . 2011-11-16 09:55 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-16 09:55 . 2011-11-16 09:55 -------- d-----w- c:\users\Classic .NET AppPool\AppData\Local\temp

2011-11-16 01:17 . 2011-11-16 01:16 607260 ----a-w- c:\program files\dds.scr