What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

bearshare

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello everyone! Any and all help/advice is appreciated! Thank you in advance. :wavey:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:34:27 PM, on 12/17/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18999)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Camera Assistant Software for Gateway\traybar.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Spare Backup\SpareBackup.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\BigFix\bigfix.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\Tesia\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Common Files\Teleca Shared\logger.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe
C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch…PTB&M=P-170
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\VIDEOD~1\ARCURL~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Gateway\traybar.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Spare Backup] "C:\Program Files\Spare Backup\SpareBackup.exe" /silent
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Mobile Connectivity Suite] "C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Tesia\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; yie8; yie8)" -"http://www.y8.com/games/Street_Fighter_Online"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O16 - DPF: Web-Based Email Tools - http://email.secureserver.net/Download.CAB
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…k.cab102118.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9432 bytes
Post #2
Hello starchile and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Any underlined text in my posts indicates a clickable link.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.com
DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • DDS.txt and Attach.txt logs
  • GMER log
Post #3
Hello RP! Thank you for being willing to help me! :)

DDS (Ver_10-12-12.02) - NTFSx86
Run by [removed] at 22:20:23.74 on Tue 12/21/2010
Internet Explorer: 8.0.6001.18999
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1028 [GMT -8:00]

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {DAAC1C79-1A96-9DFE-FC4C-6940214C33E6}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\STacSV.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE



GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-21 23:21:33
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 FUJITSU_ rev.0000
Running: b7b1m2be.exe; Driver: C:\Users\Tesia\AppData\Local\Temp\kwlcipob.sys


—- Kernel code sections - GMER 1.0.15 —-

? C:\Users\Tesia\AppData\Local\Temp\mbr.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtCreateFile + 6 77DC43DA 4 Bytes [28, 00, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtCreateFile + B 77DC43DF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtMapViewOfSection + 6 77DC4B2A 1 Byte [28]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtMapViewOfSection + 6 77DC4B2A 4 Bytes [28, 03, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtMapViewOfSection + B 77DC4B2F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenFile + 6 77DC4BBA 4 Bytes [68, 00, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenFile + B 77DC4BBF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenProcess + 6 77DC4C3A 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenProcess + B 77DC4C3F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenProcessToken + B 77DC4C4F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenProcessTokenEx + 6 77DC4C5A 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenProcessTokenEx + B 77DC4C5F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenThread + 6 77DC4CAA 4 Bytes [68, 01, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenThread + B 77DC4CAF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenThreadToken + 6 77DC4CBA 4 Bytes [68, 02, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenThreadToken + B 77DC4CBF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtOpenThreadTokenEx + B 77DC4CCF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtQueryAttributesFile + 6 77DC4D5A 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtQueryAttributesFile + B 77DC4D5F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtQueryFullAttributesFile + B 77DC4E0F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtSetInformationFile + 6 77DC52EA 4 Bytes [28, 01, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtSetInformationFile + B 77DC52EF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtSetInformationThread + 6 77DC533A 4 Bytes [28, 02, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtSetInformationThread + B 77DC533F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtUnmapViewOfSection + 6 77DC55DA 1 Byte [68]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtUnmapViewOfSection + 6 77DC55DA 4 Bytes [68, 03, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[3556] ntdll.dll!NtUnmapViewOfSection + B 77DC55DF 1 Byte [E2]
.text C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe[3976] ntdll.dll!DbgBreakPoint 77DA8B2E 1 Byte [90]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateFile + 6 77DC43DA 4 Bytes [28, 00, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtCreateFile + B 77DC43DF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtMapViewOfSection + 6 77DC4B2A 1 Byte [28]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtMapViewOfSection + 6 77DC4B2A 4 Bytes [28, 03, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtMapViewOfSection + B 77DC4B2F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenFile + 6 77DC4BBA 4 Bytes [68, 00, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenFile + B 77DC4BBF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcess + 6 77DC4C3A 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcess + B 77DC4C3F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessToken + B 77DC4C4F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessTokenEx + 6 77DC4C5A 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenProcessTokenEx + B 77DC4C5F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThread + 6 77DC4CAA 4 Bytes [68, 01, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThread + B 77DC4CAF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadToken + 6 77DC4CBA 4 Bytes [68, 02, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadToken + B 77DC4CBF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtOpenThreadTokenEx + B 77DC4CCF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryAttributesFile + 6 77DC4D5A 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryAttributesFile + B 77DC4D5F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtQueryFullAttributesFile + B 77DC4E0F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationFile + 6 77DC52EA 4 Bytes [28, 01, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationFile + B 77DC52EF 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationThread + 6 77DC533A 4 Bytes [28, 02, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtSetInformationThread + B 77DC533F 1 Byte [E2]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnmapViewOfSection + 6 77DC55DA 1 Byte [68]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnmapViewOfSection + 6 77DC55DA 4 Bytes [68, 03, 06, 00]
.text C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe[4092] ntdll.dll!NtUnmapViewOfSection + B 77DC55DF 1 Byte [E2]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\BTHUSB \Device\0000006a bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\0000006c bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\00197efbbbe7
Reg HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\00197efbbbe7 (not active ControlSet)

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR

—- Files - GMER 1.0.15 —-

File C:\System Volume Information\{899683ff-0810-11e0-903c-00197efbbbe7}{3808876b-c176-4e48-b7ae-04046e6cc752} 112787456 bytes
File C:\System Volume Information\{8996841b-0810-11e0-903c-00197efbbbe7}{3808876b-c176-4e48-b7ae-04046e6cc752} 384417792 bytes

—- EOF - GMER 1.0.15 —-

Attachments:

Post #4
Hello, A large part of the DDS.txt report is missing. Can you please post that log again? If you need to run the program again to get a new log, that is fine.
Post #5
Sorry about that! Don't know what happened. Here ya' go! DDS (Ver_10-12-12.02) - NTFSx86 Run by [removed] at 22:20:23.74 on Tue 12/21/2010 Internet Explorer: 8.0.6001.18999 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1028 [GMT -8:00] AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {DAAC1C79-1A96-9DFE-FC4C-6940214C33E6} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Windows\system32\agrsmsvc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\STacSV.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\Camera Assistant Software for Gateway\traybar.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Spare Backup\SpareBackup.exe C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Tesia\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Tesia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Common Files\Teleca Shared\logger.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Tesia\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8 uWindow Title = Windows Internet Explorer provided by Yahoo! mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Consumer&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=PTB&M=P-170 mDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8 uInternet Settings,ProxyOverride = *.local BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn4\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: IEPlugin Class: {11222041-111b-46e3-bd29-efb2449479b1} - c:\progra~1\arcsoft\videod~1\ARCURL~1.DLL BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn4\YTSingleInstance.dll TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File TB: Causes: {5d51b4f2-cc28-4488-9ab3-be7e40eb3293} - c:\program files\causes\Toolbar.dll TB: {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No File uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [Google Update] "c:\users\tesia\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; yie8; yie8)" -"http://www.y8.com/games/Street_Fighter_Online" mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe" mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe mRun: [Camera Assistant Software] "c:\program files\camera assistant software for gateway\traybar.exe" mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [Spare Backup] "c:\program files\spare backup\SpareBackup.exe" /silent mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4.0\OpwareSE4.exe" mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [Mobile Connectivity Suite] "c:\program files\htc\htc sync\application launcher\Application Launcher.exe" /startoptions mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\bigfix.lnk - c:\program files\bigfix\bigfix.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000 DPF: Web-Based Email Tools - hxxp://email.secureserver.net/Download.CAB DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab Notify: igfxcui - igfxdev.dll mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12 ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-10-8 64288] R0 logogexe;logogexe;c:\windows\system32\drivers\logogexe.sys [2006-11-2 38912] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 1389400] R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2009-6-10 347648] S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-6-10 24576] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15264] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-21 18688] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-21 8320] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2007-6-18 23680] S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184] =============== Created Last 30 ================ 2010-12-18 05:31:23 388096 —-a-r- c:\users\tesia\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2010-12-18 04:11:11 6273872 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{8ce9c3ae-a25d-4b61-86fd-a33645a7ada8}\mpengine.dll 2010-12-16 05:10:50 2048 —-a-w- c:\windows\system32\tzres.dll 2010-12-05 11:15:50 ——– d—–w- c:\progra~2\32237 2010-12-05 11:05:13 ——– d—–w- c:\users\tesia\appdata\local\HTC 2010-12-05 11:05:09 ——– d—–w- c:\users\tesia\appdata\roaming\Teleca 2010-12-05 11:02:41 ——– d—–w- c:\progra~2\HTC 2010-12-05 11:02:08 ——– d—–w- c:\program files\common files\Teleca Shared 2010-12-05 11:02:07 ——– d—–w- c:\progra~2\Teleca 2010-12-05 10:59:43 ——– d—–w- c:\program files\Spirent Communications 2010-12-05 10:59:07 ——– d—–w- c:\program files\HTC 2010-12-05 10:55:32 ——– d—–w- c:\users\tesia\appdata\local\Downloaded Installations 2010-12-03 10:18:34 ——– d—–w- c:\users\tesia\appdata\local\BearShare 2010-12-03 10:16:36 ——– d—–w- c:\program files\BearShare Applications 2010-12-03 10:14:51 ——– d—–w- c:\users\tesia\appdata\local\PackageAware 2010-12-03 10:05:55 ——– d—–w- c:\program files\FrostWire 2010-12-03 09:41:36 ——– d—–w- c:\program files\LuckyWire 2010-12-03 05:59:27 472808 —-a-w- c:\windows\system32\deployJava1.dll ==================== Find3M ==================== 2010-12-11 09:12:41 15880 —-a-w- c:\windows\system32\lsdelete.exe 2010-11-04 18:56:07 345600 —-a-w- c:\windows\system32\wmicmiplugin.dll 2010-11-04 18:55:38 352768 —-a-w- c:\windows\system32\taskschd.dll 2010-11-04 18:55:38 270336 —-a-w- c:\windows\system32\taskcomp.dll 2010-11-04 18:55:12 601600 —-a-w- c:\windows\system32\schedsvc.dll 2010-11-04 16:34:06 171520 —-a-w- c:\windows\system32\taskeng.exe 2010-11-02 06:01:54 916480 —-a-w- c:\windows\system32\wininet.dll 2010-11-02 05:57:41 43520 —-a-w- c:\windows\system32\licmgr10.dll 2010-11-02 05:57:27 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2010-11-02 05:57:11 71680 —-a-w- c:\windows\system32\iesetup.dll 2010-11-02 05:57:11 109056 —-a-w- c:\windows\system32\iesysprep.dll 2010-11-02 05:01:31 385024 —-a-w- c:\windows\system32\html.iec 2010-11-02 04:26:10 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2010-11-02 04:24:44 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2010-10-28 15:44:56 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-10-28 13:27:47 292352 —-a-w- c:\windows\system32\atmfd.dll 2010-10-19 18:41:44 222080 ——w- c:\windows\system32\MpSigStub.exe 2010-10-18 13:37:35 81920 —-a-w- c:\windows\system32\consent.exe 2010-10-18 13:31:24 2038272 —-a-w- c:\windows\system32\win32k.sys ============= FINISH: 22:25:20.72 ===============
Post #6
starchile:

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform Quick Scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please post the results.
Please include the following in your next post:
  • MBAM log
Post #7
Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5387 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18999 12/24/2010 12:42:44 AM mbam-log-2010-12-24 (00-42-44).txt Scan type: Quick scan Objects scanned: 184162 Time elapsed: 33 minute(s), 6 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 22 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3E720452-B472-4954-B7AA-33069EB53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47a3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Value: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Value: {07B18EA9-A523-4961-B6BB-170DE4475CCA} -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Windows\Temp\tmp0000000851bcca1eb4c68a9a (Trojan.Dropper) -> Quarantined and deleted successfully.
Post #8
starchile:

How is it running now? Please do this next:

🖼Click to load external image (Posted Image) Please run ESET Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Please include the following in your next post:
  • ESET log
Post #9
My computer is running faster and my browser is back to normal! C:\Program Files\Trend Micro\HijackThis\backups\backup-20091017-011403-699.dll a variant of Win32/Toolbar.MyWebSearch.K application C:\Users\Majah\Documents\LimeWire\Saved\down in valley slim whitman.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan C:\Users\Public\Music\frostwire\Nick Drake- Pink Moon.wma probably a variant of Win32/Agent.NHDFUMT trojan C:\Users\Public\Music\frostwire\Wax Taylor-02-Que sera.wma probably a variant of Win32/Agent.NKIMEUN trojan C:\Users\Tesia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\990a542-425c5972 multiple threats C:\Users\Tesia\Documents\FrostWire\Saved\New Folder\Nick Drake- Pink Moon.wma probably a variant of Win32/Agent.NHDFUMT trojan
Post #10
This is probably what you were looking for, right? lol…I'm getting it!!! ^_^ ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=617de072c4160849a2988be42e15df24 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-12-27 01:18:32 # local_time=2010-12-27 05:18:32 (-0800, Pacific Standard Time) # country="United States" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 36757248 36757248 0 0 # compatibility_mode=5892 16776573 100 100 0 130052873 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=175221 # found=6 # cleaned=0 # scan_time=10567 C:\Program Files\Trend Micro\HijackThis\backups\backup-20091017-011403-699.dll a variant of Win32/Toolbar.MyWebSearch.K application (unable to clean) 00000000000000000000000000000000 I C:\Users\Majah\Documents\LimeWire\Saved\down in valley slim whitman.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Public\Music\frostwire\Nick Drake- Pink Moon.wma probably a variant of Win32/Agent.NHDFUMT trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Public\Music\frostwire\Wax Taylor-02-Que sera.wma probably a variant of Win32/Agent.NKIMEUN trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Tesia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\990a542-425c5972 multiple threats (unable to clean) 00000000000000000000000000000000 I C:\Users\Tesia\Documents\FrostWire\Saved\New Folder\Nick Drake- Pink Moon.wma probably a variant of Win32/Agent.NHDFUMT trojan (unable to clean) 00000000000000000000000000000000 I # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=617de072c4160849a2988be42e15df24 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-12-29 02:32:54 # local_time=2010-12-28 06:32:54 (-0800, Pacific Standard Time) # country="United States" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=512 16777215 100 0 36890294 36890294 0 0 # compatibility_mode=5892 16776573 100 100 0 130185919 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=173705 # found=6 # cleaned=0 # scan_time=11582 C:\Program Files\Trend Micro\HijackThis\backups\backup-20091017-011403-699.dll a variant of Win32/Toolbar.MyWebSearch.K application (unable to clean) 00000000000000000000000000000000 I C:\Users\Majah\Documents\LimeWire\Saved\down in valley slim whitman.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Public\Music\frostwire\Nick Drake- Pink Moon.wma probably a variant of Win32/Agent.NHDFUMT trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Public\Music\frostwire\Wax Taylor-02-Que sera.wma probably a variant of Win32/Agent.NKIMEUN trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Tesia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\990a542-425c5972 multiple threats (unable to clean) 00000000000000000000000000000000 I C:\Users\Tesia\Documents\FrostWire\Saved\New Folder\Nick Drake- Pink Moon.wma probably a variant of Win32/Agent.NHDFUMT trojan (unable to clean) 00000000000000000000000000000000 I
Post #11
starchile:

🖼Click to load external image (Posted Image) P2P - I see you use or used to use P2P software (FrostWire & Limewire). We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Please see this post for more information. I recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

This will take care of those ESET detections:

🖼Click to load external image (Posted Image) Open notepad and copy/paste the text in the quotebox below into it:

@echo off 
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in ( 
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20091017-011403-699.dll"
"C:\Users\Majah\Documents\LimeWire\Saved\down in valley slim whitman.wma"
"C:\Users\Public\Music\frostwire\Nick Drake- Pink Moon.wma"
"C:\Users\Public\Music\frostwire\Wax Taylor-02-Que sera.wma"
"C:\Users\Tesia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\990a542-425c5972"
"C:\Users\Tesia\Documents\FrostWire\Saved\New Folder\Nick Drake- Pink Moon.wma"
) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
pause
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this: 🖼Click to load external image (Posted Image)
Double click on fix.bat & allow it to run.

Now I have an update and some important cleanup for you to take care of:

🖼Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version. Be sure to watch for and uncheck any boxes offering to install other software.

🖼Click to load external image (Posted Image) Delete the following tools along with any other logs you saved from our work:
  • DDS
  • GMER
🖼Click to load external image (Posted Image) Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Avoid using P2P programs, cracks and keygens! Refer back to my earlier post for more information.
  • Please carefully review the information in the Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #12
RPMcMurphy: Thank you again for all of your help and good information!! I am thankful that you all are here. :clap: Hope you have a wonderful new year!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI