This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected with search.searchcompletion.com [Closed] [Solved]

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hey Jeff, The ESET Online scanner found no threats, but didn't give me an option to export the file. Here's the malwarebytes quick scan: Malwarebytes Anti-Malware 1.60.0.1800 www.malwarebytes.org Database version: v2012.01.09.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Amer Ahmed :: AMERVAIO [administrator] 1/9/2012 3:36:20 PM mbam-log-2012-01-09 (15-36-20).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 185091 Time elapsed: 3 minute(s), 9 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Hi airs0ftr3,

Please download JavaRa to your desktop and unzip it to its own
folder
  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
    click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
    Java Runtime Environment (JRE) version for your computer.
———-

Run a new scan with DDS and post both of the logs created into your next reply.
———-

How is your system running now?
Hey Jeff, The computer is running great. When I do a search in Firefox, it crashes the page (probably because I don't have a default search enabled). Here is dds.txt . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 12:50:33.81 on Wed 01/11/2012 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8118.5652 [GMT -5:00] . AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Windows\SysWOW64\nlssrv32.exe C:\Program Files\Raxco\PerfectDisk\PDAgent.exe C:\Windows\system32\sppsvc.exe C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\SysWOW64\DllHost.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\WUDFHost.exe C:\Windows\system32\atieclxx.exe C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\taskeng.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Zune\ZuneLauncher.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE C:\Program Files\Peerblock\peerblock.exe C:\Users\Amer Ahmed\AppData\Local\Programs\Google\MusicManager\MusicManager.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Apoint\Apvfb.exe C:\Windows\system32\conhost.exe C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\Google\Google Talk\googletalk.exe C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files (x86)\Mozilla\firefox.exe C:\Program Files (x86)\Mozilla\plugin-container.exe C:\Users\Amer Ahmed\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe C:\Program Files (x86)\Mozilla\plugin-container.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\system32\msiexec.exe C:\Windows\system32\vssvc.exe C:\Windows\System32\svchost.exe -k swprv C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Amer Ahmed\Desktop\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mStart Page = hxxp://www.google.com BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: DivX Plus Web Player HTML5 : {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll uRun: [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" uRun: [GrooveMonitor] C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE uRun: [PeerBlock] C:\Program Files\Peerblock\peerblock.exe uRun: [MusicManager] "C:\Users\Amer Ahmed\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [googletalk] C:\Program Files (x86)\Google\Google Talk\googletalk.exe /autostart mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" StartupFolder: C:\Users\AMERAH~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\UVAITC~1.LNK - C:\Windows\Installer\{3C9B29DE-4C2C-4C10-A8F2-7662EE95BEA9}\_2E0263870D3F7424756461.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Google Sidewiki… - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://d1ylr6sba64qi3.cloudfront.net/global/bin/srldetect_cyri_4.1.71.0.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Notify: VESWinlogon - VESWinlogon.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL BHO-X64: URLRedirectionBHO - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s mRun-x64: [Apoint] %ProgramFiles%\Apoint\Apoint.exe mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" mRun-x64: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices mRun-x64: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" mRun-x64: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe" mRun-x64: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm AppInit_DLLs-X64: C:\Windows\System32\acaptuser64.dll SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\AMERAH~1\AppData\Roaming\Mozilla\Firefox\Profiles\s55aitdr.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla\plugins\npContribute.dll FF - plugin: C:\Program Files (x86)\Mozilla\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla\plugins\npvsharetvplg.dll FF - plugin: C:\Program Files (x86)\Mozilla\plugins\npwachk.dll FF - plugin: C:\Users\Amer Ahmed\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Users\Amer Ahmed\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: C:\Users\Amer Ahmed\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-8-10 55856] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-11-25 203776] R2 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2011-8-9 202576] R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-9-22 974944] R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2011-8-4 137144] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-8-9 13336] R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\system32\nlssrv32.exe –> C:\Windows\system32\nlssrv32.exe [?] R2 PDFSFilter;PDFSFilter;C:\Windows\System32\drivers\PDFsFilter.sys [2011-9-7 79888] R2 rimspci;rimspci;C:\Windows\System32\drivers\rimssne64.sys [2010-8-9 93696] R2 risdsnpe;risdsnpe;C:\Windows\System32\drivers\risdsne64.sys [2010-8-9 75776] R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2010-5-21 13832] R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-8-9 2320920] R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-11-25 8120320] R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-11-25 289792] R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-8-9 56344] R3 pbfilter;pbfilter;C:\Program Files\Peerblock\pbfilter.sys [2010-11-23 24176] R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2007-8-3 11392] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-10 135664] S3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;C:\Program Files\BitComet\tools\BitCometService.exe -service –> C:\Program Files\BitComet\tools\BitCometService.exe -service [?] S3 BrSerIb;Brother Serial Interface Driver(WDM);C:\Windows\System32\drivers\BrSerIb.sys [2010-1-19 87552] S3 BrUsbSIb;Brother Serial USB Driver(WDM);C:\Windows\System32\drivers\BrUsbSib.sys [2010-1-19 14592] S3 btusbflt;Bluetooth USB Filter;C:\Windows\System32\drivers\btusbflt.sys [2010-8-9 52264] S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2010-8-9 35104] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-10 135664] S3 HTCAND64;HTC Device Driver;C:\Windows\System32\drivers\ANDROIDUSB.sys [2009-11-1 33736] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 51740536] S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440] S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2011-3-2 20992] S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-3-2 59392] S3 TVICHW64;TVICHW64;C:\Windows\System32\drivers\TVicHW64.sys [2010-8-9 21200] S3 USA19H;USA19H;C:\Windows\System32\drivers\USA19Hx64.sys [2007-10-30 740096] S3 USA19HP;USA19HP;C:\Windows\System32\drivers\USA19Hx64p.sys [2007-10-23 35840] S3 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2010-9-8 571248] S3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [2010-8-9 1223024] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-3-5 1255736] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2010-8-9 395264] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2012-01-11 17:49:11 750488 —-a-w- C:\Windows\System32\npdeployJava1.dll 2012-01-11 17:33:58 69000 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{9B831BDF-DE7D-4A4E-AE43-1286281E53AF}\offreg.dll 2012-01-11 06:45:20 1572864 —-a-w- C:\Windows\System32\quartz.dll 2012-01-11 06:45:19 514560 —-a-w- C:\Windows\SysWow64\qdvd.dll 2012-01-11 06:45:19 366592 —-a-w- C:\Windows\System32\qdvd.dll 2012-01-11 06:45:19 1328128 —-a-w- C:\Windows\SysWow64\quartz.dll 2012-01-11 06:45:14 1731920 —-a-w- C:\Windows\System32\ntdll.dll 2012-01-11 06:45:14 1292080 —-a-w- C:\Windows\SysWow64\ntdll.dll 2012-01-11 06:45:12 77312 —-a-w- C:\Windows\System32\packager.dll 2012-01-11 06:45:12 67072 —-a-w- C:\Windows\SysWow64\packager.dll 2012-01-10 08:59:33 8822856 —-a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{9B831BDF-DE7D-4A4E-AE43-1286281E53AF}\mpengine.dll 2012-01-09 20:35:14 23152 —-a-w- C:\Windows\System32\drivers\mbam.sys 2012-01-09 03:02:51 ——– d-sh–w- C:\$RECYCLE.BIN 2012-01-09 02:42:56 ——– d—–w- C:\ComboFix 2012-01-08 16:36:50 98816 —-a-w- C:\Windows\sed.exe 2012-01-08 16:36:50 518144 —-a-w- C:\Windows\SWREG.exe 2012-01-08 16:36:50 256000 —-a-w- C:\Windows\PEV.exe 2012-01-08 16:36:50 208896 —-a-w- C:\Windows\MBR.exe 2012-01-03 07:28:06 2570286 —-a-w- C:\Windows\SysWow64\abgx360.exe 2012-01-02 19:15:04 ——– d—–w- C:\PROGRA~3\MediaMonkey 2012-01-02 19:14:57 ——– d—–w- C:\Users\AMERAH~1\AppData\Roaming\MediaMonkey 2011-12-27 20:57:10 ——– d—–w- C:\Azhar 2011-12-25 23:36:02 ——– d—–w- C:\Users\AMERAH~1\AppData\Roaming\Garmin 2011-12-25 23:35:34 ——– d—–w- C:\Program Files (x86)\Garmin 2011-12-23 06:06:31 ——– d—–w- C:\Temp 2011-12-15 01:51:30 43520 —-a-w- C:\Windows\System32\csrsrv.dll 2011-12-15 01:30:28 3145216 —-a-w- C:\Windows\System32\win32k.sys 2011-12-15 01:30:19 723456 —-a-w- C:\Windows\System32\EncDec.dll 2011-12-15 01:30:18 534528 —-a-w- C:\Windows\SysWow64\EncDec.dll 2011-12-15 01:29:53 2048 —-a-w- C:\Windows\SysWow64\tzres.dll 2011-12-15 01:29:53 2048 —-a-w- C:\Windows\System32\tzres.dll . ==================== Find3M ==================== . 2012-01-11 17:48:47 660368 —-a-w- C:\Windows\System32\deployJava1.dll 2011-12-21 21:35:44 419840 —-a-w- C:\Windows\System32\systemcpl.dll 2011-11-17 06:49:14 95600 —-a-w- C:\Windows\System32\drivers\ksecdd.sys 2011-11-17 06:49:14 152432 —-a-w- C:\Windows\System32\drivers\ksecpkg.sys 2011-11-17 06:44:43 459232 —-a-w- C:\Windows\System32\drivers\cng.sys 2011-11-17 06:35:28 395776 —-a-w- C:\Windows\System32\webio.dll 2011-11-17 06:35:26 29184 —-a-w- C:\Windows\System32\sspisrv.dll 2011-11-17 06:35:26 136192 —-a-w- C:\Windows\System32\sspicli.dll 2011-11-17 06:35:25 340992 —-a-w- C:\Windows\System32\schannel.dll 2011-11-17 06:35:25 28160 —-a-w- C:\Windows\System32\secur32.dll 2011-11-17 06:35:19 1447936 —-a-w- C:\Windows\System32\lsasrv.dll 2011-11-17 06:33:55 31232 —-a-w- C:\Windows\System32\lsass.exe 2011-11-17 05:35:02 314880 —-a-w- C:\Windows\SysWow64\webio.dll 2011-11-17 05:34:52 224768 —-a-w- C:\Windows\SysWow64\schannel.dll 2011-11-17 05:34:52 22016 —-a-w- C:\Windows\SysWow64\secur32.dll 2011-11-17 05:28:48 96768 —-a-w- C:\Windows\SysWow64\sspicli.dll 2011-11-13 21:36:13 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-04 01:53:39 2309120 —-a-w- C:\Windows\System32\jscript9.dll 2011-11-04 01:44:47 1390080 —-a-w- C:\Windows\System32\wininet.dll 2011-11-04 01:44:21 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl 2011-11-04 01:34:43 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2011-11-03 22:47:42 1798144 —-a-w- C:\Windows\SysWow64\jscript9.dll 2011-11-03 22:40:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2011-11-03 22:39:47 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-11-03 22:31:57 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-10-20 23:26:22 94208 —-a-w- C:\Windows\SysWow64\dpl100.dll . ============= FINISH: 12:54:37.23 =============== And here is Attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_11-03-05.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume2 Install Date: 8/9/2010 2:45:24 PM System Uptime: 1/11/2012 12:29:20 PM (0 hours ago) . Motherboard: Sony Corporation | | VAIO Processor: Intel® Core™ CPU Q 820 @ 1.73GHz | N/A | 1734/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 456 GiB total, 135.805 GiB free. D: is CDROM () E: is CDROM () F: is Removable G: is Removable H: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Microsoft Virtual WiFi Miniport Adapter Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&108D72A9&0&01 Manufacturer: Microsoft Name: Microsoft Virtual WiFi Miniport Adapter PNP Device ID: {5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&108D72A9&0&01 Service: vwifimp . Class GUID: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974} Description: FOXCONN-T77H114-BCM2070 Device ID: USB\VID_0489&PID_E00F\506313E01671 Manufacturer: Broadcom Name: FOXCONN-T77H114-BCM2070 PNP Device ID: USB\VID_0489&PID_E00F\506313E01671 Service: BTHUSB . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Marvell Yukon 88E8059 PCI-E Gigabit Ethernet Controller Device ID: PCI\VEN_11AB&DEV_4381&SUBSYS_9071104D&REV_11\4&F179732&0&00E2 Manufacturer: Marvell Name: Marvell Yukon 88E8059 PCI-E Gigabit Ethernet Controller PNP Device ID: PCI\VEN_11AB&DEV_4381&SUBSYS_9071104D&REV_11\4&F179732&0&00E2 Service: yukonw7 . ==== System Restore Points =================== . RP634: 1/10/2012 1:54:00 AM - Scheduled Checkpoint RP635: 1/10/2012 3:59:18 AM - Windows Update RP636: 1/11/2012 3:00:12 AM - Windows Update RP637: 1/11/2012 12:22:07 PM - Windows Update RP638: 1/11/2012 12:47:59 PM - Installed Java™ 7 Update 2 (64-bit) . ==== Installed Programs ====================== . . 360GamesPatcher (Client setup) abgx360 v1.0.6 ACID Pro 7.0 Adobe Acrobat X Pro - English, Français, Deutsch Adobe AIR Adobe Creative Suite 5 Master Collection Adobe Media Player Adobe Photoshop CS5 Adobe Shockwave Player 11.6 AnalogX Vocal Remover Apple Application Support Apple Software Update ArcSoft WebCam Companion 3 Avant Browser (remove only) BitComet 1.31 64-bit ccc-core-static CoreAVC Professional Edition (remove only) D3DX10 DivX Setup Fahrenheit Garmin USB Drivers Google Chrome Google Talk (remove only) Google Talk Plugin Google Update Helper Haali Media Splitter Half-Life 2 Episode One ImgBurn Intel® Control Center Intel® Management Engine Components Intel® Rapid Storage Technology Internet TV for Windows Media Center ITC Network Setup Tool JDownloader K-Lite Codec Pack 6.3.0 (Basic) Magic ISO Maker v5.5 (build 0281) Malwarebytes Anti-Malware version 1.60.0.1800 MediaMonkey 4.0 Mesh Runtime Microsoft Flight Simulator X Microsoft Flight Simulator X Service Pack 1 Microsoft Flight Simulator X Service Pack 2 Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 MKVtoolnix 4.5.0 Mozilla Firefox 9.0.1 (x86 en-US) Mp3tag v2.48 MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB973685) Music Manager Oblivion PDF Settings CS5 PMDG 747-400/400F for FSX PMDG BAe JS4100 PMDG_MD11_FSX PxMergeModule QuickTime Realtek HDMI Audio Driver for ATI Realtek High Definition Audio Driver Remote Keyboard with PlayStation 3 Revo Uninstaller 1.92 Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Setting Utility Series Skype™ 5.6 Star Wars® Knights of the Old Republic® II: The Sith Lords™ Steam swMSM System Requirements Lab Team Fortress 2 TI Connect 1.6 TI NoteFolio Creator Trapcode Suite 64-bit Unreal Tournament 2004 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) VAIO Control Center VAIO Event Service VAIO Power Management VAIO Update VC80CRTRedist - 8.0.50727.6195 Vertus Fluid Mask 3 3.2.1 VLC media player 1.1.10 vShare.tv plugin 1.3 WavePad Sound Editor Winamp Winamp Detector Plug-in Windows Installer Clean Up Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Media Center Add-in for Flash Windows Media Player Firefox Plugin . ==== Event Viewer Messages From Past Week ======== . 1/9/2012 6:44:24 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 1/8/2012 9:55:43 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 1/8/2012 11:51:51 AM, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver. 1/8/2012 10:11:17 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting. 1/8/2012 10:09:18 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service. 1/7/2012 2:19:50 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer SABERA-LAPTOP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6AB01CEA-E371-4F6E-9051-0A053C145918}. The master browser is stopping or an election is being forced. 1/7/2012 10:23:11 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk4\DR11. 1/7/2012 1:59:38 PM, Error: NetBT [4321] - The name "NETWORK :1d" could not be registered on the interface with IP address 192.168.1.4. The computer with the IP address 192.168.1.11 did not allow the name to be claimed by this computer. 1/5/2012 3:33:13 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel® Rapid Storage Technology service to connect. 1/5/2012 3:33:13 PM, Error: Service Control Manager [7000] - The Intel® Rapid Storage Technology service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 1/5/2012 10:21:47 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk4\DR7. 1/11/2012 4:04:57 AM, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83} as /. The error: "5" Happened while starting this command: C:\Windows\System32\slui.exe -Embedding 1/11/2012 12:29:32 PM, Error: Application Popup [56] - Driver RISD returned invalid ID for a child device (0001). . ==== End Of File =========================== Cheers
IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :D SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :D

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
———-

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
———-

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
  • Open Internet Explorer
  • Click on Tools > Internet Options
  • Press Security tab
  • Select Internet zone then place check next to Enable Protected Mode if not already done
  • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
  • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.
3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI