Spyware / Malware / Virus Removal

Double Click Virus [Closed]

78 min read

Looking for the outcome? Ask AI

michael81

Post #46May 21, 2012, 2:29 AM UTC

Thanks for reopening the thread! The requested logs follow: aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-04-28 15:38:12 —————————– 15:38:12.941 OS Version: Windows 6.0.6002 Service Pack 2 15:38:12.941 Number of processors: 2 586 0xF0D 15:38:12.941 ComputerName: MIKE-PC UserName: Mike 15:38:16.763 Initialize success 15:44:10.018 AVAST engine defs: 12042801 15:44:58.346 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 15:44:58.346 Disk 0 Vendor: ST3500630AS 3.ADG Size: 476940MB BusType: 3 15:44:58.362 Disk 0 MBR read successfully 15:44:58.362 Disk 0 MBR scan 15:44:58.409 Disk 0 Windows VISTA default MBR code 15:44:58.424 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63 15:44:58.440 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304 15:44:58.456 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 466651 MB offset 21069824 15:44:58.471 Disk 0 scanning sectors +976771072 15:44:58.549 Disk 0 scanning C:\Windows\system32\drivers 15:45:10.703 Service scanning 15:45:11.327 Service $sys$DRMServer C:\Windows\system32\$sys$filesystem\$sys$DRMServer.exe **INFECTED** Win32:Rootkit-gen [Rtk] 15:45:13.713 Service CD_Proxy C:\Windows\CDProxyServ.exe **INFECTED** Win32:Rootkit-gen [Rtk] 15:45:34.524 Modules scanning 15:45:41.466 Disk 0 trace - called modules: 15:45:41.513 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 15:45:41.513 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83eed568] 15:45:41.528 3 CLASSPNP.SYS[85bac8b3] -> nt!IofCallDriver -> [0x83360950] 15:45:41.528 5 acpi.sys[8069a6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8334ab98] 15:45:42.714 AVAST engine scan C:\Windows 15:45:42.948 File: C:\Windows\CDProxyServ.exe **INFECTED** Win32:Rootkit-gen [Rtk] 15:45:46.021 AVAST engine scan C:\Windows\system32 15:45:46.224 File: C:\Windows\system32\$sys$caj.dll **INFECTED** Win32:Rootkit-gen [Rtk] 15:45:46.286 File: C:\Windows\system32\$sys$upgtool.exe **INFECTED** Win32:Rootkit-gen [Rtk] 15:49:17.120 AVAST engine scan C:\Windows\system32\drivers 15:49:40.100 AVAST engine scan C:\Users\Mike 16:04:17.899 File: C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\26774810-11676934 **INFECTED** Win32:Alureon-GF [Rtk] 16:04:28.757 File: C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\e06415b-2d00e7b3 **INFECTED** Win32:MalOb-GY [Cryp] 16:04:34.311 File: C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\60cbe462-3b0c4324 **INFECTED** Win32:Malware-gen 16:04:58.881 File: C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\425101be-58b3ff47 **INFECTED** Win32:Malware-gen 16:05:01.080 File: C:\Users\Mike\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\43914a07-18cd3937 **INFECTED** Win32:MalOb-IJ [Cryp] 16:19:49.303 AVAST engine scan C:\ProgramData 16:23:05.849 Scan finished successfully 16:25:38.829 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat" 16:25:38.844 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-02 20:26:15 —————————– 20:26:15.801 OS Version: Windows 6.0.6002 Service Pack 2 20:26:15.801 Number of processors: 2 586 0xF0D 20:26:15.801 ComputerName: MIKE-PC UserName: Mike 20:27:01.429 Initialize success 20:27:16.835 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 20:27:16.835 Disk 0 Vendor: ST3500630AS 3.ADG Size: 476940MB BusType: 3 20:27:16.866 Disk 0 MBR read successfully 20:27:16.866 Disk 0 MBR scan 20:27:16.866 Disk 0 Windows VISTA default MBR code 20:27:16.866 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63 20:27:16.882 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304 20:27:16.898 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 466651 MB offset 21069824 20:27:16.913 Disk 0 scanning sectors +976771072 20:27:16.976 Disk 0 scanning C:\Windows\system32\drivers 20:27:24.647 Service scanning 20:27:38.997 Modules scanning 20:27:43.879 Disk 0 trace - called modules: 20:27:43.911 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 20:27:43.942 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84379ac8] 20:27:43.942 3 CLASSPNP.SYS[85b9e8b3] -> nt!IofCallDriver -> [0x83ce3858] 20:27:43.957 5 acpi.sys[8069c6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8334bb98] 20:27:43.973 Scan finished successfully 20:28:00.595 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat" 20:28:00.610 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-02 20:26:15 —————————– 20:26:15.801 OS Version: Windows 6.0.6002 Service Pack 2 20:26:15.801 Number of processors: 2 586 0xF0D 20:26:15.801 ComputerName: MIKE-PC UserName: Mike 20:27:01.429 Initialize success 20:27:16.835 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 20:27:16.835 Disk 0 Vendor: ST3500630AS 3.ADG Size: 476940MB BusType: 3 20:27:16.866 Disk 0 MBR read successfully 20:27:16.866 Disk 0 MBR scan 20:27:16.866 Disk 0 Windows VISTA default MBR code 20:27:16.866 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63 20:27:16.882 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304 20:27:16.898 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 466651 MB offset 21069824 20:27:16.913 Disk 0 scanning sectors +976771072 20:27:16.976 Disk 0 scanning C:\Windows\system32\drivers 20:27:24.647 Service scanning 20:27:38.997 Modules scanning 20:27:43.879 Disk 0 trace - called modules: 20:27:43.911 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 20:27:43.942 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84379ac8] 20:27:43.942 3 CLASSPNP.SYS[85b9e8b3] -> nt!IofCallDriver -> [0x83ce3858] 20:27:43.957 5 acpi.sys[8069c6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8334bb98] 20:27:43.973 Scan finished successfully 20:28:00.595 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat" 20:28:00.610 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt" 20:28:29.015 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat" 20:28:29.031 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-11 14:41:16 —————————– 14:41:16.055 OS Version: Windows 6.0.6002 Service Pack 2 14:41:16.055 Number of processors: 2 586 0xF0D 14:41:16.055 ComputerName: MIKE-PC UserName: Mike 14:41:18.114 Initialize success 14:41:28.566 AVAST engine defs: 12051100 14:41:33.807 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 14:41:33.807 Disk 0 Vendor: ST3500630AS 3.ADG Size: 476940MB BusType: 3 14:41:33.870 Disk 0 MBR read successfully 14:41:33.885 Disk 0 MBR scan 14:41:33.963 Disk 0 Windows VISTA default MBR code 14:41:33.979 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63 14:41:34.010 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304 14:41:34.026 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 466651 MB offset 21069824 14:41:34.057 Disk 0 scanning sectors +976771072 14:41:34.197 Disk 0 scanning C:\Windows\system32\drivers 14:42:11.202 Service scanning 14:42:35.818 Modules scanning 14:43:00.201 Disk 0 trace - called modules: 14:43:00.232 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 14:43:00.232 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84304ac8] 14:43:00.248 3 CLASSPNP.SYS[85b9f8b3] -> nt!IofCallDriver -> [0x83ce24c8] 14:43:00.248 5 acpi.sys[806936bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8334bb98] 14:43:01.621 AVAST engine scan C:\Windows 14:43:02.042 File: C:\Windows\CDProxyServ.exe **INFECTED** Win32:Rootkit-gen [Rtk] 14:43:52.588 AVAST engine scan C:\Windows\system32 14:48:19.756 AVAST engine scan C:\Windows\system32\drivers 14:48:59.273 AVAST engine scan C:\Users\Mike 14:55:12.381 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat" 14:55:12.427 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt" aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-18 11:54:11 —————————– 11:54:11.037 OS Version: Windows 6.0.6002 Service Pack 2 11:54:11.037 Number of processors: 2 586 0xF0D 11:54:11.052 ComputerName: MIKE-PC UserName: Mike 11:54:14.204 Initialize success 12:00:22.434 AVAST engine defs: 12051800 12:00:26.194 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 12:00:26.194 Disk 0 Vendor: ST3500630AS 3.ADG Size: 476940MB BusType: 3 12:00:26.225 Disk 0 MBR read successfully 12:00:26.225 Disk 0 MBR scan 12:00:26.240 Disk 0 Windows VISTA default MBR code 12:00:26.240 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63 12:00:26.256 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304 12:00:26.272 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 466651 MB offset 21069824 12:00:26.272 Disk 0 scanning sectors +976771072 12:00:26.459 Disk 0 scanning C:\Windows\system32\drivers 12:00:42.901 Service scanning 12:01:08.595 Modules scanning 12:01:15.771 Disk 0 trace - called modules: 12:01:15.787 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 12:01:15.787 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83eeeaa0] 12:01:15.803 3 CLASSPNP.SYS[85da38b3] -> nt!IofCallDriver -> [0x83cf6918] 12:01:15.818 5 acpi.sys[8069d6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8334bb98] 12:01:17.191 AVAST engine scan C:\Windows 12:01:22.479 AVAST engine scan C:\Windows\system32 12:04:40.008 AVAST engine scan C:\Windows\system32\drivers 12:05:16.761 AVAST engine scan C:\Users\Mike 12:35:16.478 AVAST engine scan C:\ProgramData 12:38:59.870 Scan finished successfully 12:39:12.992 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat" 12:39:13.023 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt" . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0 Run by [removed] at 17:33:50 on 2012-05-18 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1012.370 [GMT -4:00] . SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\wpcumi.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\AT&T\Internet Security Wizard\ISW.exe C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\ehome\ehmsas.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\Macromed\Flash\FlashUtil10x_ActiveX.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://att.my.yahoo.com/ uInternet Settings,ProxyServer = http= uInternet Settings,ProxyOverride = localhost;*.local BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [ECenter] c:\dell\e-center\EULALauncher.exe mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe" mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [ISW.exe] "c:\program files\at&t\internet security wizard\ISW.exe" /AUTORUN mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1 mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll LSP: c:\windows\system32\wpclsp.dll DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/RACtrl.cab TCP: DhcpNameServer = 192.168.1.254 192.168.1.254 TCP: Interfaces\{F54C3E81-F99F-4662-83F4-A99BF40508F0} : DhcpNameServer = 192.168.1.254 192.168.1.254 Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: igfxcui - igfxdev.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R0 $sys$cor;$sys$cor;c:\windows\system32\drivers\$sys$cor.sys [2004-10-6 18432] R1 $sys$crater;$sys$crater;c:\windows\system32\$sys$filesystem\crater.sys [2004-10-7 11904] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024] R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 587096] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-30 21504] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-30 136176] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-30 136176] . =============== Created Last 30 ================ . 2012-05-17 11:56:44 6734704 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{de8b5f7b-1355-4e7f-832a-7028400f895c}\mpengine.dll 2012-05-14 01:30:50 ——– d—–w- c:\users\mike\appdata\local\temp 2012-05-14 01:14:02 ——– d—–w- C:\$RECYCLE.BIN 2012-05-14 00:55:26 ——– d—–w- C:\ComboFix 2012-05-06 22:36:48 ——– d—–w- c:\users\mike\appdata\roaming\QuickScan 2012-05-05 03:24:27 772552 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-05-05 02:58:44 172032 —-a-w- c:\windows\system32\igfxres.dll 2012-05-05 02:21:10 ——– d—–w- c:\users\mike\appdata\roaming\Malwarebytes 2012-05-05 02:20:49 ——– d—–w- c:\programdata\Malwarebytes 2012-05-05 02:20:47 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-05-02 02:34:05 98816 —-a-w- c:\windows\sed.exe 2012-05-02 02:34:05 518144 —-a-w- c:\windows\SWREG.exe 2012-05-02 02:34:05 256000 —-a-w- c:\windows\PEV.exe 2012-05-02 02:34:05 208896 —-a-w- c:\windows\MBR.exe . ==================== Find3M ==================== . 2012-05-14 00:59:02 167936 —-a-w- c:\windows\CDProxyServ.exe 2012-05-06 15:02:28 687560 —-a-w- c:\windows\system32\deployJava1.dll 2012-05-02 23:37:16 90112 —-a-w- c:\windows\system32\$sys$caj.dll 2012-05-02 23:37:16 77824 —-a-w- c:\windows\system32\$sys$upgtool.exe 2012-03-17 23:07:10 979456 —-a-w- c:\windows\system32\MFH264Dec.dll 2012-02-23 14:18:36 237072 ——w- c:\windows\system32\MpSigStub.exe . ============= FINISH: 17:35:13.01 ===============

JonTom

Post #47May 21, 2012, 3:08 PM UTC

Hello michael81

Did you back up all of your data?

There is no need to post all of the previous aswMBR logs you have saved, just the latest one

The DDS log and the aswMBR log you have posted are both 3 days old.

Please post fresh logs so we know exactly what is happening with the machine.

Also (just to let you know) there are a number of "real life" things happening for me at the moment which require my immediate attention. You may be assisted by another member of our Malware Team during this time so you are not kept waiting.

Please post the new logs when you can.

michael81

Post #48May 23, 2012, 1:59 PM UTC

Thanks. I'll try to get new logs posted today.

michael81

Post #49May 23, 2012, 3:00 PM UTC

New logs:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.4.0
Run by [removed] at 10:52:54 on 2012-05-23
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1012.301 [GMT -4:00]
.
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AT&T\Internet Security Wizard\ISW.exe
C:\Program Files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\consent.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://att.my.yahoo.com/
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = localhost;*.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [ISW.exe] "c:\program files\at&t\internet security wizard\ISW.exe" /AUTORUN
mRun: [HelpCenter4.1] c:\program files\fastaccessdsl\helpcenter43\bin\sprtcmd.exe /P HelpCenter4.1
mRun: [Adobe_ID0EYTHM] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\windows\system32\wpclsp.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/RACtrl.cab
TCP: DhcpNameServer = 192.168.1.254 192.168.1.254
TCP: Interfaces\{F54C3E81-F99F-4662-83F4-A99BF40508F0} : DhcpNameServer = 192.168.1.254 192.168.1.254
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 $sys$cor;$sys$cor;c:\windows\system32\drivers\$sys$cor.sys [2004-10-6 18432]
R1 $sys$crater;$sys$crater;c:\windows\system32\$sys$filesystem\crater.sys [2004-10-7 11904]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2008-1-4 587096]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-30 21504]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-30 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-30 136176]
.
=============== Created Last 30 ================
.
2012-05-17 11:56:44 6734704 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{de8b5f7b-1355-4e7f-832a-7028400f895c}\mpengine.dll
2012-05-14 01:30:50 ——– d—–w- c:\users\mike\appdata\local\temp
2012-05-14 01:14:02 ——– d—–w- C:\$RECYCLE.BIN
2012-05-14 00:55:26 ——– d—–w- C:\ComboFix
2012-05-06 22:36:48 ——– d—–w- c:\users\mike\appdata\roaming\QuickScan
2012-05-05 03:24:27 772552 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-05-05 02:58:44 172032 —-a-w- c:\windows\system32\igfxres.dll
2012-05-05 02:21:10 ——– d—–w- c:\users\mike\appdata\roaming\Malwarebytes
2012-05-05 02:20:49 ——– d—–w- c:\programdata\Malwarebytes
2012-05-05 02:20:47 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-05-02 02:34:05 98816 —-a-w- c:\windows\sed.exe
2012-05-02 02:34:05 518144 —-a-w- c:\windows\SWREG.exe
2012-05-02 02:34:05 256000 —-a-w- c:\windows\PEV.exe
2012-05-02 02:34:05 208896 —-a-w- c:\windows\MBR.exe
.
==================== Find3M ====================
.
2012-05-14 00:59:02 167936 —-a-w- c:\windows\CDProxyServ.exe
2012-05-06 15:02:28 687560 —-a-w- c:\windows\system32\deployJava1.dll
2012-05-02 23:37:16 90112 —-a-w- c:\windows\system32\$sys$caj.dll
2012-05-02 23:37:16 77824 —-a-w- c:\windows\system32\$sys$upgtool.exe
2012-03-17 23:07:10 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
.
============= FINISH: 10:54:15.45 ===============

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-05-23 10:01:00
—————————–
10:01:00.818 OS Version: Windows 6.0.6002 Service Pack 2
10:01:00.818 Number of processors: 2 586 0xF0D
10:01:00.818 ComputerName: MIKE-PC UserName: Mike
10:01:03.189 Initialize success
10:07:11.002 AVAST engine defs: 12051401
10:08:10.516 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
10:08:10.516 Disk 0 Vendor: ST3500630AS 3.ADG Size: 476940MB BusType: 3
10:08:10.532 Disk 0 MBR read successfully
10:08:10.548 Disk 0 MBR scan
10:08:10.610 Disk 0 Windows VISTA default MBR code
10:08:10.610 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
10:08:10.641 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304
10:08:10.641 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 466651 MB offset 21069824
10:08:10.657 Disk 0 scanning sectors +976771072
10:08:10.766 Disk 0 scanning C:\Windows\system32\drivers
10:08:23.776 Service scanning
10:08:49.672 Modules scanning
10:08:55.725 Disk 0 trace - called modules:
10:08:56.240 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
10:08:56.256 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83ee5ac8]
10:08:56.256 3 CLASSPNP.SYS[85daa8b3] -> nt!IofCallDriver -> [0x83368a70]
10:08:56.271 5 acpi.sys[8069c6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x83d40820]
10:08:57.706 AVAST engine scan C:\Windows
10:09:02.012 AVAST engine scan C:\Windows\system32
10:12:20.
730 AVAST engine scan C:\Windows\system32\drivers
10:12:41.634 AVAST engine scan C:\Users\Mike
10:47:05.876 AVAST engine scan C:\ProgramData
10:50:31.062 Scan finished successfully
10:51:43.601 Disk 0 MBR has been saved successfully to "C:\Users\Mike\Desktop\MBR.dat"
10:51:43.632 The log file has been saved successfully to "C:\Users\Mike\Desktop\aswMBR.txt"

JonTom

Post #50May 24, 2012, 2:57 PM UTC

Hello michael81

Thank you for the logs.

Whilst I am aware that you are still having problems with your system your latest logs appear to be malware free.

Under these circumstances (and given the approaches we have already undertaken) there are a limited number of things we can try which may or may not resolve the problem.

Lets run Combofix one more time and check your System Event Viewer.

Please drag the copy of Combofix that is on your desktop to the recycle bin then empty the bin.

Once you have done that, download an updated copy from here , disable all of your security programs and run it.

Event Viewer by Vino Rosso
Please download VEW by Vino Rosso and save it to your desktop.
Double click it to start it Note: If running Windows Vista or Windows 7 you will need to right click the file and select Run as administrator and click Continue or Allow at the User Account Control Prompt.
Click the check boxes next to Application and System located under Select log to query on the upper left.
Under Select type to list on the right click the boxes next to Error and Warning Note: If running Windows Vista or Windows 7 also click the box next to Critical (not XP).
Under Number or date of events select Number of events and type 20 in the box next to 1 to 20 and click Run.
Once it finishes it will display a log file in notepad
Please copy and paste its entire contents into your next reply

Please post the Combofix log and the event viewer log in your next reply.

michael81

Post #51May 24, 2012, 5:17 PM UTC

ComboFix 12-05-24.02 - Mike 05/24/2012 12:42:35.5.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1012.326 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-04-24 to 2012-05-24 )))))))))))))))))))))))))))))))
.
.
2012-05-24 16:58 . 2012-05-24 16:58 ——– d—–w- c:\users\wooten\AppData\Local\temp
2012-05-24 16:58 . 2012-05-24 16:58 ——– d—–w- c:\users\wooten.Mike-PC\AppData\Local\temp
2012-05-24 16:58 . 2012-05-24 16:58 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-23 15:21 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{81EE3E95-95E7-4B64-9DC1-640705E1548C}\mpengine.dll
2012-05-14 01:30 . 2012-05-24 16:58 ——– d—–w- c:\users\Mike\AppData\Local\temp
2012-05-06 22:36 . 2012-05-06 22:36 ——– d—–w- c:\users\Mike\AppData\Roaming\QuickScan
2012-05-05 03:24 . 2012-05-06 15:02 772552 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-05-05 02:58 . 2008-01-02 21:33 172032 —-a-w- c:\windows\system32\igfxres.dll
2012-05-05 02:21 . 2012-05-05 02:21 ——– d—–w- c:\users\Mike\AppData\Roaming\Malwarebytes
2012-05-05 02:20 . 2012-05-05 02:20 ——– d—–w- c:\programdata\Malwarebytes
2012-05-05 02:20 . 2012-04-04 19:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-06 15:02 . 2012-04-10 11:50 687560 —-a-w- c:\windows\system32\deployJava1.dll
2012-03-17 23:08 . 2012-03-17 23:08 161792 —-a-w- c:\windows\system32\msls31.dll
2012-03-17 23:08 . 2012-03-17 23:08 1127424 —-a-w- c:\windows\system32\wininet.dll
2012-03-17 23:08 . 2012-03-17 23:08 86528 —-a-w- c:\windows\system32\iesysprep.dll
2012-03-17 23:08 . 2012-03-17 23:08 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-17 23:08 . 2012-03-17 23:08 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-17 23:08 . 2012-03-17 23:08 63488 —-a-w- c:\windows\system32\tdc.ocx
2012-03-17 23:08 . 2012-03-17 23:08 48640 —-a-w- c:\windows\system32\mshtmler.dll
2012-03-17 23:08 . 2012-03-17 23:08 74752 —-a-w- c:\windows\system32\iesetup.dll
2012-03-17 23:08 . 2012-03-17 23:08 367104 —-a-w- c:\windows\system32\html.iec
2012-03-17 23:08 . 2012-03-17 23:08 23552 —-a-w- c:\windows\system32\licmgr10.dll
2012-03-17 23:08 . 2012-03-17 23:08 152064 —-a-w- c:\windows\system32\wextract.exe
2012-03-17 23:08 . 2012-03-17 23:08 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2012-03-17 23:08 . 2012-03-17 23:08 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-03-17 23:08 . 2012-03-17 23:08 150528 —-a-w- c:\windows\system32\iexpress.exe
2012-03-17 23:08 . 2012-03-17 23:08 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-03-17 23:08 . 2012-03-17 23:08 35840 —-a-w- c:\windows\system32\imgutil.dll
2012-03-17 23:08 . 2012-03-17 23:08 1798656 —-a-w- c:\windows\system32\jscript9.dll
2012-03-17 23:08 . 2012-03-17 23:08 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-03-17 23:08 . 2012-03-17 23:08 11776 —-a-w- c:\windows\system32\mshta.exe
2012-03-17 23:08 . 2012-03-17 23:08 101888 —-a-w- c:\windows\system32\admparse.dll
2012-03-17 23:08 . 2012-03-17 23:08 110592 —-a-w- c:\windows\system32\IEAdvpack.dll
2012-03-17 23:07 . 2012-03-17 23:07 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
2012-03-17 23:07 . 2012-03-17 23:07 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll
2012-03-17 23:07 . 2012-03-17 23:07 302592 —-a-w- c:\windows\system32\mfmp4src.dll
2012-03-17 23:07 . 2012-03-17 23:07 261632 —-a-w- c:\windows\system32\mfreadwrite.dll
2012-03-17 23:07 . 2012-03-17 23:07 2873344 —-a-w- c:\windows\system32\mf.dll
2012-03-17 23:07 . 2012-03-17 23:07 98816 —-a-w- c:\windows\system32\mfps.dll
2012-03-17 23:07 . 2012-03-17 23:07 586240 —-a-w- c:\windows\system32\stobject.dll
2012-03-17 23:07 . 2012-03-17 23:07 209920 —-a-w- c:\windows\system32\mfplat.dll
2012-03-17 23:07 . 2012-03-17 23:07 797184 —-a-w- c:\windows\system32\FntCache.dll
2012-03-17 23:07 . 2012-03-17 23:07 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-03-17 23:07 . 2012-03-17 23:07 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2012-03-17 23:07 . 2012-03-17 23:07 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2012-03-17 23:07 . 2012-03-17 23:07 1068544 —-a-w- c:\windows\system32\DWrite.dll
2012-03-17 23:07 . 2012-03-17 23:07 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2012-03-17 23:07 . 2012-03-17 23:07 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-03-17 23:07 . 2012-03-17 23:07 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-03-17 23:07 . 2012-03-17 23:07 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-03-17 23:07 . 2012-03-17 23:07 638336 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-03-17 23:07 . 2012-03-17 23:07 478720 —-a-w- c:\windows\system32\dxgi.dll
2012-03-17 23:07 . 2012-03-17 23:07 189952 —-a-w- c:\windows\system32\d3d10core.dll
2012-03-17 23:07 . 2012-03-17 23:07 1029120 —-a-w- c:\windows\system32\d3d10.dll
2012-03-17 23:07 . 2012-03-17 23:07 37376 —-a-w- c:\windows\system32\cdd.dll
2012-03-17 23:07 . 2012-03-17 23:07 847360 —-a-w- c:\windows\system32\OpcServices.dll
2012-03-17 23:07 . 2012-03-17 23:07 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-03-17 23:07 . 2012-03-17 23:07 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-03-17 23:07 . 2012-03-17 23:07 258048 —-a-w- c:\windows\system32\winspool.drv
2012-03-17 23:07 . 2012-03-17 23:07 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2012-03-17 23:07 . 2012-03-17 23:07 876032 —-a-w- c:\windows\system32\XpsPrint.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-25 17920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-11 4452352]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-11-16 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3526811434-3959650205-2272629206-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3526811434-3959650205-2272629206-1001]
"EnableNotificationsRef"=dword:00000001
.
S0 $sys$cor;$sys$cor;c:\windows\System32\Drivers\$sys$cor.sys [2005-07-04 18432]
S1 $sys$crater;$sys$crater;c:\windows\system32\$sys$filesystem\crater.sys [2005-07-04 11904]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-01 03:13]
.
2012-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-01 03:13]
.
2012-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3526811434-3959650205-2272629206-1000Core.job
- c:\users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 14:35]
.
2012-05-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3526811434-3959650205-2272629206-1000UA.job
- c:\users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 14:35]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://att.my.yahoo.com/
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = localhost;*.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.1.254 192.168.1.254
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-24 12:58
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-05-24 13:06:42
ComboFix-quarantined-files.txt 2012-05-24 17:06
ComboFix2.txt 2012-05-12 14:40
ComboFix3.txt 2012-05-03 00:08
ComboFix4.txt 2012-05-02 03:11
.
Pre-Run: 317,568,659,456 bytes free
Post-Run: 316,634,415,104 bytes free
.
- - End Of File - - 2D26D51E825365C4C2DFD67FB6A4D435

Vino's Event Viewer v01c run on Windows Vista in English
Report run at 24/05/2012 1:13:00 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 23/05/2012 5:44:55 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application WINWORD.EXE, version 11.0.8326.0, time stamp 0x4c1c23b8, faulting module mso.dll, version 11.0.8324.0, time stamp 0x4bc960ac, exception code 0xc0000005, fault offset 0x0054d20d, process id 0xac, application start time 0x01cd390ac8e2fb65.

Log: 'Application' Date/Time: 20/05/2012 11:38:59 PM
Type: Error Category: 100
Event: 1000 Source: Application Error
Faulting application SearchIndexer.exe, version 7.0.6002.18005, time stamp 0x49e02459, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception code 0xc0000005, fault offset 0x0003e13d, process id 0x504, application start time 0x01cd36c31120dc52.

Log: 'Application' Date/Time: 18/05/2012 4:46:06 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program bcont.exe version 6.9.2018.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: f8c Start Time: 01cd34b0c112bca6 Termination Time: 16

Log: 'Application' Date/Time: 16/05/2012 2:48:46 AM
Type: Error Category: 101
Event: 1002 Source: Application HangThe program iexplore.exe version 9.0.8112.16421 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: eb0 Start Time: 01cd330e5eaf3484 Termination Time: 31

Log: 'Application' Date/Time: 14/05/2012 2:06:52 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: d20 Start Time: 01cd31762ae49c11 Termination Time: 78

Log: 'Application' Date/Time: 14/05/2012 2:06:25 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 7d4 Start Time: 01cd31751e4b68e1 Termination Time: 0

Log: 'Application' Date/Time: 14/05/2012 1:49:56 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: f38 Start Time: 01cd3173af2e5b81 Termination Time: 0

Log: 'Application' Date/Time: 14/05/2012 1:48:39 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 720 Start Time: 01cd317376a92e21 Termination Time: 0

Log: 'Application' Date/Time: 14/05/2012 1:47:04 AM
Type: Error Category: 101
Event: 1002 Source: Application Hang
The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 7a4 Start Time: 01cd31730b3d64d1 Termination Time: 0

Log: 'Application' Date/Time: 14/05/2012 12:17:46 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 19485

Log: 'Application' Date/Time: 14/05/2012 12:17:46 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 19485

Log: 'Application' Date/Time: 14/05/2012 12:17:46 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 14/05/2012 12:17:45 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 18471

Log: 'Application' Date/Time: 14/05/2012 12:17:45 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 18471

Log: 'Application' Date/Time: 14/05/2012 12:17:45 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 14/05/2012 12:17:44 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 17473

Log: 'Application' Date/Time: 14/05/2012 12:17:44 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 17473

Log: 'Application' Date/Time: 14/05/2012 12:17:44 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: Continuously busy for more than a second

Log: 'Application' Date/Time: 14/05/2012 12:17:43 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledSPRetry 16459

Log: 'Application' Date/Time: 14/05/2012 12:17:43 AM
Type: Error Category: 0
Event: 100 Source: Bonjour Service
Task Scheduling Error: m->NextScheduledEvent 16459

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 24/05/2012 4:52:45 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 3:58:45 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 3:35:51 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 3:09:01 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 2:28:46 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 1:40:51 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 12:45:25 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 2:16:00 AM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 1:54:13 AM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 1:19:25 AM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 12:48:30 AM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 12:10:43 AM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 24/05/2012 12:00:42 AM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 23/05/2012 10:32:25 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 23/05/2012 9:37:07 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 23/05/2012 8:40:42 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 23/05/2012 5:04:27 PM
Type: Warning Category: 0
Event: 1530 Source: Microsoft-Windows-User Profiles Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 11 user registry handles leaked from \Registry\User\S-1-5-21-3526811434-3959650205-2272629206-1000:
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Policies\Microsoft\SystemCertificates
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Policies\Microsoft\SystemCertificates
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Microsoft\SystemCertificates\Root
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Microsoft\SystemCertificates\My
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Microsoft\SystemCertificates\CA
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Microsoft\SystemCertificates\Disallowed
Process 1020 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3526811434-3959650205-2272629206-1000\Software\Microsoft\SystemCertificates\trust

Log: 'Application' Date/Time: 23/05/2012 4:03:37 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 23/05/2012 2:18:13 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

Log: 'Application' Date/Time: 23/05/2012 12:44:33 PM
Type: Warning Category: 0
Event: 4006 Source: Microsoft-Windows-Winlogon
The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Users\Mike\Desktop\dds.scr /s.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Critical Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 19/04/2012 8:13:20 PM
Type: Critical Category: 0
Event: 41 Source: Microsoft-Windows-Kernel-Power
The last sleep transition was unsuccessful. This error could be caused if the system stopped responding, failed, or lost power during the sleep transition.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 24/05/2012 4:58:30 PM
Type: Error Category: 0
Event: 7030 Source: Service Control Manager
The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Log: 'System' Date/Time: 24/05/2012 4:53:33 PM
Type: Error Category: 0
Event: 7030 Source: Service Control Manager
The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Log: 'System' Date/Time: 24/05/2012 4:41:17 PM
Type: Error Category: 0
Event: 7030 Source: Service Control Manager
The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Log: 'System' Date/Time: 24/05/2012 4:25:28 PM
Type: Error Category: 0
Event: 7034 Source: Service Control Manager
The XAudioService service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 24/05/2012 12:13:47 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 24/05/2012 2:45:09 AM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 23/05/2012 5:24:03 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 23/05/2012 5:04:35 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 23/05/2012 11:52:32 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 23/05/2012 12:27:14 AM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 22/05/2012 11:05:19 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 22/05/2012 10:17:55 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 22/05/2012 8:24:17 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 22/05/2012 6:17:32 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 22/05/2012 10:36:13 AM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 22/05/2012 12:03:03 AM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 21/05/2012 6:59:44 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 21/05/2012 5:53:10 PM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 21/05/2012 12:34:51 PM
Type: Error Category: 0
Event: 7000 Source: Service Control Manager
The adfs service failed to start due to the following error: The system cannot find the file specified.

Log: 'System' Date/Time: 21/05/2012 2:48:37 AM
Type: Error Category: 0
Event: 10010 Source: Microsoft-Windows-DistributedCOM
The server {C2BFE331-6739-4270-86C9-493D9A04CD38} did not register with DCOM within the required timeout.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - Warning Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 18/05/2012 4:46:19 AM
Type: Warning Category: 0
Event: 27 Source: e1express
Intel® 82562V-2 10/100 Network Connection Link has been disconnected.

Log: 'System' Date/Time: 12/05/2012 3:56:40 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:40 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:40 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:40 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:39 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:56:37 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:55:49 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:55:48 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:55:48 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 12/05/2012 3:55:47 PM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 05/05/2012 2:11:38 AM
Type: Warning Category: 0
Event: 51 Source: cdrom
An error was detected on device \Device\CdRom0 during a paging operation.

Log: 'System' Date/Time: 03/05/2012 12:27:11 AM
Type: Warning Category: 0
Event: 3004 Source: Microsoft-Windows-Windows Defender
Windows Defender Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows Defender can't undo changes that you allow. For more information please see the following: Not Applicable Scan ID: {4ED36A59-457F-458B-8164-28F2046D85C9} User: Mike-PC\Mike Name: Unknown ID: Severity ID: Category ID: Path Found: regkey:HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\aswMBR;file:C:\Users\Mike\AppData\Local\Temp\aswMBR.sys Alert Type: Unclassified software Detection Type:

Log: 'System' Date/Time: 02/05/2012 4:03:45 AM
Type: Warning Category: 0
Event: 1002 Source: Microsoft-Windows-Windows Defender
Windows Defender scan has been stopped before completion. Scan ID: {46B84BB1-3D68-41DB-BA8F-B4F66625F583} Scan Type: AntiSpyware Scan Parameters: Quick Scan User: Mike-PC\Mike

CatByte

Post #52May 25, 2012, 1:37 AM UTC last edited May 25, 2012, 1:42 AM UTC

Hi,

I'm going to assist while JT is away,

Please run the following:

Note: Please allow combofix to update if it asks to do so

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

DDS::
uInternet Settings,ProxyServer = http=
uInternet Settings,ProxyOverride = localhost;*.local

Driver::
$sys$cor
$sys$crater

File::
c:\windows\system32\drivers\$sys$cor.sys
c:\windows\system32\$sys$filesystem\crater.sys
c:\windows\system32\$sys$caj.dll
c:\windows\system32\$sys$upgtool.exe


Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix may request an update; please allow it.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

michael81

Post #53May 25, 2012, 4:51 PM UTC

Hello, CatByte. Thank you for your help. Here's the ComboFix log:

ComboFix 12-05-25.02 - Mike 05/25/2012 12:19:06.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1012.417 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Mike\Desktop\CFScript
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\$sys$caj.dll"
"c:\windows\system32\$sys$filesystem\crater.sys"
"c:\windows\system32\$sys$upgtool.exe"
"c:\windows\system32\drivers\$sys$cor.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_$SYS$COR
——-\Service_$sys$cor
——-\Service_$sys$crater
.
.
((((((((((((((((((((((((( Files Created from 2012-04-25 to 2012-05-25 )))))))))))))))))))))))))))))))
.
.
2012-05-25 16:30 . 2012-05-25 16:30 ——– d—–w- c:\users\wooten\AppData\Local\temp
2012-05-25 16:30 . 2012-05-25 16:30 ——– d—–w- c:\users\wooten.Mike-PC\AppData\Local\temp
2012-05-25 16:30 . 2012-05-25 16:30 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-23 15:21 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{81EE3E95-95E7-4B64-9DC1-640705E1548C}\mpengine.dll
2012-05-14 01:30 . 2012-05-25 16:36 ——– d—–w- c:\users\Mike\AppData\Local\temp
2012-05-06 22:36 . 2012-05-06 22:36 ——– d—–w- c:\users\Mike\AppData\Roaming\QuickScan
2012-05-05 03:24 . 2012-05-06 15:02 772552 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-05-05 02:58 . 2008-01-02 21:33 172032 —-a-w- c:\windows\system32\igfxres.dll
2012-05-05 02:21 . 2012-05-05 02:21 ——– d—–w- c:\users\Mike\AppData\Roaming\Malwarebytes
2012-05-05 02:20 . 2012-05-05 02:20 ——– d—–w- c:\programdata\Malwarebytes
2012-05-05 02:20 . 2012-04-04 19:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-06 15:02 . 2012-04-10 11:50 687560 —-a-w- c:\windows\system32\deployJava1.dll
2012-03-17 23:08 . 2012-03-17 23:08 161792 —-a-w- c:\windows\system32\msls31.dll
2012-03-17 23:08 . 2012-03-17 23:08 1127424 —-a-w- c:\windows\system32\wininet.dll
2012-03-17 23:08 . 2012-03-17 23:08 86528 —-a-w- c:\windows\system32\iesysprep.dll
2012-03-17 23:08 . 2012-03-17 23:08 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-17 23:08 . 2012-03-17 23:08 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-17 23:08 . 2012-03-17 23:08 63488 —-a-w- c:\windows\system32\tdc.ocx
2012-03-17 23:08 . 2012-03-17 23:08 48640 —-a-w- c:\windows\system32\mshtmler.dll
2012-03-17 23:08 . 2012-03-17 23:08 74752 —-a-w- c:\windows\system32\iesetup.dll
2012-03-17 23:08 . 2012-03-17 23:08 367104 —-a-w- c:\windows\system32\html.iec
2012-03-17 23:08 . 2012-03-17 23:08 23552 —-a-w- c:\windows\system32\licmgr10.dll
2012-03-17 23:08 . 2012-03-17 23:08 152064 —-a-w- c:\windows\system32\wextract.exe
2012-03-17 23:08 . 2012-03-17 23:08 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2012-03-17 23:08 . 2012-03-17 23:08 420864 —-a-w- c:\windows\system32\vbscript.dll
2012-03-17 23:08 . 2012-03-17 23:08 150528 —-a-w- c:\windows\system32\iexpress.exe
2012-03-17 23:08 . 2012-03-17 23:08 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-03-17 23:08 . 2012-03-17 23:08 35840 —-a-w- c:\windows\system32\imgutil.dll
2012-03-17 23:08 . 2012-03-17 23:08 1798656 —-a-w- c:\windows\system32\jscript9.dll
2012-03-17 23:08 . 2012-03-17 23:08 142848 —-a-w- c:\windows\system32\ieUnatt.exe
2012-03-17 23:08 . 2012-03-17 23:08 11776 —-a-w- c:\windows\system32\mshta.exe
2012-03-17 23:08 . 2012-03-17 23:08 101888 —-a-w- c:\windows\system32\admparse.dll
2012-03-17 23:08 . 2012-03-17 23:08 110592 —-a-w- c:\windows\system32\IEAdvpack.dll
2012-03-17 23:07 . 2012-03-17 23:07 979456 —-a-w- c:\windows\system32\MFH264Dec.dll
2012-03-17 23:07 . 2012-03-17 23:07 357376 —-a-w- c:\windows\system32\MFHEAACdec.dll
2012-03-17 23:07 . 2012-03-17 23:07 302592 —-a-w- c:\windows\system32\mfmp4src.dll
2012-03-17 23:07 . 2012-03-17 23:07 261632 —-a-w- c:\windows\system32\mfreadwrite.dll
2012-03-17 23:07 . 2012-03-17 23:07 2873344 —-a-w- c:\windows\system32\mf.dll
2012-03-17 23:07 . 2012-03-17 23:07 98816 —-a-w- c:\windows\system32\mfps.dll
2012-03-17 23:07 . 2012-03-17 23:07 586240 —-a-w- c:\windows\system32\stobject.dll
2012-03-17 23:07 . 2012-03-17 23:07 209920 —-a-w- c:\windows\system32\mfplat.dll
2012-03-17 23:07 . 2012-03-17 23:07 797184 —-a-w- c:\windows\system32\FntCache.dll
2012-03-17 23:07 . 2012-03-17 23:07 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-03-17 23:07 . 2012-03-17 23:07 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2012-03-17 23:07 . 2012-03-17 23:07 135680 —-a-w- c:\windows\system32\XpsRasterService.dll
2012-03-17 23:07 . 2012-03-17 23:07 1068544 —-a-w- c:\windows\system32\DWrite.dll
2012-03-17 23:07 . 2012-03-17 23:07 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2012-03-17 23:07 . 2012-03-17 23:07 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-03-17 23:07 . 2012-03-17 23:07 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-03-17 23:07 . 2012-03-17 23:07 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-03-17 23:07 . 2012-03-17 23:07 638336 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-03-17 23:07 . 2012-03-17 23:07 478720 —-a-w- c:\windows\system32\dxgi.dll
2012-03-17 23:07 . 2012-03-17 23:07 189952 —-a-w- c:\windows\system32\d3d10core.dll
2012-03-17 23:07 . 2012-03-17 23:07 1029120 —-a-w- c:\windows\system32\d3d10.dll
2012-03-17 23:07 . 2012-03-17 23:07 37376 —-a-w- c:\windows\system32\cdd.dll
2012-03-17 23:07 . 2012-03-17 23:07 847360 —-a-w- c:\windows\system32\OpcServices.dll
2012-03-17 23:07 . 2012-03-17 23:07 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe
2012-03-17 23:07 . 2012-03-17 23:07 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll
2012-03-17 23:07 . 2012-03-17 23:07 258048 —-a-w- c:\windows\system32\winspool.drv
2012-03-17 23:07 . 2012-03-17 23:07 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2012-03-17 23:07 . 2012-03-17 23:07 876032 —-a-w- c:\windows\system32\XpsPrint.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-25 17920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-11 4452352]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]
"HelpCenter4.1"="c:\program files\FastAccessDSL\HelpCenter43\bin\sprtcmd.exe" [2007-04-13 198184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-11-16 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3526811434-3959650205-2272629206-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3526811434-3959650205-2272629206-1001]
"EnableNotificationsRef"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-01 03:13]
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-01 03:13]
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3526811434-3959650205-2272629206-1000Core.job
- c:\users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 14:35]
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3526811434-3959650205-2272629206-1000UA.job
- c:\users\Mike\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-04 14:35]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://att.my.yahoo.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.1.254 192.168.1.254
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-25 12:35
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\WerCon.exe
.
**************************************************************************
.
Completion time: 2012-05-25 12:47:09 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-25 16:45
ComboFix2.txt 2012-05-24 17:06
ComboFix3.txt 2012-05-12 14:40
ComboFix4.txt 2012-05-03 00:08
ComboFix5.txt 2012-05-25 16:15
.
Pre-Run: 317,446,295,552 bytes free
Post-Run: 317,639,434,240 bytes free
.
- - End Of File - - E617C94CD26616743A5F38E92D51F205

CatByte

Post #54May 25, 2012, 6:10 PM UTC

hi The log looks good Please advise how the computer is running now and if there are any outstanding issues (please describe in as much detail as possible) thanks

michael81

Post #55May 25, 2012, 7:15 PM UTC

The machine seems to be running more smoothly with no obvious "double-click" issues at this point. (Although the double-click has appeared to come and go in the past.) Hopefully, your fix has kicked it! Thanks very much for all of your help.

CatByte

Post #56May 25, 2012, 8:41 PM UTC

Hi

That's good to hear, We just some housekeeping to do now,

Please do the following:

You can delete the TDSSKiller, DDS, SystemLook, VEW and aswMBR logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

michael81

Post #57May 26, 2012, 6:45 PM UTC

Maybe I spoke too soon: I am having a little trouble with double-clicks again this morning. Not as bad as before,but still noticeable. Should I go ahead with the procedures you outlined in your last post?

CatByte

Post #58May 26, 2012, 6:47 PM UTC

yes,clean it up. I'm not sure I really understand what you are referring to exactly? Can you describe in a little more detail as to what exactly happens, as whatever is remaining, doesn't appear to be malware related.

michael81

Post #59May 26, 2012, 11:30 PM UTC

Here's the major symptom: when I left click using my mouse, the machine seems to register two clicks instead of one. For example, if I'm on the web and click the back button, my browser will jump back two pages instead of one. Or, if I'm typing a document in Word and try to highlight a section text, it is as if I'm doing nothing (because the machine is reading two mouse clicks instead of one). The problem isn't constant but it is consistent. I would say 7 or 8 times out of 10 the problem occurs. After I followed your last set of instructions yesterday, the problem seemed to be gone. But today, it has reappeared, although not as seriously as before.

CatByte

Post #60May 27, 2012, 12:14 AM UTC

what type of mouse do you use? Please go into Device Manager and scroll down to Mice and Other pointing devices > right click your installed mouse driver and uninstall it > reboot and allow Windows to reinstall the driver Do you use a mouse pad? Try giving it a clean, if it is a USB mouse, replace the batteries.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Double Click Virus [Closed]

✨ Ask AI

Ask AI