HiOriginal Thread
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:39:17, on 28/11/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16455)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Users\Dan\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\Dan\Downloads\HiJackThis.exe
C:\Windows\system32\DllHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0912&m=aspire_7730
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0912&m=aspire_7730
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0912&m=aspire_7730
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
–
End of file - 6288 bytes
Hi manicd,
My name is
NoodleTech . I would be glad to look into this problem for you. It may or may not be malware related.
Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer. The fixes are specific to your problem and should only be used for the issues on this machine. Do not delete anything unless instructed to. DO NOT use tools such as ComboFix without supervision. Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.===================================================
Please download DDS by sUBs from one of the following links and save it to your desktop.
Disable any script blocking protection (How to Disable your Security Programs ) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. —————————————————
Post DDS.txt report in your next replyAttach Attach.txt Attachments area and then clicking Browse . Browse to where you saved the file, and click Open and then click UPLOAD .===================================================
Please download aswMBR.exe and save it to your desktop.
Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
Click
Scan
Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet. You will also notice another file created on the desktop named MBR.dat . Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.
manicd,
My pleasure!
Please do the following
Refer to the
ComboFix User's Guide Download ComboFix from one of these locations:Link 1 Link 2 * IMPORTANT !!! Place ComboFix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.here Double click on ComboFix.exe & follow the prompts. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next replyNote: Ensure your AntiVirus and AntiSpyware applications are re-enabled. NOTE: If you encounter a message
"illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.
Hi Noodletech, sorry for the late reply. Here is my log as requested. I had to reboot twice after windows failed start up after the first time after running comb-fix.
ComboFix 12-12-20.02 - Dan 21/12/2012 23:34:51.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.44.1033.18.3000.1790 [GMT 0:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Infected copy of c:\windows\system32\drivers\ntfs.sys was found and disinfected
Restored copy from - c:\windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6002.18005_none_a85ca2c91a0d64df\ntfs.sys
.
.
((((((((((((((((((((((((( Files Created from 2012-11-22 to 2012-12-22 )))))))))))))))))))))))))))))))
.
.
2012-12-21 20:00 . 2012-12-16 13:12 34304 —-a-w- c:\windows\system32\atmlib.dll
2012-12-21 20:00 . 2012-12-16 10:50 293376 —-a-w- c:\windows\system32\atmfd.dll
2012-12-16 01:59 . 2012-12-16 01:59 ——– d—–w- c:\program files\uTorrent
2012-12-16 01:58 . 2012-12-18 00:09 ——– d—–w- c:\users\Dan\AppData\Roaming\uTorrent
2012-12-12 20:50 . 2012-12-12 20:50 ——– d—–w- c:\program files\iPod
2012-12-12 20:49 . 2012-12-12 20:51 ——– d—–w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2012-12-12 20:49 . 2012-12-12 20:51 ——– d—–w- c:\program files\iTunes
2012-12-12 20:06 . 2012-11-14 02:01 678912 —-a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-12-12 20:06 . 2012-11-14 01:58 1427968 —-a-w- c:\windows\system32\inetcpl.cpl
2012-12-12 20:03 . 2012-07-26 02:46 9728 —-a-w- c:\windows\system32\Wdfres.dll
2012-12-12 20:03 . 2012-07-26 02:33 66560 —-a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-12 20:03 . 2012-07-26 02:32 155136 —-a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-12 20:03 . 2012-07-26 03:20 73216 —-a-w- c:\windows\system32\WUDFSvc.dll
2012-12-12 20:03 . 2012-07-26 03:20 172032 —-a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-12 20:03 . 2009-07-14 12:12 16896 —-a-w- c:\windows\system32\winusb.dll
2012-12-12 20:03 . 2012-07-26 03:39 526952 —-a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-12 20:03 . 2012-07-26 03:39 47720 —-a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-12 20:03 . 2012-07-26 03:21 196608 —-a-w- c:\windows\system32\WUDFHost.exe
2012-12-12 20:03 . 2012-07-26 03:20 38912 —-a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-12 20:03 . 2012-07-26 03:20 613888 —-a-w- c:\windows\system32\WUDFx.dll
2012-12-12 07:29 . 2012-11-13 01:36 2048000 —-a-w- c:\windows\system32\win32k.sys
2012-12-12 07:29 . 2012-11-02 10:18 376320 —-a-w- c:\windows\system32\dpnet.dll
2012-12-12 07:29 . 2012-11-02 08:26 23040 —-a-w- c:\windows\system32\dpnsvr.exe
2012-12-12 07:29 . 2012-08-21 11:47 224640 —-a-w- c:\windows\system32\drivers\volsnap.sys
2012-12-12 07:29 . 2012-11-13 01:29 2048 —-a-w- c:\windows\system32\tzres.dll
2012-11-30 16:31 . 2012-11-30 16:31 ——– d—–w- c:\users\Dan\AppData\Roaming\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 19:57 . 2012-09-03 22:22 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-12 19:57 . 2012-09-03 22:22 697272 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-16 21:39 . 2012-11-16 21:39 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-16 21:38 . 2012-09-29 22:08 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-11-16 21:38 . 2012-09-29 22:08 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-09-30 01:28 . 2012-09-30 01:28 0 —-a-w- c:\windows\system32\FAP55A8.tmp
2012-09-29 19:08 . 2012-09-28 16:59 416 —-a-w- c:\programdata\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2012-09-29 18:54 . 2012-09-26 18:57 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-09-28 17:03 . 2012-09-28 17:03 348256 —-a-w- c:\programdata\Microsoft\VSTAHost\Architecture2011\9.0\1033\ResourceCache.dll
2012-09-28 10:32 . 2012-09-28 10:32 5989776 —-a-w- c:\windows\system32\usbaaplrc.dll
2012-09-28 10:32 . 2012-09-28 10:32 44544 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2012-09-25 16:19 . 2012-11-14 19:37 75776 —-a-w- c:\windows\system32\synceng.dll
2012-12-05 22:59 . 2012-12-05 22:59 262112 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-28 6111232]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-02 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-02 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-02 145944]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 3080264]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-11-29 151952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2012-11-28 14:13 59280 —-a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-11-29 00:49 151952 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R3 A310;AVerMedia A310 DVB-T;c:\windows\system32\DRIVERS\AVerA310USB.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-03 19:57]
.
2012-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-02 01:50]
.
2012-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-02 01:50]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0912&m=aspire_7730
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\12qnr5r4.default\
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-11-11 01:13; {3d7eb24f-2740-49df-8937-200b1cc08f8a}; c:\users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\12qnr5r4.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-eRecoveryService - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-AVerMedia A310 (MiniCard, DVB-T) - c:\program files\AVerMedia\AVerMedia A310 (MiniCard
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-22 00:05
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
———————— Other Running Processes ————————
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ESET\ESET Smart Security\ekrn.exe
c:\program files\Acer\Empowering Technology\Service\ETService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\igfxsrvc.exe
c:\users\Dan\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\Launch Manager\QtZgAcer.EXE
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Completion time: 2012-12-22 00:07:56 - machine was rebooted
ComboFix-quarantined-files.txt 2012-12-22 00:07
.
Pre-Run: 29,751,189,504 bytes free
Post-Run: 29,559,435,264 bytes free
.
- - End Of File - - 7BEB9AFE6A96FB5CE372DEE96B2314AD
Hi manicd,
No worries.
Please go to:
VirusTotal [external image: Posted Image] Click the Choose File button and locate the following file: c:\windows\system32\FAP55A8.tmp Click Open Then click Send File Please be patient while the file is scanned. Once the scan results appear, please provide them in your next reply.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
Hi manicd,
Flash Player is out of date
Outdated versions of Flash are vulnerable to malware infections. Please uninstall old versions of Flash Player by following the instructions here . Next, click here to download the latest version of Flash Player. Uncheck "Yes, install Google Toolbar - optional" if you do not want to install Google Toolbar. Click Download Now then double click on the setup file to start the installation. ===================================================
Please run
Malwarebytes' Anti-Malware .
Click the Update tab, then click Check for Updates . If an update is found, download and install the latest version. Next, click Scanner , select Perform quick scan , then click Scan . When the scan is complete, click OK , then Show Results to view the results. Be sure that everything is checked, and click Remove Selected . When completed, a log will open in Notepad. Please save it to a convenient location and post the results. ===================================================
I need you to run the following scan:
Eset Online Scanner Place a check mark in the box YES, I accept the Terms Of Use Click the Start button. Now click the Install button. Click Start . The scanner engine will initialize and update. Do Not place a check mark Remove found threats . Click the Scan button. The scan will now run, please be patient. When the scan finishes click the Details tab . Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.
Hello NoodleTech, I hope all is well
Malwarebytes :
Malwarebytes Anti-Malware (PRO) 1.65.1.1000
www.malwarebytes.org
Database version: v2012.12.24.03
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Dan :: DAN-PC [administrator]
Protection: Enabled
24/12/2012 21:56:46
mbam-log-2012-12-24 (21-56-46).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 202063
Time elapsed: 4 minute(s), 14 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Nod32:
📎 ESET_Online_Scan_Results.jpg
Thanks in advance
Hi manicd,
It is safe as long as you remember to check for updates periodically. With that said, your logs appear to be malware free.
Please delete
DDS and aswMBR from your desktop.
Follow these steps to uninstall Combofix
*
Click START
* Now type
ComboFix /Uninstall in the searchbox and hit
ENTER . Note the space between the X and the /, it needs to be there.
(Note: There is a space between the ..X and the /U that needs to be there.)
[external image: Posted Image]
=================================================== Here are some tips to reduce the potential for spyware infection in the future Updates It is very important that you keep your Operating System and applications up to date so that you will be less susceptible to malware. It's a good idea to have Windows Update automatically download and install updates as they become available. Secunia Online Software Inspector Run Anti-Virus Software For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here . IMPORTANT! ONE firewall and ONE real-time antivirus installed on your system. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan. Once complete, remember to re-engage your resident security before going online. Passwords It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft articleStrong passwords: How to create and use them password keeper , to keep all your passwords safe. Spyware Protection This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: How to Prevent Malware by miekiemoesPC Safety and Security–What Do I Need? Additional Software To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements.Google Chrome
Follow these steps, keep your antivirus program and antispyware programs updated, and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.
Hopefully this should take care of your problems! Good luck.
Do you have any further questions?
**Please respond one more time to confirm your problem is resolved so I can close this thread.
Hi NoodleTech,
Hi manicd,
Did you by any chance delete the Combofix.exe file you downloaded earlier? You can download it again from the links in my previous post. Do not run it. Just follow the uninstall instructions. Click start, then type
Combofix /Uninstall in the search box.
Let me know if that doesn't work.
Regarding your original problem, I'm not quite sure what's causing it. You did have an infected file system driver. It was replaced. Are you still having the issue?
Hi manicd,
Do you still need help?
Hi NoodleTech,
Hi manicd,
You are very welcome. I would try and replicate the original problem and make sure it still occurs before returning to the tech forum.
The ntfs.sys driver was infected. It relates to the operating system.
As a last measure, let's clear your temp files to free up some space.
Download
TFC to your desktop
Open the file and close any other windows. It will close all programs itself Click the Start button to begin the process. The program should not take long to finish its job Once its finished it should reboot your machine , if not, do this yourself to ensure a complete clean
