I tried following the posts on the other topics, and the problem is not fixed. I have tried running Malwarebytes, HijackThis, Spybot S&D, SuperAntiSpyware and Windows Defender, and nothing has fixed the problem. Below are the logs from DDS and GMER. When I ran GMER, it only let me choose Services, Registry and Files because the other options were grayed out. I also attached the attach.txt file.
Thanks in advance for your help.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19154 BrowserJavaVersion: 1.6.0_29
Run by Jonathan at 9:49:22 on 2011-10-26
Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.1917.659 [GMT -4:00]
.
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\pnusbvirtualhubwssrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\bcmwltry.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe
C:\Windows\system32\pnssosvr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Citrix\ICA Client\concentr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\UI0Detect.exe
C:\Program Files\Citrix\ICA Client\wfcrun32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Jonathan\Desktop\gmer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Users\Jonathan\Desktop\gmer.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://login.yahoo.com/config/login?.src=fpctx&.intl=us&.done=http%3A%2F%2Fwww.yahoo.com%2F
uInternet Settings,ProxyOverride = *.local;192.168.*.*
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{7f0c4457-8e64-491b-8d7b-991504365d1e}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://akamaicdn.webex.com/client/WBXclient-T27L10NSP27-10832/webex/ieatgpc1.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{62254B73-AF28-4AF5-9CEC-99CC03612753} : DhcpNameServer = 209.183.33.23 209.183.35.23
TCP: Interfaces\{E0F900BE-74EB-4B91-AFAC-42CDFB8B0ADB} : DhcpNameServer = 209.18.47.61 209.18.47.62
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: GoToAssist Express Customer - c:\program files\citrix\gotoassist express customer\274\g2ax_winlogon.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\jonathan\appdata\roaming\mozilla\firefox\profiles\k3c9mxby.default\
FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/mail?.intl=us&.done=http%3A%2F%2Fus.mg1.mail.yahoo.com%2Fdc%2Flaunch%3F.rand%3D7hlm7u337ql3b
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\users\jonathan\appdata\roaming\facebook\npfbplugin_1_0_3.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
============= SERVICES / DRIVERS ===============
.
R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2009-10-5 65584]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-12-2 21504]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-10-12 366152]
R2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-3-25 223088]
R2 pnpnptool;Quest RDP PnP Driver;c:\windows\system32\drivers\pnpnptool.sys [2010-6-16 33488]
R2 pnusbvirtualhubwssrv;Quest USB Hub Client Service;c:\windows\system32\pnusbvirtualhubwssrv.exe [2010-6-16 398832]
R3 fwlcrkow;fwlcrkow;c:\users\jonathan\appdata\local\temp\fwlcrkow.sys [2011-10-26 100864]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-10-12 22216]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-29 136176]
S3 GoToAssist Express Customer;GoToAssist Express Customer;c:\program files\citrix\gotoassist express customer\274\g2ax_service.exe [2011-4-8 161144]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-8-29 136176]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\drivers\Ph3xIB32.sys [2007-4-3 1131136]
S3 pnusbd;Quest RDP USB Driver;c:\windows\system32\drivers\pnusbd.sys [2010-6-16 19920]
S3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\system32\drivers\swnc8u80.sys [2008-8-20 168192]
S3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\system32\drivers\swumx80.sys [2008-8-20 142976]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-12-2 16896]
S4 OracleJobSchedulerDBJCZA;OracleJobSchedulerDBJCZA;c:\oracle\product\10.2.0\db_1\bin\extjob.exe dbjcza --> c:\oracle\product\10.2.0\db_1\bin\extjob.exe DBJCZA [?]
S4 OracleOraDb10g_home1TNSListener;OracleOraDb10g_home1TNSListener;c:\oracle\product\10.2.0\db_1\bin\tnslsnr --> c:\oracle\product\10.2.0\db_1\bin\TNSLSNR [?]
S4 OracleServiceDBJCZA;OracleServiceDBJCZA;c:\oracle\product\10.2.0\db_1\bin\oracle.exe dbjcza --> c:\oracle\product\10.2.0\db_1\bin\ORACLE.EXE DBJCZA [?]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-6-24 92008]
.
=============== Created Last 30 ================
.
2011-10-26 12:56:23 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{73ee83f9-7046-4f0b-a8ba-a746f455692a}\offreg.dll
2011-10-26 12:17:08 6144 ----a-w- c:\program files\internet explorer\iecompat.dll
2011-10-25 12:57:38 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{73ee83f9-7046-4f0b-a8ba-a746f455692a}\mpengine.dll
2011-10-19 19:56:25 -------- d-----w- c:\program files\CCleaner
2011-10-19 19:52:30 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-10-19 19:52:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-10-19 19:49:33 -------- d-----w- c:\users\jonathan\appdata\roaming\SUPERAntiSpyware.com
2011-10-19 19:48:48 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-10-19 19:48:48 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-10-19 19:09:17 -------- d-----w- c:\program files\ESET
2011-10-19 19:02:20 388096 ----a-r- c:\users\jonathan\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-10-19 19:02:16 -------- d-----w- c:\program files\Trend Micro
2011-10-19 18:46:30 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-10-19 18:46:29 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-19 18:07:05 -------- d-sh--w- C:\$RECYCLE.BIN
2011-10-19 16:58:54 -------- d-----w- C:\ComboFix
2011-10-19 15:49:38 -------- d-----w- c:\users\jonathan\appdata\local\temp
2011-10-19 14:48:15 98816 ----a-w- c:\windows\sed.exe
2011-10-19 14:48:15 518144 ----a-w- c:\windows\SWREG.exe
2011-10-19 14:48:15 256000 ----a-w- c:\windows\PEV.exe
2011-10-19 14:48:15 208896 ----a-w- c:\windows\MBR.exe
2011-10-19 12:10:41 -------- d-----w- c:\windows\pss
2011-10-14 02:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
2011-10-14 02:22:02 247808 ----a-w- c:\program files\internet explorer\ieproxy.dll
2011-10-14 02:22:02 129536 ----a-w- c:\program files\internet explorer\sqmapi.dll
2011-10-14 02:20:58 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-10-14 02:18:56 563712 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-14 02:18:56 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2011-10-14 02:18:56 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2011-10-14 02:18:56 238080 ----a-w- c:\windows\system32\oleacc.dll
2011-10-12 12:34:43 -------- d-----w- c:\users\jonathan\appdata\roaming\Malwarebytes
2011-10-12 12:34:22 -------- d-----w- c:\programdata\Malwarebytes
2011-10-12 12:34:18 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-12 12:34:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-10-02 22:11:28 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-10-02 22:11:25 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-10-02 22:11:25 773080 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-10-02 22:11:25 478168 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-10-02 22:11:25 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-10-02 22:11:25 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-10-02 22:11:25 1833944 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-10-02 22:11:25 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
.
==================== Find3M ====================
.
2011-09-30 23:02:06 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-09-30 23:01:51 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-09-30 23:01:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2011-09-30 23:01:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
2011-09-30 22:07:25 385024 ----a-w- c:\windows\system32\html.iec
2011-09-30 21:29:54 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2011-09-30 21:28:36 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2011-09-06 13:30:12 2043392 ----a-w- c:\windows\system32\win32k.sys
2011-07-29 16:01:34 293376 ----a-w- c:\windows\system32\psisdecd.dll
2011-07-29 16:01:33 217088 ----a-w- c:\windows\system32\psisrndr.ax
2011-07-29 16:00:14 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2011-07-29 16:00:05 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
.
============= FINISH: 9:56:06.80 ===============
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-26 10:56:28
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Jonathan\AppData\Local\Temp\fwlcrkow.sys
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage@HandWritingFiles 1062926988
Reg HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug@StoreLocation C:\Users\Jonathan\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report113cc5cf
---- EOF - GMER 1.0.15 ----
Attached File(s)
-
Attach.txt (15.63K)
Number of downloads: 1

Help
This topic is locked


Back to top











