Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

System Fix Infection


  • This topic is locked This topic is locked
6 replies to this topic

#1 Xebulba

Xebulba

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:49 PM

Posted 12 December 2011 - 06:01 AM

Contracted, I'm assuming since no other cause has presented itself, from StumbleUpon. I had the toolbar installed in my Firefox 8.0 browser, clicked the "Stumble" button and my browser crashed to the desktop. I was then prompted by my antivirus program (Microsoft Security Essentials) that I had 2 infections of the Alureon Trojan present, one on my desktop and the other in the directory of Sun Java. I then used Microsoft Security Essentials to "fix" the 2 problems brought to my attention, or so I thought. Immediately after this happened System Fix came up on my screen followed by a massive amount of warning messages, icons disappearing, notification windows and all the other wonderful things this program seems to bring with it. Recognizing that this was not a program I had personally installed, nor one that I should trust, I came to Bleepingcomputer.com and followed the "Remove System Fix (Uninstall Guide)". I'm now posting here to gain help in knowing that I have hopefully removed it completely. Thank you for your time and help with this, I truly appreciate it.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_27
Run by Xebulba at 5:07:24 on 2011-12-12
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.830 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: KeyScramblerBHO Class: {2b9f5787-88a5-4945-90e7-c4b18563bc5e} - c:\program files\keyscrambler\KeyScramblerIE.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\mif5ba~1\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mif5ba~1\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [HydraVisionDesktopManager] "c:\program files\ati technologies\hydravision\HydraDM.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\mif5ba~1\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - c:\program files\keyscrambler\KeyScramblerIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: rhapsody.com\rhap-app-4-0
Trusted Zone: rhapsody.com\rhapreg
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{827E1BC0-F676-490E-AD10-2443A84BF64C} : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\mif5ba~1\office14\GROOVEEX.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\xebulba\appdata\roaming\mozilla\firefox\profiles\ddhvwmyy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2671266&SearchSource=3&q={searchTerms}
FF - plugin: c:\progra~1\mif5ba~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\mif5ba~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 MpKsl5d72b015;MpKsl5d72b015;c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\MpKsl5d72b015.sys [2011-12-12 29904]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-11-25 176128]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ati technologies\ati.ace\fuel\Fuel.Service.exe [2011-11-25 291840]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-6-4 1153368]
R3 amdiox86;AMD IO Driver;c:\windows\system32\drivers\amdiox86.sys [2011-6-4 37944]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-11-25 8854016]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-11-25 264192]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-6-6 211984]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2011-6-6 225592]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-1-21 30963576]
S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files\msi\live update 5\msibios32_100507.sys [2011-6-4 25912]
S3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files\msi\live update 5\NTIOLib.sys [2011-6-4 7680]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-6-5 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-5 52224]
.
=============== Created Last 30 ================
.
2011-12-12 09:30:53 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\MpKsl5d72b015.sys
2011-12-12 09:30:50 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\offreg.dll
2011-12-12 04:03:16 6823496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\mpengine.dll
2011-12-08 09:14:38 -------- d-----w- c:\program files\Ventrilo
2011-12-04 15:46:47 -------- d-----w- c:\program files\IObit
2011-12-01 13:32:12 -------- d-----w- c:\program files\common files\BOSS
2011-12-01 13:18:37 -------- d-----w- c:\program files\Nexus Mod Manager
2011-12-01 12:28:48 -------- d-----w- C:\The Elder Scrolls V Skyrim
2011-12-01 05:49:23 -------- d-----w- C:\AMD
2011-12-01 01:45:16 -------- d-----w- c:\windows\msdownld.tmp
2011-12-01 00:57:06 -------- d-----w- c:\users\xebulba\appdata\local\Black_Tree_Gaming
2011-11-30 23:26:56 -------- d-----w- c:\users\xebulba\appdata\local\Skyrim
2011-11-25 15:05:12 8854016 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-11-25 14:06:22 18829312 ----a-w- c:\windows\system32\atioglxx.dll
2011-11-25 14:04:34 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2011-11-25 14:00:52 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-11-25 14:00:26 417792 ----a-w- c:\windows\system32\atieclxx.exe
2011-11-25 14:00:00 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2011-11-25 13:59:02 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2011-11-25 13:58:46 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2011-11-25 13:58:38 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2011-11-25 13:58:32 20992 ----a-w- c:\windows\system32\atimuixx.dll
2011-11-25 13:58:24 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-11-25 13:50:08 1828864 ----a-w- c:\windows\system32\atiumdmv.dll
2011-11-25 13:40:24 46080 ----a-w- c:\windows\system32\aticalrt.dll
2011-11-25 13:40:12 44032 ----a-w- c:\windows\system32\aticalcl.dll
2011-11-25 13:39:44 4189184 ----a-w- c:\windows\system32\atiumdva.dll
2011-11-25 13:36:12 8449024 ----a-w- c:\windows\system32\aticaldd.dll
2011-11-25 13:36:12 4356096 ----a-w- c:\windows\system32\atiumdag.dll
2011-11-25 13:23:34 339968 ----a-w- c:\windows\system32\atiadlxx.dll
2011-11-25 13:23:20 14336 ----a-w- c:\windows\system32\atiglpxx.dll
2011-11-25 13:23:10 32768 ----a-w- c:\windows\system32\atigktxx.dll
2011-11-25 13:22:44 264192 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-11-25 13:21:36 53760 ----a-w- c:\windows\system32\atimpc32.dll
2011-11-25 13:21:36 53760 ----a-w- c:\windows\system32\amdpcom32.dll
2011-11-25 13:21:34 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-11-21 11:56:30 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-11-21 11:56:30 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2011-11-21 11:56:28 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2011-11-21 11:32:55 51504 ----a-w- c:\program files\microsoft games\age of empires online\rmdll\final\RandomMap.dll
2011-11-21 11:32:55 19248 ----a-w- c:\program files\microsoft games\age of empires online\rmdll\final\CLRBinder.dll
2011-11-21 11:32:55 13616 ----a-w- c:\program files\microsoft games\age of empires online\rmdll\final\RandomMapBinder.dll
2011-11-21 11:23:56 81998 ----a-w- c:\program files\microsoft games\age of empires online\RockallDLL.dll
2011-11-21 11:23:56 746496 ----a-w- c:\program files\microsoft games\age of empires online\granny2.dll
2011-11-21 11:23:53 139568 ----a-w- c:\program files\microsoft games\age of empires online\eulax.dll
2011-11-21 11:23:52 173408 ----a-w- c:\program files\microsoft games\age of empires online\pw32b.dll
2011-11-21 11:23:29 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2011-11-21 11:23:29 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2011-11-21 11:23:28 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2011-11-21 05:22:34 -------- d-----w- c:\program files\AMD APP
2011-11-16 00:54:08 -------- d-----w- c:\program files\common files\Steam
2011-11-16 00:54:01 -------- d-----w- c:\program files\Steam
.
==================== Find3M ====================
.
2011-11-25 14:04:24 749568 ----a-w- c:\windows\system32\aticfx32.dll
2011-11-25 13:55:50 4327936 ----a-w- c:\windows\system32\atidxx32.dll
2011-11-25 13:30:06 52736 ----a-w- c:\windows\system32\coinst.dll
2011-11-25 13:22:18 31744 ----a-w- c:\windows\system32\atiuxpag.dll
2011-11-25 13:22:06 29184 ----a-w- c:\windows\system32\atiu9pag.dll
2011-11-18 04:26:35 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-26 02:21:48 56832 ----a-w- c:\windows\system32\OpenVideo.dll
2011-10-26 02:21:34 56832 ----a-w- c:\windows\system32\OVDecoder.dll
2011-10-26 02:20:42 13950464 ----a-w- c:\windows\system32\amdocl.dll
2011-10-24 18:29:02 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 18:29:02 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-10-08 22:11:04 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2011-10-08 22:11:04 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2011-10-02 00:04:33 234768 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-10-02 00:04:33 234768 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-10-01 23:19:18 138264 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-09-29 16:03:04 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-29 03:37:56 2341888 ----a-w- c:\windows\system32\win32k.sys
2011-09-28 22:45:42 15453832 ----a-w- c:\windows\system32\xlive.dll
2011-09-28 22:45:42 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2011-09-14 15:47:40 53760 ----a-w- c:\windows\system32\OVDecode.dll
2011-09-14 15:38:28 37376 ----a-w- c:\windows\system32\amdoclcl.dll
2011-09-14 13:58:10 225592 ----a-w- c:\windows\system32\drivers\keyscrambler.sys
.
============= FINISH: 5:08:14.45 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 PM

Posted 18 December 2011 - 03:24 AM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • Please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

  • Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger may ask you to reboot the machine, if it does - click OK
Do not re-enable these drivers until otherwise instructed.

Download DDS:

  • Please download DDS by sUBs from one of the links below and save it to your desktop:

    Posted Image
    Download DDS and save it to your desktop

    Link1
    Link2
    Link3

    Please disable any anti-malware program that will block scripts from running before running DDS.

    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
    • DDS.txt
    • Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply

information and logs:

  • In your next post I need the following

  • .logs from DDS
  • let me know of any problems you may have had

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 Xebulba

Xebulba
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:49 PM

Posted 19 December 2011 - 04:40 PM

Contracted, I'm assuming since no other cause has presented itself, from StumbleUpon. I had the toolbar installed in my Firefox 8.0 browser, clicked the "Stumble" button and my browser crashed to the desktop. I was then prompted by my antivirus program (Microsoft Security Essentials) that I had 2 infections of the Alureon Trojan present, one on my desktop and the other in the directory of Sun Java. I then used Microsoft Security Essentials to "fix" the 2 problems brought to my attention, or so I thought. Immediately after this happened System Fix came up on my screen followed by a massive amount of warning messages, icons disappearing, notification windows and all the other wonderful things this program seems to bring with it. Recognizing that this was not a program I had personally installed, nor one that I should trust, I came to Bleepingcomputer.com and followed the "Remove System Fix (Uninstall Guide)". I'm now posting here to gain help in knowing that I have hopefully removed it completely. Thank you for your time and help with this, I truly appreciate it.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_27
Run by Xebulba at 5:07:24 on 2011-12-12
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2047.830 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: KeyScramblerBHO Class: {2b9f5787-88a5-4945-90e7-c4b18563bc5e} - c:\program files\keyscrambler\KeyScramblerIE.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\mif5ba~1\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mif5ba~1\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [HydraVisionDesktopManager] "c:\program files\ati technologies\hydravision\HydraDM.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\mif5ba~1\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - c:\program files\keyscrambler\KeyScramblerIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: rhapsody.com\rhap-app-4-0
Trusted Zone: rhapsody.com\rhapreg
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{827E1BC0-F676-490E-AD10-2443A84BF64C} : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\mif5ba~1\office14\GROOVEEX.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\xebulba\appdata\roaming\mozilla\firefox\profiles\ddhvwmyy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2671266&SearchSource=3&q={searchTerms}
FF - plugin: c:\progra~1\mif5ba~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\mif5ba~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 MpKsl5d72b015;MpKsl5d72b015;c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\MpKsl5d72b015.sys [2011-12-12 29904]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-11-25 176128]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ati technologies\ati.ace\fuel\Fuel.Service.exe [2011-11-25 291840]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-6-4 1153368]
R3 amdiox86;AMD IO Driver;c:\windows\system32\drivers\amdiox86.sys [2011-6-4 37944]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-11-25 8854016]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-11-25 264192]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-6-6 211984]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2011-6-6 225592]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-1-21 30963576]
S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files\msi\live update 5\msibios32_100507.sys [2011-6-4 25912]
S3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files\msi\live update 5\NTIOLib.sys [2011-6-4 7680]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-6-5 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-5 52224]
.
=============== Created Last 30 ================
.
2011-12-12 09:30:53 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\MpKsl5d72b015.sys
2011-12-12 09:30:50 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\offreg.dll
2011-12-12 04:03:16 6823496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{4a569aa7-3d23-4a37-b3a0-b3b4948e20b4}\mpengine.dll
2011-12-08 09:14:38 -------- d-----w- c:\program files\Ventrilo
2011-12-04 15:46:47 -------- d-----w- c:\program files\IObit
2011-12-01 13:32:12 -------- d-----w- c:\program files\common files\BOSS
2011-12-01 13:18:37 -------- d-----w- c:\program files\Nexus Mod Manager
2011-12-01 12:28:48 -------- d-----w- C:\The Elder Scrolls V Skyrim
2011-12-01 05:49:23 -------- d-----w- C:\AMD
2011-12-01 01:45:16 -------- d-----w- c:\windows\msdownld.tmp
2011-12-01 00:57:06 -------- d-----w- c:\users\xebulba\appdata\local\Black_Tree_Gaming
2011-11-30 23:26:56 -------- d-----w- c:\users\xebulba\appdata\local\Skyrim
2011-11-25 15:05:12 8854016 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-11-25 14:06:22 18829312 ----a-w- c:\windows\system32\atioglxx.dll
2011-11-25 14:04:34 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2011-11-25 14:00:52 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-11-25 14:00:26 417792 ----a-w- c:\windows\system32\atieclxx.exe
2011-11-25 14:00:00 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2011-11-25 13:59:02 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2011-11-25 13:58:46 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2011-11-25 13:58:38 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2011-11-25 13:58:32 20992 ----a-w- c:\windows\system32\atimuixx.dll
2011-11-25 13:58:24 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-11-25 13:50:08 1828864 ----a-w- c:\windows\system32\atiumdmv.dll
2011-11-25 13:40:24 46080 ----a-w- c:\windows\system32\aticalrt.dll
2011-11-25 13:40:12 44032 ----a-w- c:\windows\system32\aticalcl.dll
2011-11-25 13:39:44 4189184 ----a-w- c:\windows\system32\atiumdva.dll
2011-11-25 13:36:12 8449024 ----a-w- c:\windows\system32\aticaldd.dll
2011-11-25 13:36:12 4356096 ----a-w- c:\windows\system32\atiumdag.dll
2011-11-25 13:23:34 339968 ----a-w- c:\windows\system32\atiadlxx.dll
2011-11-25 13:23:20 14336 ----a-w- c:\windows\system32\atiglpxx.dll
2011-11-25 13:23:10 32768 ----a-w- c:\windows\system32\atigktxx.dll
2011-11-25 13:22:44 264192 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-11-25 13:21:36 53760 ----a-w- c:\windows\system32\atimpc32.dll
2011-11-25 13:21:36 53760 ----a-w- c:\windows\system32\amdpcom32.dll
2011-11-25 13:21:34 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-11-21 11:56:30 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2011-11-21 11:56:30 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2011-11-21 11:56:28 81768 ----a-w- c:\windows\system32\xinput1_3.dll
2011-11-21 11:32:55 51504 ----a-w- c:\program files\microsoft games\age of empires online\rmdll\final\RandomMap.dll
2011-11-21 11:32:55 19248 ----a-w- c:\program files\microsoft games\age of empires online\rmdll\final\CLRBinder.dll
2011-11-21 11:32:55 13616 ----a-w- c:\program files\microsoft games\age of empires online\rmdll\final\RandomMapBinder.dll
2011-11-21 11:23:56 81998 ----a-w- c:\program files\microsoft games\age of empires online\RockallDLL.dll
2011-11-21 11:23:56 746496 ----a-w- c:\program files\microsoft games\age of empires online\granny2.dll
2011-11-21 11:23:53 139568 ----a-w- c:\program files\microsoft games\age of empires online\eulax.dll
2011-11-21 11:23:52 173408 ----a-w- c:\program files\microsoft games\age of empires online\pw32b.dll
2011-11-21 11:23:29 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2011-11-21 11:23:29 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2011-11-21 11:23:28 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2011-11-21 05:22:34 -------- d-----w- c:\program files\AMD APP
2011-11-16 00:54:08 -------- d-----w- c:\program files\common files\Steam
2011-11-16 00:54:01 -------- d-----w- c:\program files\Steam
.
==================== Find3M ====================
.
2011-11-25 14:04:24 749568 ----a-w- c:\windows\system32\aticfx32.dll
2011-11-25 13:55:50 4327936 ----a-w- c:\windows\system32\atidxx32.dll
2011-11-25 13:30:06 52736 ----a-w- c:\windows\system32\coinst.dll
2011-11-25 13:22:18 31744 ----a-w- c:\windows\system32\atiuxpag.dll
2011-11-25 13:22:06 29184 ----a-w- c:\windows\system32\atiu9pag.dll
2011-11-18 04:26:35 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-26 02:21:48 56832 ----a-w- c:\windows\system32\OpenVideo.dll
2011-10-26 02:21:34 56832 ----a-w- c:\windows\system32\OVDecoder.dll
2011-10-26 02:20:42 13950464 ----a-w- c:\windows\system32\amdocl.dll
2011-10-24 18:29:02 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 18:29:02 69632 ----a-w- c:\windows\system32\QuickTime.qts
2011-10-08 22:11:04 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2011-10-08 22:11:04 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2011-10-02 00:04:33 234768 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-10-02 00:04:33 234768 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-10-01 23:19:18 138264 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-09-29 16:03:04 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-29 03:37:56 2341888 ----a-w- c:\windows\system32\win32k.sys
2011-09-28 22:45:42 15453832 ----a-w- c:\windows\system32\xlive.dll
2011-09-28 22:45:42 13642888 ----a-w- c:\windows\system32\xlivefnt.dll
2011-09-14 15:47:40 53760 ----a-w- c:\windows\system32\OVDecode.dll
2011-09-14 15:38:28 37376 ----a-w- c:\windows\system32\amdoclcl.dll
2011-09-14 13:58:10 225592 ----a-w- c:\windows\system32\drivers\keyscrambler.sys
.
============= FINISH: 5:08:14.45 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 6/4/2011 3:31:37 AM
System Uptime: 12/12/2011 4:30:30 AM (1 hours ago)
.
Motherboard: MSI | | MS-7309
Processor: AMD Athlon™ 64 X2 Dual Core Processor 5000+ | CPU 1 | 2612/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 44.192 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl98431063
Device ID: ROOT\LEGACY_MPKSL98431063\0000
Manufacturer:
Name: MpKsl98431063
PNP Device ID: ROOT\LEGACY_MPKSL98431063\0000
Service: MpKsl98431063
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl2ba9d2e6
Device ID: ROOT\LEGACY_MPKSL2BA9D2E6\0000
Manufacturer:
Name: MpKsl2ba9d2e6
PNP Device ID: ROOT\LEGACY_MPKSL2BA9D2E6\0000
Service: MpKsl2ba9d2e6
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKslae7c7aac
Device ID: ROOT\LEGACY_MPKSLAE7C7AAC\0000
Manufacturer:
Name: MpKslae7c7aac
PNP Device ID: ROOT\LEGACY_MPKSLAE7C7AAC\0000
Service: MpKslae7c7aac
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl2ce5d3ba
Device ID: ROOT\LEGACY_MPKSL2CE5D3BA\0000
Manufacturer:
Name: MpKsl2ce5d3ba
PNP Device ID: ROOT\LEGACY_MPKSL2CE5D3BA\0000
Service: MpKsl2ce5d3ba
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl4640c81f
Device ID: ROOT\LEGACY_MPKSL4640C81F\0000
Manufacturer:
Name: MpKsl4640c81f
PNP Device ID: ROOT\LEGACY_MPKSL4640C81F\0000
Service: MpKsl4640c81f
.
Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318}
Description: Microsoft PS/2 Mouse
Device ID: ACPI\PNP0F03\4&130FF85E&0
Manufacturer: Microsoft
Name: Microsoft PS/2 Mouse
PNP Device ID: ACPI\PNP0F03\4&130FF85E&0
Service: i8042prt
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsle711d35d
Device ID: ROOT\LEGACY_MPKSLE711D35D\0000
Manufacturer:
Name: MpKsle711d35d
PNP Device ID: ROOT\LEGACY_MPKSLE711D35D\0000
Service: MpKsle711d35d
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKslfcd3de38
Device ID: ROOT\LEGACY_MPKSLFCD3DE38\0000
Manufacturer:
Name: MpKslfcd3de38
PNP Device ID: ROOT\LEGACY_MPKSLFCD3DE38\0000
Service: MpKslfcd3de38
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl8394be61
Device ID: ROOT\LEGACY_MPKSL8394BE61\0000
Manufacturer:
Name: MpKsl8394be61
PNP Device ID: ROOT\LEGACY_MPKSL8394BE61\0000
Service: MpKsl8394be61
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl06429453
Device ID: ROOT\LEGACY_MPKSL06429453\0000
Manufacturer:
Name: MpKsl06429453
PNP Device ID: ROOT\LEGACY_MPKSL06429453\0000
Service: MpKsl06429453
.
Class GUID: {4d36e96b-e325-11ce-bfc1-08002be10318}
Description: Standard PS/2 Keyboard
Device ID: ACPI\PNP0303\4&130FF85E&0
Manufacturer: (Standard keyboards)
Name: Standard PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&130FF85E&0
Service: i8042prt
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsl202d50a3
Device ID: ROOT\LEGACY_MPKSL202D50A3\0000
Manufacturer:
Name: MpKsl202d50a3
PNP Device ID: ROOT\LEGACY_MPKSL202D50A3\0000
Service: MpKsl202d50a3
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
µTorrent
7-Zip 9.20
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Shockwave Player 11.5
Advanced Tactical Center™ 1.0
Age of Empires Online
AMD APP SDK Runtime
AMD AVIVO Codecs
AMD Catalyst Install Manager
AMD Drag and Drop Transcoding
AMD Fuel
AMD Media Foundation Decoders
AMD VISION Engine Control Center
Anarchy Online
Apple Application Support
Apple Software Update
Application Profiles
Bandisoft MPEG-1 Decoder
Battlefield Play4Free
BOSS
BufferChm
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
D1500
Definition update for Microsoft Office 2010 (KB982726) 32-Bit Edition
DeviceDiscovery
DJ_SF_03_D1500_Software_Min
ffdshow [rev 3154] [2009-12-09]
File Shredder 2.0
Foxit Reader 5.1
Game Booster 3
GIMP 2.6.11
GPBaseService2
Half-Life 2
Half-Life 2: Episode One
Half-Life 2: Episode Two
Half-Life 2: Lost Coast
HijackThis 2.0.2
HP Customer Participation Program 13.0
HP Deskjet D1500 Printer Driver Software 13.0 Rel. 3
HP Imaging Device Functions 13.0
HP Smart Web Printing 4.51
HP Solution Center 13.0
HP Update
HPPhotoGadget
HPProductAssistant
HPSSupply
HydraVision
Java Auto Updater
Java™ 6 Update 27
KeyScrambler
Left 4 Dead
Left 4 Dead 2
Live Update 5
Magic ISO Maker v5.5 (build 0281)
MagicDisc 2.7.106
Malwarebytes' Anti-Malware version 1.51.2.1300
MarketResearch
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox 8.0 (x86 en-US)
Nexus Mod Manager
NVIDIA Drivers
NVIDIA PhysX
OpenAL
PeerBlock 1.1 (r518)
Portal
PunkBuster Services
QuickTime
SAMSUNG Mobile USB DRIVER(4.40.7.0) v1.6
SAMSUNG USB Driver for Mobile Phones
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Shop for HP Supplies
SmartWebPrinting
SolutionCenter
Sophos Anti-Rootkit 1.5.20
Spybot - Search & Destroy
Status
Steam
Team Fortress 2
Team Fortress 2 Beta
TeamSpeak 3 Client
Toolbox
TrayApp
UnloadSupport
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553092)
V CAST Music with Rhapsody
Ventrilo Client
Verizon Wireless Software Upgrade Assistant - Samsung
Verizon Wireless Software Upgrade Assistant - SAMSUNG (TL-PC)
WebReg
Winamp
Winamp Detector Plug-in
Windows Live ID Sign-in Assistant
World of Tanks v.0.6.6
Xfire (remove only)
Yahoo! Messenger
Yahoo! Software Update
.
==== Event Viewer Messages From Past Week ========
.
12/12/2011 4:27:51 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
12/12/2011 3:31:50 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
12/12/2011 3:31:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/12/2011 3:31:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/12/2011 3:31:46 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/12/2011 3:31:39 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/12/2011 3:31:36 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter spldr Wanarpv6
12/12/2011 3:31:29 AM, Error: Microsoft-Windows-Eventlog [22] - The event logging service encountered an error while initializing publishing resources for channel DebugChannel. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well.
.
==== End Of File ===========================

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 PM

Posted 19 December 2011 - 11:09 PM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 PM

Posted 23 December 2011 - 11:45 AM

Hello




Happy Holidays, It has been a couple of days since I have you heard from you so I came by to check on you



Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 PM

Posted 27 December 2011 - 12:46 AM

Hello

48 Hour bump

It has been more than 48 hours since my last post.

  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 PM

Posted 31 December 2011 - 01:26 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users