PDA

View Full Version : Malware causing havoc


dom2830
2010-10-06, 11:05
Hey guys,
Over the past two days, malware has managed to uninstall all my graphics cards drivers, prevent mozilla firefox from working and also prevent me from updating and installing new anti-spyware programs. Here are my two dds reports. Any help will be greatly appreciated.
Thanks.


DDS (Ver_10-03-17.01) - NTFSX64
Run by Dom at 19:52:43.56 on 06/10/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.61.1033.18.6142.4074 [GMT 11:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\XSrvSetup.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
C:\Program Files (x86)\Realtek\Smart Dual Lan\SDLService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\DisplayFusion\DisplayFusionHookx86.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Dom\Desktop\dds.com
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.bing.com/?cc=au
mLocal Page = c:\windows\syswow64\blank.htm
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - c:\program files (x86)\devicevm\browser configuration utility\AddressBarSearch.dll
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~2\micros~3\office14\GROOVEEX.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~2\micros~3\office14\URLREDIR.DLL
uRun: [DisplayFusion] "c:\program files (x86)\displayfusion\DisplayFusion.exe"
uRun: [TomTomHOME.exe] "c:\program files (x86)\tomtom home 2\TomTomHOMERunner.exe"
uRun: [Skype] "c:\program files (x86)\skype\\phone\Skype.exe" /nosplash /minimized
uRun: [Logitech Vid HD] "c:\program files (x86)\logitech\vid\vid.exe" -bootmode
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [BCU] "c:\program files (x86)\devicevm\browser configuration utility\BCU.exe"
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [NUSB3MON] "c:\program files (x86)\nec electronics\usb 3.0 host controller driver\application\nusb3mon.exe"
mRun: [ATICustomerCare] "c:\program files (x86)\ati\aticustomercare\ATICustomerCare.exe"
mRun: [LWS] c:\program files (x86)\logitech\lws\webcam software\LWS.exe -hide
mRun: [StartCCC] "c:\program files (x86)\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files (x86)\itunes\iTunesHelper.exe"
StartupFolder: c:\users\dom\appdata\roaming\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files (x86)\logitech\ereg\eReg.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files (x86)\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files (x86)\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files (x86)\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~2\micros~3\office14\GROOVEEX.DLL
BHO-X64: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll
BHO-X64: Windows Live Family Safety Browser Helper - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\progra~1\micros~2\office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
mRun-x64: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe -s
mRun-x64: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\progra~1\micros~2\office14\GROOVEEX.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\dom\appdata\roaming\mozilla\firefox\profiles\pz21aror.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - plugin: c:\progra~2\micros~3\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~2\micros~3\office14\NPSPWRAP.DLL

---- FIREFOX POLICIES ----
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-6-5 69152]
R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [2010-5-12 20520]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-5-12 121936]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 173984]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-8-26 203264]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-5-12 20048]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-5-12 61008]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-11 40384]
R2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\devicevm\browser configuration utility\BCUService.exe [2010-5-12 219360]
R2 JMB36X;JMB36X;c:\windows\syswow64\XSrvSetup.exe [2010-5-12 65536]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\lavasoft\ad-aware\AAWService.exe [2010-8-12 1356952]
R2 LVPrcS64;Process Monitor;c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe [2010-5-7 197976]
R2 SDLService;SDLService;c:\program files (x86)\realtek\smart dual lan\SDLService.exe [2010-5-12 88064]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\tomtom home 2\TomTomHOMEService.exe [2010-5-7 92008]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2010-8-26 7767040]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2010-8-26 279040]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-7-15 116240]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-11 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-11 40384]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\drivers\LVPr2M64.sys [2010-5-7 30304]
R3 Lycosa;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys [2008-1-17 18816]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-3-25 40832]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2009-11-20 75776]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2009-11-20 177152]
R3 rtkio;rtkio;c:\program files (x86)\realtek\smart dual lan\rtkio.sys [2010-5-12 17392]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt64win7.sys [2010-5-12 239616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\common files\macrovision shared\flexnet publisher\FNPLicensingService64.exe [2010-8-11 1030600]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-9-6 61288]
S3 fsssvc;Windows Live Family Safety Service;c:\program files (x86)\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\lavasoft\ad-aware\kernexplorer64.sys [2010-8-12 16928]
S3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\drivers\lvpopf64.sys [2010-7-27 271712]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\drivers\lvrs64.sys [2010-7-27 339040]
S3 LVUVC64;Logitech Webcam 200(UVC);c:\windows\system32\drivers\lvuvc64.sys [2010-7-27 6465632]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-1-21 51445112]
S3 ose64;Office 64 Source Engine;c:\program files\common files\microsoft shared\source engine\OSE.EXE [2010-1-9 174440]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl64.sys [2010-4-19 50688]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-12 1255736]

============== File Associations ===============

.scr=AutoCADScriptFile

=============== Created Last 30 ================

2010-10-05 11:42:20 0 d-----w- c:\program files (x86)\Microsoft Antimalware
2010-10-05 11:42:19 0 d-----w- c:\program files\Microsoft Security Essentials
2010-10-01 09:16:38 0 d-----w- c:\program files\iPod
2010-10-01 09:16:37 0 d-----w- c:\program files\iTunes
2010-10-01 09:15:54 0 d-----w- c:\program files\Bonjour
2010-10-01 09:15:54 0 d-----w- c:\program files (x86)\Bonjour
2010-09-30 11:17:56 0 d-----w- c:\users\dom\appdata\roaming\PDF Writer
2010-09-30 11:17:56 0 d-----w- c:\programdata\PDF Writer
2010-09-30 11:15:14 227840 ----a-w- c:\windows\syswow64\bzFlRdr.dll
2010-09-30 11:15:14 135168 ----a-w- c:\windows\syswow64\bzpdfc.dll
2010-09-30 11:15:14 103424 ----a-w- c:\windows\syswow64\bzDCT.dll
2010-09-30 11:15:14 0 d-----w- c:\program files\common files\Bullzip
2010-09-30 11:15:12 214016 ----a-w- c:\windows\system32\bzpdf.dll
2010-09-30 11:15:09 0 d-----w- c:\program files\Bullzip
2010-09-30 11:14:41 0 d-----w- c:\program files (x86)\GSLITE
2010-09-30 09:35:08 0 d-----w- c:\program files (x86)\etax2010
2010-09-29 08:02:05 243712 ----a-w- c:\windows\system32\drivers\ks.sys
2010-09-29 07:47:22 2048 ----a-w- c:\windows\syswow64\tzres.dll
2010-09-29 07:47:22 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-23 11:13:55 0 d-----w- c:\programdata\ATI
2010-09-15 07:42:14 2058752 ----a-w- c:\windows\syswow64\iertutil.dll
2010-09-15 07:41:08 558592 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-13 00:13:54 0 dc-h--w- c:\programdata\{ECC164E0-3133-4C70-A831-F08DB2940F70}
2010-09-09 05:29:16 0 d-sh--w- C:\found.000
2010-09-08 09:37:39 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-09-08 08:44:08 0 d-----w- c:\program files (x86)\Microsoft CAPICOM 2.1.0.2
2010-09-08 01:17:46 94208 ----a-w- c:\windows\syswow64\QuickTimeVR.qtx
2010-09-08 01:17:46 69632 ----a-w- c:\windows\syswow64\QuickTime.qts
2010-09-06 11:36:05 61288 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2010-09-06 11:36:04 0 d-----w- c:\program files\Windows Live
2010-09-06 11:35:49 0 d-----w- c:\program files (x86)\Microsoft

==================== Find3M ====================

2010-10-03 06:20:32 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2010-09-13 06:53:14 10991 ----a-w- c:\program files (x86)\hs_err_pid5804.log
2010-09-13 06:53:11 10991 ----a-w- c:\program files (x86)\hs_err_pid5292.log
2010-09-13 00:09:59 10990 ----a-w- c:\program files (x86)\hs_err_pid5700.log
2010-09-13 00:09:19 10991 ----a-w- c:\program files (x86)\hs_err_pid5732.log
2010-09-13 00:09:19 10991 ----a-w- c:\program files (x86)\hs_err_pid5552.log
2010-09-13 00:09:19 10988 ----a-w- c:\program files (x86)\hs_err_pid2892.log
2010-09-13 00:09:18 10991 ----a-w- c:\program files (x86)\hs_err_pid5340.log
2010-09-13 00:09:18 10991 ----a-w- c:\program files (x86)\hs_err_pid3920.log
2010-09-13 00:09:17 10991 ----a-w- c:\program files (x86)\hs_err_pid2732.log
2010-09-13 00:09:12 10991 ----a-w- c:\program files (x86)\hs_err_pid6060.log
2010-09-13 00:09:03 10991 ----a-w- c:\program files (x86)\hs_err_pid5820.log
2010-09-13 00:08:49 10991 ----a-w- c:\program files (x86)\hs_err_pid5404.log
2010-09-13 00:08:30 10991 ----a-w- c:\program files (x86)\hs_err_pid3588.log
2010-09-13 00:08:03 10989 ----a-w- c:\program files (x86)\hs_err_pid4840.log
2010-09-13 00:07:53 9530 ----a-w- c:\program files (x86)\hs_err_pid904.log
2010-09-07 15:12:17 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11:54 167592 ----a-w- c:\windows\syswow64\aswBoot.exe
2010-09-07 14:47:33 61008 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-08-26 03:37:26 7767040 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-08-26 02:14:12 20736000 ----a-w- c:\windows\system32\atio6axx.dll
2010-08-26 02:01:14 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-26 02:01:04 528384 ----a-w- c:\windows\syswow64\aticfx32.dll
2010-08-26 02:00:02 616960 ----a-w- c:\windows\system32\aticfx64.dll
2010-08-26 01:57:58 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-08-26 01:57:50 462336 ----a-w- c:\windows\system32\atieclxx.exe
2010-08-26 01:57:14 203264 ----a-w- c:\windows\system32\atiesrxx.exe
2010-08-26 01:56:06 120320 ----a-w- c:\windows\system32\atitmm64.dll
2010-08-26 01:55:50 421376 ----a-w- c:\windows\system32\atipdl64.dll
2010-08-26 01:55:48 15830016 ----a-w- c:\windows\syswow64\atioglxx.dll
2010-08-26 01:55:42 356352 ----a-w- c:\windows\syswow64\atipdlxx.dll
2010-08-26 01:55:32 278528 ----a-w- c:\windows\syswow64\Oemdspif.dll
2010-08-26 01:55:28 12288 ----a-w- c:\windows\system32\atimuixx.dll
2010-08-26 01:55:22 59392 ----a-w- c:\windows\system32\atiedu64.dll
2010-08-26 01:55:18 43520 ----a-w- c:\windows\syswow64\ati2edxx.dll
2010-08-26 01:52:22 3914240 ----a-w- c:\windows\syswow64\atidxx32.dll
2010-08-26 01:43:28 4602880 ----a-w- c:\windows\system32\atidxx64.dll
2010-08-26 01:34:38 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2010-08-26 01:34:36 46080 ----a-w- c:\windows\syswow64\aticalrt.dll
2010-08-26 01:34:28 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2010-08-26 01:34:26 44032 ----a-w- c:\windows\syswow64\aticalcl.dll
2010-08-26 01:34:16 5425664 ----a-w- c:\windows\system32\aticaldd64.dll
2010-08-26 01:33:52 4032512 ----a-w- c:\windows\syswow64\atiumdag.dll
2010-08-26 01:33:08 4375552 ----a-w- c:\windows\syswow64\aticaldd.dll
2010-08-26 01:33:02 3147264 ----a-w- c:\windows\system32\atiumd6a.dll
2010-08-26 01:27:58 57344 ----a-w- c:\windows\system32\coinst.dll
2010-08-26 01:27:54 5202944 ----a-w- c:\windows\system32\atiumd64.dll
2010-08-26 01:25:58 3392000 ----a-w- c:\windows\syswow64\atiumdva.dll
2010-08-26 01:21:24 338432 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-26 01:21:18 241664 ----a-w- c:\windows\syswow64\atiadlxy.dll
2010-08-26 01:21:08 14848 ----a-w- c:\windows\system32\atig6pxx.dll
2010-08-26 01:21:06 12800 ----a-w- c:\windows\syswow64\atiglpxx.dll
2010-08-26 01:21:06 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-08-26 01:21:02 21504 ----a-w- c:\windows\system32\atig6txx.dll
2010-08-26 01:21:00 19968 ----a-w- c:\windows\syswow64\atigktxx.dll
2010-08-26 01:20:56 279040 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-08-26 01:20:14 39424 ----a-w- c:\windows\system32\atiuxp64.dll
2010-08-26 01:20:08 30208 ----a-w- c:\windows\syswow64\atiuxpag.dll
2010-08-26 01:20:04 37376 ----a-w- c:\windows\system32\atiu9p64.dll
2010-08-26 01:19:56 28160 ----a-w- c:\windows\syswow64\atiu9pag.dll
2010-08-26 01:19:28 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-08-26 01:13:22 53760 ----a-w- c:\windows\system32\atimpc64.dll
2010-08-26 01:13:22 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2010-08-26 01:13:16 52736 ----a-w- c:\windows\syswow64\atimpc32.dll
2010-08-26 01:13:16 52736 ----a-w- c:\windows\syswow64\amdpcom32.dll
2010-08-12 12:15:20 69152 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-08-12 12:15:20 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-07-29 06:30:34 82944 ----a-w- c:\windows\syswow64\iccvid.dll
2010-07-27 14:03:24 12867584 ----a-w- c:\windows\syswow64\shell32.dll
2010-07-27 08:55:50 95520 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 08:55:50 119584 ----a-w- c:\windows\system32\dns-sd.exe
2010-07-27 08:44:10 91424 ----a-w- c:\windows\syswow64\dnssd.dll
2010-07-27 08:44:10 107808 ----a-w- c:\windows\syswow64\dns-sd.exe
2010-07-26 22:14:12 539232 ----a-w- c:\windows\syswow64\LVUI2RC.dll
2010-07-26 22:14:00 543328 ----a-w- c:\windows\syswow64\LVUI2.dll
2010-07-26 22:13:50 559712 ----a-w- c:\windows\system32\LVUIRC64.dll
2010-07-26 22:13:04 771168 ----a-w- c:\windows\system32\LVUI64.dll
2010-07-26 22:08:58 269408 ----a-w- c:\windows\system32\lvco1311021.dll
2010-07-26 22:08:22 398432 ----a-w- c:\windows\system32\lvcod64.dll
2010-07-26 22:07:56 416352 ----a-w- c:\windows\syswow64\lvcodec2.dll
2010-07-26 22:03:20 10829656 ----a-w- c:\windows\syswow64\LogiDPP.dll
2010-07-26 22:03:20 10829656 ----a-w- c:\windows\system32\LogiDPP.dll
2010-07-26 22:03:20 102744 ----a-w- c:\windows\syswow64\LogiDPPApp.exe
2010-07-26 22:03:20 102744 ----a-w- c:\windows\system32\LogiDPPApp.exe
2010-07-26 22:03:18 290648 ----a-w- c:\windows\syswow64\DevManagerCore.dll
2010-07-26 22:03:18 290648 ----a-w- c:\windows\system32\DevManagerCore.dll
2010-07-26 21:55:50 37518 ----a-w- c:\windows\system32\Repository.reg
2010-07-21 10:04:14 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini
2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 19:52:56.27 ===============

can anyone help?
-------------------------

Edit
Waiting for help in the Malware Forum FOUR days or longer? (http://forums.spybot.info/showthread.php?t=1137)
Blade81
2010-10-09, 11:09
Hi,


Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Copy-paste following contents into custom scan -area:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.



Please download MBRCheck (http://ad13.geekstogo.com/MBRCheck.exe) to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log in your reply.
Blade81
2010-10-16, 10:41
Due to inactivity, this thread will now be closed.

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.