farazahmad
2010-11-03, 03:20
Hi,
I am using windows 7 and firefox. When I first click on a google search result, it is redirected to some unknown websites of virus removal etc. I am also getting a pop up message on desktop of "Windows No Disk" and "You are running very low on disk space". I have Avast Antivirus installed and running. I also have MalwareBytes Anti-Malware installed. I performed a quick scan and it found and removed 5 infections below:
Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
C:\Users\Faraz\AppData\Roaming\Microsoft\svchost.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\Users\Faraz\AppData\Roaming\Microsoft\Windows\shell.exe (Trojan.Shell) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{1a82170d-ccb6-4e71-eddd-f79cc44a0a1a} (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.
I know there is still malware present in my system. My browser is also running very slowly. Please help me completely remove the malware.
Here is the DDS log file and attach.zip attached.
=====================================================
DDS (Ver_10-11-01.01) - NTFS_AMD64
Run by Faraz at 22:03:15.70 on Tue 11/02/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2550.866 [GMT -4:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Xming\Xming.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Faraz\AppData\Local\Temp\dwm.exe
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Faraz\AppData\Local\Temp\winsp1up.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Faraz\AppData\Local\Temp\893475281.exe
C:\Users\Faraz\AppData\Roaming\Microsoft\svchost.exe i
C:\Users\Faraz\AppData\Roaming\Microsoft\Windows\shell.exe
C:\Program Files (x86)\ERUNT\ERUNT.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Faraz\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:50370
uURLSearchHooks: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
mURLSearchHooks: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - C:\Program Files (x86)\SpeedBit Video Downloader\Toolbar\tbcore3.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - C:\PROGRA~2\SEARCH~1\SEARCH~1.DLL
BHO: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - C:\PROGRA~2\DAP\DAPIEL~1.DLL
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - C:\PROGRA~2\SPEEDB~1\Toolbar\grabber.dll
TB: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - C:\Program Files (x86)\SpeedBit Video Downloader\Toolbar\tbcore3.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [winsp1up.exe] C:\Users\Faraz\AppData\Local\Temp\winsp1up.exe
uRun: [893475281] C:\Users\Faraz\AppData\Local\Temp\893475281.exe
mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
StartupFolder: C:\Users\Faraz\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ERUNTA~1.LNK - C:\Program Files (x86)\ERUNT\AUTOBACK.EXE
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Clean Traces - C:\Program Files (x86)\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm
IE: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: Free YouTube Download - C:\Users\Faraz\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No File
TB-X64: {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - No File
================= FIREFOX ===================
FF - ProfilePath - C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 1
FF - component: C:\Program Files (x86)\DAP\DAPFireFox\components\DAPFireFox.dll
FF - component: C:\Program Files (x86)\SpeedBit Video Downloader\SPFireFox\components\Engine.dll
FF - component: C:\Users\Faraz\AppData\Roaming\5006\components\AcroFF006.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - HiddenExtension: Java Console: No Registry Reference - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
============= SERVICES / DRIVERS ===============
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-3-21 121936]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-3-21 20048]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-3-21 61008]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-22 40384]
R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-22 40384]
R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-22 40384]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;C:\Windows\System32\drivers\RTL85n64.sys [2009-6-10 378368]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-7-26 79360]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-23 48488]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-4-19 50688]
=============== Created Last 30 ================
2010-11-02 12:30:02 8006480 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{262FC979-4358-4A62-8407-E2F7B440B056}\mpengine.dll
2010-11-01 03:48:08 208 ----a-w- C:\Users\Faraz\AppData\Roaming\dkfjasdfshd.bat
2010-11-01 03:47:29 117248 ------w- C:\Users\Faraz\AppData\Roaming\Microsoft\Windows\shell.exe
2010-11-01 03:47:18 107008 ------w- C:\Users\Faraz\AppData\Roaming\Microsoft\svchost.exe
2010-11-01 03:06:48 -------- d-----w- C:\Program Files\iPod
2010-11-01 03:06:41 -------- d-----w- C:\Program Files\iTunes
2010-11-01 03:04:25 -------- d-----w- C:\Program Files\Bonjour
2010-11-01 03:04:25 -------- d-----w- C:\Program Files (x86)\Bonjour
2010-10-26 20:34:08 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2010-10-26 20:34:08 641536 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2010-10-26 20:34:08 552960 ----a-w- C:\Windows\System32\msdri.dll
2010-10-26 20:34:07 288256 ----a-w- C:\Windows\System32\MSNP.ax
2010-10-26 20:34:07 258560 ----a-w- C:\Windows\System32\mpg2splt.ax
2010-10-26 20:34:07 204288 ----a-w- C:\Windows\SysWow64\MSNP.ax
2010-10-26 20:34:07 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
2010-10-26 20:33:46 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2010-10-24 01:14:13 -------- d-----w- C:\Users\Faraz\AppData\Roaming\Windows Live Writer
2010-10-24 01:14:13 -------- d-----w- C:\Users\Faraz\AppData\Local\Windows Live Writer
2010-10-23 15:36:21 -------- d-----w- C:\Windows\en
2010-10-23 15:33:59 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2010-10-23 15:29:45 48488 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
2010-10-23 15:26:52 -------- d-----w- C:\Program Files (x86)\MSN Toolbar
2010-10-23 15:26:11 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer
2010-10-23 15:25:44 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
2010-10-23 15:25:44 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll
2010-10-23 15:25:43 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
2010-10-23 15:25:43 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
2010-10-23 15:25:34 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll
2010-10-23 15:25:34 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll
2010-10-23 15:25:01 469256 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\72de9f711cb72c60d\InstallManager_WLE_WLE.exe
2010-10-23 15:24:55 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\72116f0f1cb72c60c\MeshBetaRemover.exe
2010-10-23 15:24:51 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6e00bc9a1cb72c60b\DSETUP.dll
2010-10-23 15:24:51 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6e00bc9a1cb72c60b\DXSETUP.exe
2010-10-23 15:24:51 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6e00bc9a1cb72c60b\dsetup32.dll
2010-10-23 15:24:47 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6cac3ec51cb72c60a\DSETUP.dll
2010-10-23 15:24:47 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6cac3ec51cb72c60a\DXSETUP.exe
2010-10-23 15:24:47 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6cac3ec51cb72c60a\dsetup32.dll
2010-10-23 15:24:08 -------- d-----w- C:\Users\Faraz\AppData\Local\Windows Live
2010-10-23 15:22:56 206848 ----a-w- C:\Windows\System32\mfps.dll
2010-10-23 15:22:55 257024 ----a-w- C:\Windows\System32\mfreadwrite.dll
2010-10-23 15:22:54 196608 ----a-w- C:\Windows\SysWow64\mfreadwrite.dll
2010-10-23 15:22:53 1888256 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2010-10-23 15:22:53 1619456 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2010-10-23 15:22:52 4068864 ----a-w- C:\Windows\System32\mf.dll
2010-10-23 15:22:51 3181568 ----a-w- C:\Windows\SysWow64\mf.dll
2010-10-23 15:22:11 -------- d-----w- C:\Users\Faraz\AppData\Roaming\Malwarebytes
2010-10-23 15:21:52 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-10-23 15:21:51 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-10-23 15:21:51 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-10-23 15:21:51 -------- d-----w- C:\PROGRA~3\Malwarebytes
2010-10-23 02:40:40 38848 ----a-w- C:\Windows\avastSS.scr
2010-10-23 01:33:52 -------- d-----w- C:\Program Files (x86)\ESET
2010-10-23 01:24:07 189520 ----a-w- C:\Windows\SysWow64\drivers\tmcomm.sys
2010-10-22 22:53:52 -------- d-----w- C:\PROGRA~3\F-Secure
2010-10-05 04:47:18 0 ----a-w- C:\Users\Faraz\AppData\Roaming\xcfrkz82.default.tmp
2010-10-05 02:10:06 -------- d-----w- C:\Program Files (x86)\Common Files\Akamai
2010-10-05 01:39:47 -------- d-----w- C:\Users\Faraz\AppData\Roaming\5006
==================== Find3M ====================
2010-10-19 15:41:44 270720 ------w- C:\Windows\System32\MpSigStub.exe
2010-09-26 09:21:27 112 ----a-w- C:\Users\Faraz\AppData\Roaming\srvblck2.tmp
2010-09-23 04:47:28 49016 ----a-w- C:\Windows\SysWow64\sirenacm.dll
2010-09-23 04:32:56 301936 ----a-w- C:\Windows\WLXPGSS.SCR
2010-09-21 18:49:02 252800 ----a-w- C:\Windows\System32\LIVESSP.DLL
2010-09-21 18:03:14 208768 ----a-w- C:\Windows\SysWow64\LIVESSP.DLL
2010-09-10 05:35:44 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2010-09-10 05:35:43 347648 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2010-09-08 15:17:46 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2010-09-08 15:17:46 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
2010-09-08 05:36:17 1192960 ----a-w- C:\Windows\System32\wininet.dll
2010-09-08 05:34:34 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2010-09-08 04:30:04 978432 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-09-08 04:28:15 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-08 04:16:38 482816 ----a-w- C:\Windows\System32\html.iec
2010-09-08 03:35:30 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-09-08 03:22:31 386048 ----a-w- C:\Windows\SysWow64\html.iec
2010-09-08 02:48:16 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-09-07 14:47:33 61008 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2010-09-01 05:12:09 12625920 ----a-w- C:\Windows\System32\wmploc.DLL
2010-09-01 04:23:49 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-01 02:58:34 3123712 ----a-w- C:\Windows\System32\win32k.sys
2010-08-31 04:32:30 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 04:32:30 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-27 06:14:02 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2010-08-27 05:46:48 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2010-08-27 03:38:04 463360 ----a-w- C:\Windows\System32\drivers\srv.sys
2010-08-27 03:37:48 402944 ----a-w- C:\Windows\System32\drivers\srv2.sys
2010-08-27 03:37:26 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-26 05:27:28 148992 ----a-w- C:\Windows\System32\t2embed.dll
2010-08-26 04:39:58 109056 ----a-w- C:\Windows\SysWow64\t2embed.dll
2010-08-21 06:38:47 1024512 ----a-w- C:\Windows\System32\wmpmde.dll
2010-08-21 06:36:49 340992 ----a-w- C:\Windows\System32\schannel.dll
2010-08-21 06:31:06 633856 ----a-w- C:\Windows\System32\comctl32.dll
2010-08-21 06:29:47 558592 ----a-w- C:\Windows\System32\spoolsv.exe
2010-08-21 05:36:33 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll
2010-08-21 05:36:24 224256 ----a-w- C:\Windows\SysWow64\schannel.dll
2010-08-21 05:33:24 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll
2010-08-11 03:02:06 737280 ----a-w- C:\Windows\iun6002.exe
============= FINISH: 22:04:49.98 ===============
I am using windows 7 and firefox. When I first click on a google search result, it is redirected to some unknown websites of virus removal etc. I am also getting a pop up message on desktop of "Windows No Disk" and "You are running very low on disk space". I have Avast Antivirus installed and running. I also have MalwareBytes Anti-Malware installed. I performed a quick scan and it found and removed 5 infections below:
Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
C:\Users\Faraz\AppData\Roaming\Microsoft\svchost.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\Users\Faraz\AppData\Roaming\Microsoft\Windows\shell.exe (Trojan.Shell) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{1a82170d-ccb6-4e71-eddd-f79cc44a0a1a} (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.
I know there is still malware present in my system. My browser is also running very slowly. Please help me completely remove the malware.
Here is the DDS log file and attach.zip attached.
=====================================================
DDS (Ver_10-11-01.01) - NTFS_AMD64
Run by Faraz at 22:03:15.70 on Tue 11/02/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_18
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2550.866 [GMT -4:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Xming\Xming.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Faraz\AppData\Local\Temp\dwm.exe
C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Faraz\AppData\Local\Temp\winsp1up.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Faraz\AppData\Local\Temp\893475281.exe
C:\Users\Faraz\AppData\Roaming\Microsoft\svchost.exe i
C:\Users\Faraz\AppData\Roaming\Microsoft\Windows\shell.exe
C:\Program Files (x86)\ERUNT\ERUNT.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Faraz\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:50370
uURLSearchHooks: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
mURLSearchHooks: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - C:\Program Files (x86)\SpeedBit Video Downloader\Toolbar\tbcore3.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - C:\PROGRA~2\SEARCH~1\SEARCH~1.DLL
BHO: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - C:\PROGRA~2\DAP\DAPIEL~1.DLL
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - C:\PROGRA~2\SPEEDB~1\Toolbar\grabber.dll
TB: Softonic-Eng7 Toolbar: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - C:\Program Files (x86)\Softonic-Eng7\tbSoft.dll
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - C:\Program Files (x86)\SpeedBit Video Downloader\Toolbar\tbcore3.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [winsp1up.exe] C:\Users\Faraz\AppData\Local\Temp\winsp1up.exe
uRun: [893475281] C:\Users\Faraz\AppData\Local\Temp\893475281.exe
mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
StartupFolder: C:\Users\Faraz\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ERUNTA~1.LNK - C:\Program Files (x86)\ERUNT\AUTOBACK.EXE
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Clean Traces - C:\Program Files (x86)\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - C:\Program Files (x86)\DAP\dapextie.htm
IE: Download &all with DAP - C:\Program Files (x86)\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
IE: Free YouTube Download - C:\Users\Faraz\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No File
TB-X64: {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - No File
================= FIREFOX ===================
FF - ProfilePath - C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 1
FF - component: C:\Program Files (x86)\DAP\DAPFireFox\components\DAPFireFox.dll
FF - component: C:\Program Files (x86)\SpeedBit Video Downloader\SPFireFox\components\Engine.dll
FF - component: C:\Users\Faraz\AppData\Roaming\5006\components\AcroFF006.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: C:\Users\Faraz\AppData\Roaming\Mozilla\Firefox\Profiles\xcfrkz82.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - HiddenExtension: Java Console: No Registry Reference - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
============= SERVICES / DRIVERS ===============
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-3-21 121936]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-3-21 20048]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-3-21 61008]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-22 40384]
R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-22 40384]
R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-10-22 40384]
R3 RTL85n64;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;C:\Windows\System32\drivers\RTL85n64.sys [2009-6-10 378368]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-7-26 79360]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-23 48488]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-4-19 50688]
=============== Created Last 30 ================
2010-11-02 12:30:02 8006480 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{262FC979-4358-4A62-8407-E2F7B440B056}\mpengine.dll
2010-11-01 03:48:08 208 ----a-w- C:\Users\Faraz\AppData\Roaming\dkfjasdfshd.bat
2010-11-01 03:47:29 117248 ------w- C:\Users\Faraz\AppData\Roaming\Microsoft\Windows\shell.exe
2010-11-01 03:47:18 107008 ------w- C:\Users\Faraz\AppData\Roaming\Microsoft\svchost.exe
2010-11-01 03:06:48 -------- d-----w- C:\Program Files\iPod
2010-11-01 03:06:41 -------- d-----w- C:\Program Files\iTunes
2010-11-01 03:04:25 -------- d-----w- C:\Program Files\Bonjour
2010-11-01 03:04:25 -------- d-----w- C:\Program Files (x86)\Bonjour
2010-10-26 20:34:08 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2010-10-26 20:34:08 641536 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2010-10-26 20:34:08 552960 ----a-w- C:\Windows\System32\msdri.dll
2010-10-26 20:34:07 288256 ----a-w- C:\Windows\System32\MSNP.ax
2010-10-26 20:34:07 258560 ----a-w- C:\Windows\System32\mpg2splt.ax
2010-10-26 20:34:07 204288 ----a-w- C:\Windows\SysWow64\MSNP.ax
2010-10-26 20:34:07 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
2010-10-26 20:33:46 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2010-10-24 01:14:13 -------- d-----w- C:\Users\Faraz\AppData\Roaming\Windows Live Writer
2010-10-24 01:14:13 -------- d-----w- C:\Users\Faraz\AppData\Local\Windows Live Writer
2010-10-23 15:36:21 -------- d-----w- C:\Windows\en
2010-10-23 15:33:59 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2010-10-23 15:29:45 48488 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
2010-10-23 15:26:52 -------- d-----w- C:\Program Files (x86)\MSN Toolbar
2010-10-23 15:26:11 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer
2010-10-23 15:25:44 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
2010-10-23 15:25:44 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll
2010-10-23 15:25:43 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
2010-10-23 15:25:43 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
2010-10-23 15:25:34 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll
2010-10-23 15:25:34 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll
2010-10-23 15:25:01 469256 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\72de9f711cb72c60d\InstallManager_WLE_WLE.exe
2010-10-23 15:24:55 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\72116f0f1cb72c60c\MeshBetaRemover.exe
2010-10-23 15:24:51 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6e00bc9a1cb72c60b\DSETUP.dll
2010-10-23 15:24:51 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6e00bc9a1cb72c60b\DXSETUP.exe
2010-10-23 15:24:51 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6e00bc9a1cb72c60b\dsetup32.dll
2010-10-23 15:24:47 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6cac3ec51cb72c60a\DSETUP.dll
2010-10-23 15:24:47 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6cac3ec51cb72c60a\DXSETUP.exe
2010-10-23 15:24:47 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6cac3ec51cb72c60a\dsetup32.dll
2010-10-23 15:24:08 -------- d-----w- C:\Users\Faraz\AppData\Local\Windows Live
2010-10-23 15:22:56 206848 ----a-w- C:\Windows\System32\mfps.dll
2010-10-23 15:22:55 257024 ----a-w- C:\Windows\System32\mfreadwrite.dll
2010-10-23 15:22:54 196608 ----a-w- C:\Windows\SysWow64\mfreadwrite.dll
2010-10-23 15:22:53 1888256 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2010-10-23 15:22:53 1619456 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2010-10-23 15:22:52 4068864 ----a-w- C:\Windows\System32\mf.dll
2010-10-23 15:22:51 3181568 ----a-w- C:\Windows\SysWow64\mf.dll
2010-10-23 15:22:11 -------- d-----w- C:\Users\Faraz\AppData\Roaming\Malwarebytes
2010-10-23 15:21:52 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-10-23 15:21:51 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-10-23 15:21:51 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-10-23 15:21:51 -------- d-----w- C:\PROGRA~3\Malwarebytes
2010-10-23 02:40:40 38848 ----a-w- C:\Windows\avastSS.scr
2010-10-23 01:33:52 -------- d-----w- C:\Program Files (x86)\ESET
2010-10-23 01:24:07 189520 ----a-w- C:\Windows\SysWow64\drivers\tmcomm.sys
2010-10-22 22:53:52 -------- d-----w- C:\PROGRA~3\F-Secure
2010-10-05 04:47:18 0 ----a-w- C:\Users\Faraz\AppData\Roaming\xcfrkz82.default.tmp
2010-10-05 02:10:06 -------- d-----w- C:\Program Files (x86)\Common Files\Akamai
2010-10-05 01:39:47 -------- d-----w- C:\Users\Faraz\AppData\Roaming\5006
==================== Find3M ====================
2010-10-19 15:41:44 270720 ------w- C:\Windows\System32\MpSigStub.exe
2010-09-26 09:21:27 112 ----a-w- C:\Users\Faraz\AppData\Roaming\srvblck2.tmp
2010-09-23 04:47:28 49016 ----a-w- C:\Windows\SysWow64\sirenacm.dll
2010-09-23 04:32:56 301936 ----a-w- C:\Windows\WLXPGSS.SCR
2010-09-21 18:49:02 252800 ----a-w- C:\Windows\System32\LIVESSP.DLL
2010-09-21 18:03:14 208768 ----a-w- C:\Windows\SysWow64\LIVESSP.DLL
2010-09-10 05:35:44 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2010-09-10 05:35:43 347648 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2010-09-08 15:17:46 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2010-09-08 15:17:46 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts
2010-09-08 05:36:17 1192960 ----a-w- C:\Windows\System32\wininet.dll
2010-09-08 05:34:34 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2010-09-08 04:30:04 978432 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-09-08 04:28:15 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-08 04:16:38 482816 ----a-w- C:\Windows\System32\html.iec
2010-09-08 03:35:30 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-09-08 03:22:31 386048 ----a-w- C:\Windows\SysWow64\html.iec
2010-09-08 02:48:16 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-09-07 14:47:33 61008 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2010-09-01 05:12:09 12625920 ----a-w- C:\Windows\System32\wmploc.DLL
2010-09-01 04:23:49 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-01 02:58:34 3123712 ----a-w- C:\Windows\System32\win32k.sys
2010-08-31 04:32:30 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 04:32:30 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-27 06:14:02 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2010-08-27 05:46:48 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2010-08-27 03:38:04 463360 ----a-w- C:\Windows\System32\drivers\srv.sys
2010-08-27 03:37:48 402944 ----a-w- C:\Windows\System32\drivers\srv2.sys
2010-08-27 03:37:26 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-26 05:27:28 148992 ----a-w- C:\Windows\System32\t2embed.dll
2010-08-26 04:39:58 109056 ----a-w- C:\Windows\SysWow64\t2embed.dll
2010-08-21 06:38:47 1024512 ----a-w- C:\Windows\System32\wmpmde.dll
2010-08-21 06:36:49 340992 ----a-w- C:\Windows\System32\schannel.dll
2010-08-21 06:31:06 633856 ----a-w- C:\Windows\System32\comctl32.dll
2010-08-21 06:29:47 558592 ----a-w- C:\Windows\System32\spoolsv.exe
2010-08-21 05:36:33 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll
2010-08-21 05:36:24 224256 ----a-w- C:\Windows\SysWow64\schannel.dll
2010-08-21 05:33:24 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll
2010-08-11 03:02:06 737280 ----a-w- C:\Windows\iun6002.exe
============= FINISH: 22:04:49.98 ===============