PDA

View Full Version : Click.giftload


Arconite
2011-04-29, 15:21
I have been having an issue with some virus scanner attempting to self-load onto my system and recently it upgraded in threat level to my PC. it caused several crashes and other situations. this may not be the only malware item within my system since i lived with multiple roomates who would download unknown software on my system without informing me. just want it known.

here is the DDS log. thank god i found a forum for this. i woulda been lost without it.
---------------------------------------------------
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Arconite at 6:06:00.14 on Fri 04/29/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_23
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3326.2253 [GMT -7:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMHID.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\NETGEAR\WG111v3\WG111v3.exe
C:\Program Files\SteelSeries\World of Warcraft MMO Gaming Mouse\WoWMTray.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Arconite\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.search.yahoo.com/?fr=w3i&type=W3i_SP,204,0_0,StartPage,20101148,16898,0,8,0
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: {1631550F-191D-4826-B069-D9439253D926} - No File
BHO: {20FEC4E7-F7B7-438B-8191-33D2EFC5EBEA} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No File
BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - No File
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No File
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
uRun: [Speech Recognition] "c:\windows\speech\common\sapisvr.exe" -SpeechUX -Startup
uRun: [BitTorrent] "c:\program files\bittorrent\BitTorrent.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [SteelSeries World of Warcraft MMO Gaming Mouse] c:\program files\steelseries\world of warcraft mmo gaming mouse\WoWMHID.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\users\arconite\appdata\roaming\micros~1\windows\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\arconite\appdata\roaming\mozilla\firefox\profiles\sznsmp9a.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\wat\npWatWeb.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Video Codec Plugin: plugin@gameplaylabs.com - %profile%\extensions\plugin@gameplaylabs.com
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============
.
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-8-24 1153368]
R3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys [2010-7-19 11136]
R3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver;c:\windows\system32\drivers\wg111v3.sys [2010-11-20 376832]
R3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\drivers\VSTBS23.SYS [2009-7-13 266752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-1-8 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-8-24 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-04-29 12:25:36 -------- d-----w- c:\users\arconite\appdata\local\{AB9389FB-B13A-49FD-B3F8-203FE62BF767}
2011-04-29 12:16:18 -------- d-----w- c:\users\arconite\appdata\local\{8D47646E-F234-4A2B-BEC6-F4B4465DB4A8}
2011-04-29 11:35:00 -------- d-----w- c:\users\arconite\appdata\local\{D172BF67-7535-49AF-9CFD-598F4BB004B5}
2011-04-29 10:37:33 -------- d-----w- c:\users\arconite\appdata\local\{56342F79-9048-44B1-B479-A1F3415BCCD2}
2011-04-29 10:33:08 6792528 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{0943f87a-67f3-42e8-b833-1b435e26e24c}\mpengine.dll
2011-04-29 10:32:21 -------- d-----w- c:\users\arconite\appdata\local\{71E3C695-EDBD-40F6-9937-4BCB0BDA4E73}
2011-04-29 10:09:25 -------- d-----w- c:\users\arconite\appdata\local\{DDE865DD-3286-4AB8-9EA7-9768067A9CF1}
2011-04-29 09:34:23 -------- d-----w- c:\users\arconite\appdata\roaming\AntiVirus AntiSpyware 2011
2011-04-29 09:33:42 -------- d-----w- c:\users\arconite\appdata\roaming\500F2C24F93EA3B3B298B77A53B1F52F
2011-04-26 09:43:08 -------- d-----w- c:\users\arconite\appdata\local\{D996508E-91B3-43E2-80E6-8FF831A77A8D}
2011-04-24 20:40:32 -------- d-----w- c:\users\arconite\appdata\local\{5AFDAC8A-CDF3-46B6-AFFE-D9734F4DA73E}
2011-04-21 00:01:00 -------- d-----w- c:\users\arconite\appdata\local\{5766DBCE-75B2-4E46-A17E-64A89F53E34E}
2011-04-16 20:53:35 -------- d-----w- c:\users\arconite\appdata\local\{00F3669C-2EDB-4637-ABA8-3AB0CBB30B7F}
2011-04-16 20:47:37 -------- d-----w- c:\users\arconite\appdata\local\{032EC494-6FEA-4357-86E2-0E6A0D6B677C}
2011-04-11 16:29:15 -------- d-----w- c:\users\arconite\appdata\local\{9EC38848-0066-48AC-BA14-CE3983DBDFFC}
2011-04-11 04:26:02 -------- d-----w- c:\users\arconite\appdata\local\{00BC7067-6162-47A9-808C-5E3DCC4EA4F0}
2011-04-11 03:39:47 -------- d-----w- c:\windows\system32\SPReview
2011-04-11 03:38:50 -------- d-----w- c:\windows\system32\EventProviders
2011-04-11 03:38:35 -------- d-----w- C:\57fc49ecf6c7d667ebe324fbe13123fa
2011-04-11 03:14:05 -------- d-----w- c:\users\arconite\appdata\local\{81BE1788-D804-4ECC-AF5E-D95F5CBCE398}
2011-04-11 02:57:02 -------- d-----w- c:\progra~2\kAk31002bFfDh31002
2011-04-06 20:52:45 -------- d-----w- c:\users\arconite\appdata\local\{95757B1F-7A60-40ED-AF08-87BD124F0811}
2011-04-03 00:42:20 -------- d-----w- c:\users\arconite\appdata\roaming\RIFT
2011-04-03 00:24:05 -------- d-----w- c:\program files\RIFT Game
2011-04-02 04:27:25 -------- d-----w- c:\users\arconite\appdata\local\{89BC0254-D7E6-4F64-AF3C-D5F56121B5B8}
2011-03-31 00:28:25 -------- d-----w- c:\progra~2\EA Core
2011-03-31 00:28:24 -------- d-----w- c:\progra~2\Electronic Arts
2011-03-31 00:16:30 -------- d-----w- c:\program files\Dragon Age 2
2011-03-31 00:16:30 -------- d-----w- c:\program files\common files\BioWare
.
==================== Find3M ====================
.
2011-02-03 01:11:20 222080 ----a-w- c:\windows\system32\MpSigStub.exe
.
============= FINISH: 6:08:51.87 ===============
Blade81
2011-05-03, 15:43
Hello,

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

BitTorrent


I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282).

Uninstall the programs listed above (in red).
Blade81
2011-05-10, 19:05
Due to inactivity, this thread will now be closed.

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.