Results 1 to 4 of 4

Thread: Need help to get rid of Win32.downloader.gen

  1. #1
    Junior Member
    Join Date
    Sep 2013
    Posts
    2

    Default Need help to get rid of Win32.downloader.gen

    Hi, Spybot found this malware (Win32.downloader.gen) but can't remove it because of an "unexpected error" = cannot create file "C:/Windows/wininit.ini". Access is denied.

    Avast did not identify this malware at all. All I did so far was use ERUNT to create a registry backup. Then I disabled TeaTimer, reran Spybot, but it still didn't work. I'm now at a loss and don't know what to do.

    Any help would be greatly appreciated.

    Basia

    The attach.txt zipped file is attached.

    Here is the DDS.txt
    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 10.0.9200.16686 BrowserJavaVersion: 10.25.2
    Run by Basia at 16:51:41 on 2013-09-29
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4031.1914 [GMT -7:00]
    .
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
    C:\Program Files (x86)\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Program Files (x86)\Pervasive Software\PSQL\bin\w3dbsmgr.exe
    C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    C:\Program Files (x86)\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe
    c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
    C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
    C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
    C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    C:\Windows\SysWOW64\DllHost.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrvProxy.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files (x86)\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrvProxy.exe
    C:\Windows\SYSTEM32\WISPTIS.EXE
    C:\Windows\Explorer.EXE
    C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
    c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
    c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
    C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
    C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
    C:\Windows\System32\WUDFHost.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Sony\VAIO Care\VCsystray.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
    C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
    C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Sony\VAIO Power Management\SPMService.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\Program Files\Java\jre6\bin\jucheck.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
    C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
    C:\Windows\splwow64.exe
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
    C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://paypal.com/
    uSearch Bar = Preserve
    uURLSearchHooks: {df96f37a-accd-42b5-bd3d-629c0895e2b0} - <orphaned>
    mWinlogon: Userinit = C:\Windows\SysWOW64\Userinit.exe
    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
    BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDFViewerPlus\bin\PlusIEContextMenu.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
    TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
    mRun: [SmartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup
    mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    StartupFolder: C:\Users\Basia\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ERUNTA~1.LNK - C:\Program Files (x86)\ERUNT\AUTOBACK.EXE
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-001025-0002-0025-ABCDEFFEDCBC} - <orphaned>
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
    DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} - hxxp://esupport.sony.com/VaioInfo.CAB
    DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://oas.support.microsoft.com/ActiveX/MSDcode.cab
    DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://akamaicdn.webex.com/client/WBXclient-T27L10NSP24-10113/webex/ieatgpc1.cab
    TCP: NameServer = 192.168.0.1 205.171.3.25
    TCP: Interfaces\{B0E160BF-9299-42C3-A389-0FC1DC72135E} : DHCPNameServer = 192.168.0.1 205.171.3.25
    TCP: Interfaces\{B0E160BF-9299-42C3-A389-0FC1DC72135E}\379676E616C6865616C64786 : DHCPNameServer = 192.168.0.1 205.171.3.25
    TCP: Interfaces\{B0E160BF-9299-42C3-A389-0FC1DC72135E}\379676E616C6D2865616C64786 : DHCPNameServer = 192.168.0.1 205.171.3.25
    TCP: Interfaces\{E1DE6791-1BA0-4DD5-8AC2-8C10486FF114} : DHCPNameServer = 10.100.94.1
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    Notify: VESWinlogon - VESWinlogon.dll
    SSODL: WebCheck - <orphaned>
    x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    x64-BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg64.dll
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    x64-Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
    x64-Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\System32\NvCpl.dll,NvStartup
    x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    x64-DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Basia\AppData\Roaming\Mozilla\Firefox\Profiles\nzhkta0k.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=SOLTDF&PC=SUN1&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxps://www.paypal.com/
    FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=SOLTDF&PC=SUN1&q=
    FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_3_6\components\coFFPlgn.dll
    FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\components\IPSFFPl.dll
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll
    FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrlui.dll
    FF - plugin: C:\Program Files (x86)\Virtual Earth 3D\npVE3D.dll
    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: C:\Users\Basia\AppData\Local\Citrix\Plugins\104\npappdetector.dll
    FF - plugin: C:\Users\Basia\AppData\Roaming\Mozilla\plugins\npatgpc.dll
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
    FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-3-3 65336]
    R0 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-3-3 204880]
    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-9-6 55280]
    R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-3-3 1030952]
    R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-3-3 378944]
    R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-16 169312]
    R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2013-3-3 33400]
    R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-3-3 80816]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-9-8 46808]
    R2 DiskDoctorService;Norton Disk Doctor Service;C:\Program Files (x86)\Norton Utilities 15\Tools\Disk Doctor\DiskDoctorSrv.exe [2012-2-26 1029480]
    R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-8-23 13672]
    R2 PDFProFiltSrvPP;PDFProFiltSrvPP;C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [2009-8-27 144672]
    R2 psqlWGE;Pervasive PSQL Workgroup Engine;C:\Program Files (x86)\Pervasive Software\PSQL\bin\w3dbsmgr.exe [2008-6-6 435496]
    R2 regi;regi;C:\Windows\System32\drivers\regi.sys [2007-4-16 14112]
    R2 rimspci;rimspci;C:\Windows\System32\drivers\rimssne64.sys [2009-8-19 91648]
    R2 risdsnpe;risdsnpe;C:\Windows\System32\drivers\risdsne64.sys [2009-8-19 75776]
    R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2013-3-2 1153368]
    R2 SpeedDiskService;Norton SpeedDisk Service;C:\Program Files (x86)\Norton Utilities 15\Tools\SpeedDisk\SpeedDiskSrv.exe [2012-2-26 1037672]
    R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2009-9-6 104960]
    R2 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2009-9-6 411496]
    R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-7-22 642920]
    R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2009-9-6 19968]
    R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\System32\drivers\e1y62x64.sys [2009-8-19 287960]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2009-8-19 56344]
    R3 NW1950;NextWindow 1950 Touch Screen;C:\Windows\System32\drivers\NW1950.sys [2009-8-19 25064]
    R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2009-8-19 11392]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 LMIRescue;LogMeIn Rescue (51def55f-b526-4ee7-8572-bf1c8dfd95bd);"C:\Users\Basia\AppData\Local\Temp\LMID932.tmp\lmi_rescue.exe" -service -sid 51def55f-b526-4ee7-8572-bf1c8dfd95bd --> C:\Users\Basia\AppData\Local\Temp\LMID932.tmp\lmi_rescue.exe [?]
    S2 Roxio Upnp Server 10;Roxio Upnp Server 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-6-26 362992]
    S3 AVerAVF2;AVerAVF2;C:\Windows\System32\drivers\AVerAVF2.sys [2009-8-19 1019776]
    S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]
    S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2009-8-19 35104]
    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2013-9-6 57840]
    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2013-2-5 1512448]
    S3 hidkmdf;Microsoft HID Class Shim for KMDF;C:\Windows\System32\drivers\hidkmdf.sys [2009-8-19 14312]
    S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-6-26 313840]
    S3 SampleCollector;Intel(R) Sample Collector;C:\Program Files\Sony\VAIO Care\collsvc.exe [2009-9-6 167424]
    S3 savt;SAVT Service;C:\Windows\System32\drivers\savt.sys [2009-8-19 4218368]
    S3 SOHCImp;VAIO Media plus Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-9-6 120104]
    S3 SOHDBSvr;VAIO Media plus Database Manager;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-9-6 70952]
    S3 SOHDms;VAIO Media plus Digital Media Server;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-9-6 427304]
    S3 SOHDs;VAIO Media plus Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-9-6 75048]
    S3 SOHPlMgr;VAIO Media plus Playlist Manager;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-9-6 91432]
    S3 SymDSMon;SymDSMon;C:\Windows\System32\drivers\SymDSMon.sys [2012-2-26 191232]
    S3 SYMSpeedDisk;SYMSpeedDisk;C:\Windows\System32\drivers\SymSpeedDisk.sys [2012-2-26 163384]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-7-7 59392]
    S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-9-6 468264]
    S3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2009-9-6 357672]
    S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-9-6 110888]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-17 1255736]
    .
    =============== File Associations ===============
    .
    ShellExec: VCExporterLaunch.exe: open="C:\Program Files (x86)\Sony\VAIO VP Utilities\VCELaunch.exe" "%1"
    .
    =============== Created Last 30 ================
    .
    2013-09-28 02:27:46 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D4FB7FC0-6039-483F-8E32-8AA1684288DE}\offreg.dll
    2013-09-27 13:02:10 9694160 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D4FB7FC0-6039-483F-8E32-8AA1684288DE}\mpengine.dll
    2013-09-12 13:08:12 155584 ----a-w- C:\Windows\System32\drivers\ataport.sys
    2013-09-07 00:08:55 -------- d-----w- C:\Users\Basia\AppData\Roaming\Windows Live Writer
    2013-09-07 00:08:55 -------- d-----w- C:\Users\Basia\AppData\Local\Windows Live Writer
    2013-09-06 22:50:01 -------- d-----w- C:\Windows\en
    2013-09-06 22:43:04 57840 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
    2013-09-06 22:35:33 77656 ----a-w- C:\Windows\System32\XAPOFX1_5.dll
    2013-09-06 22:35:33 74072 ----a-w- C:\Windows\SysWow64\XAPOFX1_5.dll
    2013-09-06 22:35:33 527192 ----a-w- C:\Windows\SysWow64\XAudio2_7.dll
    2013-09-06 22:35:33 518488 ----a-w- C:\Windows\System32\XAudio2_7.dll
    2013-09-06 22:35:31 2526056 ----a-w- C:\Windows\System32\D3DCompiler_43.dll
    2013-09-06 22:35:31 2106216 ----a-w- C:\Windows\SysWow64\D3DCompiler_43.dll
    2013-09-06 22:35:28 276832 ----a-w- C:\Windows\System32\d3dx11_43.dll
    2013-09-06 22:35:28 248672 ----a-w- C:\Windows\SysWow64\d3dx11_43.dll
    2013-09-06 22:34:49 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
    2013-09-06 22:34:49 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
    2013-09-06 22:32:22 5659096 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\98abc4561ceab5005\skydrivesetup.exe
    2013-09-06 22:32:22 -------- d-----w- C:\Program Files (x86)\Microsoft SkyDrive
    2013-09-06 22:32:17 -------- d-----r- C:\Users\Basia\SkyDrive
    2013-09-06 22:31:42 -------- d-----w- C:\ProgramData\Microsoft SkyDrive
    2013-09-06 22:29:47 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\95650d331ceab5004\DXSETUP.exe
    2013-09-06 22:29:47 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\95650d331ceab5004\dsetup32.dll
    2013-09-06 22:29:46 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\95650d331ceab5004\DSETUP.dll
    2013-09-06 22:29:42 89944 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\921875c81ceab5003\DSETUP.dll
    2013-09-06 22:29:42 537432 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\921875c81ceab5003\DXSETUP.exe
    2013-09-06 22:29:42 1801048 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\921875c81ceab5003\dsetup32.dll
    2013-09-06 22:29:26 537432 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\8733ef141ceab5001\DXSETUP.exe
    2013-09-06 22:29:24 1801048 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\8733ef141ceab5001\dsetup32.dll
    2013-09-06 22:29:23 89944 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\8733ef141ceab5001\DSETUP.dll
    2013-09-06 22:29:06 -------- d-----w- C:\Users\Basia\AppData\Local\Windows Live
    2013-09-06 22:18:12 -------- d-----w- C:\Users\Basia\AppData\Roaming\ZoomBrowser EX
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
    2013-09-06 22:05:36 159744 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
    2013-09-05 14:04:02 209272 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
    2013-09-05 14:04:02 209272 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll
    .
    ==================== Find3M ====================
    .
    2013-08-30 07:48:10 72016 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
    2013-08-30 07:48:10 65336 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
    2013-08-30 07:48:10 204880 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
    2013-08-30 07:48:10 1030952 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2013-08-30 07:48:09 80816 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2013-08-30 07:47:40 41664 ----a-w- C:\Windows\avastSS.scr
    2013-08-10 05:22:18 2241024 ----a-w- C:\Windows\System32\wininet.dll
    2013-08-10 05:20:59 3959296 ----a-w- C:\Windows\System32\jscript9.dll
    2013-08-10 05:20:55 67072 ----a-w- C:\Windows\System32\iesetup.dll
    2013-08-10 05:20:55 136704 ----a-w- C:\Windows\System32\iesysprep.dll
    2013-08-10 03:59:10 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
    2013-08-10 03:58:09 2876928 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2013-08-10 03:58:06 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
    2013-08-10 03:58:06 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
    2013-08-10 03:17:38 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
    2013-08-10 03:07:50 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2013-08-10 02:27:59 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
    2013-08-10 02:17:19 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
    2013-08-08 01:20:43 3155456 ----a-w- C:\Windows\System32\win32k.sys
    2013-08-07 11:22:02 278800 ------w- C:\Windows\System32\MpSigStub.exe
    2013-08-02 02:23:53 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2013-08-02 02:15:44 1732032 ----a-w- C:\Windows\System32\ntdll.dll
    2013-08-02 02:15:03 362496 ----a-w- C:\Windows\System32\wow64win.dll
    2013-08-02 02:15:03 243712 ----a-w- C:\Windows\System32\wow64.dll
    2013-08-02 02:15:03 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
    2013-08-02 02:14:57 215040 ----a-w- C:\Windows\System32\winsrv.dll
    2013-08-02 02:14:11 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
    2013-08-02 02:13:34 424448 ----a-w- C:\Windows\System32\KernelBase.dll
    2013-08-02 01:59:30 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2013-08-02 01:59:30 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2013-08-02 01:51:23 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll
    2013-08-02 01:50:42 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
    2013-08-02 01:50:42 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
    2013-08-02 01:09:17 338432 ----a-w- C:\Windows\System32\conhost.exe
    2013-08-02 00:59:09 112640 ----a-w- C:\Windows\System32\smss.exe
    2013-08-02 00:45:37 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
    2013-08-02 00:45:36 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
    2013-08-02 00:45:35 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
    2013-08-02 00:45:34 2048 ----a-w- C:\Windows\SysWow64\user.exe
    2013-08-02 00:43:05 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2013-08-02 00:43:05 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2013-08-02 00:43:05 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2013-08-02 00:43:05 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2013-07-25 09:25:54 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL
    2013-07-25 08:57:27 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
    2013-07-19 01:58:42 2048 ----a-w- C:\Windows\System32\tzres.dll
    2013-07-19 01:41:01 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2013-07-11 09:41:41 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2013-07-11 09:41:40 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2013-07-09 05:52:52 224256 ----a-w- C:\Windows\System32\wintrust.dll
    2013-07-09 05:51:16 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll
    2013-07-09 05:46:20 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
    2013-07-09 05:46:20 1472512 ----a-w- C:\Windows\System32\crypt32.dll
    2013-07-09 05:46:20 139776 ----a-w- C:\Windows\System32\cryptnet.dll
    2013-07-09 04:52:33 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
    2013-07-09 04:52:10 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll
    2013-07-09 04:46:31 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
    2013-07-09 04:46:31 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll
    2013-07-09 04:46:31 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
    2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys
    1999-11-15 16:54:46 7024640 ----a-w- C:\Program Files\gmw5.exe
    1999-11-12 19:30:48 122880 ----a-w- C:\Program Files\GMTB32.DLL
    1999-11-12 19:09:18 565248 ----a-w- C:\Program Files\GM5S32.dll
    1999-11-12 19:06:22 638976 ----a-w- C:\Program Files\gmps32.dll
    1999-11-12 19:04:48 94208 ----a-w- C:\Program Files\GmPlCnd.dll
    1999-11-04 18:38:48 122880 ----a-w- C:\Program Files\Gmcomapi.dll
    1999-11-04 17:36:20 86016 ----a-w- C:\Program Files\Gmfocomw.dll
    1999-10-31 05:09:02 131072 ----a-w- C:\Program Files\DZIP32.DLL
    1999-10-31 05:09:02 110592 ----a-w- C:\Program Files\DUNZIP32.DLL
    1999-10-29 22:13:58 269312 ----a-w- C:\Program Files\L_rlsgm5.exe
    1999-10-27 18:53:16 286720 ----a-w- C:\Program Files\GMSProcs.exe
    1999-09-03 00:58:16 32768 ----a-w- C:\Program Files\gm5sql.dll
    1999-08-23 20:34:18 114688 ----a-w- C:\Program Files\GMNU32.DLL
    1998-01-05 11:00:16 239616 ----a-w- C:\Program Files\gmre32.dll
    1997-12-22 23:01:06 48640 ----a-w- C:\Program Files\Inetwh32.dll
    1996-06-29 06:33:34 37904 ----a-w- C:\Program Files\GOLDPAGE.EXE
    1996-01-23 10:56:56 83976 ----a-w- C:\Program Files\PMSDK16.DLL
    .
    ============= FINISH: 16:52:25.85 ===============

    Here's the aswMBR log file:
    aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
    Run date: 2013-09-29 17:02:55
    -----------------------------
    17:02:55.068 OS Version: Windows x64 6.1.7601 Service Pack 1
    17:02:55.068 Number of processors: 2 586 0x170A
    17:02:55.069 ComputerName: BASIA UserName: Basia
    17:02:56.689 Initialize success
    17:02:57.711 AVAST engine defs: 13092901
    17:03:03.122 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    17:03:03.126 Disk 0 Vendor: WDC_WD3200AAJS-55M0A0 01.03E01 Size: 305245MB BusType: 3
    17:03:03.132 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000064
    17:03:03.135 Disk 1 Vendor: RICOH 02 Size: 305245MB BusType: 0
    17:03:03.138 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000065
    17:03:03.140 Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
    17:03:03.247 Disk 0 MBR read successfully
    17:03:03.253 Disk 0 MBR scan
    17:03:03.260 Disk 0 Windows 7 default MBR code
    17:03:03.272 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 10744 MB offset 2048
    17:03:03.286 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 22005760
    17:03:03.297 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 294399 MB offset 22210560
    17:03:03.315 Disk 0 scanning C:\Windows\system32\drivers
    17:03:15.960 Service scanning
    17:03:36.337 Modules scanning
    17:03:36.350 Disk 0 trace - called modules:
    17:03:36.394 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
    17:03:36.403 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004b254d0]
    17:03:36.413 3 CLASSPNP.SYS[fffff8800188243f] -> nt!IofCallDriver -> [0xfffffa8004696520]
    17:03:36.422 5 ACPI.sys[fffff88000fb07a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004693060]
    17:03:37.136 AVAST engine scan C:\Windows
    17:03:39.486 AVAST engine scan C:\Windows\system32
    17:06:12.683 AVAST engine scan C:\Windows\system32\drivers
    17:06:21.806 AVAST engine scan C:\Users\Basia
    17:08:11.799 Disk 0 MBR has been saved successfully to "C:\Users\Basia\Desktop\MBR.dat"
    17:08:11.808 The log file has been saved successfully to "C:\Users\Basia\Desktop\aswMBR.txt"
    Attached Files Attached Files

  2. #2
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,465

    Default

    Hello Basia,
    Quote Originally Posted by Basia View Post
    Hi, Spybot found this malware (Win32.downloader.gen) but can't remove it because of an "unexpected error" = cannot create file "C:/Windows/wininit.ini". Access is denied.
    That error is produced if Spybot is not run with elevated permissions. Please see: win32.downloader.gen

    Then let me know if the issue is resolved, if not I will remove my post and your reply as helpers look for a zero response.

    Best regards.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  3. #3
    Junior Member
    Join Date
    Sep 2013
    Posts
    2

    Default

    Quote Originally Posted by tashi View Post
    Hello Basia,


    That error is produced if Spybot is not run with elevated permissions. Please see: win32.downloader.gen

    Then let me know if the issue is resolved, if not I will remove my post and your reply as helpers look for a zero response.

    Best regards.
    Hello tashi,
    It worked! Thanks. I guess I have to enable Tea Timer now.
    I really appreciate your help.
    Basia

  4. #4
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,465

    Default

    Hi Basia,

    for letting us know.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •