jestein
Posts: 48 +0
Hi this is my first time requesting assistance from the users and mods of techspot. I appreciate all help given. My computer has been acting slow and is infected with a trojan that malwarebytes has detected but has been unable to remove successfully. Thanks in advance for your assistance in cleaning up my computer.
MBAM LOG:
Malwarebytes Anti-Malware (PRO) 1.65.0.1400
www.malwarebytes.org
Database version: v2012.09.26.02
Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Admin :: LINDSAY-PC [administrator]
Protection: Enabled
9/25/2012 9:43:19 PM
mbam-log-2012-09-25 (22-11-30).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 252473
Time elapsed: 17 minute(s), 58 second(s)
Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 2604 -> No action taken.
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> No action taken.
(end)
GMER LOG:
GMER did not find any modifications and did not produce a log
DDS LOG:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_35
Run by Admin at 22:36:31 on 2012-09-25
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3838.571 [GMT -7:00]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\mqsvc.exe
c:\Program Files\Microsoft SQL Server\MSSQL10.SOPHOS\MSSQL\Binn\sqlservr.exe
C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe
C:\Program Files (x86)\Sophos\Encryption\BLService.exe
C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\ManagementAgentNT.exe
C:\Program Files (x86)\Sophos\Enterprise Console\CertificationManagerServiceNT.exe
C:\Program Files (x86)\Sophos\Enterprise Console\MgntSvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe
C:\Program Files\Sophos\Enterprise Console\Sophos.FrontEnd.Service.exe
C:\Windows\System32\spool\drivers\x64\3\E_IATIFBA.EXE
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
C:\Program Files\Sophos\Patch\PatchEndpointCommunicator\PatchEndpointCommunicator.exe
C:\Program Files\Sophos\Patch\PatchEndpointOrchestrator\PatchEndpointOrchestrator.exe
C:\Program Files\Sophos\Patch\PatchServerCommunicator\PatchServerCommunicator.exe
-netsvcs
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWlan.exe
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Users\Admin\Downloads\rm0srrso.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\PHOTOF~1.LNK - C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll/206
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
LSP: mswsock.dll
Trusted Zone: jcatsdefender.com\caaoc
Trusted Zone: jcatsdefender.com\traincaaoc
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} - hxxp://www.photodex.com/pxplay.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C2E68E71-4D89-4571-ADDE-07B7D237543A} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C2E68E71-4D89-4571-ADDE-07B7D237543A}\E4544574541425D22343D274 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{C2E68E71-4D89-4571-ADDE-07B7D237543A}\E4544574541425D22343D274 : DhcpNameServer = 192.168.1.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
BHO-X64: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO-X64: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll
BHO-X64: BitComet ClickCapture - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
mRun-x64: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun-x64: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
IE-X64: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE-X64: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll/206
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bsiu5cbq.default\
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-7-18 140672]
R2 cpuz134;cpuz134;\??\C:\Windows\system32\drivers\cpuz134_x64.sys --> C:\Windows\system32\drivers\cpuz134_x64.sys [?]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-12 399432]
R2 MSSQL$SOPHOS;SQL Server (SOPHOS);C:\Program Files\Microsoft SQL Server\MSSQL10.SOPHOS\MSSQL\Binn\sqlservr.exe [2010-9-17 57966424]
R2 Realtek11nSU;Realtek11nSU;C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [2010-11-29 36864]
R2 SGNBusinessLogicService;Sophos Encryption Business Logic Service;C:\Program Files (x86)\Sophos\Encryption\BLService.exe [2012-4-29 12800]
R2 Sophos Agent;Sophos Agent;C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\ManagementAgentNT.exe [2011-10-18 282624]
R2 Sophos Certification Manager;Sophos Certification Manager;C:\Program Files (x86)\Sophos\Enterprise Console\CertificationManagerServiceNT.exe [2011-10-18 77824]
R2 Sophos Management Service;Sophos Management Service;C:\Program Files (x86)\Sophos\Enterprise Console\MgntSvc.exe [2012-4-27 5839872]
R2 Sophos Message Router;Sophos Message Router;C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe [2011-10-18 806912]
R2 SophosManagementHostService;Sophos Management Host;C:\Program Files\Sophos\Enterprise Console\Sophos.FrontEnd.Service.exe [2012-4-27 9728]
R2 SophosPatchEndpointCommunicator;Sophos Patch Endpoint Communicator;C:\Program Files\Sophos\Patch\PatchEndpointCommunicator\PatchEndpointCommunicator.exe [2012-4-27 151064]
R2 SophosPatchOrchestratorService;Sophos Patch Endpoint Orchestrator;C:\Program Files\Sophos\Patch\PatchEndpointOrchestrator\PatchEndpointOrchestrator.exe [2012-4-27 19992]
R2 SophosPatchServerCommunicator;Sophos Patch Server Communicator;C:\Program Files\Sophos\Patch\PatchServerCommunicator\PatchServerCommunicator.exe [2012-4-27 61464]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8192su.sys --> C:\Windows\system32\DRIVERS\RTL8192su.sys [?]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-12 676936]
S2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files (x86)/PostgreSQL/8.4/data" -w --> C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-13 250288]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2010-9-19 61976]
S4 RsFx0103;RsFx0103 Driver;C:\Windows\system32\DRIVERS\RsFx0103.sys --> C:\Windows\system32\DRIVERS\RsFx0103.sys [?]
S4 SQLAgent$SOPHOS;SQL Server Agent (SOPHOS);C:\Program Files\Microsoft SQL Server\MSSQL10.SOPHOS\MSSQL\Binn\SQLAGENT.EXE [2010-9-17 430424]
.
=============== Created Last 30 ================
.
4103-10-08 07:18:11 -------- d-----w- C:\Windows\pss
2099-10-22 12:04:31 -------- d-----w- C:\Program Files\iPod
2099-10-22 12:04:30 -------- d-----w- C:\Program Files\iTunes
2099-10-22 12:04:30 -------- d-----w- C:\Program Files (x86)\iTunes
2099-10-22 12:03:17 -------- d-----w- C:\Program Files\Bonjour
2099-10-22 12:03:17 -------- d-----w- C:\Program Files (x86)\Bonjour
2012-09-26 03:35:10 20480 ----a-w- C:\Windows\svchost.exe
2012-09-17 00:53:24 -------- d-----w- C:\ProgramData\Utimaco
2012-09-17 00:53:24 -------- d-----w- C:\Program Files (x86)\Sophos
2012-09-17 00:53:24 -------- d-----w- C:\Program Files (x86)\Common Files\Business Objects
2012-09-17 00:52:22 -------- d-----w- C:\Program Files\Sophos
2012-09-17 00:50:19 78872 ----a-w- C:\Windows\System32\perf-SQLAgent$SOPHOS-sqlagtctr10.2.4000.0.dll
2012-09-17 00:50:19 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SOPHOS-sqlagtctr10.2.4000.0.dll
2012-09-17 00:50:07 72536 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SOPHOS-sqlctr10.2.4000.0.dll
2012-09-17 00:50:07 108376 ----a-w- C:\Windows\System32\perf-MSSQL$SOPHOS-sqlctr10.2.4000.0.dll
2012-09-17 00:49:25 -------- d-----w- C:\Windows\System32\RsFx
2012-09-17 00:48:41 -------- d-----w- C:\Windows\SysWow64\1033
2012-09-17 00:48:41 -------- d-----w- C:\Windows\System32\1033
2012-09-17 00:46:45 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2012-09-17 00:45:56 -------- d-----w- C:\Program Files\Microsoft SQL Server
2012-09-17 00:43:28 -------- d-----w- C:\Windows\System32\msmq
2012-09-17 00:42:37 -------- d-----w- C:\Program Files (x86)\Business Objects
2012-09-17 00:40:02 -------- d-----w- C:\ProgramData\Sophos
2012-09-17 00:39:20 -------- d-----w- C:\sec_51
2012-09-13 03:35:02 477168 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll
2012-09-13 03:32:00 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-09-13 03:31:27 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-09-13 03:30:59 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-09-13 03:30:59 186752 ----a-w- C:\Windows\System32\wuwebv.dll
2012-09-13 03:26:35 -------- d-----w- C:\ProgramData\!SASCORE
2012-09-13 03:22:50 -------- d-----w- C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
2012-09-13 02:46:26 -------- d-----w- C:\Users\Admin\AppData\Roaming\Malwarebytes
2012-08-30 16:33:03 -------- d-----w- C:\Users\Admin\AppData\Local\Apple
2012-08-30 07:22:02 -------- d-----w- C:\Program Files (x86)\MSECache
2012-08-30 07:13:26 -------- d-----w- C:\Program Files (x86)\Investintech.com Inc
2012-08-30 05:04:49 -------- d-----w- C:\Users\Admin\AppData\Local\Adobe
2012-08-30 04:57:58 -------- d-----w- C:\Users\Admin\AppData\Local\Macromedia
2012-08-30 04:57:40 -------- d-----w- C:\Users\Admin\AppData\Local\Mozilla
.
==================== Find3M ====================
.
2012-09-21 08:12:52 73136 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-09-21 08:12:52 696240 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-09-13 03:34:46 473072 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-09-08 00:04:46 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
.
============= FINISH: 22:37:02.43 ===============
DDS ATTACH LOG:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 11/29/2010 10:01:50 AM
System Uptime: 9/25/2012 8:49:46 PM (2 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | M4A78T-E
Processor: AMD Athlon(tm) II X4 630 Processor | AM3 | 2809/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 541 GiB total, 445.147 GiB free.
D: is FIXED (NTFS) - 391 GiB total, 369.847 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description:
Device ID: ACPI\ATK0110\1010110
Manufacturer:
Name:
PNP Device ID: ACPI\ATK0110\1010110
Service:
.
==== System Restore Points ===================
.
RP1: 11/29/2010 9:13:45 AM - Installed REALTEK PCIE Wireless LAN Driver
RP2: 11/29/2010 9:21:49 AM - Installed REALTEK PCIE Wireless LAN Driver
RP56: 9/12/2012 7:28:41 PM - Installed Rosetta Stone V3.
RP57: 9/12/2012 7:31:12 PM - Installed Rosetta Stone V3.
RP58: 9/12/2012 7:32:04 PM - Installed Rosetta Stone V3.
RP59: 9/12/2012 7:32:56 PM - Installed Rosetta Stone V3.
RP60: 9/12/2012 7:44:42 PM - Installed Rosetta Stone V3.
RP61: 9/12/2012 8:16:57 PM - Installed Rosetta Stone V3.
RP62: 9/12/2012 8:30:32 PM - Windows Update
RP63: 9/12/2012 8:33:45 PM - Installed Java(TM) 6 Update 35
RP64: 9/12/2012 9:43:33 PM - Installed Rosetta Stone V3.
RP65: 9/12/2012 9:50:27 PM - Installed Rosetta Stone V3.
RP66: 9/12/2012 9:51:55 PM - Installed Rosetta Stone V3.
RP67: 9/12/2012 9:56:10 PM - Installed Rosetta Stone V3.
RP68: 9/16/2012 5:42:59 PM - Windows Modules Installer
.
==== Installed Programs ======================
.
7-Zip 9.20
Able2Extract 7.0
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 8.1.1
AIM 7
Apple Application Support
Apple Software Update
BitComet 1.11
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Download Updater (AOL LLC)
Epson CreativeZone
Epson Easy Photo Print 2
Epson Event Manager
EPSON Scan
Evernote v. 4.5.3
Fallout 3
Freecorder 5
Full Tilt Poker
Java Auto Updater
Java(TM) 6 Update 35
Jcats AOC
Malwarebytes Anti-Malware version 1.65.0.1400
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
Microsoft SQL Server 2008 Browser
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox 10.0.2 (x86 en-US)
Oblivion
Photodex Presenter
PHOTOfunSTUDIO 5.0
PokerStars
PostgreSQL 8.4
PowerISO
QuickTime
REALTEK Wireless LAN Driver and Utility
SitNGo Wizard
TableNinja
Virtual DJ Pro Full - Atomix Productions
Visual Studio 2008 x64 Redistributables
WinRAR archiver
.
==== Event Viewer Messages From Past Week ========
.
9/25/2012 8:51:05 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Realtek11nSU service.
9/25/2012 8:50:17 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
9/25/2012 8:50:15 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
9/25/2012 8:50:14 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
9/25/2012 8:34:12 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x000004a8000000e0, 0x0000000000000002, 0x0000000000000001, 0xfffff80002a54995). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 092512-28126-01.
9/25/2012 8:16:56 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002d72fea, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 092512-26629-01.
9/25/2012 10:36:07 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
11/8/2099 11:09:07 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer JESTEIN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C2E68E71-4D89-4571-ADDE-07B7D237543A}. The master browser is stopping or an election is being forced.
11/8/2099 10:57:02 PM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.8. The computer with the IP address 192.168.1.6 did not allow the name to be claimed by this computer.
11/17/2099 11:43:00 PM, Error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.4 with the system having network hardware address 00-26-B0-28-F4-41. Network operations on this system may be disrupted as a result.
10/22/2099 5:04:34 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
10/22/2099 5:03:34 AM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/22/2099 5:03:23 AM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/10/2099 5:38:46 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{C2E68E71-4D89-4571-ADDE-07B7D237543A} because another computer on the network has the same name. The server could not start.
10/10/2099 5:38:46 PM, Error: NetBT [4321] - The name "LINDSAY-PC :20" could not be registered on the interface with IP address 192.168.1.9. The computer with the IP address 192.168.1.2 did not allow the name to be claimed by this computer.
10/10/2099 5:38:46 PM, Error: NetBT [4321] - The name "LINDSAY-PC :0" could not be registered on the interface with IP address 192.168.1.9. The computer with the IP address 192.168.1.2 did not allow the name to be claimed by this computer.
.
==== End Of File ===========================
MBAM LOG:
Malwarebytes Anti-Malware (PRO) 1.65.0.1400
www.malwarebytes.org
Database version: v2012.09.26.02
Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Admin :: LINDSAY-PC [administrator]
Protection: Enabled
9/25/2012 9:43:19 PM
mbam-log-2012-09-25 (22-11-30).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 252473
Time elapsed: 17 minute(s), 58 second(s)
Memory Processes Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> 2604 -> No action taken.
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Windows\svchost.exe (Trojan.Agent) -> No action taken.
(end)
GMER LOG:
GMER did not find any modifications and did not produce a log
DDS LOG:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_35
Run by Admin at 22:36:31 on 2012-09-25
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.3838.571 [GMT -7:00]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\mqsvc.exe
c:\Program Files\Microsoft SQL Server\MSSQL10.SOPHOS\MSSQL\Binn\sqlservr.exe
C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe
C:\Program Files (x86)\Sophos\Encryption\BLService.exe
C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\ManagementAgentNT.exe
C:\Program Files (x86)\Sophos\Enterprise Console\CertificationManagerServiceNT.exe
C:\Program Files (x86)\Sophos\Enterprise Console\MgntSvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe
C:\Program Files\Sophos\Enterprise Console\Sophos.FrontEnd.Service.exe
C:\Windows\System32\spool\drivers\x64\3\E_IATIFBA.EXE
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
C:\Program Files\Sophos\Patch\PatchEndpointCommunicator\PatchEndpointCommunicator.exe
C:\Program Files\Sophos\Patch\PatchEndpointOrchestrator\PatchEndpointOrchestrator.exe
C:\Program Files\Sophos\Patch\PatchServerCommunicator\PatchServerCommunicator.exe
-netsvcs
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWlan.exe
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe
C:\Users\Admin\Downloads\rm0srrso.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\PHOTOF~1.LNK - C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll/206
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
LSP: mswsock.dll
Trusted Zone: jcatsdefender.com\caaoc
Trusted Zone: jcatsdefender.com\traincaaoc
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} - hxxp://www.photodex.com/pxplay.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C2E68E71-4D89-4571-ADDE-07B7D237543A} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C2E68E71-4D89-4571-ADDE-07B7D237543A}\E4544574541425D22343D274 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{C2E68E71-4D89-4571-ADDE-07B7D237543A}\E4544574541425D22343D274 : DhcpNameServer = 192.168.1.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
BHO-X64: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO-X64: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll
BHO-X64: BitComet ClickCapture - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
mRun-x64: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun-x64: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
IE-X64: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE-X64: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.3.3.2.dll/206
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bsiu5cbq.default\
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_278.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-7-18 140672]
R2 cpuz134;cpuz134;\??\C:\Windows\system32\drivers\cpuz134_x64.sys --> C:\Windows\system32\drivers\cpuz134_x64.sys [?]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-12 399432]
R2 MSSQL$SOPHOS;SQL Server (SOPHOS);C:\Program Files\Microsoft SQL Server\MSSQL10.SOPHOS\MSSQL\Binn\sqlservr.exe [2010-9-17 57966424]
R2 Realtek11nSU;Realtek11nSU;C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [2010-11-29 36864]
R2 SGNBusinessLogicService;Sophos Encryption Business Logic Service;C:\Program Files (x86)\Sophos\Encryption\BLService.exe [2012-4-29 12800]
R2 Sophos Agent;Sophos Agent;C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\ManagementAgentNT.exe [2011-10-18 282624]
R2 Sophos Certification Manager;Sophos Certification Manager;C:\Program Files (x86)\Sophos\Enterprise Console\CertificationManagerServiceNT.exe [2011-10-18 77824]
R2 Sophos Management Service;Sophos Management Service;C:\Program Files (x86)\Sophos\Enterprise Console\MgntSvc.exe [2012-4-27 5839872]
R2 Sophos Message Router;Sophos Message Router;C:\Program Files (x86)\Sophos\Enterprise Console\Remote Management System\RouterNT.exe [2011-10-18 806912]
R2 SophosManagementHostService;Sophos Management Host;C:\Program Files\Sophos\Enterprise Console\Sophos.FrontEnd.Service.exe [2012-4-27 9728]
R2 SophosPatchEndpointCommunicator;Sophos Patch Endpoint Communicator;C:\Program Files\Sophos\Patch\PatchEndpointCommunicator\PatchEndpointCommunicator.exe [2012-4-27 151064]
R2 SophosPatchOrchestratorService;Sophos Patch Endpoint Orchestrator;C:\Program Files\Sophos\Patch\PatchEndpointOrchestrator\PatchEndpointOrchestrator.exe [2012-4-27 19992]
R2 SophosPatchServerCommunicator;Sophos Patch Server Communicator;C:\Program Files\Sophos\Patch\PatchServerCommunicator\PatchServerCommunicator.exe [2012-4-27 61464]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8192su.sys --> C:\Windows\system32\DRIVERS\RTL8192su.sys [?]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-12 676936]
S2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files (x86)/PostgreSQL/8.4/data" -w --> C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-13 250288]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2010-9-19 61976]
S4 RsFx0103;RsFx0103 Driver;C:\Windows\system32\DRIVERS\RsFx0103.sys --> C:\Windows\system32\DRIVERS\RsFx0103.sys [?]
S4 SQLAgent$SOPHOS;SQL Server Agent (SOPHOS);C:\Program Files\Microsoft SQL Server\MSSQL10.SOPHOS\MSSQL\Binn\SQLAGENT.EXE [2010-9-17 430424]
.
=============== Created Last 30 ================
.
4103-10-08 07:18:11 -------- d-----w- C:\Windows\pss
2099-10-22 12:04:31 -------- d-----w- C:\Program Files\iPod
2099-10-22 12:04:30 -------- d-----w- C:\Program Files\iTunes
2099-10-22 12:04:30 -------- d-----w- C:\Program Files (x86)\iTunes
2099-10-22 12:03:17 -------- d-----w- C:\Program Files\Bonjour
2099-10-22 12:03:17 -------- d-----w- C:\Program Files (x86)\Bonjour
2012-09-26 03:35:10 20480 ----a-w- C:\Windows\svchost.exe
2012-09-17 00:53:24 -------- d-----w- C:\ProgramData\Utimaco
2012-09-17 00:53:24 -------- d-----w- C:\Program Files (x86)\Sophos
2012-09-17 00:53:24 -------- d-----w- C:\Program Files (x86)\Common Files\Business Objects
2012-09-17 00:52:22 -------- d-----w- C:\Program Files\Sophos
2012-09-17 00:50:19 78872 ----a-w- C:\Windows\System32\perf-SQLAgent$SOPHOS-sqlagtctr10.2.4000.0.dll
2012-09-17 00:50:19 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SOPHOS-sqlagtctr10.2.4000.0.dll
2012-09-17 00:50:07 72536 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SOPHOS-sqlctr10.2.4000.0.dll
2012-09-17 00:50:07 108376 ----a-w- C:\Windows\System32\perf-MSSQL$SOPHOS-sqlctr10.2.4000.0.dll
2012-09-17 00:49:25 -------- d-----w- C:\Windows\System32\RsFx
2012-09-17 00:48:41 -------- d-----w- C:\Windows\SysWow64\1033
2012-09-17 00:48:41 -------- d-----w- C:\Windows\System32\1033
2012-09-17 00:46:45 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2012-09-17 00:45:56 -------- d-----w- C:\Program Files\Microsoft SQL Server
2012-09-17 00:43:28 -------- d-----w- C:\Windows\System32\msmq
2012-09-17 00:42:37 -------- d-----w- C:\Program Files (x86)\Business Objects
2012-09-17 00:40:02 -------- d-----w- C:\ProgramData\Sophos
2012-09-17 00:39:20 -------- d-----w- C:\sec_51
2012-09-13 03:35:02 477168 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll
2012-09-13 03:32:00 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-09-13 03:31:27 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-09-13 03:30:59 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-09-13 03:30:59 186752 ----a-w- C:\Windows\System32\wuwebv.dll
2012-09-13 03:26:35 -------- d-----w- C:\ProgramData\!SASCORE
2012-09-13 03:22:50 -------- d-----w- C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
2012-09-13 02:46:26 -------- d-----w- C:\Users\Admin\AppData\Roaming\Malwarebytes
2012-08-30 16:33:03 -------- d-----w- C:\Users\Admin\AppData\Local\Apple
2012-08-30 07:22:02 -------- d-----w- C:\Program Files (x86)\MSECache
2012-08-30 07:13:26 -------- d-----w- C:\Program Files (x86)\Investintech.com Inc
2012-08-30 05:04:49 -------- d-----w- C:\Users\Admin\AppData\Local\Adobe
2012-08-30 04:57:58 -------- d-----w- C:\Users\Admin\AppData\Local\Macromedia
2012-08-30 04:57:40 -------- d-----w- C:\Users\Admin\AppData\Local\Mozilla
.
==================== Find3M ====================
.
2012-09-21 08:12:52 73136 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-09-21 08:12:52 696240 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-09-13 03:34:46 473072 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-09-08 00:04:46 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
.
============= FINISH: 22:37:02.43 ===============
DDS ATTACH LOG:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 11/29/2010 10:01:50 AM
System Uptime: 9/25/2012 8:49:46 PM (2 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | M4A78T-E
Processor: AMD Athlon(tm) II X4 630 Processor | AM3 | 2809/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 541 GiB total, 445.147 GiB free.
D: is FIXED (NTFS) - 391 GiB total, 369.847 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description:
Device ID: ACPI\ATK0110\1010110
Manufacturer:
Name:
PNP Device ID: ACPI\ATK0110\1010110
Service:
.
==== System Restore Points ===================
.
RP1: 11/29/2010 9:13:45 AM - Installed REALTEK PCIE Wireless LAN Driver
RP2: 11/29/2010 9:21:49 AM - Installed REALTEK PCIE Wireless LAN Driver
RP56: 9/12/2012 7:28:41 PM - Installed Rosetta Stone V3.
RP57: 9/12/2012 7:31:12 PM - Installed Rosetta Stone V3.
RP58: 9/12/2012 7:32:04 PM - Installed Rosetta Stone V3.
RP59: 9/12/2012 7:32:56 PM - Installed Rosetta Stone V3.
RP60: 9/12/2012 7:44:42 PM - Installed Rosetta Stone V3.
RP61: 9/12/2012 8:16:57 PM - Installed Rosetta Stone V3.
RP62: 9/12/2012 8:30:32 PM - Windows Update
RP63: 9/12/2012 8:33:45 PM - Installed Java(TM) 6 Update 35
RP64: 9/12/2012 9:43:33 PM - Installed Rosetta Stone V3.
RP65: 9/12/2012 9:50:27 PM - Installed Rosetta Stone V3.
RP66: 9/12/2012 9:51:55 PM - Installed Rosetta Stone V3.
RP67: 9/12/2012 9:56:10 PM - Installed Rosetta Stone V3.
RP68: 9/16/2012 5:42:59 PM - Windows Modules Installer
.
==== Installed Programs ======================
.
7-Zip 9.20
Able2Extract 7.0
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 8.1.1
AIM 7
Apple Application Support
Apple Software Update
BitComet 1.11
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Download Updater (AOL LLC)
Epson CreativeZone
Epson Easy Photo Print 2
Epson Event Manager
EPSON Scan
Evernote v. 4.5.3
Fallout 3
Freecorder 5
Full Tilt Poker
Java Auto Updater
Java(TM) 6 Update 35
Jcats AOC
Malwarebytes Anti-Malware version 1.65.0.1400
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
Microsoft SQL Server 2008 Browser
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox 10.0.2 (x86 en-US)
Oblivion
Photodex Presenter
PHOTOfunSTUDIO 5.0
PokerStars
PostgreSQL 8.4
PowerISO
QuickTime
REALTEK Wireless LAN Driver and Utility
SitNGo Wizard
TableNinja
Virtual DJ Pro Full - Atomix Productions
Visual Studio 2008 x64 Redistributables
WinRAR archiver
.
==== Event Viewer Messages From Past Week ========
.
9/25/2012 8:51:05 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Realtek11nSU service.
9/25/2012 8:50:17 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
9/25/2012 8:50:15 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
9/25/2012 8:50:14 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
9/25/2012 8:34:12 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x000004a8000000e0, 0x0000000000000002, 0x0000000000000001, 0xfffff80002a54995). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 092512-28126-01.
9/25/2012 8:16:56 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002d72fea, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 092512-26629-01.
9/25/2012 10:36:07 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
11/8/2099 11:09:07 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer JESTEIN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{C2E68E71-4D89-4571-ADDE-07B7D237543A}. The master browser is stopping or an election is being forced.
11/8/2099 10:57:02 PM, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.8. The computer with the IP address 192.168.1.6 did not allow the name to be claimed by this computer.
11/17/2099 11:43:00 PM, Error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.4 with the system having network hardware address 00-26-B0-28-F4-41. Network operations on this system may be disrupted as a result.
10/22/2099 5:04:34 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
10/22/2099 5:03:34 AM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/22/2099 5:03:23 AM, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
10/10/2099 5:38:46 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{C2E68E71-4D89-4571-ADDE-07B7D237543A} because another computer on the network has the same name. The server could not start.
10/10/2099 5:38:46 PM, Error: NetBT [4321] - The name "LINDSAY-PC :20" could not be registered on the interface with IP address 192.168.1.9. The computer with the IP address 192.168.1.2 did not allow the name to be claimed by this computer.
10/10/2099 5:38:46 PM, Error: NetBT [4321] - The name "LINDSAY-PC :0" could not be registered on the interface with IP address 192.168.1.9. The computer with the IP address 192.168.1.2 did not allow the name to be claimed by this computer.
.
==== End Of File ===========================
