Hi everyone, brand new user here with a problem I hope you can help with.
Basically I have a number of websites on a host and a couple of days ago my server was compromised. After contact with the host company they concluded that the attack came from within my own pc.
Now I clean it regularly with various programs but never seem to have it totally clear and one infection will just not go away and I think this may be the culprit. It is listed in Malwarebytes as 'PUM.UserWLoad' and when I delete it, it just reappears straight away!
Does anyone have experience of this one and can you help me?
Thanks and here are the logs you require.
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org
Database version: v2012.11.23.02
Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Kaye :: KAYES-PC [administrator]
23/11/2012 17:06:54
mbam-log-2012-11-23 (17-06-54).txt
Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 537795
Time elapsed: 1 hour(s), 47 minute(s), 11 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\Kaye\LOCALS~1\Temp\msjmtxaem.pif -> Delete on reboot.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Users\Kaye\Downloads\Photoshop CS2 v9.0 + working KeyGen\Photoshop.CS2.KeyGen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
(end)
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 21/03/2010 19:45:07
System Uptime: 23/11/2012 07:18:29 (14 hours ago)
.
Motherboard: Packard Bell | | WMCP78M
Processor: AMD Athlon(tm) II X3 425 Processor | Socket AM2 | 2700/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 341 GiB total, 119.987 GiB free.
D: is FIXED (NTFS) - 342 GiB total, 341.009 GiB free.
E: is CDROM (UDF)
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart B110 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart B110 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\4&18018E29&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\4&18018E29&0
Service: i8042prt
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: SBRE
Device ID: ROOT\LEGACY_SBRE\0000
Manufacturer:
Name: SBRE
PNP Device ID: ROOT\LEGACY_SBRE\0000
Service: SBRE
.
==== System Restore Points ===================
.
RP538: 16/11/2012 06:47:22 - Windows Update
RP539: 17/11/2012 01:46:10 - Windows Update
RP540: 17/11/2012 15:36:38 - Configured Microsoft Office Enterprise 2007
RP541: 19/11/2012 03:00:11 - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
64 Bit HP CIO Components Installer
Acrobat.com
Ad-Aware Browsing Protection
Adelantado Trilogy: Book One
Adobe AIR
Adobe Anchor Service CS4
Adobe Anchor Service x64 CS4
Adobe Bridge 1.0
Adobe Bridge CS4
Adobe CMaps CS4
Adobe CMaps x64 CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe Common File Installer
Adobe CSI CS4
Adobe CSI CS4 x64
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Drive CS4
Adobe Drive CS4 x64
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Fonts All
Adobe Fonts All x64
Adobe Help Center 1.0
Adobe Linguistics CS4
Adobe Linguistics CS4 x64
Adobe Output Module
Adobe PDF Library Files CS4
Adobe PDF Library Files x64 CS4
Adobe Photoshop CS2
Adobe Photoshop CS4
Adobe Photoshop CS4 (64 Bit)
Adobe Photoshop CS4 Support
Adobe Photoshop Elements 7.0
Adobe Reader 9.5.2 MUI
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Stock Photos 1.0
Adobe Type Support CS4
Adobe Type Support x64 CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe WinSoft Linguistics Plugin x64
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Any Video Converter 3.4.0
Apple Application Support
Apple Mobile Device Support
ATI Catalyst Install Manager
µTorrent
avast! Free Antivirus
B110
Belkin F6D4050 Enhanced Wireless USB Adapter
Belkin F7D1102 Surf Wireless Micro USB Adapter
Belkin Setup and Router Monitor
Belkin Wireless USB Adapter Setup
Big Fish Games: Game Manager
Bing Ads Intelligence
BlackBerry App World Browser Plugin
Boutique Boulevard
BufferChm
Camtasia Studio 7
Cases Of Stolen Beauty
Catalyst Control Center InstallProxy
CoffeeCup Free HTML Editor
CoffeeCup HTML Editor
Compatibility Pack for the 2007 Office system
Connect
D3DX10
Destinations
DeviceDiscovery
DHTML Editing Component
Doggie Dash
Domain Name Analyzer v6.011412
Dropbox
Eternal Journey: New Atlantis Collector's Edition
Fierce Tales: The Dog's Heart
FileZilla Client 3.6.0
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GoogleSuggestor
GoToMeeting 5.3.0.1010
GPBaseService2
Grim Facade: Sinister Obsession
HitmanPro 3.6
HP Customer Participation Program 14.0
HP Imaging Device Functions 14.0
HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPAppStudio
HPDiagnosticAlert
HPPhotoGadget
HPProductAssistant
iLivid
ImagXpress
IrfanView (remove only)
iTunes
Java Auto Updater
Java(TM) 6 Update 26
Jing
Jo's Dream: Organic Coffee
Junk Mail filter update
K-Lite Codec Pack 8.2.0 (Basic)
KaraFun Player
Keyword Pad v1.0.112706
KeywordXtreme
kuler
Live Novels: Jane Austen’s Pride and Prejudice
Malwarebytes Anti-Malware version 1.65.1.1000
Market Samurai
MarketResearch
Micro Manager
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Office 64-bit Components 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Server Speech Platform Runtime (x86)
Microsoft Server Speech Text to Speech Voice (en-US, ZiraPro)
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
Microsoft Works
Microsoft WSE 3.0 Runtime
Microsoft XNA Framework Redistributable 3.1
Mobilizer
Monument Builders: Statue of Liberty
Mozilla Firefox 16.0.2 (x86 en-US)
Mozilla Maintenance Service
Mozilla Thunderbird 14.0 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
neroxml
Network64
Northern Tale
NoteTab 7 Trial (Remove only)
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
NVIDIA PhysX
Packard Bell Recovery Management
Packard Bell Registration
Packard Bell Software Suite SE
Packard Bell Updater
PDF Settings CS4
Photoshop Camera Raw
Photoshop Camera Raw_x64
PrimoPDF -- brought to you by Nitro PDF Software
PS_AIO_07_B110_SW_Min
QuickTime
QuickTransfer
Rapport
Realtek High Definition Audio Driver
Samsung Mobile phone USB driver Drive Software
Scan
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
Shop-n-Spree: Shopping Paradise
SingAlong 2008 (FREE Edition)
Skype™ 6.0
SmartWebPrinting
SolutionCenter
Spotify
Spybot - Search & Destroy
Status
Suite Shared Configuration CS4
Syberia - Part 2
Tales of Terror: Crimson Dawn
TextPad 6
The Logo Creator v5.2
The Sims 2
The Timebuilders: Pyramid Rising
The TimeBuilders: Pyramid Rising 2
The TimeBuilders: Pyramid Rising 2 Strategy Guide
Toolbox
Traffic Travis 4.1.0
TrayApp
TVersity Codec Pack 1.7
TVersity Media Server 2.2
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760413) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Video Marketing Dominator Lite v1.0
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebReg
Welcome Center
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR archiver
Wonder World
Xiph.Org Open Codecs 0.85.17777
.
==== Event Viewer Messages From Past Week ========
.
23/11/2012 18:19:58, Error: Schannel [36887] - The following fatal alert was received: 80.
23/11/2012 07:19:28, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd SBRE
20/11/2012 19:06:15, Error: bowser [8003] - The master browser has received a server announcement from the computer JADE-TOSH that believes that it is the master browser for the domain on transport NetBT_Tcpip_{8E7DFEE6-657E-4CC2-85E8-2316B2592502}. The master browser is stopping or an election is being forced.
20/11/2012 06:31:57, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Print Spooler service to connect.
20/11/2012 06:31:57, Error: Service Control Manager [7000] - The Print Spooler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16/11/2012 21:09:45, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk5\DR9.
16/11/2012 06:41:48, Error: Tcpip [4199] - The system detected an address conflict for IP address 0.0.0.0 with the system having network hardware address 00-00-00-00-00-00. Network operations on this system may be disrupted as a result.
.
==== End Of File ===========================
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16455
Run by Kaye at 21:18:51 on 2012-11-23
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.4095.1330 [GMT 0:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
c:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\system32\lxdxcoms.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\ProgramData\TVersity\Media Server\MediaServer.exe
C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\TechSmith\Jing\Jing.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Users\Kaye\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxMsdMon.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\notepad.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
mDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
uURLSearchHooks: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - <orphaned>
uURLSearchHooks: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - <orphaned>
uURLSearchHooks: {bd4aec4a-dcbe-4e19-b5b1-c42dacbedeb2} - <orphaned>
uWindows: Load = C:\Users\Kaye\LOCALS~1\Temp\msjmtxaem.pif
mWinlogon: Userinit = userinit.exe,
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - <orphaned>
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [CredentialManager] regsvr32 /s /u "C:\Users\Kaye\AppData\Local\Credential\CredentialManager.dll"
uRun: [AdobeBridge] <no file>
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [lxdxmon.exe] "C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxmon.exe"
mRun: [lxdxamon] "C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxamon.exe"
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun: [NPSStartup] <no file>
mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
StartupFolder: C:\Users\Kaye\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
StartupFolder: C:\Users\Kaye\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Kaye\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\Kaye\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20101221064513
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} - hxxp://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader6.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUplden-gb.cab
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{8E7DFEE6-657E-4CC2-85E8-2316B2592502} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{BA114615-AAC0-4E8E-8F45-42CE23974BD5} : DHCPNameServer = 192.168.0.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
x64-mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
x64-mDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\System32\NvCpl.dll,NvStartup
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Kaye\AppData\Roaming\Mozilla\Firefox\Profiles\zlbmrolk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/groups/332826703467896/
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Kaye\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll
FF - ExtSQL: 2012-10-07 11:01; toolbar-amazon@alexa.com; C:\Users\Kaye\AppData\Roaming\Mozilla\Firefox\Profiles\zlbmrolk.default\extensions\toolbar-amazon@alexa.com.xpi
FF - ExtSQL: 2012-10-15 18:01; {317B5128-0B0B-49b2-B2DB-1E7560E16C74}; C:\Users\Kaye\AppData\Roaming\Mozilla\Firefox\Profiles\zlbmrolk.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
FF - ExtSQL: !HIDDEN! 2012-04-30 11:52; smartwebprinting@hp.com; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-3-21 55024]
R0 RapportKE64;RapportKE64;C:\Windows\System32\drivers\RapportKE64.sys [2011-2-25 64272]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-7-23 819032]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-3-21 337240]
R1 RapportCerberus_43926;RapportCerberus_43926;C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\43926\RapportCerberus64_43926.sys [2012-10-30 505720]
R1 RapportEI64;RapportEI64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-9-25 55056]
R1 RapportPG64;RapportPG64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-9-25 61712]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-12-8 169312]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-7-28 203264]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-3-21 24408]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-3-21 69976]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2012-3-23 44768]
R2 Greg_Service;GRegService;C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe [2009-6-4 1150496]
R2 HitmanProScheduler;HitmanPro Scheduler;C:\Program Files\HitmanPro\hmpsched.exe [2012-5-21 108904]
R2 lxdx_device;lxdx_device;C:\Windows\System32\lxdxcoms.exe -service --> C:\Windows\System32\lxdxcoms.exe -service [?]
R2 RapportMgmtService;Rapport Management Service;C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-9-25 919352]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-7-25 1153368]
R2 Updater Service;Updater Service;C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2009-8-15 240160]
R3 RTL8192cu;Surf Wireless Micro USB Adapter;C:\Windows\System32\drivers\rtl8192cu.sys [2012-4-12 762472]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\System32\drivers\ssadadb.sys [2011-5-13 36328]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-11-12 1038088]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920]
S3 TFsExDisk;TFsExDisk;C:\Windows\System32\drivers\TFsExDisk.sys [2010-11-22 16448]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-8-2 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-3 1255736]
.
=============== Created Last 30 ================
.
2012-11-23 20:34:41 -------- d-----w- C:\Users\Kaye\AppData\Local\{1FBAB002-B299-46F2-B458-A44C18CEE197}
2012-11-23 08:33:51 -------- d-----w- C:\Users\Kaye\AppData\Local\{AFCF360C-694A-4C58-A26F-B243CA744056}
2012-11-22 20:33:04 -------- d-----w- C:\Users\Kaye\AppData\Local\{50C73877-7883-46E2-91DC-E46C6F3440C7}
2012-11-22 17:51:18 -------- d-----r- C:\Program Files (x86)\Skype
2012-11-22 08:32:31 -------- d-----w- C:\Users\Kaye\AppData\Local\{089832A4-3709-43F6-9373-E6242FD78917}
2012-11-21 20:31:45 -------- d-----w- C:\Users\Kaye\AppData\Local\{11755018-9607-46DD-B345-DBCFB37A805B}
2012-11-21 08:31:12 -------- d-----w- C:\Users\Kaye\AppData\Local\{3593F101-68B4-466A-8185-3891497AF65F}
2012-11-20 18:45:03 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D02DAA01-A1AA-43AA-A1F0-400508544D9C}\mpengine.dll
2012-11-20 08:30:25 -------- d-----w- C:\Users\Kaye\AppData\Local\{1F761BD9-0DE1-4487-A99F-4D41FCCAD739}
2012-11-19 20:29:39 -------- d-----w- C:\Users\Kaye\AppData\Local\{DF1C827F-3C90-4422-8952-FC65C58A3A61}
2012-11-19 08:29:06 -------- d-----w- C:\Users\Kaye\AppData\Local\{AF9FCE36-9E38-4153-B8AF-1D01C87BA084}
2012-11-18 20:28:32 -------- d-----w- C:\Users\Kaye\AppData\Local\{D3533D1B-F601-4302-B5B8-64B04A24D92A}
2012-11-18 08:27:58 -------- d-----w- C:\Users\Kaye\AppData\Local\{018DE64D-200F-4737-9BDE-F87BAF284631}
2012-11-17 20:27:01 -------- d-----w- C:\Users\Kaye\AppData\Local\{D7D1C1DB-082C-44D1-8D30-D5EBD6986F75}
2012-11-17 20:18:05 -------- d-----w- C:\Users\Kaye\AppData\Roaming\com.toojoos.micro-manager
2012-11-17 20:18:03 -------- d-----w- C:\Program Files (x86)\Micro Manager
2012-11-17 08:26:15 -------- d-----w- C:\Users\Kaye\AppData\Local\{17BA2EA5-FB8C-4812-BB87-4FE74BFADA63}
2012-11-17 01:59:52 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui
2012-11-17 01:59:51 9728 ----a-w- C:\Windows\System32\Wdfres.dll
2012-11-17 01:59:51 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys
2012-11-17 01:59:51 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys
2012-11-17 01:53:59 754848 ----a-w- C:\Program Files\Internet Explorer\iexplore.exe
2012-11-17 01:48:39 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
2012-11-17 01:48:39 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys
2012-11-17 01:48:36 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll
2012-11-17 01:48:36 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll
2012-11-17 01:48:31 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll
2012-11-17 01:48:30 744448 ----a-w- C:\Windows\System32\WUDFx.dll
2012-11-17 01:48:30 229888 ----a-w- C:\Windows\System32\WUDFHost.exe
2012-11-16 18:40:46 -------- d-----w- C:\Users\Kaye\AppData\Local\{D5D38DA9-7286-4CDA-B53E-A62F36BDE99C}
2012-11-16 06:53:22 3147264 ----a-w- C:\Windows\System32\win32k.sys
2012-11-16 06:52:58 95744 ----a-w- C:\Windows\System32\synceng.dll
2012-11-16 06:52:57 78336 ----a-w- C:\Windows\SysWow64\synceng.dll
2012-11-16 06:41:43 -------- d-----w- C:\Users\Kaye\AppData\Local\{287C7E04-A982-4EC4-B3FC-EBC4F53DB5DD}
2012-11-15 18:41:10 -------- d-----w- C:\Users\Kaye\AppData\Local\{281D08C7-0F70-42CB-B558-2523BE3BDC16}
2012-11-15 06:40:47 -------- d-----w- C:\Users\Kaye\AppData\Local\{AC887CD7-DF87-4E85-BEAF-FF3044446672}
2012-11-14 18:40:00 -------- d-----w- C:\Users\Kaye\AppData\Local\{32B46F4A-1AF0-49BE-9FE5-8C60E5111A4A}
2012-11-14 06:39:19 -------- d-----w- C:\Users\Kaye\AppData\Local\{BD85EA3E-BFAD-42B6-9AC5-A5DAD867EBB4}
2012-11-13 12:10:55 -------- d-----w- C:\Users\Kaye\AppData\Local\{F071FC2E-06BE-4C5F-8188-127E0EC02186}
2012-11-13 00:14:39 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-11-13 00:09:30 -------- d-----w- C:\Users\Kaye\AppData\Local\{81F57A1C-EAFF-4789-927A-B71902C357F2}
2012-11-12 19:28:18 -------- d-----w- C:\Users\Kaye\AppData\Local\{D33A5F08-9A27-471C-A009-22258BF9244D}
2012-11-12 07:27:45 -------- d-----w- C:\Users\Kaye\AppData\Local\{50306D9A-B7F7-44B4-BE84-2C2AB36BF28E}
2012-11-11 19:26:58 -------- d-----w- C:\Users\Kaye\AppData\Local\{6B7CEEBD-86D7-4E42-B904-F9B208FF7F5E}
2012-11-11 07:25:53 -------- d-----w- C:\Users\Kaye\AppData\Local\{916E88A8-4234-46BD-B672-D1EF3A1465EA}
2012-11-10 19:25:06 -------- d-----w- C:\Users\Kaye\AppData\Local\{0B4021CD-A984-4E6E-8F11-1662628B654F}
2012-11-10 07:24:26 -------- d-----w- C:\Users\Kaye\AppData\Local\{A9AF1B87-1E81-459A-B30E-1DCEFC025E43}
2012-11-09 06:53:42 -------- d-----w- C:\Users\Kaye\AppData\Local\{D4130803-4376-42B1-9830-DB88AA9AE0E4}
2012-11-08 21:28:37 -------- d-----w- C:\Users\Kaye\AppData\Local\Opera
2012-11-08 06:52:21 -------- d-----w- C:\Users\Kaye\AppData\Local\{F1E7D4F1-9946-4A3F-82BF-5FA8F7E9C86F}
2012-11-07 18:51:35 -------- d-----w- C:\Users\Kaye\AppData\Local\{87C669FF-07BB-4FCA-B868-D8C4811FA15D}
2012-11-07 06:51:02 -------- d-----w- C:\Users\Kaye\AppData\Local\{80CE59DD-A7B2-4A32-82FB-B6D3FEB1A6E6}
2012-11-06 06:49:36 -------- d-----w- C:\Users\Kaye\AppData\Local\{E6FCA5B0-0824-4794-B4C6-5872EAA5179D}
2012-11-05 13:18:05 -------- d-----w- C:\Users\Kaye\AppData\Local\{336A59C8-66EF-49F4-A92F-41121573D32D}
2012-11-04 13:18:06 -------- d-----w- C:\Users\Kaye\AppData\Local\{9F28AE72-AD2C-4434-B47A-D6A587265974}
2012-11-03 22:21:37 -------- d-----w- C:\Users\Kaye\AppData\Local\{B26AFE2D-EE78-4BE9-BFBE-81CB032EDE0A}
2012-11-03 10:20:51 -------- d-----w- C:\Users\Kaye\AppData\Local\{BDA05BF2-54DC-429D-B1DB-ECD6B5C229F7}
2012-11-02 22:20:04 -------- d-----w- C:\Users\Kaye\AppData\Local\{7A61C57E-EDD0-4588-9001-1B40ACA0D097}
2012-11-02 10:19:30 -------- d-----w- C:\Users\Kaye\AppData\Local\{245D9B29-012E-4381-86DF-992C1E4C843A}
2012-11-01 22:18:44 -------- d-----w- C:\Users\Kaye\AppData\Local\{4C051F64-BFD1-436A-AF48-D3CC98D6F1A3}
2012-11-01 10:17:58 -------- d-----w- C:\Users\Kaye\AppData\Local\{9E07F9D1-8BE7-40BC-BB1A-BE74CD419649}
2012-10-31 22:17:11 -------- d-----w- C:\Users\Kaye\AppData\Local\{3D3EFD17-3EAF-4009-A203-DEAC89D6711F}
2012-10-31 22:02:19 -------- d-----w- C:\Program Files (x86)\Doggie Dash
2012-10-31 10:16:38 -------- d-----w- C:\Users\Kaye\AppData\Local\{9FBF895D-F019-4141-B9C8-AA783A2EBFF5}
2012-10-30 22:15:52 -------- d-----w- C:\Users\Kaye\AppData\Local\{122F5CF4-8BE1-4CF2-AA7A-3D083BAFF2B5}
2012-10-30 10:15:17 -------- d-----w- C:\Users\Kaye\AppData\Local\{0EC421FB-9904-474E-B504-ECB286CDC6B3}
2012-10-29 22:14:44 -------- d-----w- C:\Users\Kaye\AppData\Local\{95E13E77-4D53-41D6-8163-32BD32CDEE5A}
2012-10-29 21:01:47 -------- d-----w- C:\Program Files (x86)\Video Marketing Dominator Lite v1.0
2012-10-29 10:14:10 -------- d-----w- C:\Users\Kaye\AppData\Local\{581E6AA8-8446-46AF-9D61-16F15CB58E7E}
2012-10-28 10:13:00 -------- d-----w- C:\Users\Kaye\AppData\Local\{1DF47581-E66D-4775-BC1A-A2F87F66662B}
2012-10-27 19:16:16 -------- d-----w- C:\ProgramData\Recisio
2012-10-27 19:16:16 -------- d-----w- C:\Program Files (x86)\KaraFun Player
2012-10-27 19:08:46 -------- d-----w- C:\Program Files (x86)\SingAlong (FREE Edition)
2012-10-27 19:08:33 249856 ------w- C:\Windows\Setup1.exe
2012-10-27 19:08:30 73216 ----a-w- C:\Windows\ST6UNST.EXE
2012-10-27 18:42:48 -------- d-----w- C:\Users\Kaye\AppData\Local\{FFDF3DA6-B02E-44D4-9ECB-1516947395EF}
2012-10-27 06:42:02 -------- d-----w- C:\Users\Kaye\AppData\Local\{A31CA5B3-DF3D-41DE-B1A8-F276E2CECE6B}
2012-10-26 17:55:36 -------- d-----w- C:\Users\Kaye\AppData\Local\{D4DB8732-6A31-493F-9866-7068ED65E0C9}
2012-10-26 05:55:42 -------- d-----w- C:\Users\Kaye\AppData\Local\{514B253C-3B48-4589-9604-82D6E220B69C}
2012-10-25 10:08:54 -------- d-----w- C:\Users\Kaye\AppData\Local\{753E690D-E81B-47B7-8832-8A264F909C35}
2012-10-24 22:08:08 -------- d-----w- C:\Users\Kaye\AppData\Local\{5299735C-7251-43B8-8EE1-C200E736962E}
.
==================== Find3M ====================
.
2012-10-09 11:00:23 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-09 11:00:23 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-10-08 11:31:03 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-10-08 11:23:52 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-10-08 11:22:55 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-10-08 11:18:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-10-08 11:17:35 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-10-08 11:13:33 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-10-08 07:56:24 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-10-08 07:48:03 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-10-08 07:47:44 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-10-08 07:44:05 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-10-08 07:43:21 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-10-08 07:40:56 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-09-14 19:23:40 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-09-14 18:30:38 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-08-31 18:02:20 1656688 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2012-08-30 18:11:29 5505904 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-08-30 17:18:33 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:18:33 3902832 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
.
============= FINISH: 21:19:42.48 ===============
Basically I have a number of websites on a host and a couple of days ago my server was compromised. After contact with the host company they concluded that the attack came from within my own pc.
Now I clean it regularly with various programs but never seem to have it totally clear and one infection will just not go away and I think this may be the culprit. It is listed in Malwarebytes as 'PUM.UserWLoad' and when I delete it, it just reappears straight away!
Does anyone have experience of this one and can you help me?
Thanks and here are the logs you require.
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org
Database version: v2012.11.23.02
Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Kaye :: KAYES-PC [administrator]
23/11/2012 17:06:54
mbam-log-2012-11-23 (17-06-54).txt
Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 537795
Time elapsed: 1 hour(s), 47 minute(s), 11 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\Kaye\LOCALS~1\Temp\msjmtxaem.pif -> Delete on reboot.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Users\Kaye\Downloads\Photoshop CS2 v9.0 + working KeyGen\Photoshop.CS2.KeyGen.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
(end)
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 21/03/2010 19:45:07
System Uptime: 23/11/2012 07:18:29 (14 hours ago)
.
Motherboard: Packard Bell | | WMCP78M
Processor: AMD Athlon(tm) II X3 425 Processor | Socket AM2 | 2700/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 341 GiB total, 119.987 GiB free.
D: is FIXED (NTFS) - 342 GiB total, 341.009 GiB free.
E: is CDROM (UDF)
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart B110 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart B110 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID: {4d36e96f-e325-11ce-bfc1-08002be10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\4&18018E29&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\4&18018E29&0
Service: i8042prt
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: SBRE
Device ID: ROOT\LEGACY_SBRE\0000
Manufacturer:
Name: SBRE
PNP Device ID: ROOT\LEGACY_SBRE\0000
Service: SBRE
.
==== System Restore Points ===================
.
RP538: 16/11/2012 06:47:22 - Windows Update
RP539: 17/11/2012 01:46:10 - Windows Update
RP540: 17/11/2012 15:36:38 - Configured Microsoft Office Enterprise 2007
RP541: 19/11/2012 03:00:11 - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
64 Bit HP CIO Components Installer
Acrobat.com
Ad-Aware Browsing Protection
Adelantado Trilogy: Book One
Adobe AIR
Adobe Anchor Service CS4
Adobe Anchor Service x64 CS4
Adobe Bridge 1.0
Adobe Bridge CS4
Adobe CMaps CS4
Adobe CMaps x64 CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe Common File Installer
Adobe CSI CS4
Adobe CSI CS4 x64
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Drive CS4
Adobe Drive CS4 x64
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Fonts All
Adobe Fonts All x64
Adobe Help Center 1.0
Adobe Linguistics CS4
Adobe Linguistics CS4 x64
Adobe Output Module
Adobe PDF Library Files CS4
Adobe PDF Library Files x64 CS4
Adobe Photoshop CS2
Adobe Photoshop CS4
Adobe Photoshop CS4 (64 Bit)
Adobe Photoshop CS4 Support
Adobe Photoshop Elements 7.0
Adobe Reader 9.5.2 MUI
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Stock Photos 1.0
Adobe Type Support CS4
Adobe Type Support x64 CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe WinSoft Linguistics Plugin x64
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Any Video Converter 3.4.0
Apple Application Support
Apple Mobile Device Support
ATI Catalyst Install Manager
µTorrent
avast! Free Antivirus
B110
Belkin F6D4050 Enhanced Wireless USB Adapter
Belkin F7D1102 Surf Wireless Micro USB Adapter
Belkin Setup and Router Monitor
Belkin Wireless USB Adapter Setup
Big Fish Games: Game Manager
Bing Ads Intelligence
BlackBerry App World Browser Plugin
Boutique Boulevard
BufferChm
Camtasia Studio 7
Cases Of Stolen Beauty
Catalyst Control Center InstallProxy
CoffeeCup Free HTML Editor
CoffeeCup HTML Editor
Compatibility Pack for the 2007 Office system
Connect
D3DX10
Destinations
DeviceDiscovery
DHTML Editing Component
Doggie Dash
Domain Name Analyzer v6.011412
Dropbox
Eternal Journey: New Atlantis Collector's Edition
Fierce Tales: The Dog's Heart
FileZilla Client 3.6.0
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GoogleSuggestor
GoToMeeting 5.3.0.1010
GPBaseService2
Grim Facade: Sinister Obsession
HitmanPro 3.6
HP Customer Participation Program 14.0
HP Imaging Device Functions 14.0
HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPAppStudio
HPDiagnosticAlert
HPPhotoGadget
HPProductAssistant
iLivid
ImagXpress
IrfanView (remove only)
iTunes
Java Auto Updater
Java(TM) 6 Update 26
Jing
Jo's Dream: Organic Coffee
Junk Mail filter update
K-Lite Codec Pack 8.2.0 (Basic)
KaraFun Player
Keyword Pad v1.0.112706
KeywordXtreme
kuler
Live Novels: Jane Austen’s Pride and Prejudice
Malwarebytes Anti-Malware version 1.65.1.1000
Market Samurai
MarketResearch
Micro Manager
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Office 64-bit Components 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Server Speech Platform Runtime (x86)
Microsoft Server Speech Text to Speech Voice (en-US, ZiraPro)
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
Microsoft Works
Microsoft WSE 3.0 Runtime
Microsoft XNA Framework Redistributable 3.1
Mobilizer
Monument Builders: Statue of Liberty
Mozilla Firefox 16.0.2 (x86 en-US)
Mozilla Maintenance Service
Mozilla Thunderbird 14.0 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
neroxml
Network64
Northern Tale
NoteTab 7 Trial (Remove only)
NVIDIA Drivers
NVIDIA ForceWare Network Access Manager
NVIDIA PhysX
Packard Bell Recovery Management
Packard Bell Registration
Packard Bell Software Suite SE
Packard Bell Updater
PDF Settings CS4
Photoshop Camera Raw
Photoshop Camera Raw_x64
PrimoPDF -- brought to you by Nitro PDF Software
PS_AIO_07_B110_SW_Min
QuickTime
QuickTransfer
Rapport
Realtek High Definition Audio Driver
Samsung Mobile phone USB driver Drive Software
Scan
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
Shop-n-Spree: Shopping Paradise
SingAlong 2008 (FREE Edition)
Skype™ 6.0
SmartWebPrinting
SolutionCenter
Spotify
Spybot - Search & Destroy
Status
Suite Shared Configuration CS4
Syberia - Part 2
Tales of Terror: Crimson Dawn
TextPad 6
The Logo Creator v5.2
The Sims 2
The Timebuilders: Pyramid Rising
The TimeBuilders: Pyramid Rising 2
The TimeBuilders: Pyramid Rising 2 Strategy Guide
Toolbox
Traffic Travis 4.1.0
TrayApp
TVersity Codec Pack 1.7
TVersity Media Server 2.2
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2760413) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Video Marketing Dominator Lite v1.0
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebReg
Welcome Center
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR archiver
Wonder World
Xiph.Org Open Codecs 0.85.17777
.
==== Event Viewer Messages From Past Week ========
.
23/11/2012 18:19:58, Error: Schannel [36887] - The following fatal alert was received: 80.
23/11/2012 07:19:28, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd SBRE
20/11/2012 19:06:15, Error: bowser [8003] - The master browser has received a server announcement from the computer JADE-TOSH that believes that it is the master browser for the domain on transport NetBT_Tcpip_{8E7DFEE6-657E-4CC2-85E8-2316B2592502}. The master browser is stopping or an election is being forced.
20/11/2012 06:31:57, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Print Spooler service to connect.
20/11/2012 06:31:57, Error: Service Control Manager [7000] - The Print Spooler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16/11/2012 21:09:45, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk5\DR9.
16/11/2012 06:41:48, Error: Tcpip [4199] - The system detected an address conflict for IP address 0.0.0.0 with the system having network hardware address 00-00-00-00-00-00. Network operations on this system may be disrupted as a result.
.
==== End Of File ===========================
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16455
Run by Kaye at 21:18:51 on 2012-11-23
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.4095.1330 [GMT 0:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
c:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\system32\lxdxcoms.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\ProgramData\TVersity\Media Server\MediaServer.exe
C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\TechSmith\Jing\Jing.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Users\Kaye\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxMsdMon.exe
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\notepad.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
mDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
uURLSearchHooks: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - <orphaned>
uURLSearchHooks: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - <orphaned>
uURLSearchHooks: {bd4aec4a-dcbe-4e19-b5b1-c42dacbedeb2} - <orphaned>
uWindows: Load = C:\Users\Kaye\LOCALS~1\Temp\msjmtxaem.pif
mWinlogon: Userinit = userinit.exe,
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - <orphaned>
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [CredentialManager] regsvr32 /s /u "C:\Users\Kaye\AppData\Local\Credential\CredentialManager.dll"
uRun: [AdobeBridge] <no file>
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [lxdxmon.exe] "C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxmon.exe"
mRun: [lxdxamon] "C:\Program Files (x86) (x86)\Lexmark 3600-4600 Series\lxdxamon.exe"
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun: [NPSStartup] <no file>
mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
StartupFolder: C:\Users\Kaye\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
StartupFolder: C:\Users\Kaye\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Kaye\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\Kaye\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20101221064513
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} - hxxp://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader6.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUplden-gb.cab
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{8E7DFEE6-657E-4CC2-85E8-2316B2592502} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{BA114615-AAC0-4E8E-8F45-42CE23974BD5} : DHCPNameServer = 192.168.0.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
x64-mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
x64-mDefault_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0809&m=imedia_s3210&r=173603101716p0325v1k5y4891928r
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\System32\NvCpl.dll,NvStartup
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Kaye\AppData\Roaming\Mozilla\Firefox\Profiles\zlbmrolk.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/groups/332826703467896/
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Kaye\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll
FF - ExtSQL: 2012-10-07 11:01; toolbar-amazon@alexa.com; C:\Users\Kaye\AppData\Roaming\Mozilla\Firefox\Profiles\zlbmrolk.default\extensions\toolbar-amazon@alexa.com.xpi
FF - ExtSQL: 2012-10-15 18:01; {317B5128-0B0B-49b2-B2DB-1E7560E16C74}; C:\Users\Kaye\AppData\Roaming\Mozilla\Firefox\Profiles\zlbmrolk.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
FF - ExtSQL: !HIDDEN! 2012-04-30 11:52; smartwebprinting@hp.com; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-3-21 55024]
R0 RapportKE64;RapportKE64;C:\Windows\System32\drivers\RapportKE64.sys [2011-2-25 64272]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-7-23 819032]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-3-21 337240]
R1 RapportCerberus_43926;RapportCerberus_43926;C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\43926\RapportCerberus64_43926.sys [2012-10-30 505720]
R1 RapportEI64;RapportEI64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-9-25 55056]
R1 RapportPG64;RapportPG64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-9-25 61712]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-12-8 169312]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2009-7-28 203264]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-3-21 24408]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-3-21 69976]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2012-3-23 44768]
R2 Greg_Service;GRegService;C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe [2009-6-4 1150496]
R2 HitmanProScheduler;HitmanPro Scheduler;C:\Program Files\HitmanPro\hmpsched.exe [2012-5-21 108904]
R2 lxdx_device;lxdx_device;C:\Windows\System32\lxdxcoms.exe -service --> C:\Windows\System32\lxdxcoms.exe -service [?]
R2 RapportMgmtService;Rapport Management Service;C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-9-25 919352]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-7-25 1153368]
R2 Updater Service;Updater Service;C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2009-8-15 240160]
R3 RTL8192cu;Surf Wireless Micro USB Adapter;C:\Windows\System32\drivers\rtl8192cu.sys [2012-4-12 762472]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\System32\drivers\ssadadb.sys [2011-5-13 36328]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-11-12 1038088]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920]
S3 TFsExDisk;TFsExDisk;C:\Windows\System32\drivers\TFsExDisk.sys [2010-11-22 16448]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-8-2 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-3 1255736]
.
=============== Created Last 30 ================
.
2012-11-23 20:34:41 -------- d-----w- C:\Users\Kaye\AppData\Local\{1FBAB002-B299-46F2-B458-A44C18CEE197}
2012-11-23 08:33:51 -------- d-----w- C:\Users\Kaye\AppData\Local\{AFCF360C-694A-4C58-A26F-B243CA744056}
2012-11-22 20:33:04 -------- d-----w- C:\Users\Kaye\AppData\Local\{50C73877-7883-46E2-91DC-E46C6F3440C7}
2012-11-22 17:51:18 -------- d-----r- C:\Program Files (x86)\Skype
2012-11-22 08:32:31 -------- d-----w- C:\Users\Kaye\AppData\Local\{089832A4-3709-43F6-9373-E6242FD78917}
2012-11-21 20:31:45 -------- d-----w- C:\Users\Kaye\AppData\Local\{11755018-9607-46DD-B345-DBCFB37A805B}
2012-11-21 08:31:12 -------- d-----w- C:\Users\Kaye\AppData\Local\{3593F101-68B4-466A-8185-3891497AF65F}
2012-11-20 18:45:03 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D02DAA01-A1AA-43AA-A1F0-400508544D9C}\mpengine.dll
2012-11-20 08:30:25 -------- d-----w- C:\Users\Kaye\AppData\Local\{1F761BD9-0DE1-4487-A99F-4D41FCCAD739}
2012-11-19 20:29:39 -------- d-----w- C:\Users\Kaye\AppData\Local\{DF1C827F-3C90-4422-8952-FC65C58A3A61}
2012-11-19 08:29:06 -------- d-----w- C:\Users\Kaye\AppData\Local\{AF9FCE36-9E38-4153-B8AF-1D01C87BA084}
2012-11-18 20:28:32 -------- d-----w- C:\Users\Kaye\AppData\Local\{D3533D1B-F601-4302-B5B8-64B04A24D92A}
2012-11-18 08:27:58 -------- d-----w- C:\Users\Kaye\AppData\Local\{018DE64D-200F-4737-9BDE-F87BAF284631}
2012-11-17 20:27:01 -------- d-----w- C:\Users\Kaye\AppData\Local\{D7D1C1DB-082C-44D1-8D30-D5EBD6986F75}
2012-11-17 20:18:05 -------- d-----w- C:\Users\Kaye\AppData\Roaming\com.toojoos.micro-manager
2012-11-17 20:18:03 -------- d-----w- C:\Program Files (x86)\Micro Manager
2012-11-17 08:26:15 -------- d-----w- C:\Users\Kaye\AppData\Local\{17BA2EA5-FB8C-4812-BB87-4FE74BFADA63}
2012-11-17 01:59:52 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui
2012-11-17 01:59:51 9728 ----a-w- C:\Windows\System32\Wdfres.dll
2012-11-17 01:59:51 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys
2012-11-17 01:59:51 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys
2012-11-17 01:53:59 754848 ----a-w- C:\Program Files\Internet Explorer\iexplore.exe
2012-11-17 01:48:39 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
2012-11-17 01:48:39 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys
2012-11-17 01:48:36 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll
2012-11-17 01:48:36 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll
2012-11-17 01:48:31 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll
2012-11-17 01:48:30 744448 ----a-w- C:\Windows\System32\WUDFx.dll
2012-11-17 01:48:30 229888 ----a-w- C:\Windows\System32\WUDFHost.exe
2012-11-16 18:40:46 -------- d-----w- C:\Users\Kaye\AppData\Local\{D5D38DA9-7286-4CDA-B53E-A62F36BDE99C}
2012-11-16 06:53:22 3147264 ----a-w- C:\Windows\System32\win32k.sys
2012-11-16 06:52:58 95744 ----a-w- C:\Windows\System32\synceng.dll
2012-11-16 06:52:57 78336 ----a-w- C:\Windows\SysWow64\synceng.dll
2012-11-16 06:41:43 -------- d-----w- C:\Users\Kaye\AppData\Local\{287C7E04-A982-4EC4-B3FC-EBC4F53DB5DD}
2012-11-15 18:41:10 -------- d-----w- C:\Users\Kaye\AppData\Local\{281D08C7-0F70-42CB-B558-2523BE3BDC16}
2012-11-15 06:40:47 -------- d-----w- C:\Users\Kaye\AppData\Local\{AC887CD7-DF87-4E85-BEAF-FF3044446672}
2012-11-14 18:40:00 -------- d-----w- C:\Users\Kaye\AppData\Local\{32B46F4A-1AF0-49BE-9FE5-8C60E5111A4A}
2012-11-14 06:39:19 -------- d-----w- C:\Users\Kaye\AppData\Local\{BD85EA3E-BFAD-42B6-9AC5-A5DAD867EBB4}
2012-11-13 12:10:55 -------- d-----w- C:\Users\Kaye\AppData\Local\{F071FC2E-06BE-4C5F-8188-127E0EC02186}
2012-11-13 00:14:39 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-11-13 00:09:30 -------- d-----w- C:\Users\Kaye\AppData\Local\{81F57A1C-EAFF-4789-927A-B71902C357F2}
2012-11-12 19:28:18 -------- d-----w- C:\Users\Kaye\AppData\Local\{D33A5F08-9A27-471C-A009-22258BF9244D}
2012-11-12 07:27:45 -------- d-----w- C:\Users\Kaye\AppData\Local\{50306D9A-B7F7-44B4-BE84-2C2AB36BF28E}
2012-11-11 19:26:58 -------- d-----w- C:\Users\Kaye\AppData\Local\{6B7CEEBD-86D7-4E42-B904-F9B208FF7F5E}
2012-11-11 07:25:53 -------- d-----w- C:\Users\Kaye\AppData\Local\{916E88A8-4234-46BD-B672-D1EF3A1465EA}
2012-11-10 19:25:06 -------- d-----w- C:\Users\Kaye\AppData\Local\{0B4021CD-A984-4E6E-8F11-1662628B654F}
2012-11-10 07:24:26 -------- d-----w- C:\Users\Kaye\AppData\Local\{A9AF1B87-1E81-459A-B30E-1DCEFC025E43}
2012-11-09 06:53:42 -------- d-----w- C:\Users\Kaye\AppData\Local\{D4130803-4376-42B1-9830-DB88AA9AE0E4}
2012-11-08 21:28:37 -------- d-----w- C:\Users\Kaye\AppData\Local\Opera
2012-11-08 06:52:21 -------- d-----w- C:\Users\Kaye\AppData\Local\{F1E7D4F1-9946-4A3F-82BF-5FA8F7E9C86F}
2012-11-07 18:51:35 -------- d-----w- C:\Users\Kaye\AppData\Local\{87C669FF-07BB-4FCA-B868-D8C4811FA15D}
2012-11-07 06:51:02 -------- d-----w- C:\Users\Kaye\AppData\Local\{80CE59DD-A7B2-4A32-82FB-B6D3FEB1A6E6}
2012-11-06 06:49:36 -------- d-----w- C:\Users\Kaye\AppData\Local\{E6FCA5B0-0824-4794-B4C6-5872EAA5179D}
2012-11-05 13:18:05 -------- d-----w- C:\Users\Kaye\AppData\Local\{336A59C8-66EF-49F4-A92F-41121573D32D}
2012-11-04 13:18:06 -------- d-----w- C:\Users\Kaye\AppData\Local\{9F28AE72-AD2C-4434-B47A-D6A587265974}
2012-11-03 22:21:37 -------- d-----w- C:\Users\Kaye\AppData\Local\{B26AFE2D-EE78-4BE9-BFBE-81CB032EDE0A}
2012-11-03 10:20:51 -------- d-----w- C:\Users\Kaye\AppData\Local\{BDA05BF2-54DC-429D-B1DB-ECD6B5C229F7}
2012-11-02 22:20:04 -------- d-----w- C:\Users\Kaye\AppData\Local\{7A61C57E-EDD0-4588-9001-1B40ACA0D097}
2012-11-02 10:19:30 -------- d-----w- C:\Users\Kaye\AppData\Local\{245D9B29-012E-4381-86DF-992C1E4C843A}
2012-11-01 22:18:44 -------- d-----w- C:\Users\Kaye\AppData\Local\{4C051F64-BFD1-436A-AF48-D3CC98D6F1A3}
2012-11-01 10:17:58 -------- d-----w- C:\Users\Kaye\AppData\Local\{9E07F9D1-8BE7-40BC-BB1A-BE74CD419649}
2012-10-31 22:17:11 -------- d-----w- C:\Users\Kaye\AppData\Local\{3D3EFD17-3EAF-4009-A203-DEAC89D6711F}
2012-10-31 22:02:19 -------- d-----w- C:\Program Files (x86)\Doggie Dash
2012-10-31 10:16:38 -------- d-----w- C:\Users\Kaye\AppData\Local\{9FBF895D-F019-4141-B9C8-AA783A2EBFF5}
2012-10-30 22:15:52 -------- d-----w- C:\Users\Kaye\AppData\Local\{122F5CF4-8BE1-4CF2-AA7A-3D083BAFF2B5}
2012-10-30 10:15:17 -------- d-----w- C:\Users\Kaye\AppData\Local\{0EC421FB-9904-474E-B504-ECB286CDC6B3}
2012-10-29 22:14:44 -------- d-----w- C:\Users\Kaye\AppData\Local\{95E13E77-4D53-41D6-8163-32BD32CDEE5A}
2012-10-29 21:01:47 -------- d-----w- C:\Program Files (x86)\Video Marketing Dominator Lite v1.0
2012-10-29 10:14:10 -------- d-----w- C:\Users\Kaye\AppData\Local\{581E6AA8-8446-46AF-9D61-16F15CB58E7E}
2012-10-28 10:13:00 -------- d-----w- C:\Users\Kaye\AppData\Local\{1DF47581-E66D-4775-BC1A-A2F87F66662B}
2012-10-27 19:16:16 -------- d-----w- C:\ProgramData\Recisio
2012-10-27 19:16:16 -------- d-----w- C:\Program Files (x86)\KaraFun Player
2012-10-27 19:08:46 -------- d-----w- C:\Program Files (x86)\SingAlong (FREE Edition)
2012-10-27 19:08:33 249856 ------w- C:\Windows\Setup1.exe
2012-10-27 19:08:30 73216 ----a-w- C:\Windows\ST6UNST.EXE
2012-10-27 18:42:48 -------- d-----w- C:\Users\Kaye\AppData\Local\{FFDF3DA6-B02E-44D4-9ECB-1516947395EF}
2012-10-27 06:42:02 -------- d-----w- C:\Users\Kaye\AppData\Local\{A31CA5B3-DF3D-41DE-B1A8-F276E2CECE6B}
2012-10-26 17:55:36 -------- d-----w- C:\Users\Kaye\AppData\Local\{D4DB8732-6A31-493F-9866-7068ED65E0C9}
2012-10-26 05:55:42 -------- d-----w- C:\Users\Kaye\AppData\Local\{514B253C-3B48-4589-9604-82D6E220B69C}
2012-10-25 10:08:54 -------- d-----w- C:\Users\Kaye\AppData\Local\{753E690D-E81B-47B7-8832-8A264F909C35}
2012-10-24 22:08:08 -------- d-----w- C:\Users\Kaye\AppData\Local\{5299735C-7251-43B8-8EE1-C200E736962E}
.
==================== Find3M ====================
.
2012-10-09 11:00:23 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-09 11:00:23 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-10-08 11:31:03 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-10-08 11:23:52 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-10-08 11:22:55 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-10-08 11:18:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-10-08 11:17:35 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-10-08 11:13:33 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-10-08 07:56:24 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-10-08 07:48:03 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-10-08 07:47:44 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-10-08 07:44:05 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-10-08 07:43:21 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-10-08 07:40:56 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-09-14 19:23:40 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-09-14 18:30:38 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-08-31 18:02:20 1656688 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2012-08-30 18:11:29 5505904 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-08-30 17:18:33 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:18:33 3902832 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
.
============= FINISH: 21:19:42.48 ===============
