Quantcast
Channel: Tech Support Forum - Virus/Trojan/Spyware Help
Viewing all articles
Browse latest Browse all 2798

ref from Windows Vista/Windows 7 Support

$
0
0
I started in the above mentioned forum because I couldn't start Security Center, I got an 'Error 1068'
I had previously just removed the FBI Moneypak virus so I wasn't sure if it might be due to that.
jenae the mod helped me run several commands as well as several scans and then she redirected me here to post the scan results.
I hope this helps if not, please let me know and I'll post more info.

I was asked to reference my previous thread in Windows Vista/Windows 7 Support, but I don't know if there's a specific way of doing it. It was my post regarding 'Can't start Security Center, Error 1068' with jenae's help, and she finally redirected me to this forum.

I have the logs of the scans she had me do.

Here is the DDS.txt scan results

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.10.2
Run by shoshi at 10:42:35 on 2013-01-07
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\TuneUp360\CareMon.exe
C:\Windows\system32\dlcxcoms.exe
C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.babylon.com/?affID=110232&tt=5212_5&babsrc=HP_ss&mntrId=ec1f154f0000000000000023ae1bc3ce
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: LastPass Browser Helper Object: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: ChromeFrame BHO: {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - c:\program files\google\chrome\application\23.0.1271.97\npchrome_frame.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [dlcxmon.exe] "c:\program files\dell photo aio printer 926\dlcxmon.exe"
mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:253
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: LastPass - c:\program files\lastpass\context.html?cmd=lastpass
IE: LastPass Fill Forms - c:\program files\lastpass\context.html?cmd=fillforms
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
TCP: NameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{7B7E85E0-0AF5-48D0-B8E8-62F3F0A814AF} : DHCPNameServer = 192.168.1.1 192.168.1.1
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome\application\23.0.1271.97\npchrome_frame.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\shoshi\appdata\roaming\mozilla\firefox\profiles\76mw5ybt.default-1356904688151\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\wildtangent games\app\browserintegration\registered\8\NP_wtapp.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\zylom\zylomgamesplayer\npzylomgamesplayer.dll
FF - plugin: c:\users\shoshi\appdata\local\facebook\video\skype\npFacebookVideoCalling.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1168638.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2012-12-04 20:43; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: 2012-12-30 12:03; wrc@avast.com; c:\program files\avast software\avast\webrep\FF
FF - ExtSQL: 2012-12-30 16:02; support@lastpass.com; c:\users\shoshi\appdata\roaming\mozilla\firefox\profiles\76mw5ybt.default-1356904688151\extensions\support@lastpass.com
.
============= SERVICES / DRIVERS ===============
.
2 CareMon;CareMon
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? GamesAppService;GamesAppService
R? mferkdk;McAfee Inc. mferkdk
R? mfesmfk;McAfee Inc. mfesmfk
R? Revoflt;Revoflt
R? SkypeUpdate;Skype Updater
R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
S? aswFsBlk;aswFsBlk
S? aswMonFlt;aswMonFlt
S? aswSnx;aswSnx
S? aswSP;aswSP
S? avast! Antivirus;avast! Antivirus
S? dlcx_device;dlcx_device
S? FontCache;Windows Font Cache Service
S? IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service
S? SftService;SoftThinks Agent Service
S? UMVPFSrv;UMVPFSrv
.
=============== File Associations ===============
.
ShellExec: FRONTPG.EXE: edit=c:\progra~1\micros~2\office10\FRONTPG.EXE
.
=============== Created Last 30 ================
.
2013-01-04 10:09:08 6812136 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{106bc08f-76fd-4a0d-808e-1ea9b5f5214a}\mpengine.dll
2012-12-30 19:29:19 -------- d-----w- c:\users\shoshi\appdata\roaming\spotmau
2012-12-30 19:29:12 -------- d-----w- c:\users\shoshi\appdata\roaming\Babylon
2012-12-30 19:29:12 -------- d-----w- c:\programdata\Babylon
2012-12-30 19:28:22 -------- d-----w- c:\programdata\TuneUp360
2012-12-30 19:28:16 -------- d-----w- c:\program files\TuneUp360
2012-12-30 18:18:59 -------- d-----w- c:\users\shoshi\appdata\roaming\SpeedMaxPc
2012-12-30 18:16:09 -------- d-----w- c:\programdata\SpeedMaxPc
2012-12-30 14:52:18 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-12-30 14:51:42 41224 ----a-w- c:\windows\avastSS.scr
2012-12-30 14:05:06 221568 ----a-w- c:\windows\system32\drivers\netio.sys
2012-12-28 22:20:57 -------- d-----w- C:\FRST
2012-12-22 17:03:36 859072 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-12-22 17:02:47 93640 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-12-21 21:01:22 293376 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 21:01:20 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-20 02:33:04 -------- d-----w- c:\users\shoshi\appdata\roaming\island_tribe_4_realore_bfg_en
2012-12-20 02:29:30 -------- d-----w- c:\program files\Island Tribe 4
2012-12-14 21:58:17 -------- d-----w- c:\users\shoshi\appdata\roaming\Ashes of Immortality
2012-12-14 21:18:51 -------- d-----w- c:\program files\Ashes of Immortality
2012-12-12 21:22:05 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-12-12 21:22:04 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-12-12 21:22:04 194048 ----a-w- c:\program files\internet explorer\IEShims.dll
2012-12-12 21:22:04 149552 ----a-w- c:\program files\internet explorer\sqmapi.dll
2012-12-12 21:22:02 194560 ----a-w- c:\program files\internet explorer\ieproxy.dll
2012-12-12 21:22:02 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-12-12 21:22:01 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-12-12 21:21:59 1800704 ----a-w- c:\windows\system32\jscript9.dll
2012-12-12 21:21:58 757296 ----a-w- c:\program files\internet explorer\iexplore.exe
2012-12-12 21:21:57 387584 ----a-w- c:\program files\internet explorer\jsdbgui.dll
2012-12-12 21:21:56 678912 ----a-w- c:\program files\internet explorer\iedvtool.dll
2012-12-12 21:21:55 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-12-12 21:15:43 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-12-12 21:15:18 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-12-12 21:15:17 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-12-12 21:15:16 16896 ----a-w- c:\windows\system32\winusb.dll
2012-12-12 21:15:12 73216 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-12-12 21:15:12 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-12-12 21:15:05 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-12-12 21:15:05 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-12-12 21:14:51 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-12-12 21:14:48 196608 ----a-w- c:\windows\system32\WUDFHost.exe
2012-12-12 21:14:47 613888 ----a-w- c:\windows\system32\WUDFx.dll
2012-12-12 20:45:14 2048000 ----a-w- c:\windows\system32\win32k.sys
2012-12-12 20:45:12 376320 ----a-w- c:\windows\system32\dpnet.dll
2012-12-12 20:45:12 23040 ----a-w- c:\windows\system32\dpnsvr.exe
2012-12-12 20:45:09 224640 ----a-w- c:\windows\system32\drivers\volsnap.sys
2012-12-12 20:44:51 2048 ----a-w- c:\windows\system32\tzres.dll
.
==================== Find3M ====================
.
2012-12-22 17:01:49 779704 ----a-w- c:\windows\system32\deployJava1.dll
2012-12-17 13:38:34 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-17 13:38:33 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-14 22:49:28 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-07 01:27:36 19752 ----a-w- c:\programdata\SPL10D.tmp
2012-12-07 00:31:38 1164764 ----a-w- c:\programdata\SPLC354.tmp
2012-12-06 01:26:59 1055824 ----a-w- c:\programdata\SPL7425.tmp
2012-12-05 21:34:21 1164012 ----a-w- c:\programdata\SPL77FD.tmp
2012-12-05 21:20:34 1164524 ----a-w- c:\programdata\SPLD741.tmp
2012-11-21 13:21:34 1172569 ----a-w- c:\programdata\SPLA2D3.tmp
2012-11-20 20:21:03 1172569 ----a-w- c:\programdata\SPLFECC.tmp
2012-11-20 19:44:58 1184002 ----a-w- c:\programdata\SPLF444.tmp
2012-11-20 19:43:41 1055748 ----a-w- c:\programdata\SPLC7C8.tmp
2012-11-20 19:37:34 1184002 ----a-w- c:\programdata\SPL2CF0.tmp
2012-11-20 19:36:11 1055748 ----a-w- c:\programdata\SPLE8B4.tmp
2012-11-20 19:30:09 1109740 ----a-w- c:\programdata\SPL5A2A.tmp
2012-10-30 23:51:57 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-10-25 09:12:26 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-10-25 09:12:26 69632 ----a-w- c:\windows\system32\QuickTime.qts
.
============= FINISH: 10:45:07.36 ===============



Also included the attach.zip file as instructed.

Attached Files
File Type: zip attach.zip (7.0 KB)

Viewing all articles
Browse latest Browse all 2798

Trending Articles