Hi, I'm a newer member.
I was working last night and I came home to find out my wife tried to download a powerpoint viewer for her college classes.
2 Hours later I find my Chrome/IE has been infected with some form of malware that has completely taken over, every time I open Chrome or open a new tab it redirects me to a search website called mysearchresults.com The only thing to do is view background pages and end the default tab process.(I don't use IE for any reason ever
Anyways, I've ran MalwareBytes, and SpyBot S&D and neither can find it.
I was wondering if anyone had any experience with this specific type of malware.
All help will be appreciated and accepted. My logs will be pasted below.
Thanks!
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.10.2
Run by [removed] at 14:58:02 on 2012-12-22
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3544.1507 [GMT -5:00]
.
.
============== Running Processes ================
.
E:\WINDOWS\System32\WLTRYSVC.EXE
E:\WINDOWS\System32\bcmwltry.exe
E:\WINDOWS\system32\spoolsv.exe
e:\program files\idt\xpm09_6047v002\wdm\STacSV.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\WLTRAY.exe
E:\Program Files\IDT\WDM\sttray.exe
E:\WINDOWS\system32\AESTFltr.exe
E:\Program Files\Ask.com\Updater\Updater.exe
E:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\WINDOWS\system32\igfxtray.exe
E:\WINDOWS\system32\hkcmd.exe
E:\WINDOWS\system32\igfxpers.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Documents and Settings\Avery\Local Settings\Application Data\Akamai\netsession_win.exe
E:\WINDOWS\system32\igfxsrvc.exe
E:\Documents and Settings\Avery\Local Settings\Application Data\Akamai\netsession_win.exe
E:\Documents and Settings\CheyBabygirl\Local Settings\Application Data\StrongVault\StrongVaultApp.exe
E:\Program Files\DefaultTab\DefaultTabSearch.exe
E:\Documents and Settings\CheyBabygirl\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
E:\Program Files\Java\jre7\bin\jqs.exe
E:\WINDOWS\system32\RUNDLL32.EXE
E:\WINDOWS\System32\alg.exe
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\PnkBstrA.exe
E:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
E:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
E:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
E:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
E:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\WINDOWS\system32\wbem\wmiprvse.exe
E:\WINDOWS\System32\svchost.exe -k netsvcs
E:\WINDOWS\system32\svchost.exe -k NetworkService
E:\WINDOWS\system32\svchost.exe -k LocalService
E:\WINDOWS\system32\svchost.exe -k LocalService
E:\WINDOWS\system32\svchost.exe -k imgsvc
E:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.mysearchresults.com/?c=2651&t=03
uProxyOverride = <local>
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - e:\program files\spybot - search & destroy 2\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - e:\program files\java\jre7\bin\ssv.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - e:\documents and settings\cheybabygirl\application data\defaulttab\defaulttab\DefaultTabBHO.dll
BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - e:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - e:\program files\java\jre7\bin\jp2ssv.dll
BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - e:\program files\ask.com\GenericAskToolbar.dll
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - e:\program files\ask.com\GenericAskToolbar.dll
uRun: [ctfmon.exe] e:\windows\system32\ctfmon.exe
uRun: [Akamai NetSession Interface] "e:\documents and settings\avery\local settings\application data\akamai\netsession_win.exe"
uRun: [DAEMON Tools Lite] "e:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [uTorrent] "e:\program files\utorrent\uTorrent.exe" /MINIMIZED
uRunOnce: [SpybotDeletingF4211] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
uRunOnce: [SpybotDeletingF9544] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
uRunOnce: [SpybotDeletingF4540] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\imsins.log"
uRunOnce: [SpybotDeletingF6690] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\OEWABLog.txt"
uRunOnce: [SpybotDeletingF1168] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\comsetup.log"
uRunOnce: [SpybotDeletingF3197] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\Directx.log"
uRunOnce: [SpybotDeletingF4806] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\ocgen.log"
uRunOnce: [SpybotDeletingF7169] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupact.log"
uRunOnce: [SpybotDeletingF5930] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupapi.log"
uRunOnce: [SpybotDeletingF4056] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuperr.log"
uRunOnce: [SpybotDeletingF944] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuplog.txt"
uRunOnce: [SpybotDeletingF2426] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\wmsetup.log"
uRunOnce: [SpybotDeletingF9578] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\DtcInstall.log"
uRunOnce: [SpybotDeletingF4125] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\mofcomp.log"
uRunOnce: [SpybotDeletingF6988] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\setup.log"
uRunOnce: [SpybotDeletingF139] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemcore.log"
uRunOnce: [SpybotDeletingF5184] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.lo_"
uRunOnce: [SpybotDeletingF2591] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.log"
uRunOnce: [SpybotDeletingF2974] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemprox.log"
uRunOnce: [SpybotDeletingF4292] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiadap.log"
uRunOnce: [SpybotDeletingF2457] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiprov.log"
mRun: [Broadcom Wireless Manager UI] e:\windows\system32\WLTRAY.exe
mRun: [SysTrayApp] e:\program files\idt\wdm\sttray.exe
mRun: [AESTFltr] e:\windows\system32\AESTFltr.exe /NoDlg
mRun: [ApnUpdater] "e:\program files\ask.com\updater\Updater.exe"
mRun: [SunJavaUpdateSched] "e:\program files\common files\java\java update\jusched.exe"
mRun: [IgfxTray] e:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] e:\windows\system32\hkcmd.exe
mRun: [Persistence] e:\windows\system32\igfxpers.exe
mRun: [SDTray] "e:\program files\spybot - search & destroy 2\SDTray.exe"
mRunOnce: [Malwarebytes Anti-Malware] e:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunOnce: [SpybotDeletingE6085] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
mRunOnce: [SpybotDeletingE5501] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
mRunOnce: [SpybotDeletingE3703] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\imsins.log"
mRunOnce: [SpybotDeletingE5641] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\OEWABLog.txt"
mRunOnce: [SpybotDeletingE9018] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\comsetup.log"
mRunOnce: [SpybotDeletingE229] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\Directx.log"
mRunOnce: [SpybotDeletingE55] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\ocgen.log"
mRunOnce: [SpybotDeletingE984] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupact.log"
mRunOnce: [SpybotDeletingE9368] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupapi.log"
mRunOnce: [SpybotDeletingE7094] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuperr.log"
mRunOnce: [SpybotDeletingE9467] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuplog.txt"
mRunOnce: [SpybotDeletingE813] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\wmsetup.log"
mRunOnce: [SpybotDeletingE7953] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\DtcInstall.log"
mRunOnce: [SpybotDeletingE9415] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\mofcomp.log"
mRunOnce: [SpybotDeletingE1092] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\setup.log"
mRunOnce: [SpybotDeletingE9252] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemcore.log"
mRunOnce: [SpybotDeletingE6098] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.lo_"
mRunOnce: [SpybotDeletingE6434] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.log"
mRunOnce: [SpybotDeletingE4397] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemprox.log"
mRunOnce: [SpybotDeletingE6734] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiadap.log"
mRunOnce: [SpybotDeletingE9724] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiprov.log"
mRunOnce: [SpybotDeletingE5332] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\program files\spybot - search & destroy 2\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: dell.com
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{37AAF5D3-9510-4476-80C0-4E06DE4D25A4} : DHCPNameServer = [removed] [removed]
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - e:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: SDWinLogon - SDWinLogon.dll
SecurityProviders: SecurityProviders = msapsspc.dll, schannel.dll, credssp.dll, digest.dll, msnsspc.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
============= SERVICES / DRIVERS ===============
.
R0 iastor7;iastor7;e:\windows\system32\drivers\iastor7.sys [2012-8-17 471360]
R0 mv61xxmm;mv61xxmm;e:\windows\system32\drivers\mv61xxmm.sys [2012-8-17 13616]
R0 mv64xxmm;mv64xxmm;e:\windows\system32\drivers\mv64xxmm.sys [2012-8-17 5632]
R0 mvxxmm;mvxxmm;e:\windows\system32\drivers\mvxxmm.sys [2012-8-17 13616]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;e:\windows\system32\drivers\dtsoftbus01.sys [2012-12-19 242240]
R2 DefaultTabSearch;DefaultTabSearch;e:\program files\defaulttab\DefaultTabSearch.exe [2012-11-14 568832]
R2 DefaultTabUpdate;DefaultTabUpdate;e:\documents and settings\cheybabygirl\application data\defaulttab\defaulttab\DTUpdate.exe [2012-12-21 107520]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;e:\program files\spybot - search & destroy 2\SDFSSvc.exe [2012-12-22 1103392]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;e:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2012-12-22 1369624]
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc --> RUNDLL32.EXE ykx32coinst,serviceStartProc [?]
R3 AESTAud;AE Audio Service;e:\windows\system32\drivers\AESTAud.sys [2012-12-18 108160]
R3 ManyCam;ManyCam Virtual Webcam;e:\windows\system32\drivers\mcvidrv.sys [2012-10-10 34432]
R3 mcaudrv_simple;ManyCam Virtual Microphone;e:\windows\system32\drivers\mcaudrv.sys [2012-10-10 25088]
R3 OA009Afx;Provides a software interface to control audio effects of OA009 camera.;e:\windows\system32\drivers\OA009Afx.sys [2012-12-18 148056]
R3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;e:\windows\system32\drivers\OA009Ufd.sys [2012-12-18 144544]
R3 OA009Vid;Creative Camera OA009 Function Driver;e:\windows\system32\drivers\OA009Vid.sys [2012-12-18 268992]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;e:\program files\spybot - search & destroy 2\SDWSCSvc.exe [2012-12-22 168384]
S2 SkypeUpdate;Skype Updater;e:\program files\skype\updater\Updater.exe [2012-11-9 160944]
.
=============== Created Last 30 ================
.
2012-12-22 15:09:55 -------- d-----w- e:\documents and settings\all users\application data\Spybot - Search & Destroy
2012-12-22 15:09:46 15224 ----a-w- e:\windows\system32\sdnclean.exe
2012-12-22 15:09:41 -------- d-----w- e:\program files\Spybot - Search & Destroy 2
2012-12-22 14:45:19 22328 ----a-w- e:\windows\system32\drivers\PnkBstrK.sys
2012-12-22 14:45:18 22328 ----a-w- e:\documents and settings\avery\application data\PnkBstrK.sys
2012-12-22 14:45:02 103736 ----a-w- e:\windows\system32\PnkBstrB.exe
2012-12-22 14:45:01 66872 ----a-w- e:\windows\system32\PnkBstrA.exe
2012-12-22 14:39:38 -------- d-----w- e:\program files\Activision
2012-12-22 14:29:23 -------- d-sh--w- e:\windows\ftpcache
2012-12-22 12:41:59 -------- d-----w- e:\documents and settings\avery\application data\Malwarebytes
2012-12-22 12:41:51 -------- d-----w- e:\documents and settings\all users\application data\Malwarebytes
2012-12-22 12:41:50 22856 ----a-w- e:\windows\system32\drivers\mbam.sys
2012-12-22 12:41:50 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2012-12-22 01:02:37 165376 ----a-w- e:\windows\system32\unrar.dll
2012-12-22 01:02:35 -------- d-----w- e:\program files\K-Lite Codec Pack
2012-12-22 01:01:41 -------- d-----w- e:\program files\DefaultTab
2012-12-19 22:15:19 221184 ----a-w- e:\windows\system32\wmpns.dll
2012-12-19 21:36:16 40960 ----a-w- e:\windows\system32\SSubTmr6.dll
2012-12-19 21:36:12 36921 ----a-w- e:\windows\system32\hcwutl32.dll
2012-12-19 21:36:12 -------- d-----w- e:\program files\HCW17
2012-12-19 21:32:54 -------- d-----w- e:\documents and settings\all users\application data\Electronic Arts
2012-12-19 21:30:48 -------- d-----w- e:\windows\pss
2012-12-19 21:00:48 -------- d-----w- e:\program files\common files\BioWare
2012-12-19 20:48:35 242240 ----a-w- e:\windows\system32\drivers\dtsoftbus01.sys
2012-12-19 20:48:28 -------- d-----w- e:\documents and settings\avery\application data\DAEMON Tools Lite
2012-12-19 20:48:26 -------- d-----w- e:\program files\DAEMON Tools Lite
2012-12-19 20:47:36 -------- d-----w- e:\documents and settings\all users\application data\DAEMON Tools Lite
2012-12-19 05:13:13 -------- d-----w- e:\program files\SystemRequirementsLab
2012-12-19 05:00:11 -------- d-----w- e:\program files\uTorrent
2012-12-19 04:59:48 -------- d-----w- e:\documents and settings\avery\application data\uTorrent
2012-12-19 04:42:30 -------- d-----r- e:\program files\Skype
2012-12-19 04:19:25 -------- d-----w- e:\program files\Ask.com
2012-12-19 04:19:25 -------- d-----w- e:\documents and settings\avery\local settings\application data\AskToolbar
2012-12-19 04:19:21 -------- d-----w- e:\documents and settings\avery\local settings\application data\APN
2012-12-19 04:19:18 -------- d-----w- e:\documents and settings\avery\local settings\application data\Temp
2012-12-19 04:19:17 -------- d-----w- e:\documents and settings\all users\application data\Ask
2012-12-19 04:18:35 -------- d-----w- e:\documents and settings\avery\local settings\application data\ManyCam
2012-12-19 04:18:35 -------- d-----w- e:\documents and settings\all users\application data\ManyCam
2012-12-19 04:18:34 -------- d-----w- e:\documents and settings\avery\application data\ManyCam
2012-12-19 04:18:20 -------- d-----w- e:\program files\ManyCam
2012-12-19 04:06:24 -------- d-----w- e:\program files\ATI Technologies
2012-12-19 04:06:14 77824 ------w- e:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2012-12-19 04:06:14 32768 ------w- e:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2012-12-19 04:06:14 221184 ------w- e:\program files\common files\installshield\iscript\IScript.dll
2012-12-19 04:06:14 221184 ------w- e:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2012-12-19 04:06:14 212992 ----a-w- e:\program files\common files\installshield\engine\6\intel 32\ILog.dll
2012-12-19 04:06:00 610436 ----a-w- e:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2012-12-19 04:04:07 53248 ----a-w- e:\windows\system32\CSVer.dll
2012-12-19 04:03:59 -------- d-----w- E:\Intel
2012-12-19 04:00:20 -------- d-----w- e:\windows\system32\LogFiles
2012-12-19 03:58:42 -------- d-----w- e:\documents and settings\avery\local settings\application data\Akamai
2012-12-19 03:55:26 -------- d-----w- e:\documents and settings\avery\local settings\application data\Deployment
2012-12-19 03:37:48 -------- d-----w- e:\program files\Marvell
2012-12-19 03:37:17 -------- d-----w- e:\documents and settings\avery\application data\TMP
2012-12-19 03:33:52 442466 ----a-w- e:\windows\system32\stacapi.dll
2012-12-19 03:20:41 -------- d-----w- e:\documents and settings\avery\local settings\application data\Google
2012-12-19 03:02:07 -------- d-sh--w- e:\documents and settings\avery\PrivacIE
2012-12-19 03:00:08 -------- d-s---w- e:\windows\system32\Microsoft
.
==================== Find3M ====================
.
2012-12-19 05:12:06 93640 ----a-w- e:\windows\system32\WindowsAccessBridge.dll
2012-12-19 05:12:05 859072 ----a-w- e:\windows\system32\npDeployJava1.dll
2012-12-19 05:12:05 779704 ----a-w- e:\windows\system32\deployJava1.dll
2012-12-19 05:12:05 143872 ----a-w- e:\windows\system32\javacpl.cpl
2012-10-11 03:08:10 34432 ----a-w- e:\windows\system32\drivers\mcvidrv.sys
2012-10-11 03:08:08 25088 ----a-w- e:\windows\system32\drivers\mcaudrv.sys
.
============= FINISH: 14:58:23.67 ===============
I was working last night and I came home to find out my wife tried to download a powerpoint viewer for her college classes.
2 Hours later I find my Chrome/IE has been infected with some form of malware that has completely taken over, every time I open Chrome or open a new tab it redirects me to a search website called mysearchresults.com The only thing to do is view background pages and end the default tab process.(I don't use IE for any reason ever
Anyways, I've ran MalwareBytes, and SpyBot S&D and neither can find it.
I was wondering if anyone had any experience with this specific type of malware.
All help will be appreciated and accepted. My logs will be pasted below.
Thanks!
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.10.2
Run by [removed] at 14:58:02 on 2012-12-22
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3544.1507 [GMT -5:00]
.
.
============== Running Processes ================
.
E:\WINDOWS\System32\WLTRYSVC.EXE
E:\WINDOWS\System32\bcmwltry.exe
E:\WINDOWS\system32\spoolsv.exe
e:\program files\idt\xpm09_6047v002\wdm\STacSV.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\WLTRAY.exe
E:\Program Files\IDT\WDM\sttray.exe
E:\WINDOWS\system32\AESTFltr.exe
E:\Program Files\Ask.com\Updater\Updater.exe
E:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\WINDOWS\system32\igfxtray.exe
E:\WINDOWS\system32\hkcmd.exe
E:\WINDOWS\system32\igfxpers.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Documents and Settings\Avery\Local Settings\Application Data\Akamai\netsession_win.exe
E:\WINDOWS\system32\igfxsrvc.exe
E:\Documents and Settings\Avery\Local Settings\Application Data\Akamai\netsession_win.exe
E:\Documents and Settings\CheyBabygirl\Local Settings\Application Data\StrongVault\StrongVaultApp.exe
E:\Program Files\DefaultTab\DefaultTabSearch.exe
E:\Documents and Settings\CheyBabygirl\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
E:\Program Files\Java\jre7\bin\jqs.exe
E:\WINDOWS\system32\RUNDLL32.EXE
E:\WINDOWS\System32\alg.exe
E:\WINDOWS\system32\wscntfy.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\PnkBstrA.exe
E:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
E:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
E:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
E:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
E:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\Program Files\Google\Chrome\Application\chrome.exe
E:\WINDOWS\system32\wbem\wmiprvse.exe
E:\WINDOWS\System32\svchost.exe -k netsvcs
E:\WINDOWS\system32\svchost.exe -k NetworkService
E:\WINDOWS\system32\svchost.exe -k LocalService
E:\WINDOWS\system32\svchost.exe -k LocalService
E:\WINDOWS\system32\svchost.exe -k imgsvc
E:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.mysearchresults.com/?c=2651&t=03
uProxyOverride = <local>
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - e:\program files\spybot - search & destroy 2\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - e:\program files\java\jre7\bin\ssv.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - e:\documents and settings\cheybabygirl\application data\defaulttab\defaulttab\DefaultTabBHO.dll
BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - e:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - e:\program files\java\jre7\bin\jp2ssv.dll
BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - e:\program files\ask.com\GenericAskToolbar.dll
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - e:\program files\ask.com\GenericAskToolbar.dll
uRun: [ctfmon.exe] e:\windows\system32\ctfmon.exe
uRun: [Akamai NetSession Interface] "e:\documents and settings\avery\local settings\application data\akamai\netsession_win.exe"
uRun: [DAEMON Tools Lite] "e:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [uTorrent] "e:\program files\utorrent\uTorrent.exe" /MINIMIZED
uRunOnce: [SpybotDeletingF4211] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
uRunOnce: [SpybotDeletingF9544] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
uRunOnce: [SpybotDeletingF4540] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\imsins.log"
uRunOnce: [SpybotDeletingF6690] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\OEWABLog.txt"
uRunOnce: [SpybotDeletingF1168] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\comsetup.log"
uRunOnce: [SpybotDeletingF3197] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\Directx.log"
uRunOnce: [SpybotDeletingF4806] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\ocgen.log"
uRunOnce: [SpybotDeletingF7169] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupact.log"
uRunOnce: [SpybotDeletingF5930] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupapi.log"
uRunOnce: [SpybotDeletingF4056] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuperr.log"
uRunOnce: [SpybotDeletingF944] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuplog.txt"
uRunOnce: [SpybotDeletingF2426] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\wmsetup.log"
uRunOnce: [SpybotDeletingF9578] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\DtcInstall.log"
uRunOnce: [SpybotDeletingF4125] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\mofcomp.log"
uRunOnce: [SpybotDeletingF6988] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\setup.log"
uRunOnce: [SpybotDeletingF139] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemcore.log"
uRunOnce: [SpybotDeletingF5184] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.lo_"
uRunOnce: [SpybotDeletingF2591] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.log"
uRunOnce: [SpybotDeletingF2974] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemprox.log"
uRunOnce: [SpybotDeletingF4292] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiadap.log"
uRunOnce: [SpybotDeletingF2457] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiprov.log"
mRun: [Broadcom Wireless Manager UI] e:\windows\system32\WLTRAY.exe
mRun: [SysTrayApp] e:\program files\idt\wdm\sttray.exe
mRun: [AESTFltr] e:\windows\system32\AESTFltr.exe /NoDlg
mRun: [ApnUpdater] "e:\program files\ask.com\updater\Updater.exe"
mRun: [SunJavaUpdateSched] "e:\program files\common files\java\java update\jusched.exe"
mRun: [IgfxTray] e:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] e:\windows\system32\hkcmd.exe
mRun: [Persistence] e:\windows\system32\igfxpers.exe
mRun: [SDTray] "e:\program files\spybot - search & destroy 2\SDTray.exe"
mRunOnce: [Malwarebytes Anti-Malware] e:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunOnce: [SpybotDeletingE6085] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
mRunOnce: [SpybotDeletingE5501] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
mRunOnce: [SpybotDeletingE3703] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\imsins.log"
mRunOnce: [SpybotDeletingE5641] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\OEWABLog.txt"
mRunOnce: [SpybotDeletingE9018] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\comsetup.log"
mRunOnce: [SpybotDeletingE229] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\Directx.log"
mRunOnce: [SpybotDeletingE55] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\ocgen.log"
mRunOnce: [SpybotDeletingE984] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupact.log"
mRunOnce: [SpybotDeletingE9368] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setupapi.log"
mRunOnce: [SpybotDeletingE7094] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuperr.log"
mRunOnce: [SpybotDeletingE9467] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\setuplog.txt"
mRunOnce: [SpybotDeletingE813] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\wmsetup.log"
mRunOnce: [SpybotDeletingE7953] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\DtcInstall.log"
mRunOnce: [SpybotDeletingE9415] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\mofcomp.log"
mRunOnce: [SpybotDeletingE1092] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\setup.log"
mRunOnce: [SpybotDeletingE9252] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemcore.log"
mRunOnce: [SpybotDeletingE6098] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.lo_"
mRunOnce: [SpybotDeletingE6434] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemess.log"
mRunOnce: [SpybotDeletingE4397] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wbemprox.log"
mRunOnce: [SpybotDeletingE6734] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiadap.log"
mRunOnce: [SpybotDeletingE9724] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\system32\wbem\logs\wmiprov.log"
mRunOnce: [SpybotDeletingE5332] "e:\program files\spybot - search & destroy 2\sddelfile.exe" "e:\windows\SchedLgU.Txt"
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\program files\spybot - search & destroy 2\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: dell.com
TCP: NameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{37AAF5D3-9510-4476-80C0-4E06DE4D25A4} : DHCPNameServer = [removed] [removed]
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - e:\program files\common files\skype\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: SDWinLogon - SDWinLogon.dll
SecurityProviders: SecurityProviders = msapsspc.dll, schannel.dll, credssp.dll, digest.dll, msnsspc.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
.
============= SERVICES / DRIVERS ===============
.
R0 iastor7;iastor7;e:\windows\system32\drivers\iastor7.sys [2012-8-17 471360]
R0 mv61xxmm;mv61xxmm;e:\windows\system32\drivers\mv61xxmm.sys [2012-8-17 13616]
R0 mv64xxmm;mv64xxmm;e:\windows\system32\drivers\mv64xxmm.sys [2012-8-17 5632]
R0 mvxxmm;mvxxmm;e:\windows\system32\drivers\mvxxmm.sys [2012-8-17 13616]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;e:\windows\system32\drivers\dtsoftbus01.sys [2012-12-19 242240]
R2 DefaultTabSearch;DefaultTabSearch;e:\program files\defaulttab\DefaultTabSearch.exe [2012-11-14 568832]
R2 DefaultTabUpdate;DefaultTabUpdate;e:\documents and settings\cheybabygirl\application data\defaulttab\defaulttab\DTUpdate.exe [2012-12-21 107520]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;e:\program files\spybot - search & destroy 2\SDFSSvc.exe [2012-12-22 1103392]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;e:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2012-12-22 1369624]
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc --> RUNDLL32.EXE ykx32coinst,serviceStartProc [?]
R3 AESTAud;AE Audio Service;e:\windows\system32\drivers\AESTAud.sys [2012-12-18 108160]
R3 ManyCam;ManyCam Virtual Webcam;e:\windows\system32\drivers\mcvidrv.sys [2012-10-10 34432]
R3 mcaudrv_simple;ManyCam Virtual Microphone;e:\windows\system32\drivers\mcaudrv.sys [2012-10-10 25088]
R3 OA009Afx;Provides a software interface to control audio effects of OA009 camera.;e:\windows\system32\drivers\OA009Afx.sys [2012-12-18 148056]
R3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;e:\windows\system32\drivers\OA009Ufd.sys [2012-12-18 144544]
R3 OA009Vid;Creative Camera OA009 Function Driver;e:\windows\system32\drivers\OA009Vid.sys [2012-12-18 268992]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;e:\program files\spybot - search & destroy 2\SDWSCSvc.exe [2012-12-22 168384]
S2 SkypeUpdate;Skype Updater;e:\program files\skype\updater\Updater.exe [2012-11-9 160944]
.
=============== Created Last 30 ================
.
2012-12-22 15:09:55 -------- d-----w- e:\documents and settings\all users\application data\Spybot - Search & Destroy
2012-12-22 15:09:46 15224 ----a-w- e:\windows\system32\sdnclean.exe
2012-12-22 15:09:41 -------- d-----w- e:\program files\Spybot - Search & Destroy 2
2012-12-22 14:45:19 22328 ----a-w- e:\windows\system32\drivers\PnkBstrK.sys
2012-12-22 14:45:18 22328 ----a-w- e:\documents and settings\avery\application data\PnkBstrK.sys
2012-12-22 14:45:02 103736 ----a-w- e:\windows\system32\PnkBstrB.exe
2012-12-22 14:45:01 66872 ----a-w- e:\windows\system32\PnkBstrA.exe
2012-12-22 14:39:38 -------- d-----w- e:\program files\Activision
2012-12-22 14:29:23 -------- d-sh--w- e:\windows\ftpcache
2012-12-22 12:41:59 -------- d-----w- e:\documents and settings\avery\application data\Malwarebytes
2012-12-22 12:41:51 -------- d-----w- e:\documents and settings\all users\application data\Malwarebytes
2012-12-22 12:41:50 22856 ----a-w- e:\windows\system32\drivers\mbam.sys
2012-12-22 12:41:50 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2012-12-22 01:02:37 165376 ----a-w- e:\windows\system32\unrar.dll
2012-12-22 01:02:35 -------- d-----w- e:\program files\K-Lite Codec Pack
2012-12-22 01:01:41 -------- d-----w- e:\program files\DefaultTab
2012-12-19 22:15:19 221184 ----a-w- e:\windows\system32\wmpns.dll
2012-12-19 21:36:16 40960 ----a-w- e:\windows\system32\SSubTmr6.dll
2012-12-19 21:36:12 36921 ----a-w- e:\windows\system32\hcwutl32.dll
2012-12-19 21:36:12 -------- d-----w- e:\program files\HCW17
2012-12-19 21:32:54 -------- d-----w- e:\documents and settings\all users\application data\Electronic Arts
2012-12-19 21:30:48 -------- d-----w- e:\windows\pss
2012-12-19 21:00:48 -------- d-----w- e:\program files\common files\BioWare
2012-12-19 20:48:35 242240 ----a-w- e:\windows\system32\drivers\dtsoftbus01.sys
2012-12-19 20:48:28 -------- d-----w- e:\documents and settings\avery\application data\DAEMON Tools Lite
2012-12-19 20:48:26 -------- d-----w- e:\program files\DAEMON Tools Lite
2012-12-19 20:47:36 -------- d-----w- e:\documents and settings\all users\application data\DAEMON Tools Lite
2012-12-19 05:13:13 -------- d-----w- e:\program files\SystemRequirementsLab
2012-12-19 05:00:11 -------- d-----w- e:\program files\uTorrent
2012-12-19 04:59:48 -------- d-----w- e:\documents and settings\avery\application data\uTorrent
2012-12-19 04:42:30 -------- d-----r- e:\program files\Skype
2012-12-19 04:19:25 -------- d-----w- e:\program files\Ask.com
2012-12-19 04:19:25 -------- d-----w- e:\documents and settings\avery\local settings\application data\AskToolbar
2012-12-19 04:19:21 -------- d-----w- e:\documents and settings\avery\local settings\application data\APN
2012-12-19 04:19:18 -------- d-----w- e:\documents and settings\avery\local settings\application data\Temp
2012-12-19 04:19:17 -------- d-----w- e:\documents and settings\all users\application data\Ask
2012-12-19 04:18:35 -------- d-----w- e:\documents and settings\avery\local settings\application data\ManyCam
2012-12-19 04:18:35 -------- d-----w- e:\documents and settings\all users\application data\ManyCam
2012-12-19 04:18:34 -------- d-----w- e:\documents and settings\avery\application data\ManyCam
2012-12-19 04:18:20 -------- d-----w- e:\program files\ManyCam
2012-12-19 04:06:24 -------- d-----w- e:\program files\ATI Technologies
2012-12-19 04:06:14 77824 ------w- e:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2012-12-19 04:06:14 32768 ------w- e:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2012-12-19 04:06:14 221184 ------w- e:\program files\common files\installshield\iscript\IScript.dll
2012-12-19 04:06:14 221184 ------w- e:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2012-12-19 04:06:14 212992 ----a-w- e:\program files\common files\installshield\engine\6\intel 32\ILog.dll
2012-12-19 04:06:00 610436 ----a-w- e:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2012-12-19 04:04:07 53248 ----a-w- e:\windows\system32\CSVer.dll
2012-12-19 04:03:59 -------- d-----w- E:\Intel
2012-12-19 04:00:20 -------- d-----w- e:\windows\system32\LogFiles
2012-12-19 03:58:42 -------- d-----w- e:\documents and settings\avery\local settings\application data\Akamai
2012-12-19 03:55:26 -------- d-----w- e:\documents and settings\avery\local settings\application data\Deployment
2012-12-19 03:37:48 -------- d-----w- e:\program files\Marvell
2012-12-19 03:37:17 -------- d-----w- e:\documents and settings\avery\application data\TMP
2012-12-19 03:33:52 442466 ----a-w- e:\windows\system32\stacapi.dll
2012-12-19 03:20:41 -------- d-----w- e:\documents and settings\avery\local settings\application data\Google
2012-12-19 03:02:07 -------- d-sh--w- e:\documents and settings\avery\PrivacIE
2012-12-19 03:00:08 -------- d-s---w- e:\windows\system32\Microsoft
.
==================== Find3M ====================
.
2012-12-19 05:12:06 93640 ----a-w- e:\windows\system32\WindowsAccessBridge.dll
2012-12-19 05:12:05 859072 ----a-w- e:\windows\system32\npDeployJava1.dll
2012-12-19 05:12:05 779704 ----a-w- e:\windows\system32\deployJava1.dll
2012-12-19 05:12:05 143872 ----a-w- e:\windows\system32\javacpl.cpl
2012-10-11 03:08:10 34432 ----a-w- e:\windows\system32\drivers\mcvidrv.sys
2012-10-11 03:08:08 25088 ----a-w- e:\windows\system32\drivers\mcaudrv.sys
.
============= FINISH: 14:58:23.67 ===============
