1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Fake svchost.exe is running under my username.

Discussion in 'Virus & Other Malware Removal' started by d3lta105, Oct 30, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. d3lta105

    d3lta105 Thread Starter

    Joined:
    Oct 30, 2011
    Messages:
    4
    Recently I noticed that my games would minimize and programs would go to the background randomly. It happens every couple of minutes and makes games unplayable. Here is a screen shot <http://i.imgur.com/tSD7i.png>. Both task manager and process explorer show that it has no services attached to it.

    I have Windows 7 64-bit

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 12:49:21 PM, on 10/30/2011
    Platform: Windows 7 SP1 (WinNT 6.00.3505)
    MSIE: Internet Explorer v8.00 (8.00.7601.17514)
    Boot mode: Normal

    Running processes:
    C:\Windows\DAODx.exe
    C:\Program Files (x86)\DisplayFusion\AppHookx86.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.7wolf.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    F2 - REG:system.ini: UserInit=userinit.exe
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKCU\..\Run: [DisplayFusion] "C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
    O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
    O17 - HKLM\System\CCS\Services\Tcpip\..\{6BAF4CAA-82BA-44A2-B2B6-80DCBD0FB5A7}: NameServer = 8.8.8.8 8.8.4.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EDD66FAE-1B47-4508-8612-C4E1FB180540}: NameServer = 8.8.8.8,8.8.4.4
    O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
    O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - c:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --
    End of file - 7523 bytes


    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 8.0.7601.17514
    Run by Mr. Vercetty at 13:21:19 on 2011-10-30
    Microsoft Windows 7 Ultimate 6.1.7601.1.1251.7.1033.18.8190.6068 [GMT -5:00]
    .
    AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
    SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    c:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\explorer.exe
    C:\Windows\DAODx.exe
    C:\Windows\system32\SearchIndexer.exe
    c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Microsoft Security Client\msseces.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Windows\system32\taskmgr.exe
    C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe
    C:\Program Files (x86)\DisplayFusion\AppHookx86.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Mr. Vercetty\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = www.7wolf.net
    mWinlogon: Userinit=userinit.exe
    uWinlogon: Shell=C:\Users\Mr. Vercetty\AppData\Local\fb0caa31\X
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    uRun: [DisplayFusion] "C:\Program Files (x86)\DisplayFusion\DisplayFusion.exe"
    mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
    TCP: Interfaces\{6BAF4CAA-82BA-44A2-B2B6-80DCBD0FB5A7} : NameServer = 8.8.8.8 8.8.4.4
    TCP: Interfaces\{A05E3A63-5D6E-4FAD-92E2-C911E3C5A64A} : DhcpNameServer = 192.168.42.129
    TCP: Interfaces\{EDD66FAE-1B47-4508-8612-C4E1FB180540} : NameServer = 8.8.8.8,8.8.4.4
    TCP: Interfaces\{EDD66FAE-1B47-4508-8612-C4E1FB180540} : DhcpNameServer = 192.168.1.1 75.75.76.76 75.75.75.75
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO-X64: SkypeIEPluginBHO - No File
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-9-8 361984]
    R2 AODDriver4.01;AODDriver4.01;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2011-6-24 55424]
    R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
    R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
    R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
    R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
    R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
    R3 pnetmdm;PdaNet Modem;C:\Windows\system32\DRIVERS\pnetmdm64.sys --> C:\Windows\system32\DRIVERS\pnetmdm64.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
    R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\system32\drivers\viahduaa.sys --> C:\Windows\system32\drivers\viahduaa.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-22 136176]
    S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-22 136176]
    S3 HTCAND64;HTC Device Driver;C:\Windows\system32\Drivers\ANDROIDUSB.sys --> C:\Windows\system32\Drivers\ANDROIDUSB.sys [?]
    S3 htcnprot;HTC NDIS Protocol Driver;C:\Windows\system32\DRIVERS\htcnprot.sys --> C:\Windows\system32\DRIVERS\htcnprot.sys [?]
    S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;C:\Windows\system32\DRIVERS\MijXfilt.sys --> C:\Windows\system32\DRIVERS\MijXfilt.sys [?]
    S3 pneteth;PdaNet Broadband;C:\Windows\system32\DRIVERS\pneteth.sys --> C:\Windows\system32\DRIVERS\pneteth.sys [?]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
    S3 Synth3dVsc;Synth3dVsc;C:\Windows\system32\drivers\synth3dvsc.sys --> C:\Windows\system32\drivers\synth3dvsc.sys [?]
    S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
    S3 tsusbhub;tsusbhub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    S4 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
    S4 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-8-15 2329480]
    S4 PassThru Service;Internet Pass-Through Service;C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-8-12 87040]
    S4 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
    .
    =============== Created Last 30 ================
    .
    2074-05-18 22:44:52 607296 ----a-w- C:\Program Files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll
    2011-10-30 17:36:41 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{73924A76-6505-4E36-9C09-FB0AE2A97BF8}\offreg.dll
    2011-10-30 05:38:13 -------- d-----w- C:\ProgramData\AVAST Software
    2011-10-30 05:38:13 -------- d-----w- C:\Program Files\AVAST Software
    2011-10-30 03:20:51 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{73924A76-6505-4E36-9C09-FB0AE2A97BF8}\mpengine.dll
    2011-10-28 03:03:41 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Roaming\DisplayFusion
    2011-10-26 06:23:11 -------- d-----w- C:\Program Files\NTCore
    2011-10-26 05:56:44 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Roaming\Runscanner.net
    2011-10-25 21:16:32 6144 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll
    2011-10-25 21:16:32 6144 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll
    2011-10-25 18:43:12 -------- d-----w- C:\ProgramData\DualMonitor
    2011-10-25 18:43:09 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Roaming\Dual Monitor
    2011-10-24 23:31:12 203264 ----a-w- C:\Windows\System32\unrar.dll
    2011-10-24 23:31:11 86016 ----a-w- C:\Windows\System32\ff_vfw.dll
    2011-10-24 23:31:10 -------- d-----w- C:\Program Files\K-Lite Codec Pack x64
    2011-10-24 23:30:12 175616 ----a-w- C:\Windows\SysWow64\unrar.dll
    2011-10-24 23:30:09 839680 ----a-w- C:\Windows\SysWow64\lameACM.acm
    2011-10-24 23:30:08 74752 ----a-w- C:\Windows\SysWow64\ff_vfw.dll
    2011-10-24 23:30:08 650752 ----a-w- C:\Windows\SysWow64\xvidcore.dll
    2011-10-24 23:30:08 243200 ----a-w- C:\Windows\SysWow64\xvidvfw.dll
    2011-10-24 23:30:08 151552 ----a-w- C:\Windows\SysWow64\ac3acm.acm
    2011-10-24 23:30:05 -------- d-----w- C:\Program Files (x86)\K-Lite Codec Pack
    2011-10-23 01:46:44 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Local\FOMM
    2011-10-23 01:46:41 -------- d-----w- C:\Program Files (x86)\GeMM
    2011-10-21 23:22:20 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Local\Fallout3
    2011-10-21 06:52:27 -------- d-----w- C:\Program Files (x86)\AMD APP
    2011-10-21 06:42:57 39936 ----a-w- C:\Windows\System32\atig6txx.dll
    2011-10-19 17:32:15 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
    2011-10-19 17:32:15 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Roaming\Adobe Mini Bridge CS5.1
    2011-10-19 06:14:31 4784 ----a-w- C:\STFE94B.tmp
    2011-10-19 05:12:03 -------- d-sh--w- C:\Users\Mr. Vercetty\AppData\Local\fb0caa31
    2011-10-19 05:08:24 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Roaming\Binary Fortress Software
    2011-10-19 05:01:11 -------- d-----w- C:\Program Files (x86)\DisplayFusion
    2011-10-16 20:18:14 33856 ---ha-w- C:\Windows\System32\hamachi.sys
    2011-10-16 20:18:11 -------- d-----w- C:\Program Files (x86)\LogMeIn Hamachi
    2011-10-14 03:01:29 43520 ----a-w- C:\Windows\SysWow64\CmdLineExt03.dll
    2011-10-14 01:08:41 -------- d-----w- C:\Program Files\LucasArts
    2011-10-14 01:07:36 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
    2011-10-14 01:07:36 225280 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
    2011-10-14 01:07:36 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
    2011-10-14 01:07:35 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
    2011-10-13 06:53:40 331776 ----a-w- C:\Windows\System32\oleacc.dll
    2011-10-13 06:53:39 861696 ----a-w- C:\Windows\System32\oleaut32.dll
    2011-10-13 06:53:39 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2011-10-13 06:53:39 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
    2011-10-12 19:30:10 -------- d-----w- C:\Users\Mr. Vercetty\AppData\Local\capcom
    2011-10-12 03:17:03 -------- d-----w- C:\Program Files (x86)\Bethesda Softworks
    2011-10-11 18:15:09 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{609741DE-143E-4BCD-BD10-706A4429A506}\gapaengine.dll
    2011-10-11 05:22:19 -------- d-----w- C:\Program Files\Dobermann
    2011-10-04 23:38:09 -------- d-----w- C:\Program Files (x86)\NEC Electronics
    2011-10-04 21:21:15 -------- d-----w- C:\Program Files (x86)\Spirent Communications
    2011-10-04 21:20:10 -------- d-----w- C:\Program Files (x86)\HTC
    .
    ==================== Find3M ====================
    .
    2011-10-21 06:42:59 381952 ----a-w- C:\Windows\System32\atiadlxx.dll
    2011-10-21 06:42:58 862720 ----a-w- C:\Windows\System32\aticfx64.dll
    2011-10-21 06:42:57 58880 ----a-w- C:\Windows\System32\coinst.dll
    2011-10-21 06:08:49 234536 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
    2011-10-21 06:08:49 234536 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
    2011-10-21 06:06:44 234536 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
    2011-10-16 03:02:18 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2011-10-03 10:06:03 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
    2011-10-01 03:25:37 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-10-01 02:42:56 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-09-29 18:34:29 75136 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe
    2011-09-14 16:47:42 60416 ----a-w- C:\Windows\System32\OVDecode64.dll
    2011-09-14 16:47:40 53760 ----a-w- C:\Windows\SysWow64\OVDecode.dll
    2011-09-14 16:47:10 16652288 ----a-w- C:\Windows\System32\amdocl64.dll
    2011-09-14 16:38:30 44032 ----a-w- C:\Windows\System32\amdoclcl64.dll
    2011-09-14 16:38:28 37376 ----a-w- C:\Windows\SysWow64\amdoclcl.dll
    2011-09-06 03:03:17 3138048 ----a-w- C:\Windows\System32\win32k.sys
    2011-08-28 05:30:58 729088 ----a-w- C:\Windows\iun6002.exe
    2011-08-27 18:49:23 20480 ----a-w- C:\Windows\SysWow64\[email protected]@@k.DLL
    2011-08-27 02:53:41 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
    2011-08-27 02:53:41 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
    2011-08-27 02:53:41 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
    2011-08-27 02:53:41 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
    2011-08-25 01:19:10 56320 ----a-w- C:\Windows\SysWow64\OpenVideo.dll
    2011-08-25 01:18:30 13601280 ----a-w- C:\Windows\SysWow64\amdocl.dll
    2011-08-25 01:17:52 43520 ----a-w- C:\Windows\SysWow64\OpenCL.dll
    2011-08-20 05:37:58 1188864 ----a-w- C:\Windows\System32\wininet.dll
    2011-08-20 04:31:05 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2011-08-17 05:26:46 613888 ----a-w- C:\Windows\System32\psisdecd.dll
    2011-08-17 05:25:08 108032 ----a-w- C:\Windows\System32\psisrndr.ax
    2011-08-17 04:24:12 465408 ----a-w- C:\Windows\SysWow64\psisdecd.dll
    2011-08-17 04:19:27 75776 ----a-w- C:\Windows\SysWow64\psisrndr.ax
    2011-08-08 07:18:08 10268 ----a-w- C:\Windows\SysWow64\ealregsnapshot1.reg
    2011-08-07 08:42:12 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll
    2011-08-07 08:35:02 669184 ----a-w- C:\Windows\SysWow64\pbsvc.exe
    2011-08-06 23:41:33 3956 ----a-w- C:\STFDD0D.tmp
    2011-08-06 20:56:12 3956 ----a-w- C:\STF79F3.tmp
    2011-08-06 20:17:52 3956 ----a-w- C:\STF6356.tmp
    2011-08-05 19:00:25 3956 ----a-w- C:\STFE170.tmp
    2011-08-05 18:35:51 3956 ----a-w- C:\STF6406.tmp
    2011-08-05 10:22:30 3956 ----a-w- C:\STFE654.tmp
    2011-08-05 10:16:07 3956 ----a-w- C:\STFCA8.tmp
    2011-08-05 09:00:52 3956 ----a-w- C:\STF27B4.tmp
    2011-08-05 08:45:48 3956 ----a-w- C:\STF5EB9.tmp
    2011-08-05 06:53:52 3956 ----a-w- C:\STFE3BB.tmp
    2011-08-05 04:20:47 4054 ----a-w- C:\STF2305.tmp
    .
    ============= FINISH: 13:21:53.37 ===============
     

    Attached Files:

  2. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,451
    First Name:
    Derek
    Delete any existing version of ComboFix you have sitting on your desktop
    Please read and follow all these instructions very carefully
    Do not edit or remove any information or user names etc, otherwise we cannot fix the problem. If you insist on editing out anything then I will close the topic & refuse to offer any help.

    Download ComboFix from Here or Hereto your Desktop.
    As you download it rename it to username123.exe


    **Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer**
    --------------------------------------------------------------------
    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    • Very Important! Temporarily disable your anti-virus and anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
    • Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
    • Remember to re enable the protection again after combofix has finished
    --------------------------------------------------------------------
    2. Close any open browsers and any other programs you might have running
    Double click on renamed combofix.exe & follow the prompts.​
    If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
    Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
    When finished, it will produce a report for you.
    Please post the "C:\ComboFix.txt" for further review


    ****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

    Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
    Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

    Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

    Please tell us if it has cured the problems or if there are any outstanding issues
     
  3. d3lta105

    d3lta105 Thread Starter

    Joined:
    Oct 30, 2011
    Messages:
    4
    I installed malwarebytes and after a full scan in safe mode the problem is gone, I still did what you asked to make sure.
     

    Attached Files:

  4. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,451
    First Name:
    Derek
  5. d3lta105

    d3lta105 Thread Starter

    Joined:
    Oct 30, 2011
    Messages:
    4
    I did a few scans like you told me and they show up clean. Am I out of the woods?

    P.S. I was using a program called display fusion (i know it's clean) for my second taskbar on the other monitor but now every time i try to run it it gives me error "A device attached to the system is not functioning". I can live without it, but i don't want this to come back and bite me where it hurts.

    EDIT: Same goes for Catalyst Control. Now it's serious.
     
  6. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,451
    First Name:
    Derek
    I would reinstall display fusion as it is quite possible that it has been damaged by the malware


    *Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
    * Click START then RUN
    * Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
    [​IMG]

    This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

    go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

    and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer and update whatever it suggests

    Then pay an urgent visit to windows update & make sure you are fully updated, that will help to plug the security holes that let these pests on in the first place. If windows update doesn't work, please come back & tell us
     
  7. d3lta105

    d3lta105 Thread Starter

    Joined:
    Oct 30, 2011
    Messages:
    4
  8. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1024703

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice