suspected malware problem

2

Comments

  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    Had to use the uninstall updates instead.
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    Post me a DDS log - should take 2-3 minutes.

    Download DDS from the link below and save it to your desktop:

    Link

    After you've downloaded it and saved it to your desktop:
    • Double click DDS to run it.
    • When it's finished, DDS will open two logs:
    1. DDS.txt
    2. Attach.txt
    Save both reports to your desktop.

    Copy & paste the contents of just DDS.txt for now and post it here (you may need to split the log over separate posts)
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    here it is

    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 8.0.7600.16869 BrowserJavaVersion: 10.13.2
    Run by Holmes at 22:44:30 on 2013-02-23
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3326.2169 [GMT 0:00]
    .
    AV: AVG Anti-Virus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: AVG Anti-Virus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    .
    ============== Running Processes ================
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    C:\Windows\system32\FsUsbExService.Exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_168_ActiveX.exe
    C:\Program Files\NetMeter\NetMeter.exe
    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\svchost.exe -k SDRSVC
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://uk.mg.bt.mail.yahoo.com/neo/launch?.partner=bt-1&.rand=4qrf0mfdv7oa0
    uWindow Title = Internet Explorer, optimized for Bing and MSN
    BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
    BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
    BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} -
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
    BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} -
    TB: BT Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} -
    TB: Easy Photo Print: {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -
    TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
    uRun: [NetMeter] c:\program files\netmeter\NetMeter.exe
    mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    LSP: mswsock.dll
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    TCP: NameServer = 192.168.1.254
    TCP: Interfaces\{F43170CE-2F1D-4B12-BF25-FD43C13774A2} : DHCPNameServer = 192.168.1.254
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
    Notify: GoToAssist - c:\program files\citrix\gotoassist\570\G2AWinLogon.dll
    SSODL: WebCheck - <orphaned>
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL
    Hosts: 127.0.0.1 validation.sls.microsoft.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-2-23 738504]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-2-23 361032]
    R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\common files\abbyy\finereadersprint\9.00\licensing\NetworkLicenseServer.exe [2009-5-14 759048]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-2-23 21256]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-2-23 58680]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-2-23 44808]
    R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2012-3-5 217088]
    R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-2-23 398184]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-2-23 682344]
    R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2012-3-5 36640]
    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2013-2-19 68208]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-2-23 21104]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [2012-3-5 98432]
    S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [2012-3-5 14848]
    S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [2012-3-5 123648]
    S3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\drivers\ss_bserd.sys [2012-3-5 100224]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-10-19 1343400]
    .
    =============== Created Last 30 ================
    .
    2013-02-23 21:01:10
    d--h--w- c:\windows\msdownld.tmp
    2013-02-23 19:56:02
    d
    w- c:\program files\CCleaner
    2013-02-23 19:34:20
    d
    w- c:\users\holmes\appdata\local\Avg2013
    2013-02-23 19:28:03 44784 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
    2013-02-23 19:28:00 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2013-02-23 19:27:55 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2013-02-23 19:26:58 41224 ----a-w- c:\windows\avastSS.scr
    2013-02-23 19:26:31
    d
    w- c:\programdata\AVAST Software
    2013-02-23 19:26:31
    d
    w- c:\program files\AVAST Software
    2013-02-23 18:08:45 388096 ----a-r- c:\users\holmes\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2013-02-23 18:08:45
    d
    w- c:\program files\Trend Micro
    2013-02-23 01:40:24
    d
    w- c:\program files\Belarc
    2013-02-23 00:46:55
    d
    w- c:\users\holmes\appdata\roaming\Malwarebytes
    2013-02-23 00:46:48 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-02-23 00:46:48
    d
    w- c:\programdata\Malwarebytes
    2013-02-23 00:46:48
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2013-02-23 00:46:30
    d
    w- c:\users\holmes\appdata\local\Programs
    2013-02-22 23:44:57
    d
    w- c:\users\holmes\appdata\local\Diagnostics
    2013-02-22 15:57:11
    d-sh--w- c:\windows\system32\%APPDATA%
    2013-02-21 12:36:59
    d
    w- c:\users\holmes\appdata\roaming\Highresolution Enterprises
    2013-02-21 12:36:59
    d
    w- c:\program files\Highresolution Enterprises
    2013-02-20 12:13:03
    d
    w- c:\programdata\UDL
    2013-02-20 12:09:53
    d
    w- c:\program files\Epson Software
    2013-02-20 12:08:46
    d
    w- c:\users\holmes\appdata\local\ABBYY
    2013-02-20 12:07:08
    d
    w- c:\programdata\ABBYY
    2013-02-20 12:07:08
    d
    w- c:\program files\common files\ABBYY
    2013-02-20 12:07:08
    d
    w- c:\program files\ABBYY FineReader 9.0 Sprint
    2013-02-20 12:05:12
    d
    w- c:\programdata\EPSON
    2013-02-20 12:05:01
    d
    w- c:\program files\epson
    2013-02-19 17:05:12
    d
    w- c:\program files\common files\Motive
    2013-02-19 17:05:02
    d
    w- c:\program files\BT Broadband Desktop Help
    2013-02-19 17:04:26
    d
    w- c:\program files\Citrix
    2013-02-19 17:04:16
    d
    w- c:\program files\BTHomeHub
    2013-02-19 16:59:36 68208 ----a-w- c:\windows\system32\drivers\L1C62x86.sys
    2013-02-19 16:59:08
    d
    w- c:\windows\system32\Atheros_L1e
    2013-02-07 11:58:24 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    .
    ==================== Find3M ====================
    .
    2013-02-22 15:51:41 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-02-22 15:51:41 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-02-07 11:58:18 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
    2013-02-07 11:58:18 782240 ----a-w- c:\windows\system32\deployJava1.dll
    .
    ============= FINISH: 22:44:56.26 ===============
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    I can see the problem but this doesn't look to be a legit install - what's the history of the machine?
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    It was built by the IT dept where I worked a couple of yrs ago.
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    The best thing to do is get a legit copy of Windows, backup then format/reinstall and start again.
  • andy2004
    andy2004 Posts: 1,309 Forumite
    damn you got a lot of toolbars running.

    AVG isnt the best free antivirus anymore, would suggest Avast free
    but then again i dont have any installed.

    so its the conhost.exe virus. did a bit of googling. someone else has the same problem " If you go to Google.com and type in anything and try to go to a link of any kind it re-routes you to more spyware sites."

    check your IE settings internet explorer > tools > internet options > connections > LAN settings > and unchecking proxy server.
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    andy2004 wrote: »
    so its the conhost.exe virus.

    No. That's a legit MS process.
  • andy2004
    andy2004 Posts: 1,309 Forumite
    never start a sentence with because.

    because its in the system32 folder right.

    well i spent over 30minutes reading the above DDS report and I cant see it.
  • waddler_8
    waddler_8 Posts: 3,588 Forumite
    andy2004 wrote: »
    because its in the system32 folder right.

    Yes.

    http://blogs.technet.com/b/askperf/archive/2009/10/05/windows-7-windows-server-2008-r2-console-host.aspx
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

Categories

  • All Categories
  • 343K Banking & Borrowing
  • 250K Reduce Debt & Boost Income
  • 449.6K Spending & Discounts
  • 235.1K Work, Benefits & Business
  • 607.8K Mortgages, Homes & Bills
  • 173K Life & Family
  • 247.8K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 15.9K Discuss & Feedback
  • 15.1K Coronavirus Support Boards