Text only | Text with Images

LandzDown Forum

Security => Analysis and Malware Removal => Topic started by: Toobroketopay on February 27, 2012, 01:58:48 PM

Title: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 27, 2012, 01:58:48 PM
My daughter woke me up last night with a problem on her new laptop.  A screen popped up telling her that she had viruses, etc.  She new better than to click on anything, so she and I tried to close the windows, but they weren't responding.  The "tool" called itself 'Security Shield'.  After we turned the computer off, we tried to turn it back on.  The Windows screen pops up, asks her to punch in her password (as usual), then the the whole monitor goes black, except for the arrow/cursor.  Obviously, she caught something.  This morning I did a search (on my computer) and found that 'Security Shield' is quite a nasty virus.  There are lots of websites offering help, but I don't trust any of them, either.  Anyone here have any experience with 'Security Shield', or do you have recommendations about which help site I could trust?    You have saved us so much time and money healing up our computers, I tell everybody to visit you before purchasing a new computer.  THANKS!!
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 27, 2012, 02:48:25 PM
Hi, Toobroketopay.

1.  Please restart the computer in Safe Mode with Networking. (To do this, turn your computer off and then back on and immediately when you see anything on the screen, start tapping the F8 key on your keyboard. Using the arrow keys on your keyboard, select Safe Mode with Networking and press Enter on your keyboard. Windows will now boot into safe mode with networking and prompt you to login as a user.) 

Once in Safe Mode, do the following:

Please start Internet Explorer and do the following:
2.  Please download rkill from one of the following links and save to your Desktop:

One (http://download.bleepingcomputer.com/grinler/rkill.exe), Two (http://download.bleepingcomputer.com/grinler/rkill.com),Three (http://download.bleepingcomputer.com/grinler/rkill.scr) or Four (http://download.bleepingcomputer.com/grinler/rkill.pif)
Note: If you you receive security warnings about rkill, please ignore and allow the download to continue.

3.  Please download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam.php) to your desktop.

** Note **

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

4.  Download DDS.scr by sUBs from one of the following links and save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/sUBs/dds.scr)
Link 2 (http://www.forospyware.com/sUBs/dds)

5.  Download Security Check by screen317 from here (http://screen317.spywareinfoforum.org/SecurityCheck.exe) or here (http://screen317.changelog.fr/SecurityCheck.exe).
Requested logs:

Malwarebytes
Both DDS.txt and Attach.txt
checkup.txt
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 27, 2012, 03:06:19 PM
I did as you said, but only a blank screen with "safe mode" in each corner shows up.  What now?
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 27, 2012, 04:16:08 PM
Do you mean a screen such as this?

(https://www.landzdown.com/proxy.php?request=http%3A%2F%2F0.tqn.com%2Fd%2Fpcsupport%2F1%2F5%2F_%2F4%2F-%2F-%2Fsafe-mode-windows-7-5.jpg&hash=e6a3866de101cb684afd61f055d5d426c85a3bf0)

If there is no shortcut to Internet Explorer, click the Start button and navigate to IE to launch it and follow the instructions above.
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 27, 2012, 04:41:10 PM
It looks like your screen, only there is no start button or recycle bin, etc.    There is only the 'Safe Mode' in the extreme four corners and 'Microsoft Windows Build 7601: Service Pack 1) across the center extreme top.  Thanks!
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 27, 2012, 07:48:53 PM
Hi, Toobroketopay.

Give this a try: 

1. Right-click on the task bar and select Properties.
2. Click on Start Menu Tab and click the Customize button.
3. Click on "Use Default Settings" button at the bottom of customize window.

Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 27, 2012, 08:27:30 PM
There is no task bar.  The whole screen is completely blank except for 'safe mode' written in each corner.  Thanks!
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 28, 2012, 01:37:59 AM
How about the Last Known Good Configuration?  Follow the instructions here:  Using Last Known Good Configuration (http://windows.microsoft.com/en-US/windows7/Using-Last-Known-Good-Configuration).
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 28, 2012, 02:21:03 AM
No luck.  This time the screen was completely black,except for the cursor. 
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 28, 2012, 03:09:51 AM
My husband said said to press, "Control, Alt, Delete". I did it and actually got a screen!  I'm not sure what to do now.   In the center of the monitor is a menu choice of:   Lock this computer, Switch User, Log Off, Change a Password, Start Task Manager or Cancel.  Hope that is good news!  Thanks
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 28, 2012, 03:30:20 AM
Hi, Toobroketopay.

I'm sorry, but without the ability to access anything, the only option is a repair or clean install. 

If your daughter created or received a "Factory" Restore/Recovery installation disc, a clean install can be done.  If she has a retail OEM Windows 7 installation disc it can be used to do a repair install.  With a repair install, her files should be fine.

Tutorials:

Repair Install - Windows 7 Forums (http://www.sevenforums.com/tutorials/3413-repair-install.html)
Clean Install Windows 7 - Windows 7 Forums (http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html)

Well!  That is great news and hopefully changes the bad news.  What happens when you click Cancel?  Does it take you to the desktop? 
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 28, 2012, 04:28:56 AM
Here's the logs you asked for earlier, I'll put the dds log on a seperate post:

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.28.01

Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 8.0.7601.17514
Bailey :: BAILEY-PC [administrator]

2/27/2012 10:42:24 PM
mbam-log-2012-02-27 (22-42-24).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 186273
Time elapsed: 3 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 3
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce|nygdzsl (Rogue.SecurityTool) -> Data: C:\Users\Bailey\AppData\Local\nygdzsl.exe -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|crrss (Trojan.Agent) -> Data: C:\windows\system32\crrss.exe -> Quarantined and deleted successfully.
HKCU\Software\Microsoft|adver_id (Malware.Trace) -> Data: 0 -> Quarantined and deleted successfully.

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Trojan.Agent) -> Bad: (C:\windows\system32\crrss.exe) Good: () -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 10
C:\Users\Bailey\AppData\Local\nygdzsl.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\Bailey\AppData\Local\Temp\8626.tmp (Trojan.Agent.CBCGen) -> Quarantined and deleted successfully.
C:\Users\Bailey\Local Settings\nygdzsl.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\Bailey\Local Settings\Application Data\nygdzsl.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\Bailey\Local Settings\Temporary Internet Files\Content.IE5\63KXJJ3U\ftp[1].exe (Trojan.Agent.CBCGen) -> Quarantined and deleted successfully.
C:\Users\Bailey\Local Settings\Temporary Internet Files\Content.IE5\9Y1E83O0\soft[1].exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\Bailey\Local Settings\Temporary Internet Files\Content.IE5\R5SR73VD\gigabit[2].exe (Trojan.FakeAlert.FS) -> Quarantined and deleted successfully.
C:\Windows\System32\crrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\crrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Bailey\uidsave.dat (Malware.Trace) -> Quarantined and deleted successfully.

(end)

Results of screen317's Security Check version 0.99.31 
Windows 7  x64 (UAC is enabled) 
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled! 
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
SpywareBlaster 4.5   
Secunia PSI (2.0.0.3003)   
Java(TM) 6 Update 22 
Java version out of date!
Adobe Reader X (10.1.2)
````````````````````````````````
Process Check: 
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Client Antimalware MsMpEng.exe 
``````````End of Log````````````

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 5/14/2011 9:00:47 PM
System Uptime: 2/27/2012 10:51:10 PM (0 hours ago)
.
Motherboard: LENOVO |  | Base Board Product Name
Processor: Intel(R) Pentium(R) CPU B940 @ 2.00GHz | CPU1 | 1995/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 422 GiB total, 352.995 GiB free.
D: is FIXED (NTFS) - 29 GiB total, 26.885 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Security Processor Loader Driver
Device ID: ROOT\LEGACY_SPLDR\0000
Manufacturer:
Name: Security Processor Loader Driver
PNP Device ID: ROOT\LEGACY_SPLDR\0000
Service: spldr
.
==== System Restore Points ===================
.
RP65: 1/18/2012 10:16:28 AM - Windows Update
RP66: 1/21/2012 5:28:41 PM - Windows Update
RP67: 1/24/2012 12:09:43 AM - Windows Update
RP68: 1/25/2012 11:23:01 PM - Windows Update
RP69: 1/29/2012 10:07:31 PM - Windows Update
RP70: 2/2/2012 12:48:22 PM - Windows Update
RP71: 2/6/2012 10:16:38 AM - Windows Update
RP72: 2/9/2012 11:01:01 PM - Windows Update
RP73: 2/13/2012 10:41:13 PM - Windows Update
RP74: 2/14/2012 11:33:07 PM - Windows Update
RP75: 2/15/2012 10:30:03 PM - Windows Update
RP76: 2/19/2012 9:22:25 PM - Windows Update
RP77: 2/23/2012 1:04:13 PM - Windows Update
RP78: 2/26/2012 5:44:49 PM - Windows Update
.
==== Hosts File Hijack ======================
.
Hosts: 67.215.245.19 www.google-analytics.com.
Hosts: 67.215.245.19 ad-emea.doubleclick.net.
Hosts: 67.215.245.19 www.statcounter.com.
Hosts: 108.163.215.51 www.google-analytics.com.
Hosts: 108.163.215.51 ad-emea.doubleclick.net.
Hosts: 108.163.215.51 www.statcounter.com.
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader X (10.1.2)
Atheros Client Installation Program
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Audacity 1.3.13 (Unicode)
AVS Screen Capture version 2.0.1
AVS Update Manager 1.0
AVS Video Editor 6
AVS Video Recorder 2.4
AVS4YOU Software Navigator 1.4
Business Plan Pro 15th Anniversary Edition
D3DX10
Energy Management
Gimp 2.6.2 Debug
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 6 Update 22
Junk Mail filter update
Lenovo DirectShare
Lenovo EasyCamera
Lenovo Games Console
Lenovo OneKey Recovery
Lenovo Smile Dock
Lenovo YouCam
Malwarebytes Anti-Malware version 1.60.1.1000
Mesh Runtime
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MSVCRT
MSVCRT_amd64
MyITLab
MyITLab ActiveX Installer 2, 9, 8, 65535
Oasis2Service 1.0
ooVoo
Pinnacle device drivers
Pinnacle Instant DVD Recorder
Pinnacle USB device drivers
Power2Go
Realtek USB 2.0 Reader Driver
Secunia PSI (2.0.0.3003)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
SpywareBlaster 4.5
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
UserGuide
VeriFace
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
.
==== Event Viewer Messages From Past Week ========
.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD BPntDrv DfsC discache MpFilter NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error:  The dependency service or group failed to start.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error:  A device attached to the system is not functioning.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error:  A device attached to the system is not functioning.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error:  The dependency service or group failed to start.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error:  The dependency service or group failed to start.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error:  A device attached to the system is not functioning.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error:  The dependency service or group failed to start.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error:  A device attached to the system is not functioning.
2/27/2012 9:16:28 AM, Error: Service Control Manager [7001]  - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error:  A device attached to the system is not functioning.
2/27/2012 10:52:06 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
2/27/2012 10:52:06 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
2/27/2012 10:52:05 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/27/2012 10:52:00 PM, Error: Microsoft-Windows-DistributedCOM [10005]  - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
2/27/2012 10:51:35 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  BPntDrv discache MpFilter spldr Wanarpv6
2/27/2012 10:51:33 PM, Error: Service Control Manager [7001]  - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error:  The dependency service or group failed to start.
2/26/2012 5:32:31 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/26/2012 11:37:27 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/26/2012 11:23:21 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/25/2012 12:54:52 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/25/2012 10:44:26 PM, Error: Microsoft Antimalware [2001]  - Microsoft Antimalware has encountered an error trying to update signatures.     New Signature Version:      Previous Signature Version: 1.121.359.0     Update Source: Microsoft Update Server     Update Stage: Search     Source Path: http://www.microsoft.com     Signature Type: AntiVirus     Update Type: Full     User: NT AUTHORITY\SYSTEM     Current Engine Version:      Previous Engine Version: 1.1.8101.0     Error code: 0x8024402c     Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
2/24/2012 8:10:10 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/23/2012 7:52:25 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/23/2012 4:49:12 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/23/2012 12:53:11 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/22/2012 10:35:37 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/22/2012 10:01:53 AM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/21/2012 12:29:55 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/21/2012 10:05:11 AM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
2/20/2012 10:34:14 PM, Error: Microsoft Antimalware [3002]  - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.     Feature: Behavior Monitoring     Error Code: 0x80004005     Error description: Unspecified error      Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
.
==== End Of File ===========================
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 28, 2012, 04:29:36 AM
DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 8.0.7601.17514
Run by Bailey at 23:27:17 on 2012-02-27
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4040.3274 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\Explorer.EXE
C:\windows\system32\ctfmon.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
uStart Page = hxxp://www.yahoo.com/?ilc=1
mStart Page = hxxp://lenovo.msn.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Partner BHO Class: {83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} - C:\ProgramData\Partner\Partner.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [332BigDog] C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRunOnce: [GrpConv] grpconv -o
mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SECUNI~1.LNK - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
Trusted Zone: myitlab.com
Trusted Zone: pearsoncmg.com
Trusted Zone: pearsoned.com
Trusted Zone: researchnavigator.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} - hxxp://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.5.1
TCP: Interfaces\{E910FAE1-2475-402E-9E90-B2F8E185DFAE} : DhcpNameServer = 192.168.5.1
TCP: Interfaces\{E910FAE1-2475-402E-9E90-B2F8E185DFAE}\5696368656E686F66656277457563747 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E910FAE1-2475-402E-9E90-B2F8E185DFAE}\96B656E626573686 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{E910FAE1-2475-402E-9E90-B2F8E185DFAE}\E69636B6E65647 : DhcpNameServer = 192.168.0.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64:     AcroIEHelperStub - No File
BHO-X64: Partner BHO Class: {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [332BigDog] C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
mRun-x64: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun-x64: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun-x64: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun-x64: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
mRun-x64: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRunOnce-x64: [GrpConv] grpconv -o
mRunOnce-x64: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mRunOnce-x64: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
Hosts: 67.215.245.19 www.google-analytics.com.
Hosts: 67.215.245.19 ad-emea.doubleclick.net.
Hosts: 67.215.245.19 www.statcounter.com.
Hosts: 108.163.215.51 www.google-analytics.com.
Hosts: 108.163.215.51 ad-emea.doubleclick.net.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
============= SERVICES / DRIVERS ===============
.
R0 fbfmon;fbfmon;C:\windows\system32\drivers\fbfmon.sys --> C:\windows\system32\drivers\fbfmon.sys [?]
R0 LHDmgr;LHDmgr;C:\windows\system32\DRIVERS\LhdX64.sys --> C:\windows\system32\DRIVERS\LhdX64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\windows\system32\DRIVERS\L1C62x64.sys --> C:\windows\system32\DRIVERS\L1C62x64.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]
S1 BPntDrv;BPntDrv;C:\windows\system32\drivers\BPntDrv.sys --> C:\windows\system32\drivers\BPntDrv.sys [?]
S1 MpFilter;Microsoft Malware Protection Driver;C:\windows\system32\DRIVERS\MpFilter.sys --> C:\windows\system32\DRIVERS\MpFilter.sys [?]
S2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-14 136176]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-5-14 13336]
S2 Oasis2Service;Oasis2Service;C:\Program Files (x86)\DDNi\Oasis2Service 1.0\Oasis2Service.exe [2010-12-22 46080]
S2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-4-19 993848]
S2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-4-19 399416]
S2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-5-14 2656280]
S3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\system32\DRIVERS\clwvd.sys --> C:\windows\system32\DRIVERS\clwvd.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-14 136176]
S3 IntcDAud;Intel(R) Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\windows\system32\DRIVERS\MpNWMon.sys --> C:\windows\system32\DRIVERS\MpNWMon.sys [?]
S3 NisDrv;Microsoft Network Inspection System;C:\windows\system32\DRIVERS\NisDrvWFP.sys --> C:\windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 Partner Service;Partner Service;C:\ProgramData\Partner\Partner.exe [2011-5-14 332272]
S3 PSI;PSI;C:\windows\system32\DRIVERS\psi_mf.sys --> C:\windows\system32\DRIVERS\psi_mf.sys [?]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUVStor.sys --> C:\windows\system32\Drivers\RtsUVStor.sys [?]
S3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
S3 Sftfs;Sftfs;C:\windows\system32\DRIVERS\Sftfslh.sys --> C:\windows\system32\DRIVERS\Sftfslh.sys [?]
S3 Sftplay;Sftplay;C:\windows\system32\DRIVERS\Sftplaylh.sys --> C:\windows\system32\DRIVERS\Sftplaylh.sys [?]
S3 Sftredir;Sftredir;C:\windows\system32\DRIVERS\Sftredirlh.sys --> C:\windows\system32\DRIVERS\Sftredirlh.sys [?]
S3 Sftvol;Sftvol;C:\windows\system32\DRIVERS\Sftvollh.sys --> C:\windows\system32\DRIVERS\Sftvollh.sys [?]
S3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]
S3 vm2uvcflt;Vimicro USB Camera Filter 2;C:\windows\system32\Drivers\vm2uvcflt.sys --> C:\windows\system32\Drivers\vm2uvcflt.sys [?]
S3 vm332avs;Lenovo Camera2;C:\windows\system32\Drivers\vm332avs.sys --> C:\windows\system32\Drivers\vm332avs.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
S3 wsvd;wsvd;C:\windows\system32\DRIVERS\wsvd.sys --> C:\windows\system32\DRIVERS\wsvd.sys [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-02-28 02:31:56   8643640   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{95F72B1C-2182-419C-B375-D3D5E35DC535}\mpengine.dll
2012-02-15 00:04:46   509952   ----a-w-   C:\windows\System32\ntshrui.dll
2012-02-15 00:04:46   442880   ----a-w-   C:\windows\SysWow64\ntshrui.dll
2012-02-15 00:04:42   515584   ----a-w-   C:\windows\System32\timedate.cpl
2012-02-15 00:04:42   478720   ----a-w-   C:\windows\SysWow64\timedate.cpl
2012-02-15 00:02:04   3145728   ----a-w-   C:\windows\System32\win32k.sys
2012-02-15 00:02:03   498688   ----a-w-   C:\windows\System32\drivers\afd.sys
2012-02-13 03:23:19   --------   d-----w-   C:\Users\Bailey\AppData\Local\{8D70ABD9-422F-46CD-B62C-8CC810C2F386}
2012-02-13 03:23:08   --------   d-----w-   C:\Users\Bailey\AppData\Local\{D7BBAAAF-6747-4AC1-8B8D-A8ECC500DB31}
2012-02-13 03:21:52   --------   d-----w-   C:\Users\Bailey\AppData\Local\{41328FA4-9493-4F21-B548-6DD2084FEAF7}
2012-02-13 03:18:26   --------   d-----w-   C:\Users\Bailey\AppData\Local\{DE06317F-DB86-496D-A111-FD2B3EFE2B19}
2012-02-13 03:18:15   --------   d-----w-   C:\Users\Bailey\AppData\Local\{5D641BDF-045E-4681-B6CF-27274C636274}
2012-02-11 15:34:09   927800   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9E2B90C2-512A-48FE-9219-56252B5F3B3E}\gapaengine.dll
2012-02-06 00:43:03   --------   d-----w-   C:\Users\Bailey\AppData\Roaming\Malwarebytes
2012-02-06 00:42:47   --------   d-----w-   C:\ProgramData\Malwarebytes
2012-02-06 00:42:45   23152   ----a-w-   C:\windows\System32\drivers\mbam.sys
2012-02-06 00:42:45   --------   d-----w-   C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-01-30 17:42:39   --------   d-----w-   C:\Users\Bailey\AppData\Local\{03E6F405-3E24-485C-AA1C-AC1CCE153B7A}
2012-01-30 17:42:28   --------   d-----w-   C:\Users\Bailey\AppData\Local\{2E981342-EC24-46E5-8258-B9CD5DBA19C5}
2012-01-30 17:39:40   --------   d-----w-   C:\Users\Bailey\AppData\Local\{67ACEE2E-4429-4948-AD78-20E19A31CB9D}
2012-01-30 17:39:29   --------   d-----w-   C:\Users\Bailey\AppData\Local\{52B487FA-3D52-4673-BC2D-1A17576E7118}
2012-01-30 17:38:45   --------   d-----w-   C:\Users\Bailey\AppData\Local\{1667CE2A-B55B-419E-922A-931DC839559D}
2012-01-30 17:38:33   --------   d-----w-   C:\Users\Bailey\AppData\Local\{EDAC92CE-B0EB-4CEF-9725-E3EB229216A7}
2012-01-30 17:25:19   --------   d-----w-   C:\Users\Bailey\AppData\Local\{99B3186E-D41D-4495-AD93-3C697BF664E0}
2012-01-30 17:25:08   --------   d-----w-   C:\Users\Bailey\AppData\Local\{8A9935FC-E906-4247-9DC1-C37699AFB02C}
.
==================== Find3M  ====================
.
2012-02-19 00:55:47   414368   ----a-w-   C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-31 12:44:20   279656   ------w-   C:\windows\System32\MpSigStub.exe
2011-12-16 08:47:38   1188864   ----a-w-   C:\windows\System32\wininet.dll
2011-12-16 08:46:06   634880   ----a-w-   C:\windows\System32\msvcrt.dll
2011-12-16 07:54:22   981504   ----a-w-   C:\windows\SysWow64\wininet.dll
2011-12-16 07:52:58   690688   ----a-w-   C:\windows\SysWow64\msvcrt.dll
2011-12-16 06:44:38   1638912   ----a-w-   C:\windows\System32\mshtml.tlb
2011-12-16 06:09:17   1638912   ----a-w-   C:\windows\SysWow64\mshtml.tlb
.
============= FINISH: 23:27:28.18 ===============
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 28, 2012, 06:11:04 PM
Hi, Toobroketopay.  Good job!

Let's flush your DNS cache and restore the HOSTS file:

Please copy/paste the lines in bold below to Notepad:

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Double-click flush.bat file to run it. Your computer will reboot.

Note:  For Windows Vista or Windows 7, right-click flush.bat and select "Run as Administrator".

Download TFC (http://oldtimer.geekstogo.com/TFC.exe) to your desktop
Please follow these instructions carefully.

Download ComboFix from one of the following locations:

Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.infospyware.net/antimalware/combofix/)

!!! IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your antivirus and anti-malware security applications. If not disabled, these programs will likely interfere with cleanup process. This can usually be accomplished by a right-click on the icon in the System Tray. 

Note:  If you are unsure how to disable your security software, see the instructions in this topic at Tech Support Forum:  How to disable your security applications (http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html).

Now, please run ComboFix:
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 28, 2012, 08:01:21 PM
It's a big one! 



ComboFix 12-02-27.02 - Bailey 02/28/2012  14:51:24.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4040.2863 [GMT -5:00]
Running from: c:\users\Bailey\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\s.bat
.
.
(((((((((((((((((((((((((   Files Created from 2012-01-28 to 2012-02-28  )))))))))))))))))))))))))))))))
.
.
2012-02-28 19:55 . 2012-02-28 19:55   --------   d-----w-   c:\users\Default\AppData\Local\temp
2012-02-28 02:31 . 2012-02-08 07:13   8643640   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{95F72B1C-2182-419C-B375-D3D5E35DC535}\mpengine.dll
2012-02-15 00:04 . 2012-01-04 10:44   509952   ----a-w-   c:\windows\system32\ntshrui.dll
2012-02-15 00:04 . 2012-01-04 08:58   442880   ----a-w-   c:\windows\SysWow64\ntshrui.dll
2012-02-15 00:04 . 2011-12-30 06:26   515584   ----a-w-   c:\windows\system32\timedate.cpl
2012-02-15 00:04 . 2011-12-30 05:27   478720   ----a-w-   c:\windows\SysWow64\timedate.cpl
2012-02-15 00:02 . 2012-01-14 04:06   3145728   ----a-w-   c:\windows\system32\win32k.sys
2012-02-15 00:02 . 2011-12-28 03:59   498688   ----a-w-   c:\windows\system32\drivers\afd.sys
2012-02-11 15:34 . 2012-02-11 15:33   927800   ------w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9E2B90C2-512A-48FE-9219-56252B5F3B3E}\gapaengine.dll
2012-02-06 00:43 . 2012-02-06 00:43   --------   d-----w-   c:\users\Bailey\AppData\Roaming\Malwarebytes
2012-02-06 00:42 . 2012-02-06 00:42   --------   d-----w-   c:\programdata\Malwarebytes
2012-02-06 00:42 . 2012-02-28 03:40   --------   d-----w-   c:\program files (x86)\Malwarebytes' Anti-Malware
2012-02-06 00:42 . 2011-12-10 20:24   23152   ----a-w-   c:\windows\system32\drivers\mbam.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-19 00:55 . 2011-12-31 15:06   414368   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-08 07:13 . 2011-09-10 14:11   8643640   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-01-31 12:44 . 2010-11-21 03:27   279656   ------w-   c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2011-05-15 00:41   433648   ----a-w-   c:\programdata\Partner\Partner.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-02-18 283160]
"332BigDog"="c:\program files (x86)\USB Camera2\VM332_STI.EXE" [2010-01-19 536576]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504]
"YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2011-01-28 136488]
"YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2011-01-28 228448]
"VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2011-05-15 329056]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-4-19 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages   REG_MULTI_SZ      kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-15 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-15 136176]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 29, 2012, 02:45:03 AM
Hi, Toobroketopay.

I thought I posted this earlier.  I guess I got distracted.  Anyway, I'd like to see the results of an online scan. 

Please go here (http://www.eset.com/onlinescan/) to run an on-line scan from ESET.

Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 29, 2012, 03:22:56 PM
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

Everything seems fine!
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 29, 2012, 08:16:38 PM
Hi, Toobroketopay.

Excellent!

Please do the following to implement cleanup procedures and also to reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Note: In the event you wish to contribute to the ongoing development of ComboFix, the developer is accepting donations via PayPal (https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=combofix%40live%2ecom&item_name=ComboFix&no_shipping=0&no_note=1&tax=0&currency_code=USD&bn=PP%2dDonationsBF&charset=UTF%2d8).


Personally, I would not allow any programs in the Trusted Zone.  After all, even well known sites can be the victim of an SQL injection, hidden scripts, and more.  I suggest you discuss this with your daughter and, if you elect to remove the entries from the Trusted Zone, please do the following:

I also note that even though Secunia PSI is installed on your daughter's computer both Internet Explorer and Java are out of date.  Internet Explorer 9 had a number of security and privacy enhancements, outlined in my blog post at Internet Explorer 9, Privacy and Security Enhancements (http://securitygarden.blogspot.com/2011/02/internet-explorer-9-privacy-and.html).  If the optional upgrade to IE9 has has been hidden, you can go to Internet Explorer downloads (http://windows.microsoft.com/en-US/internet-explorer/downloads/ie).  However, I think it would be best to check for updates to find out if other updates are needed.

The latest version of Java can be obtained from here:  Java SE Runtime Environment 6u31 (http://java.com/en/download/index.jsp)

Pass along this tip to your daughter should she run into one of those nasty rogue applications again:  use the key combination of Alt + F4 to close open windows.  Repeat as many times as needed until they are all closed.

Please let me know if you or your daughter have any questions.
Title: Re: New Problem!! 'Security Shield'
Post by: Toobroketopay on February 29, 2012, 08:54:12 PM
I will DEFINITELY be donating to ComboFix!!  Thanks so much - again you saved us so much time and money.   All the volunteering we do this week will be in your name - women's prison, church, children's hospital, food pantry, etc.    One last question- I still have SecurityCheck, TFC, and rkill installed (or at least the icons are on the desktop).  Should I uninstall these somehow?  Hope you have a great day!     ps  My daughter is thrilled to be able to do her homeword again :)
Title: Re: New Problem!! 'Security Shield'
Post by: Corrine on February 29, 2012, 09:50:27 PM
You are so very welcome.  I am honored that your volunteering will be in my name.  Thank you so much for that as well as the donation to the developer of ComboFix.   :flowers:

As to the other programs, sorry, yes.  You can delete SecurityCheck and RKill.  However, you may want to keep TFC around and run it occasionally.   This is what it does:

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB).

A word of warning to anyone running any temp file cleaner:  in the event your computer is infected with one of the fake/rogue applications that "hides" your Programs, desktop shortcuts, etc., do NOT run a temp file cleaner!  The rogue has not deleted those files but rather has hidden them.  Developers in the security community have created specialized tools for restoring the programs to their proper location.
Text only | Text with Images