Hijacked Browsers, Trojan infection Getting WORSE!

Outdoors2 · September 21, 2009

Both my Firefox and IE browsers have been hijacked. I've lost permissions to run any Antivirus programs. I've scanned with IObit 360 and One Care and neither reveal any threats.

I've been able to download Stopzilla and get a successful scan, however they want me to purchase to remove. I paid IObits to prevent this from happening and need help to resolve.

Thanks, Roy

STOPZILLA event log:

Block/Extraction NT Service enforcer 2009-09-20 17:35:27 Removed driver: c:\windows\win32k.sys:1

Block/Extraction NT Service enforcer 2009-09-20 17:35:27 Removed driver: c:\windows\win32k.sys:2

Block/Extraction NT Service enforcer 2009-09-20 17:35:26 Disabled service: messenger -

Information Registry enforcer 2009-09-20 13:16:09 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2009-09-20 13:16:08 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2009-09-20 13:16:04 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2009-09-20 13:16:02 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2009-09-20 13:15:57 Inspecting WinSock registry (LSP Chain)

Block/Extraction NT Service enforcer 2009-09-20 13:15:54 Removed driver: c:\windows\win32k.sys:1

Block/Extraction NT Service enforcer 2009-09-20 13:15:54 Removed driver: c:\windows\win32k.sys:2

Block/Extraction NT Service enforcer 2009-09-20 13:15:53 Disabled service: messenger -

Information Registry enforcer 2009-09-20 13:15:32 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2009-09-20 13:15:28 Inspecting WinSock registry (LSP Chain)

Information General 2009-09-20 13:15:17 Completed system scan.

Block/Extraction NT Service enforcer 2009-09-20 12:24:26 Removed driver: c:\windows\win32k.sys:1

Block/Extraction NT Service enforcer 2009-09-20 12:24:25 Removed driver: c:\windows\win32k.sys:2

Block/Extraction NT Service enforcer 2009-09-20 12:24:25 Disabled service: messenger -

Block/Extraction NT Service enforcer 2009-09-20 12:24:25 Removed driver: c:\windows\win32k.sys:2

Block/Extraction NT Service enforcer 2009-09-20 10:24:09 Disabled service: messenger -

*****************

REMOVED Repetitious for Character count

*****************

Information General 2009-09-20 10:23:43 Started system scan.

Block/Extraction NT Service enforcer 2009-09-20 10:23:31 Removed driver: c:\windows\win32k.sys:1

Block/Extraction NT Service enforcer 2009-09-20 10:23:31 Removed driver: c:\windows\win32k.sys:2

Block/Extraction NT Service enforcer 2009-09-20 10:23:16 Disabled service: messenger -

Information Internet ExplorerSiteguard 2009-09-20 10:21:57 Inspecting registered Internet Explorer toolbars

Information Registry enforcer 2009-09-20 10:21:49 Inspecting registered Explorer bars

Information Registry enforcer 2009-09-20 10:21:41 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2009-09-20 10:21:40 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2009-09-20 10:21:37 Inspecting registered Browser Helper Objects (BHOs)

Block/Extraction NT Service enforcer 2009-09-20 10:21:37 Disabled service: messenger -

Information Process enforcer 2009-09-20 10:21:36 Starting process watcher

Block/Extraction NT Service enforcer 2009-09-20 10:17:53 Disabled service: messenger -

Disabled service: messenger -

Block/Extraction Registry enforcer 2009-09-20 10:16:56 Deleted registry value AdvancedTab in hklm\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:16:56 Detected malicious registry entry AdvancedTab in hklm\software\policies\microsoft\internet explorer\control panel

Information Registry enforcer 2009-09-20 10:16:55 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Block/Extraction Registry enforcer 2009-09-20 10:16:52 Deleted registry value ProgramsTab in hklm\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:16:52 Detected malicious registry entry ProgramsTab in hklm\software\policies\microsoft\internet explorer\control panel

****************************

REMOVED

****************************

Disabled service: messenger -

Block/Extraction Registry enforcer 2009-09-20 10:16:45 Deleted registry value ConnectionsTab in hklm\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:16:45 Detected malicious registry entry ConnectionsTab in hklm\software\policies\microsoft\internet explorer\control panel

Block/Extraction Registry enforcer 2009-09-20 10:16:30 Deleted registry value AdvancedTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:16:30 Detected malicious registry entry AdvancedTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Block/Extraction Registry enforcer 2009-09-20 10:16:24 Deleted registry value ContentTab in hklm\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:16:23 Detected malicious registry entry ContentTab in hklm\software\policies\microsoft\internet explorer\control panel

Information Registry enforcer 2009-09-20 10:16:17 Inspecting WinSock registry (LSP Chain)

Information Registry enforcer 2009-09-20 10:16:16 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Block/Extraction Registry enforcer 2009-09-20 10:16:16 Deleted registry value SecurityTab in hklm\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:16:16 Detected malicious registry entry SecurityTab in hklm\software\policies\microsoft\internet explorer\control panel

Block/Extraction Registry enforcer 2009-09-20 10:16:11 Deleted registry value HomePage in hklm\software\policies\microsoft\internet explorer\control panel

Detected malicious registry entry ContentTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Block/Extraction NT Service enforcer 2009-09-20 10:15:34 Removed driver: c:\windows\win32k.sys:2

Block/Extraction Registry enforcer 2009-09-20 10:15:32 Deleted registry value SecurityTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:15:32 Detected malicious registry entry SecurityTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Block/Extraction Registry enforcer 2009-09-20 10:15:31 Deleted registry value NoBrowserOptions in hklm\software\policies\microsoft\internet explorer\restrictions

Warning/Detection COM enforcer 2009-09-20 10:15:31 Detected malicious registry entry NoBrowserOptions in hklm\software\policies\microsoft\internet explorer\restrictions

Information General 2009-09-20 10:15:28 SITEguard Incremental definition update 5.0.50.57 successfully applied.

Block/Extraction Hosts file 2009-09-20 10:15:22 Deleted 'hosts' file entries: 10 Entries

Block/Extraction Registry enforcer 2009-09-20 10:15:21 Deleted registry value NoBrowserOptions in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\restrictions

Warning/Detection COM enforcer 2009-09-20 10:15:21 Detected malicious registry entry NoBrowserOptions in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\restrictions

Block/Extraction Registry enforcer 2009-09-20 10:15:10 Deleted registry value HomePage in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:15:10 Detected malicious registry entry HomePage in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Block/Extraction NT Service enforcer 2009-09-20 10:15:06 Disabled service: messenger -

Block/Extraction Registry enforcer 2009-09-20 10:15:02 Deleted registry value system in hklm\software\microsoft\windows nt\currentversion\winlogon

Block/Extraction Registry enforcer 2009-09-20 10:14:58 Deleted registry value GeneralTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Warning/Detection COM enforcer 2009-09-20 10:14:58 Detected malicious registry entry GeneralTab in hkus\S-1-5-21-1454471165-1708537768-854245398-1006\software\policies\microsoft\internet explorer\control panel

Information Registry enforcer 2009-09-20 10:14:57 Inspecting WinLogon notification handlers and modules loaded by WinLogon

Information Registry enforcer 2009-09-20 10:14:57 Inspecting WinSock registry (LSP Chain)

Information General 2009-09-20 10:14:53 Request to update definitions completed successfully.

Information General 2009-09-20 10:14:47 Anti-Spyware Incremental definition update 5.0.50.57 successfully applied.

Information General 2009-09-20 10:14:45 Anti-Spyware

**************

REMOVED repetitious for character count

**************

333halfevil · September 21, 2009

Hi there. Can you please do the following. And remember do NOT delete anything.

Run Hijack Scan and save a log. Once a log file is saved to your desktop, please attach it to or paste it in this thread.

http://img30.imageshack.us/img30/7895/74140502.png

Outdoors2 · September 21, 2009

Where is this scan located?

I have been blocked from all antivirus programs

Melvin_Deal · September 21, 2009

Hijack scan only takes a snapshot. A picture of whats going on.

There isnt any reason you cant run this unless you're already corrupted to the point of crash. Stop the apps that are crippling your system!

enoskype · September 21, 2009

Hi Outdoors2,

To follow 333halfevil's advice, run IS 360, click Tools and click Hijack Scan, so, you can see the window as in 333halfevil's post.

Cheers.

Outdoors2 · September 21, 2009

Not in the 360 menus

I have paid for IObit Advanced SystemCare Pro, which is now rendered useless, because of the change of registry which occurred and forbidding me access.

Outdoors2 · September 21, 2009

Uninst. and Re-installed Care

Re-installed this morning. Care began to run then shut down. Upon attempting to run again this error message appeared.

C:\Program Files\IObit\Advanced SystemCare 3\2\AWC.exe

Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access them.

taleblou · September 21, 2009

have you done this?

Hi:

If you can run in safe mode then do these? DOwnload Dr. web cureit (free), AVira antivir (free), Malwarebyte (free) superantispyware (free) (pc-tool antispyware + antivirus (free) and try to install them in "safe mode" and if possible try to update them in safe mode with networking and then back to safe mode only. Run Dr. web cureit first and clean all malwares it detects. Then try avira nativir and delete all malwares do the same with pc-tool. Then scan with malwarebytes and super antispyware. After all then try superantispyware tolls that fixes crupt or deleted windows services after all scans are finished and you can now safely reboot to windows. If you do these, then 99.9999% sure your pc will be clean at this point. Also use rootrepeal to check if any rootkits left. then go to internet explorer and disable add-ons and uninstall firefox and install opera or use IE 8.

If you can not do these in safe mode then a clean format is in-order and then try use "shadow defender" (sandbox for your pc)after a clean format pc and use sandboxie (sandbox for your browser) and having these 2 programs are all you need on a clean computer. No more anti-malwares needed. Also use "virustotal" online tpo check files for safety.

Best luck.

Outdoors2 · September 21, 2009

Already tried safe mode

I've already tried safe mode and access to several of your suggestions is denied.

From IObits Advanced System Care Pro Edition Promo page:

Defends PC Security with Extra Protection Improved!

Secure your PC – quickly and easily. Scans and removes spyware and adware using up-to-date definition files. Prevents spyware, hackers and hijackers from installing malicious items on your computer. Erases and updates your PC’s activity history with this powerful free registry cleaner. Security and Privacy assured!

What did I pay for? is my question!

taleblou · September 21, 2009

now I am sure what the issue is.

Hi:

I am 99% sure the reason you are locked out of these program and issues you have are because of you have infected badly with ROOTKITS along with deeply infected malwares. Only rootkits that hooked deep in your system would do what you are saying and cause al these issues. Also my friend no antimalware exists that can detect and romove all rootkits and speiclay the hidden or masked ones. The only solution for you to get clear of all rootkits and issues is a CLEAN FORMAT and reinstalling windows at this point. Sorry to say this but at this point this is your only solutions to get out of this.

So do a clean format and delete and reinstall the partitions and install fresh windows and then do what I said on perivious post. here it is again.

After a fresh and clean formatted windows and before applying any update. do these. (get these before hand and save it on a clean USb or burn on CD)

1. Install Sandboxie (paid version is best since it has auto browser sand box while free you have to sandbox browser manualy)

2. Install Avira antivir (free is good for scanning files you download as a backup file scanner) or use "virustotal" online to scan files you download (virus total is better) Only use dor scanning new files since shadow defender takes care of system infection for you.

3. install your softwares and updates (make sure to check them online using virustotal to see if they are clean before you reinstall)

4. Install pc-tool firewall plus (free and set to maximum setting)

5. Install Shadow defender (windows and system sandbox which is free but the paid one is better and its the only thing you need which will protect you from all malwares and pc issues by turining your C: driver and other drives in to a VIRTUAL MACHINE isolated from you system and malwares and errors and pc issues will never infect you or cause your issue) (with sahdow defender after each reboot you pc returns to a clean state. SO if you get an error or a malware infected you just reboot and you are clean.

6. Never use system restore. disable it (since malwares can hide there)

Your done now and never worry about malwares or errors ever again.

By the way do get the shadow defender (buy it and you will never regret it I promiss you) for your clean system. If you had it now then all these issues would go away with a simple reboot of windows.

shadow defender link: http://www.shadowdefender.com/ (do read first about what it is at that link.)

Good luck.

Phalin · September 21, 2009

I hope you are able to resolve your issue.

You should disable system restore before you try to fix anything.

But once you get back up and running. I would recommend installing a firefox addon called WOT it monitors sites that have malicious intent and will block them, giving you a warning screen, it will give you the option of going on too the site if you feel you want to risk it. But then I never do.

You have ran into something very nasty, you may be better off to format the partition and reinstall, but be sure it didn't restructure your drives, like making your C: something other then that, its a common practice for the high end hacker to reorder drive partitions if you have them.

Well with everyone recommending software, I use Sunbletsoftware Viper anti virus and spyware. Its one of the best I have found. It scans any file you download, Plus it creates a Virtual Drive and runs all your web browsing through that drive and scans it before it can be downloaded onto your HD. Not to mention its system demands are very low. I can run a full system scan and never even notice it is running while using other apps.

PC-Tools apps are very good for freeware, I used their firewall for sometime, but decided I wanted greater protection and configuration. I would recommend checking out Comodo free firewall. They support both 32 and 64bit

taleblou · September 21, 2009

here is what I have on my clean pc

Hi:

Here is my current security programs I have.

1. I have sandboxie (paid for all browsers incl. firefox)

2. I made a desktop link to "Virustotal" online (for file scanning)

3. I have Shadow Defender (paid for hard drive virtualization sandbox)

I also have system restore disabled since shadow defender take care of that by returning my system to its original after each reboot.

Thats it. No system resource drag and I have optimized my windows setting using advanced systemcare.

The pc is fast with no hogs.

Outdoors2 · September 23, 2009

Getting there

Formatting is not an option.

This procedure http://forums.majorgeeks.com/showthread.php?t=35407 has taken care of most issues.

Thanks for all the help?

~R

taleblou · September 23, 2009

but can you live with infection???

Hi:

Good most of your issue is gone but can you live with hidden rootkits and hidden infection that are left on your pc? How safe do you think you are? The only way you cna be 100% sure you are clean is by doing a clean format, but hey its your personal data and your computer.

Outdoors2 · September 23, 2009

Hi there. Can you please do the following. And remember do NOT delete anything.

Run Hijack Scan and save a log. Once a log file is saved to your desktop, please attach it to or paste it in this thread.
http://img30.imageshack.us/img30/7895/74140502.png

Hey Half,

After numerous scans and resolutions I finally got the Hijack Scan to appear and got it to log a report:

Logfile of IObit HijackScan v0.2.0.0

Scan saved at 15:37:21, on 2009-9-23

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\AVG\AVG8\avgemc.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\Program Files\AVG\AVG8\avgnsx.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\00THotkey.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\RAMASST.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\SB62\TeaTimer.exe

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

C:\Program Files\IObit\IObit Security 360\is360.exe

C:\Program Files\IObit\IObit Security 360\IS360tray.exe

C:\Program Files\IObit\IObit Security 360\IS360srv.exe

C:\Program Files\IObit\IObit Security 360\a_hijackscan.exe

O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\SB62\SDHelper.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKCU\Software\Microsoft\Windows\CurrentVersion\Run\: [cdloader] "C:\Documents and Settings\Outdoors2\Application Data\mjusbsp\cdloader2.exe" MAGICJACK

O4 - HKCU\Software\Microsoft\Windows\CurrentVersion\Run\: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\Software\Microsoft\Windows\CurrentVersion\Run\: [spybotSD TeaTimer] C:\Program Files\SB62\TeaTimer.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [00THotkey] C:\WINDOWS\system32\00THotkey.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [000StTHK] 000StTHK.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\MBites\mbam.exe" /runcleanupscript

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [iObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe

O9 - Extra button: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8}OGACheckControl.LegitCheck.1 - http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000}SwCtl.SwCtl.11 - http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}YInstHelper.YInstStarter.1 - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}Java Plug-in 1.6.0_16 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277}OPUCatalog.OPUCatalog12.1 - http://office.microsoft.com/officeupdate/content/opuc4.cab

O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}Java Plug-in 1.6.0_16 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}Java Plug-in 1.6.0_16 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

O23 - Service: Adobe Active File Monitor V6 - Unknown - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 E-mail Scanner - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Software Updater - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe

Hijacked Browsers, Trojan infection Getting WORSE!

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Archived