Sheax
Topic Starter
Contracted this VIMAX problem a couple of days ago, possibly after downloading what I thought was a Java update. Won't allow me to open/download ANY AV software and McAfee is useless. Keep getting redirects from google searches and VIMAx ads everywhere. Also, when I startup I get a bluescreen message until the 4/5th reboot. This also happens when I try to download AV programs or run them. Occasionally happens randomly too. I don't know what to do, don't want to run ComboFix without guidance, worried it'll make everything worse. ANY help would be very much appreciated!!
DDS log: If you require any more logs, please let me know.
DDS (Ver_09-03-16.01) - NTFSx86
Run by [removed] at 2:14:45.59 on 03/28/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_07
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.1789.963 [GMT 0:00]
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\ProgramData\Epac\EpacDownloadManagerService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIADE.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Users\Captain Handicrafts\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.myspace.com/fanfic_geek
mDefault_Page_URL = hxxp:\\www.samsungcomputer.com
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [Aim6]
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [NSLauncher] c:\program files\nokia\nokia software launcher\NSLauncher.exe /startup
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [EPSON Stylus DX4800 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatiade.exe /f "c:\windows\temp\E_S9DAA.tmp" /EF "HKLM"
mRun: [c:\program files\free video zilla\FVZilla.exe]
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\tabuse~1.lnk - c:\windows\system32\wtablet\TabUserW.exe
mPolicies-system: NoHotStart = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~1.0_0\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
TCP: NameServer = 85.255.112.77,85.255.112.206
TCP: {03A802CD-C56B-4B66-BD3D-D28A2C928B41} = 85.255.112.77,85.255.112.206
TCP: {B01D4519-116D-460B-B373-DE8EBF7729D3} = 85.255.112.77,85.255.112.206
================= FIREFOX ===================
FF - ProfilePath -
============= SERVICES / DRIVERS ===============
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]
R2 Epac Center;Epac Center;c:\programdata\epac\Epacdownloadmanagerservice.exe [2008-11-30 442368]
R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\drivers\KMDFMEMIO.sys [2008-2-19 13312]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2008-9-20 3406120]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-9-17 24652]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]
S3 NETw2v32;Intel® PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-9-22 15656]
=============== Created Last 30 ================
2009-03-28 01:23 –d—– c:\program files\SUPERAntiSpyware
2009-03-25 00:47 –d—– c:\program files\common files\Wise Installation Wizard
2009-03-22 23:49 –d—– c:\program files\common files\Corel
2009-03-22 23:39 –d—– c:\programdata\Corel
2009-03-22 23:39 –d—– c:\progra~2\Corel
2009-03-22 23:39 –d—– c:\program files\Corel
2009-03-19 17:12 7,680 a——- c:\windows\system32\spwmp.dll
2009-03-19 17:12 8,147,456 a——- c:\windows\system32\wmploc.DLL
2009-03-19 17:12 4,096 a——- c:\windows\system32\msdxm.ocx
2009-03-19 17:12 4,096 a——- c:\windows\system32\dxmasf.dll
2009-03-19 17:12 268,288 a——- c:\windows\system32\schannel.dll
2009-03-19 17:12 2,033,152 a——- c:\windows\system32\win32k.sys
2009-03-18 21:26 107,368 a——- c:\windows\system32\GEARAspi.dll
2009-03-18 21:26 23,848 a——- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-18 21:25 –d—– c:\program files\iPod
2009-03-18 21:25 –d—– c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-18 21:25 –d—– c:\program files\iTunes
2009-03-18 21:25 –d—– c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-16 22:41 –d—– c:\program files\Windows Live SkyDrive
2009-03-03 02:08 –d—– C:\downloads
2009-03-03 02:08 –d—– c:\users\captai~1\appdata\roaming\FVZilla
2009-03-03 02:08 –d—– c:\program files\Free Video Zilla
2009-02-27 09:09 97,800 a——- c:\windows\system32\infocardapi.dll
2009-02-27 09:09 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-02-27 09:09 622,080 a——- c:\windows\system32\icardagt.exe
2009-02-27 09:09 43,544 a——- c:\windows\system32\PresentationHostProxy.dll
2009-02-27 09:09 37,384 a——- c:\windows\system32\infocardcpl.cpl
2009-02-27 09:09 11,264 a——- c:\windows\system32\icardres.dll
2009-02-27 09:09 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll
2009-02-27 09:09 326,160 a——- c:\windows\system32\PresentationHost.exe
2009-02-26 19:34 96,760 a——- c:\windows\system32\dfshim.dll
2009-02-26 19:34 282,112 a——- c:\windows\system32\mscoree.dll
2009-02-26 19:34 41,984 a——- c:\windows\system32\netfxperf.dll
2009-02-26 19:34 158,720 a——- c:\windows\system32\mscorier.dll
2009-02-26 19:34 83,968 a——- c:\windows\system32\mscories.dll
2009-02-26 19:09 827,392 a——- c:\windows\system32\wininet.dll
2009-02-26 19:09 1,383,424 a——- c:\windows\system32\mshtml.tlb
2009-02-26 19:08 428,544 a——- c:\windows\system32\EncDec.dll
2009-02-26 19:08 217,088 a——- c:\windows\system32\psisrndr.ax
2009-02-26 19:08 293,376 a——- c:\windows\system32\psisdecd.dll
2009-02-26 19:08 177,664 a——- c:\windows\system32\mpg2splt.ax
2009-02-26 19:08 80,896 a——- c:\windows\system32\MSNP.ax
==================== Find3M ====================
2009-03-24 21:34 3,922 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-03-21 19:50 143,360 a——- c:\windows\inf\infstrng.dat
2009-03-21 19:50 86,016 a——- c:\windows\inf\infstor.dat
2009-03-21 19:50 51,200 a——- c:\windows\inf\infpub.dat
2009-01-03 18:41 202,240 a——- c:\windows\system32\UNIQLOCK COLOR_v2.scr
2008-09-20 14:20 174 a–sh— c:\program files\desktop.ini
2008-09-20 14:03 665,600 a——- c:\windows\inf\drvindex.dat
2006-11-02 12:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 12:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 09:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
1999-07-07 00:00 6 —shr– c:\windows\@@desktop.dat
2008-09-16 23:43 16,384 a–sh— c:\windows\temp\cookies\index.dat
2008-09-16 23:58 32,768 a–sh— c:\windows\temp\history\history.ie5\index.dat
2008-09-16 23:43 32,768 a–sh— c:\windows\temp\temporary internet files\content.ie5\index.dat
============= FINISH: 2:16:25.23 ===============