[Closed] TrojanDownloader Win32:Renos.IO

Here are the log files.. please help UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 2/25/2008 07:26:36 System Uptime: 7/13/2009 06:39:26 (1 hours ago) Motherboard: Sony Corporation | | VAIO Processor: Intel® Pentium® Dual CPU T2330 @ 1.60GHz | N/A | 1600/133mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 141 GiB total, 105.963 GiB free. D: is Removable E: is Removable F: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Marvell Yukon 88E8039 PCI-E Fast Ethernet Controller Device ID: PCI\VEN_11AB&DEV_4353&SUBSYS_902D104D&REV_15\4&2F1966C1&0&00E0 Manufacturer: Marvell Name: Marvell Yukon 88E8039 PCI-E Fast Ethernet Controller PNP Device ID: PCI\VEN_11AB&DEV_4353&SUBSYS_902D104D&REV_15\4&2F1966C1&0&00E0 Service: yukonwlh ==== System Restore Points =================== ==== Installed Programs ====================== 2007 Microsoft Office Suite Service Pack 1 (SP1) Activation Assistant for the 2007 Microsoft Office suites Adobe Flash Player 10 ActiveX Adobe Reader 8.1.3 Adobe Shockwave Player Alps Pointing-device for VAIO Apple Software Update AVG Free 8.5 Click to Disc Click to Disc Editor Compatibility Pack for the 2007 Office system CrossLoop 2.20 GearDrvs GeoVision ADPCM GeoVision H264 GeoVision JPEG GeoVision MPEG2 GeoVision MPEG4 GeoVision MPEG4 ASP GeoVision MPEG4 AVC Google Toolbar for Internet Explorer HDAUDIO SoftV92 Data Fax Modem with SmartCP Intel® Graphics Media Accelerator Driver Java™ 6 Update 14 Java™ SE Development Kit 6 Update 14 Java™ SE Runtime Environment 6 Karen's Directory Printer Meridian Systems Prolog Website 2007 R2 File Management Control Microsoft Easy Assist v2 Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office Live Meeting 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office PowerPoint Viewer 2007 (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Standard 2007 Microsoft Office Word MUI (English) 2007 Microsoft Outlook Personal Folders Backup Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Mobile Broadband Drivers MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 Parser and SDK OpenMG Limited Patch 4.7-07-15-19-01 OpenMG Secure Module 4.7.00 PL-2303 USB-to-Serial PrimoPDF QuickTime Realtek High Definition Audio Driver Roxio Activation Module Roxio Easy Media Creator Home RxFilters3D Security Update for 2007 Microsoft Office System (KB951550) Security Update for 2007 Microsoft Office System (KB951944) Security Update for 2007 Microsoft Office System (KB969559) Security Update for 2007 Microsoft Office System (KB969679) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office Excel 2007 (KB969682) Security Update for Microsoft Office OneNote 2007 (KB950130) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office system 2007 (KB954326) Security Update for Microsoft Office system 2007 (KB969613) Security Update for Microsoft Office Word 2007 (KB969604) Security Update for Visio 2007 (KB947590) Setting Utility Series SonicStage Mastering Studio Audio Filter Custom Preset SonicStage Mastering Studio Plugins Sony Video Shared Library Spy Sweeper SR Manager SupportSoft Assisted Service Symantec Technical Support Web Controls SyncToy 2.0 Beta Type2045 TWAIN Driver Ver.3 Unity Web Player Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB969907) Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Update for Outlook 2007 Junk Email Filter (kb970012) VAIO Center Access Bar VAIO Content Folder Setting VAIO Content Metadata Intelligent Analyzing Manager VAIO Content Metadata Manager Setting VAIO Content Metadata XML Interface Library VAIO Control Center VAIO DVD Menu Data Basic VAIO Entertainment Center VAIO Entertainment Platform VAIO Event Service VAIO Help and Support VAIO Launcher VAIO Media VAIO Media 6.0 VAIO Media AC3 Decoder 1.0 VAIO Media Content Collection 6.0 VAIO Media Integrated Server 6.2 VAIO Media Redistribution 6.0 VAIO Media Registration Tool VAIO Media Registration Tool 6.0 VAIO OOBE and Welcome Center VAIO PC Wireless LAN Wizard VAIO Power Management VAIO Productivity Center VAIO Service Utility VAIO Smart Network VAIO Startup Assistant VAIO Survey VAIO Update 3 VAIO Wallpaper Contents VNC Free Edition 4.1.3 VZAccess Manager Windows Live OneCare safety scanner Yahoo! Install Manager ==== End Of File =========================== #2 DDS (Ver_09-06-26.01) - NTFSx86 DSREPAIR Run by [removed] at 7:34:05.29 on Mon 07/13/2009 Internet Explorer: 7.0.6001.18000 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2038.835 [GMT -5:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Spy Sweeper with AntiVirus *On-access scanning enabled* (Updated) {B3891867-7230-459B-9987-E7CCFA7A7D1D} SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: Spy Sweeper *enabled* (Updated) {68A41C74-A1E9-48F8-B2E5-D8232211AB6D} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Sony\Network Utility\NSUService.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\Explorer.EXE C:\Windows\system32\PSIService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe C:\Windows\system32\taskeng.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Windows\System32\mobsync.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe C:\Windows\system32\msiexec.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Jerry Six\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = about:blank uDefault_Page_URL = hxxp://www.sony.com/vaiopeople mStart Page = hxxp://www.sony.com/vaiopeople mDefault_Page_URL = hxxp://www.sony.com/vaiopeople BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [Sidebar] "c:\program files\windows sidebar\sidebar.exe" /autoRun uRun: [NSUFloatingUI] "c:\program files\sony\network utility\LANUtil.exe" uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; MS-RTC LM 8; MS-RTC EA 2)" -"http://mp42.slingo.com/shockscreen2.asp?shost=mp42.slingo.com&sport=20001&susername=aiustudent87&spassword=heidi013008&roomname=1,000/2,000%20-%20No%20Limit%20-%20Room%2001&gameid=102" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [ISBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe" mRun: [VWLASU] "c:\program files\sony\vaio pc wireless lan wizard\AutoLaunchWLASU.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [Skytel] Skytel.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - hxxp://w4s2.work4sure.com/c/ge/w4sgeen9.exe DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab TCP: NameServer = 85.255.112.186,85.255.112.124 TCP: {27FFA2FC-8EFF-4A50-A327-0D06043DEBDC} = 10.36.81.28,10.36.81.49 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: igfxcui - igfxdev.dll Notify: VESWinlogon - VESWinlogon.dll AppInit_DLLs: avgrsstx.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-7 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-7-7 108552] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-7-7 298776] R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2007-10-30 9344] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-10-30 812544] =============== Created Last 30 ================ 2009-07-13 06:50 335 a——- C:\spyhunter.fix 2009-07-13 06:50 –d—– c:\program files\Enigma Software Group 2009-07-12 23:38 –d—– c:\programdata\RH_Backups 2009-07-12 23:38 –d—– c:\progra~2\RH_Backups 2009-07-12 23:09 35,261,312 a——- C:\mpam-fe.exe 2009-07-12 08:33 –d—– c:\program files\Microsoft Windows OneCare Live 2009-07-12 08:20 37,169 a——- C:\ivinit.exe 2009-07-12 08:14 176,572,704 a——- c:\windows\MEMORY.DMP 2009-07-10 13:32 691 a——- c:\users\jerrys~1\appdata\roaming\GetValue.vbs 2009-07-10 13:32 35 a——- c:\users\jerrys~1\appdata\roaming\SetValue.bat 2009-07-10 13:32 2,850 a——- c:\windows\system32\tmp.reg 2009-07-10 13:32 80,384 a——- c:\windows\system32\o4Patch.exe 2009-07-10 13:32 78,336 a——- c:\windows\system32\Agent.OMZ.Fix.exe 2009-07-10 13:32 82,944 a——- c:\windows\system32\IEDFix.C.exe 2009-07-10 13:32 87,552 a——- c:\windows\system32\VACFix.exe 2009-07-10 13:32 82,944 a——- c:\windows\system32\IEDFix.exe 2009-07-10 13:32 82,432 a——- c:\windows\system32\404Fix.exe 2009-07-10 13:31 75,776 a——- c:\windows\system32\WS2Fix.exe 2009-07-10 13:31 289,144 a——- c:\windows\system32\VCCLSID.exe 2009-07-10 13:31 79,360 a——- c:\windows\system32\swxcacls.exe 2009-07-10 13:31 288,417 a——- c:\windows\system32\SrchSTS.exe 2009-07-10 13:31 51,200 a——- c:\windows\system32\dumphive.exe 2009-07-10 13:31 135,168 a——- c:\windows\system32\swreg.exe 2009-07-10 13:31 53,248 a——- c:\windows\system32\Process.exe 2009-07-10 09:28 –d—– c:\program files\Nitro PDF 2009-07-09 13:21 –d—– c:\program files\Coupons 2009-07-09 07:08 891,448 a——- c:\windows\system32\drivers\tcpip.sys 2009-07-08 07:18 –d—– C:\PerfLogs 2009-07-07 12:02 –d-h— C:\$AVG8.VAULT$ 2009-07-07 09:50 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-07-07 09:50 108,552 a——- c:\windows\system32\drivers\avgtdix.sys 2009-07-07 09:50 327,688 a——- c:\windows\system32\drivers\avgldx86.sys 2009-07-07 09:50 –d—– c:\windows\system32\drivers\Avg 2009-07-07 09:50 –d—– c:\program files\AVG 2009-07-07 09:50 –d—– c:\programdata\avg8 2009-07-07 09:50 –d—– c:\progra~2\avg8 2009-06-15 07:08 217,088 a——- c:\windows\system32\psisrndr.ax 2009-06-15 07:08 293,376 a——- c:\windows\system32\psisdecd.dll 2009-06-15 07:08 80,896 a——- c:\windows\system32\MSNP.ax 2009-06-15 07:08 428,544 a——- c:\windows\system32\EncDec.dll 2009-06-15 07:08 177,664 a——- c:\windows\system32\mpg2splt.ax ==================== Find3M ==================== 2009-07-10 10:28 410,984 a——- c:\windows\system32\deploytk.dll 2009-07-08 07:37 174 a–sh— c:\program files\desktop.ini 2009-07-08 07:34 143,360 a——- c:\windows\inf\infstrng.dat 2009-07-08 07:34 86,016 a——- c:\windows\inf\infstor.dat 2009-07-08 07:34 51,200 a——- c:\windows\inf\infpub.dat 2009-07-08 07:18 665,600 a——- c:\windows\inf\drvindex.dat 2009-07-08 07:05 101,888 a——- c:\windows\system32\ifxcardm.dll 2009-07-08 07:05 82,432 a——- c:\windows\system32\axaltocm.dll 2009-04-24 11:05 827,904 a——- c:\windows\system32\wininet.dll 2009-04-24 11:02 78,336 a——- c:\windows\system32\ieencode.dll 2009-04-24 08:44 26,624 a——- c:\windows\system32\ieUnatt.exe 2009-04-23 21:55 176,235 a——- c:\windows\system32\Primomonnt.dll 2009-04-23 07:43 784,896 a——- c:\windows\system32\rpcrt4.dll 2009-04-23 07:42 636,928 a——- c:\windows\system32\localspl.dll 2009-04-21 06:55 2,033,152 a——- c:\windows\system32\win32k.sys 2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2008-05-31 10:40 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2008-05-31 10:40 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2008-05-31 10:40 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat 2008-02-25 13:35 88 —shr– c:\windows\system32\A455D624BB.sys 2008-02-25 13:37 3,452 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 7:36:11.57 ===============

DDS (Ver_09-06-26.01) - NTFSx86 DSREPAIR Run by [removed] at 7:34:05.29 on Mon 07/13/2009 Internet Explorer: 7.0.6001.18000 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2038.835 [GMT -5:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Spy Sweeper with AntiVirus *On-access scanning enabled* (Updated) {B3891867-7230-459B-9987-E7CCFA7A7D1D} SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: Spy Sweeper *enabled* (Updated) {68A41C74-A1E9-48F8-B2E5-D8232211AB6D} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Sony\Network Utility\NSUService.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\Explorer.EXE C:\Windows\system32\PSIService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe C:\Windows\system32\taskeng.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Windows\System32\mobsync.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe C:\Windows\system32\msiexec.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Jerry Six\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = about:blank uDefault_Page_URL = hxxp://www.sony.com/vaiopeople mStart Page = hxxp://www.sony.com/vaiopeople mDefault_Page_URL = hxxp://www.sony.com/vaiopeople BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [Sidebar] "c:\program files\windows sidebar\sidebar.exe" /autoRun uRun: [NSUFloatingUI] "c:\program files\sony\network utility\LANUtil.exe" uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; MS-RTC LM 8; MS-RTC EA 2)" -"http://mp42.slingo.com/shockscreen2.asp?shost=mp42.slingo.com&sport=20001&susername=aiustudent87&spassword=heidi013008&roomname=1,000/2,000%20-%20No%20Limit%20-%20Room%2001&gameid=102" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [ISBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe" mRun: [VWLASU] "c:\program files\sony\vaio pc wireless lan wizard\AutoLaunchWLASU.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [Skytel] Skytel.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - hxxp://w4s2.work4sure.com/c/ge/w4sgeen9.exe DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab TCP: NameServer = 85.255.112.186,85.255.112.124 TCP: {27FFA2FC-8EFF-4A50-A327-0D06043DEBDC} = 10.36.81.28,10.36.81.49 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Notify: igfxcui - igfxdev.dll Notify: VESWinlogon - VESWinlogon.dll AppInit_DLLs: avgrsstx.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-7-7 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-7-7 108552] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-7-7 298776] R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2007-10-30 9344] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-10-30 812544] =============== Created Last 30 ================ 2009-07-13 06:50 335 a——- C:\spyhunter.fix 2009-07-13 06:50 –d—– c:\program files\Enigma Software Group 2009-07-12 23:38 –d—– c:\programdata\RH_Backups 2009-07-12 23:38 –d—– c:\progra~2\RH_Backups 2009-07-12 23:09 35,261,312 a——- C:\mpam-fe.exe 2009-07-12 08:33 –d—– c:\program files\Microsoft Windows OneCare Live 2009-07-12 08:20 37,169 a——- C:\ivinit.exe 2009-07-12 08:14 176,572,704 a——- c:\windows\MEMORY.DMP 2009-07-10 13:32 691 a——- c:\users\jerrys~1\appdata\roaming\GetValue.vbs 2009-07-10 13:32 35 a——- c:\users\jerrys~1\appdata\roaming\SetValue.bat 2009-07-10 13:32 2,850 a——- c:\windows\system32\tmp.reg 2009-07-10 13:32 80,384 a——- c:\windows\system32\o4Patch.exe 2009-07-10 13:32 78,336 a——- c:\windows\system32\Agent.OMZ.Fix.exe 2009-07-10 13:32 82,944 a——- c:\windows\system32\IEDFix.C.exe 2009-07-10 13:32 87,552 a——- c:\windows\system32\VACFix.exe 2009-07-10 13:32 82,944 a——- c:\windows\system32\IEDFix.exe 2009-07-10 13:32 82,432 a——- c:\windows\system32\404Fix.exe 2009-07-10 13:31 75,776 a——- c:\windows\system32\WS2Fix.exe 2009-07-10 13:31 289,144 a——- c:\windows\system32\VCCLSID.exe 2009-07-10 13:31 79,360 a——- c:\windows\system32\swxcacls.exe 2009-07-10 13:31 288,417 a——- c:\windows\system32\SrchSTS.exe 2009-07-10 13:31 51,200 a——- c:\windows\system32\dumphive.exe 2009-07-10 13:31 135,168 a——- c:\windows\system32\swreg.exe 2009-07-10 13:31 53,248 a——- c:\windows\system32\Process.exe 2009-07-10 09:28 –d—– c:\program files\Nitro PDF 2009-07-09 13:21 –d—– c:\program files\Coupons 2009-07-09 07:08 891,448 a——- c:\windows\system32\drivers\tcpip.sys 2009-07-08 07:18 –d—– C:\PerfLogs 2009-07-07 12:02 –d-h— C:\$AVG8.VAULT$ 2009-07-07 09:50 11,952 a——- c:\windows\system32\avgrsstx.dll 2009-07-07 09:50 108,552 a——- c:\windows\system32\drivers\avgtdix.sys 2009-07-07 09:50 327,688 a——- c:\windows\system32\drivers\avgldx86.sys 2009-07-07 09:50 –d—– c:\windows\system32\drivers\Avg 2009-07-07 09:50 –d—– c:\program files\AVG 2009-07-07 09:50 –d—– c:\programdata\avg8 2009-07-07 09:50 –d—– c:\progra~2\avg8 2009-06-15 07:08 217,088 a——- c:\windows\system32\psisrndr.ax 2009-06-15 07:08 293,376 a——- c:\windows\system32\psisdecd.dll 2009-06-15 07:08 80,896 a——- c:\windows\system32\MSNP.ax 2009-06-15 07:08 428,544 a——- c:\windows\system32\EncDec.dll 2009-06-15 07:08 177,664 a——- c:\windows\system32\mpg2splt.ax ==================== Find3M ==================== 2009-07-10 10:28 410,984 a——- c:\windows\system32\deploytk.dll 2009-07-08 07:37 174 a–sh— c:\program files\desktop.ini 2009-07-08 07:34 143,360 a——- c:\windows\inf\infstrng.dat 2009-07-08 07:34 86,016 a——- c:\windows\inf\infstor.dat 2009-07-08 07:34 51,200 a——- c:\windows\inf\infpub.dat 2009-07-08 07:18 665,600 a——- c:\windows\inf\drvindex.dat 2009-07-08 07:05 101,888 a——- c:\windows\system32\ifxcardm.dll 2009-07-08 07:05 82,432 a——- c:\windows\system32\axaltocm.dll 2009-04-24 11:05 827,904 a——- c:\windows\system32\wininet.dll 2009-04-24 11:02 78,336 a——- c:\windows\system32\ieencode.dll 2009-04-24 08:44 26,624 a——- c:\windows\system32\ieUnatt.exe 2009-04-23 21:55 176,235 a——- c:\windows\system32\Primomonnt.dll 2009-04-23 07:43 784,896 a——- c:\windows\system32\rpcrt4.dll 2009-04-23 07:42 636,928 a——- c:\windows\system32\localspl.dll 2009-04-21 06:55 2,033,152 a——- c:\windows\system32\win32k.sys 2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2008-05-31 10:40 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2008-05-31 10:40 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2008-05-31 10:40 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat 2008-02-25 13:35 88 —shr– c:\windows\system32\A455D624BB.sys 2008-02-25 13:37 3,452 a–sh— c:\windows\system32\KGyGaAvL.sys ============= FINISH: 7:36:11.57 ===============