IE /Browser Hijack

………………………START…………………….
problem description:

internet explorer
web pages are hijacked and replaced with a red banner screen saying "Attention! Your web page request has been cancelled" in order to activate your security software, please press Fix Now(recommended)

option boxes: Resend request and Fix Now
……………………………………………..
sysinfo:
Windows 7 - (winNT 6.00.3504)
internet explorer v8.00 (8.00.7600.16385)
Toshiba Laptop
………………………………………………


1) have searched for antivirus7 on system; not found.

2) run McAfee stinger(10.1.0.995 built aug 5 2010)

c:\program files\toshiba\TosApin\Comps1\TC\10033000\TC10033000C.exe\wtsetup.exe\11.nsis\6.nsis\7.nsis
found the Artemis!BB03AF6402B Trojan!!!
c:\ProgramData\WildTangent\951226E3-26FC-40BC-8085-3677B1128F95-extr.exe\7.niss
found the Artemis!BB03AF6402B Trojan!!!
c:\ProgramData\WildTangent\951226E3-26FC-40BC-8085-3677B1128F95-extr.exe\7.niss has been deleted.

clean files 20563
number of trojans 2
number of files deleted 1


3) run McAfee stinger(10.1.0.995 built aug 5 2010)

c:\program files\toshiba\TosApin\Comps1\TC\10033000\TC10033000C.exe\wtsetup.exe\11.nsis\6.nsis\7.nsis
found the Artemis!BB03AF6402B Trojan!!!

clean files 20560
number of trojans 1

4) run malwazrebytes(current update) full scan… found none
………………………………………
Hijackthis post below
……………………….
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:26:58 PM, on 8/25/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskhost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.3.60.33\facemoods.dll
O2 - BHO: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers Client\YontooIEClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyn1.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.3.60.33\facemoodsTlbr.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [NortonOnlineBackupReminder] "C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MemTurbo.lnk = C:\Program Files\MemTurbo 4\MemTurbo.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AMD External Events Utility - AMD - C:\windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA eco Utility Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TECO\TecoService.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: TPCH Service (TPCHSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

–
End of file - 8874 bytes
…………………………………….END…………………………….
……….

=========================================
start of post
=====================================

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: TOSHIBA
BIOS Manufacturer: Insyde Corp.
System Manufacturer: TOSHIBA
System Product Name: Satellite L505D
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 195):
0x82C10000 \SystemRoot\system32\ntkrnlpa.exe
0x83020000 \SystemRoot\system32\halmacpi.dll
0x867C7000 \SystemRoot\system32\kdcom.dll
0x83232000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x8323D000 \SystemRoot\system32\PSHED.dll
0x8324E000 \SystemRoot\system32\BOOTVID.dll
0x83256000 \SystemRoot\system32\CLFS.SYS
0x83298000 \SystemRoot\system32\CI.dll
0x83343000 \SystemRoot\system32\drivers\Wdf01000.sys
0x833B4000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8342A000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x83472000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8347B000 \SystemRoot\system32\drivers\fltmgr.sys
0x834AF000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x834B7000 \SystemRoot\system32\DRIVERS\pci.sys
0x834E1000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x834EC000 \SystemRoot\System32\drivers\partmgr.sys
0x834FD000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x83505000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x83510000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x83520000 \SystemRoot\System32\drivers\volmgrx.sys
0x8356B000 \SystemRoot\system32\DRIVERS\pciide.sys
0x83572000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x83580000 \SystemRoot\System32\drivers\mountmgr.sys
0x83596000 \SystemRoot\system32\DRIVERS\atapi.sys
0x8359F000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x835C2000 \SystemRoot\system32\DRIVERS\msahci.sys
0x835CC000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x835D5000 \SystemRoot\system32\drivers\fileinfo.sys
0x833C2000 \SystemRoot\system32\drivers\PCTCore.sys
0x8362F000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8375E000 \SystemRoot\System32\Drivers\msrpc.sys
0x83789000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8379C000 \SystemRoot\System32\Drivers\cng.sys
0x83600000 \SystemRoot\System32\drivers\pcw.sys
0x8360E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8AA05000 \SystemRoot\system32\drivers\ndis.sys
0x8AABC000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AAFA000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8AC38000 \SystemRoot\System32\drivers\tcpip.sys
0x8AD81000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8ADB2000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8ADF1000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x8AB1F000 \SystemRoot\system32\DRIVERS\tos_sps32.sys
0x8ADF6000 \SystemRoot\System32\Drivers\spldr.sys
0x8AC00000 \SystemRoot\System32\drivers\rdyboost.sys
0x8AB66000 \SystemRoot\System32\Drivers\mup.sys
0x8AC2D000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8AB76000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8ABA8000 \SystemRoot\system32\DRIVERS\disk.sys
0x8ABB9000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8ABDE000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x83400000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x83621000 \SystemRoot\System32\Drivers\Null.SYS
0x83628000 \SystemRoot\System32\Drivers\Beep.SYS
0x83200000 \SystemRoot\System32\drivers\vga.sys
0x8320C000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8FE14000 \SystemRoot\System32\drivers\watchdog.sys
0x8FE21000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8FE29000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8FE31000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8FE39000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8FE44000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8FE52000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8FE69000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8FE74000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8FEA6000 \SystemRoot\system32\drivers\afd.sys
0x8FF00000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8FF09000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8FF10000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8FF2F000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x8FF40000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8FF4E000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8FF61000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8FF71000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8FF77000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8FFB8000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8FFC2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8FFCC000 \SystemRoot\System32\drivers\discache.sys
0x8FFD8000 \SystemRoot\System32\Drivers\dfsc.sys
0x8FFF0000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8F008000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8F024000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8F026000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8F047000 \SystemRoot\system32\DRIVERS\TVALZFL.sys
0x8F04E000 \SystemRoot\system32\DRIVERS\FwLnk.sys
0x8F056000 \SystemRoot\system32\DRIVERS\amdppm.sys
0x8F067000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x90C0F000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x91124000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8F06B000 \SystemRoot\System32\drivers\dxgmms1.sys
0x8F0A4000 \SystemRoot\system32\DRIVERS\RTL8187Se.sys
0x911DB000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x8F107000 \SystemRoot\system32\DRIVERS\Rt86win7.sys
0x911E5000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x911EF000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x911F5000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8F138000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x90C00000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8F183000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8F1A2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8F1BA000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8F1C7000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8F1FA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8FE00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x94C29000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x94C36000 \SystemRoot\system32\DRIVERS\serscan.sys
0x94C3E000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x94C50000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x94C68000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x94C73000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x94C95000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x94CAD000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x94CC4000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x94CDB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x94CDD000 \SystemRoot\system32\DRIVERS\ks.sys
0x94D11000 \SystemRoot\system32\DRIVERS\umbus.sys
0x94D1F000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x94D63000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x96025000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x962C1000 \SystemRoot\system32\drivers\portcls.sys
0x962F0000 \SystemRoot\system32\drivers\drmk.sys
0x96EF0000 \SystemRoot\System32\win32k.sys
0x96309000 \SystemRoot\System32\drivers\Dxapi.sys
0x96313000 \SystemRoot\System32\Drivers\crashdmp.sys
0x96320000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x9632B000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x96335000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x96346000 \SystemRoot\system32\DRIVERS\monitor.sys
0x97150000 \SystemRoot\System32\TSDDD.dll
0x97180000 \SystemRoot\System32\cdd.dll
0x96351000 \SystemRoot\system32\drivers\luafv.sys
0x9636C000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x96380000 \SystemRoot\system32\drivers\WudfPf.sys
0x9639A000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x963AA000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x963F0000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x96000000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x94D74000 \SystemRoot\system32\drivers\HTTP.sys
0x94C00000 \SystemRoot\system32\DRIVERS\bowser.sys
0x96013000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9C214000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9C237000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9C272000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9C2A5000 \SystemRoot\system32\drivers\AVRec.sys
0x9C2AD000 \SystemRoot\system32\drivers\peauth.sys
0x9C344000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9C34E000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9C36F000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9C37C000 \SystemRoot\system32\drivers\AVHook.sys
0x9C386000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9C3D5000 \SystemRoot\system32\drivers\AVFilter.sys
0xA061C000 \SystemRoot\System32\DRIVERS\srv.sys
0xA066D000 \SystemRoot\System32\Drivers\RtsUStor.sys
0xA069A000 \SystemRoot\System32\Drivers\fastfat.SYS
0xA06E5000 \SystemRoot\system32\drivers\spsys.sys
0x76ED0000 \Windows\System32\ntdll.dll
0x47D40000 \Windows\System32\smss.exe
0x77110000 \Windows\System32\apisetschema.dll
0x000D0000 \Windows\System32\autochk.exe
0x770E0000 \Windows\System32\imm32.dll
0x77090000 \Windows\System32\gdi32.dll
0x76E40000 \Windows\System32\oleaut32.dll
0x761F0000 \Windows\System32\shell32.dll
0x76160000 \Windows\System32\clbcatq.dll
0x760C0000 \Windows\System32\advapi32.dll
0x77080000 \Windows\System32\psapi.dll
0x76010000 \Windows\System32\msvcrt.dll
0x75F70000 \Windows\System32\usp10.dll
0x77070000 \Windows\System32\nsi.dll
0x75EF0000 \Windows\System32\comdlg32.dll
0x75CF0000 \Windows\System32\iertutil.dll
0x77020000 \Windows\System32\Wldap32.dll
0x75BB0000 \Windows\System32\urlmon.dll
0x75A50000 \Windows\System32\ole32.dll
0x77010000 \Windows\System32\normaliz.dll
0x758B0000 \Windows\System32\setupapi.dll
0x757E0000 \Windows\System32\user32.dll
0x757B0000 \Windows\System32\imagehlp.dll
0x756B0000 \Windows\System32\wininet.dll
0x75690000 \Windows\System32\sechost.dll
0x755E0000 \Windows\System32\rpcrt4.dll
0x755D0000 \Windows\System32\lpk.dll
0x75590000 \Windows\System32\ws2_32.dll
0x75530000 \Windows\System32\difxapi.dll
0x754D0000 \Windows\System32\shlwapi.dll
0x75400000 \Windows\System32\msctf.dll
0x75320000 \Windows\System32\kernel32.dll
0x752F0000 \Windows\System32\wintrust.dll
0x75260000 \Windows\System32\comctl32.dll
0x75210000 \Windows\System32\KernelBase.dll
0x750F0000 \Windows\System32\crypt32.dll
0x750C0000 \Windows\System32\cfgmgr32.dll
0x750A0000 \Windows\System32\devobj.dll
0x75090000 \Windows\System32\msasn1.dll

Processes (total 65):
0 System Idle Process
4 System
272 C:\Windows\System32\smss.exe
412 csrss.exe
488 csrss.exe
496 C:\Windows\System32\wininit.exe
536 C:\Windows\System32\winlogon.exe
596 C:\Windows\System32\services.exe
604 C:\Windows\System32\lsass.exe
612 C:\Windows\System32\lsm.exe
724 C:\Windows\System32\svchost.exe
824 C:\Windows\System32\svchost.exe
872 C:\Windows\System32\atiesrxx.exe
952 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
1060 C:\Windows\System32\svchost.exe
1124 C:\Windows\System32\audiodg.exe
1180 C:\Windows\System32\svchost.exe
1196 C:\Windows\System32\atieclxx.exe
1332 C:\Windows\System32\svchost.exe
1516 C:\Windows\System32\spoolsv.exe
1544 C:\Windows\System32\dwm.exe
1608 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1620 C:\Windows\explorer.exe
1640 C:\Windows\System32\taskhost.exe
1680 C:\Windows\System32\svchost.exe
1744 C:\Windows\System32\taskeng.exe
1992 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
432 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
408 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
480 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
1164 C:\Program Files\Bonjour\mDNSResponder.exe
1284 C:\Program Files\iTunes\iTunesHelper.exe
1552 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
1580 C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe
1832 C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
308 C:\Windows\System32\svchost.exe
2132 C:\Windows\System32\svchost.exe
2240 C:\Windows\System32\TODDSrv.exe
2348 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
2448 C:\Program Files\TOSHIBA\TECO\TecoService.exe
2524 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
2612 C:\Windows\System32\SearchIndexer.exe
2824 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
3160 C:\Windows\System32\SearchProtocolHost.exe
3260 C:\Program Files\iPod\bin\iPodService.exe
3308 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
3860 C:\Program Files\Windows Media Player\wmpnetwk.exe
4024 C:\Windows\System32\svchost.exe
2008 WmiPrvSE.exe
3656 C:\Windows\System32\taskeng.exe
4004 C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
2952 C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
1488 dllhost.exe
208 C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
1820 C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
2876 C:\Windows\System32\sppsvc.exe
3460 C:\Windows\System32\svchost.exe
3912 taskhost.exe
908 C:\Windows\System32\SearchFilterHost.exe
2908 C:\Program Files\Internet Explorer\ielowutil.exe
2164 C:\Windows\System32\wermgr.exe
976 C:\Users\Mia\Desktop\reply1\MBRCheck.exe
2896 C:\Windows\System32\conhost.exe
2196 C:\Windows\System32\dllhost.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK3263GSX, Rev: FG020M

Size Device Name MBR Status
——————————————–
298 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: CCF356FEC6D9BBB29EF3EF1E4270A2B799955EA4


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:

Done!
================================================================================
=============
dds.txt

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 18:33:08.22 on Sun 08/29/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.1766 [GMT -4:00]

SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\atieclxx.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\Dwm.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskhost.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\system32\taskeng.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\windows\system32\DllHost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\system32\svchost.exe -k SDRSVC
C:\Users\Mia\Desktop\Ducky\reply1\dds.com
C:\windows\system32\conhost.exe
C:\windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/?ilc=1
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - c:\program files\zynga\tbZyn1.dll
mURLSearchHooks: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - c:\program files\zynga\tbZyn1.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: CescrtHlpr Object: {64182481-4f71-486b-a045-b233bd0da8fc} - c:\program files\facemoods.com\facemoods\1.3.60.33\facemoods.dll
BHO: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - c:\program files\zynga\tbZyn1.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Yontoo Layers: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo layers client\YontooIEClient.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Zynga Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - c:\program files\zynga\tbZyn1.dll
TB: facemoods Toolbar: {db4e9724-f518-4dfd-9c7c-78b52103cab9} - c:\program files\facemoods.com\facemoods\1.3.60.33\facemoodsTlbr.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [NortonOnlineBackupReminder] "c:\program files\toshiba\toshiba online backup\activation\TobuActivation.exe" UNATTENDED
uRun: [AROReminder] c:\program files\advanced registry optimizer\ARO.exe -rem
mRun: []
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\mia\appdata\roaming\micros~1\windows\startm~1\programs\startup\memturbo.lnk - c:\program files\memturbo 4\MemTurbo.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
AppInit_DLLs: avgrsstx.dll
mASetup: {01250B8F-D947-4F8A-9408-FE8E3EE2EC92} - c:\program files\toshiba\my toshiba\MyToshiba.exe /SETUP

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-11-27 206256]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-3-10 11608]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-16 176128]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-3-10 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-3-10 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-3-10 56816]
R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\toshiba\configfree\CFIWmxSvcs.exe [2009-8-10 185712]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2009-3-10 46448]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-3-10 1153368]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\toshiba\teco\TecoService.exe [2009-8-11 185712]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\drivers\TVALZFL.sys [2009-6-19 12920]
R3 AVHook;AVHook;c:\windows\system32\drivers\AVHook.sys [2009-11-27 28560]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2009-11-16 7680]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-11-16 171520]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-11-16 187392]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-6 135664]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 TMachInfo;TMachInfo;c:\program files\toshiba\toshiba service station\TMachInfo.exe [2009-11-16 51512]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\toshiba\toshiba hdd ssd alert\TosSmartSrv.exe [2009-8-3 111960]
S3 TPCHSrv;TPCH Service;c:\program files\toshiba\tphm\TPCHSrv.exe [2009-8-6 685424]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-31 1343400]

=============== Created Last 30 ================

2010-08-26 02:14:59 0 d—–w- c:\program files\Trend Micro
2010-08-25 01:36:06 0 d–h–w- C:\kleaner.tmp
2010-08-25 01:31:46 0 d—–w- c:\programdata\Kaspersky Lab Setup Files
2010-08-22 12:06:50 0 d—–w- C:\perflogs
2010-08-11 18:52:31 0 d—–w- c:\programdata\Office Genuine Advantage
2010-08-07 12:44:54 0 d—–w- c:\program files\iPod
2010-08-07 12:44:53 0 d—–w- c:\program files\iTunes

==================== Find3M ====================

2010-07-29 06:30:49 197632 —-a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30:34 82944 —-a-w- c:\windows\system32\iccvid.dll
2010-06-30 06:25:31 978432 —-a-w- c:\windows\system32\wininet.dll
2010-06-19 06:33:29 3955080 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33:29 3899784 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23:50 37376 —-a-w- c:\windows\system32\rtutils.dll
2010-06-19 04:07:18 2326016 —-a-w- c:\windows\system32\win32k.sys
2010-06-16 05:48:35 224256 —-a-w- c:\windows\system32\schannel.dll
2010-06-08 06:02:06 1233920 —-a-w- c:\windows\system32\msxml3.dll
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat
2009-11-26 02:38:34 14 –sh–r- c:\windows\system32\drivers\fbd.sys
2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 18:34:14.86 ===============
================================================================================
======

withheld attach.txt per file instructions….will attach as zip

============================================================================
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-29 20:01:44
Windows 6.1.7600
Running: lzth4ct2.exe; Driver: C:\Users\Mia\AppData\Local\Temp\kwrdypow.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x833CB9A6]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x833CBB98]
SSDT 9431089C ZwCreateThread
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x833CBDA0]
SSDT 94310888 ZwOpenProcess
SSDT 9431088D ZwOpenThread
SSDT 94310897 ZwTerminateProcess

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303AAF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A3F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83022634
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83022898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A1DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A6F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303AF2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303B1A8

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C53599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C77F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!RtlSidHashLookup + 32C 82C7F83C 8 Bytes [A6, B9, 3C, 83, 98, BB, 3C, …] {CMPSB ; MOV ECX, 0xbb98833c; CMP AL, 0x83}
.text ntkrnlpa.exe!RtlSidHashLookup + 34C 82C7F85C 4 Bytes [9C, 08, 31, 94] {PUSHF ; OR [ECX], DH; XCHG ESP, EAX}
.text ntkrnlpa.exe!RtlSidHashLookup + 364 82C7F874 4 Bytes [A0, BD, 3C, 83]
.text ntkrnlpa.exe!RtlSidHashLookup + 4E8 82C7F9F8 4 Bytes [88, 08, 31, 94]
.text ntkrnlpa.exe!RtlSidHashLookup + 508 82C7FA18 4 Bytes CALL B3D0879F
.text …
.text C:\windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x8AB20000, 0x3C849, 0xE8000020]
.dsrt C:\windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x8AB65000, 0x3DC, 0x48000040]
.text C:\windows\system32\DRIVERS\atikmdag.sys section is writeable [0x90C10000, 0x2D5526, 0xE8000020]
.text peauth.sys 9C2B2C9D 28 Bytes [84, AD, 6F, C0, C0, 95, 8F, …]
.text peauth.sys 9C2B2CC1 28 Bytes [84, AD, 6F, C0, C0, 95, 8F, …]
PAGE peauth.sys 9C2B8E20 101 Bytes [89, AC, D3, 50, 00, E7, E7, …]
PAGE peauth.sys 9C2B902C 102 Bytes [10, F1, 59, EB, D7, F4, 14, …]

—- User code sections - GMER 1.0.15 —-

.text C:\windows\system32\svchost.exe[1060] ntdll.dll!NtProtectVirtualMemory 76F15380 5 Bytes JMP 002E000A
.text C:\windows\system32\svchost.exe[1060] ntdll.dll!NtWriteVirtualMemory 76F15F00 5 Bytes JMP 002F000A
.text C:\windows\system32\svchost.exe[1060] ntdll.dll!KiUserExceptionDispatcher 76F16448 5 Bytes JMP 001F000A
.text C:\windows\system32\svchost.exe[1060] ole32.dll!CoCreateInstance 75AA57FC 5 Bytes JMP 0092000A
.text C:\windows\system32\svchost.exe[1060] USER32.dll!GetCursorPos 757EC198 5 Bytes JMP 0116000A
.text C:\windows\Explorer.EXE[1620] ntdll.dll!NtProtectVirtualMemory 76F15380 5 Bytes JMP 003E000A
.text C:\windows\Explorer.EXE[1620] ntdll.dll!NtWriteVirtualMemory 76F15F00 5 Bytes JMP 003F000A
.text C:\windows\Explorer.EXE[1620] ntdll.dll!KiUserExceptionDispatcher 76F16448 5 Bytes JMP 003D000A

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs AVHook.sys (PC Tools Filter Driver for Windows 2000/XP/PC Tools Research Pty Ltd.)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004d halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat AVHook.sys (PC Tools Filter Driver for Windows 2000/XP/PC Tools Research Pty Ltd.)

—- EOF - GMER 1.0.15 —-
==================================================================

end of post

===================================================================

ComboFix 10-08-30.02 - Mia 08/31/2010 0:32.4.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2812.2216 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Uninstall
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.3.60.33\facemoods.dll
c:\program files\facemoods.com\facemoods\1.3.60.33\facemoods.png
c:\program files\facemoods.com\facemoods\1.3.60.33\facemoodsApp.dll
c:\program files\facemoods.com\facemoods\1.3.60.33\facemoodsEng.dll
c:\program files\facemoods.com\facemoods\1.3.60.33\facemoodsTlbr.dll
c:\program files\facemoods.com\facemoods\1.3.60.33\uninstall.exe
c:\program files\Mozilla Firefox\extensions\[removed]
c:\program files\Mozilla Firefox\extensions\[removed]\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\.svn\prop-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\.svn\text-base\chrome.manifest.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\.svn\text-base\install.rdf.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\.svn\text-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\chrome.manifest
c:\program files\Mozilla Firefox\extensions\[removed]\chrome\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\chrome\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\components\FFHst.dll
c:\program files\Mozilla Firefox\extensions\[removed]\components\FFHst.xpt
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\prop-base\facemoods.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\prop-base\Thumbs.db.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\prop-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\facemoods.css.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\facemoods.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\facemoods.xul.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\fcmdDef.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\Loader.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\newTabLgc.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\prefman.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\script-compiler.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\Thumbs.db.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\utils.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\xmlhttprequester.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\.svn\text-base\xpiInstallLgc.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\facemoods.css
c:\program files\Mozilla Firefox\extensions\[removed]\content\facemoods.png
c:\program files\Mozilla Firefox\extensions\[removed]\content\facemoods.xul
c:\program files\Mozilla Firefox\extensions\[removed]\content\fcmdDef.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\facemoods.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\fb.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\help_16.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\home.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\logo.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\moodsIcon.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\pref.jpg.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\privecy_16_hot.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\stripicons.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\tellafriend.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\Thumbs.db.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\prop-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\facemoods.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\fb.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\help_16.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\home.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\logo.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\moodsIcon.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\pref.jpg.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\privecy_16_hot.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\stripicons.png.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\tellafriend.gif.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\Thumbs.db.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\.svn\text-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\facemoods.png
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\fb.gif
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\help_16.gif
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\home.gif
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\logo.png
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\moodsIcon.png
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\pref.jpg
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\privecy_16_hot.gif
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\stripicons.png
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\tellafriend.gif
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\Thumbs.db
c:\program files\Mozilla Firefox\extensions\[removed]\content\images\vssver.scc
c:\program files\Mozilla Firefox\extensions\[removed]\content\instlgc.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\Loader.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\newTabLgc.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\.svn\prop-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\.svn\text-base\preferences.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\.svn\text-base\preferences.xul.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\.svn\text-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\preferences.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\preferences.xul
c:\program files\Mozilla Firefox\extensions\[removed]\content\preferences\vssver.scc
c:\program files\Mozilla Firefox\extensions\[removed]\content\prefman.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\script-compiler.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\Thumbs.db
c:\program files\Mozilla Firefox\extensions\[removed]\content\utils.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\vssver.scc
c:\program files\Mozilla Firefox\extensions\[removed]\content\xmlhttprequester.js
c:\program files\Mozilla Firefox\extensions\[removed]\content\xpiInstallLgc.js
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\.svn\all-wcprops
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\.svn\entries
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\.svn\prop-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\.svn\text-base\instlPref.js.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\.svn\text-base\vssver.scc.svn-base
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\instlPref.js
c:\program files\Mozilla Firefox\extensions\[removed]\defaults\preferences\vssver.scc
c:\program files\Mozilla Firefox\extensions\[removed]\install.rdf
c:\program files\Mozilla Firefox\extensions\[removed]\vssver.scc
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\users\Mia\AppData\Local\Microsoft\Windows\Temporary Internet Files\-kI1Euv10-l_VMa
c:\users\Mia\AppData\Local\Microsoft\Windows\Temporary Internet Files\PI5y-G4c
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((( Files Created from 2010-07-28 to 2010-08-31 )))))))))))))))))))))))))))))))
.

2010-08-31 04:45 . 2010-08-31 04:45 ——– d—–w- c:\users\Mia\AppData\Local\temp
2010-08-31 04:45 . 2010-08-31 04:45 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-08-31 04:24 . 2010-08-31 04:25 ——– d—–w- C:\32788R22FWJFW
2010-08-26 02:14 . 2010-08-26 02:14 388096 —-a-r- c:\users\Mia\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-26 02:14 . 2010-08-26 02:14 ——– d—–w- c:\program files\Trend Micro
2010-08-25 01:36 . 2010-08-25 01:36 ——– d—–w- C:\kleaner.tmp
2010-08-25 01:31 . 2010-08-25 01:31 ——– d—–w- c:\programdata\Kaspersky Lab Setup Files
2010-08-22 12:06 . 2010-08-22 12:06 ——– d—–w- C:\perflogs
2010-08-11 18:52 . 2010-08-11 18:52 ——– d—–w- c:\programdata\Office Genuine Advantage
2010-08-07 12:44 . 2010-08-07 12:44 ——– d—–w- c:\program files\iPod
2010-08-07 12:44 . 2010-08-07 12:45 ——– d—–w- c:\program files\iTunes
2010-08-07 12:41 . 2010-08-07 12:41 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-08-07 12:39 . 2010-08-07 12:39 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-08-04 20:24 . 2010-08-04 20:24 ——– d—–w- c:\users\Default\AppData\Local\Microsoft Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-26 00:26 . 2009-09-02 05:34 ——– d—–w- c:\programdata\WildTangent
2010-08-25 01:36 . 2010-03-10 21:38 ——– d—–w- c:\program files\AVG
2010-08-24 22:54 . 2010-03-10 19:26 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-20 11:38 . 2010-04-07 12:13 ——– d—–w- c:\programdata\DriverCure
2010-08-18 19:19 . 2009-12-06 16:09 ——– d—–w- c:\users\Mia\AppData\Roaming\FUJIFILM
2010-08-13 12:14 . 2009-11-16 07:17 ——– d—–w- c:\program files\Microsoft Works
2010-08-13 12:10 . 2009-11-16 07:26 ——– d—–w- c:\programdata\Microsoft Help
2010-08-11 18:52 . 2009-09-02 05:46 ——– d—–w- c:\program files\Microsoft Silverlight
2010-08-07 19:00 . 2010-02-16 23:37 ——– d—–w- c:\program files\Zynga
2010-08-07 12:44 . 2010-03-20 02:21 ——– d—–w- c:\program files\Common Files\Apple
2010-08-07 12:41 . 2010-05-21 13:14 ——– d—–w- c:\program files\Safari
2010-07-29 06:30 . 2010-08-12 12:51 197632 —-a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-12 12:51 82944 —-a-w- c:\windows\system32\iccvid.dll
2010-07-07 08:46 . 2010-07-07 08:46 92816 —-a-w- c:\programdata\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2011 11.0.1.400\english\setup.exe
2010-07-05 21:06 . 2010-04-07 12:13 ——– d—–w- c:\programdata\ParetoLogic
2010-07-05 21:06 . 2010-04-07 12:13 ——– d—–w- c:\program files\Common Files\ParetoLogic
2010-07-05 21:06 . 2010-07-05 21:05 3248400 —-a-w- c:\programdata\ParetoLogic\UUS2\DriverCure\Temp\Update.exe
2010-06-30 06:25 . 2010-08-12 12:51 978432 —-a-w- c:\windows\system32\wininet.dll
2010-06-22 02:47 . 2010-08-12 12:51 310784 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-12 12:51 307200 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-12 12:51 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-19 12:54 . 2010-06-19 12:54 71992 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-19 06:33 . 2010-08-12 12:51 3955080 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-12 12:51 3899784 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-12 12:51 37376 —-a-w- c:\windows\system32\rtutils.dll
2010-06-19 04:07 . 2010-08-12 12:51 2326016 —-a-w- c:\windows\system32\win32k.sys
2010-06-16 05:48 . 2010-08-12 12:51 224256 —-a-w- c:\windows\system32\schannel.dll
2010-06-14 11:35 . 2010-06-14 11:36 53632 —-a-w- c:\users\Mia\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-14 11:35 . 2010-04-11 00:51 53632 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-14 06:12 . 2010-08-12 12:51 1286016 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-08 06:02 . 2010-08-12 12:51 1233920 —-a-w- c:\windows\system32\msxml3.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat
2009-11-26 02:38 . 2009-11-26 02:38 14 –sh–r- c:\windows\System32\drivers\fbd.sys
2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files\Zynga\tbZyn1.dll" [2010-08-07 2734688]

[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
2010-08-07 19:00 2734688 —-a-w- c:\program files\Zynga\tbZyn1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]
2010-05-25 01:52 194912 ——w- c:\program files\Yontoo Layers Client\YontooIEClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files\Zynga\tbZyn1.dll" [2010-08-07 2734688]

[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7B13EC3E-999A-4B70-B9CB-2617B8323822}"= "c:\program files\Zynga\tbZyn1.dll" [2010-08-07 2734688]

[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-02 39408]
"NortonOnlineBackupReminder"="c:\program files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" [2009-07-16 529256]
"AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2009-12-28 2137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-07-13 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

c:\users\Mia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MemTurbo.lnk - c:\program files\MemTurbo 4\MemTurbo.exe [2010-3-27 3121760]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCTAVSvc]
@=""

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Exif Launcher S.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Exif Launcher S.lnk
backup=c:\windows\pss\Exif Launcher S.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
path=c:\users\Mia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]
2009-08-05 22:04 738616 —-a-w- c:\program files\TOSHIBA\FlashCards\TCrdMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2009-05-26 21:46 1159168 ——w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2008-12-24 15:26 114688 ——w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverCure]
2009-08-07 19:36 3993368 —-a-w- c:\program files\ParetoLogic\DriverCure\DriverCure.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 19:39 1090952 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 20:39 5244216 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyTOSHIBA]
2009-08-06 16:15 264048 —-a-w- c:\program files\TOSHIBA\My Toshiba\MyToshiba.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NortonOnlineBackupReminder]
2009-07-16 19:04 529256 —-a-w- c:\program files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp]
2009-04-16 16:27 1505168 —-a-w- c:\program files\PC Tools AntiVirus\PCTAV.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2008-07-03 16:37 812952 —-a-w- c:\program files\Registry Mechanic\RMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2009-07-29 05:12 7625248 ——w- c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2009-02-23 13:05 111856 —-a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2009-07-28 22:00 460088 —-a-w- c:\program files\TOSHIBA\SmoothView\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-07-30 06:32 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-09-02 05:47 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-07-21 01:46 1545512 —-a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Teco]
2009-08-12 00:09 1324384 —-a-w- c:\program files\TOSHIBA\TECO\TEco.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToshibaServiceStation]
2009-08-17 18:48 1294136 —-a-w- c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosSENotify]
2009-08-04 01:17 611672 —-a-w- c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosWaitSrv]
2009-08-07 01:05 611672 —-a-w- c:\program files\TOSHIBA\TPHM\TosWaitSrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]
2009-08-21 17:29 476512 —-a-w- c:\program files\TOSHIBA\Power Saver\TPwrMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2009-02-23 13:05 111856 —-a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 135664]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-08-04 111960]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-08-07 685424]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-31 1343400]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-08-24 206256]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-30 176128]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [2009-08-11 185712]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2009-08-12 185712]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 12920]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [2009-07-07 7680]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-08-06 171520]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-31 187392]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{01250B8F-D947-4F8A-9408-FE8E3EE2EC92}]
2009-08-06 16:15 264048 —-a-w- c:\program files\TOSHIBA\My Toshiba\MyToshiba.exe
.
Contents of the 'Scheduled Tasks' folder

2010-08-20 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36]

2010-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 15:25]

2010-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 15:25]

2010-08-22 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]

2010-08-16 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\program files\Common Files\PC Tools\LSP\PCTLsp.dll
.
- - - - ORPHANS REMOVED - - - -

BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files\facemoods.com\facemoods\1.3.60.33\facemoods.dll
Toolbar-Locked - (no file)
Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files\facemoods.com\facemoods\1.3.60.33\facemoodsTlbr.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-AV - c:\program files\AV\Antivir.exe
MSConfigStartUp-AVGT - c:\program files\AVGT\antivirusGT.exe
MSConfigStartUp-CyberDefender Early Detection Center - c:\users\Mia\AppData\Local\CyberDefender Internet Security\AntiSpyware\cdas1e69.exe
AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.3.60.33\uninstall.exe
AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe



**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x86725ACE]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
IoDeviceObjectType -> DumpProcedure -> 0xd46a624f
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2010-08-31 00:49:34
ComboFix-quarantined-files.txt 2010-08-31 04:49

Pre-Run: 272,800,149,504 bytes free
Post-Run: 272,917,913,600 bytes free

- - End Of File - - 3364B0CE855E16BDE3E4A87A2594DC06

Hi,

Please do the following


Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

NEXT

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.