mattpd
Topic Starter
Google.com and Yahoo.com both time out. When I ping Google.com, it returns 96.44.181.245, which is a bogus IP.
I ran malwarebytes and security essentials, and both are clean. I also ran TDSSkiller and it was clean.
Here is DDS and Attach.txt
Can someone point me in the right direction?
—————————————————————————————————————————————————————————-
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 11:27:41.51 on Fri 03/18/2011
Internet Explorer: 9.0.8112.16421
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3037.1850 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Livescribe\PenComm\PenCommService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k HPService
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\user\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uWindow Title = Internet Explorer, optimized for Bing and MSN
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AddThis Toolbar BHO: {9ebf8aaf-0a31-4786-909a-97a0ef101743} - c:\program files\addthis toolbar\Toolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AddThis Toolbar: {b43176cc-4d9e-493b-a636-d9cbfe39c6da} - c:\program files\addthis toolbar\Toolbar.dll
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Broadcom Wireless Manager UI] c:\program files\dell\dell wireless wlan card\WLTRAY.exe
mRun: [Dell Webcam Central] "c:\program files\dell webcam\dell webcam central\WebcamDell2.exe" /mode2
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
dRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /c
uPolicies-explorer: DisallowRun = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
IFEO: image file execution options - svchost.exe
Hosts: 96.44.181.245 www.google.com
Hosts: 96.44.181.245 google.com
Hosts: 96.44.181.245 google.com.au
Hosts: 96.44.181.245 www.google.com.au
Hosts: 96.44.181.245 google.be
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\user\appdata\roaming\mozilla\firefox\profiles\07zs7qr6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 165264]
R1 MpKsl2d1193d5;MpKsl2d1193d5;c:\programdata\microsoft\microsoft antimalware\definition updates\{aade7f11-7b5b-4c83-b2f0-6d9e50928ded}\MpKsl2d1193d5.sys [2011-3-17 28752]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-12-8 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2010-9-17 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2011-3-17 47640]
R2 PenCommService;Livescribe Smartpen Service;c:\program files\common files\livescribe\pencomm\PenCommService.exe [2010-10-18 457728]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2010-3-20 143968]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-12-2 43392]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-1-23 167936]
R3 VIACRX86;VIACRX86;c:\windows\system32\drivers\viacr.sys [2010-1-23 59392]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-3-16 38224]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-3-17 1153368]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\drivers\CtAudDrv.sys [2010-3-20 134144]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S3 PulseUsb;Livescribe Smartpen USB Driver;c:\windows\system32\drivers\PulseUsb.sys [2010-10-18 20480]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-13 1343400]
.
=============== Created Last 30 ================
.
2011-03-17 21:49:19 83360 —-a-w- c:\windows\system32\LMIRfsClientNP.dll
2011-03-17 21:49:19 53632 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll
2011-03-17 21:49:19 47640 —-a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
2011-03-17 21:49:19 29568 —-a-w- c:\windows\system32\LMIport.dll
2011-03-17 21:49:17 87424 —-a-w- c:\windows\system32\LMIinit.dll
2011-03-17 21:30:58 28752 —-a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{aade7f11-7b5b-4c83-b2f0-6d9e50928ded}\MpKsl2d1193d5.sys
2011-03-17 21:07:17 5943120 —-a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{aade7f11-7b5b-4c83-b2f0-6d9e50928ded}\mpengine.dll
2011-03-16 20:35:32 ——– d—–w- c:\users\user\appdata\local\LogMeIn
2011-03-16 20:35:27 ——– d—–w- c:\progra~2\LogMeIn
2011-03-16 20:35:18 ——– d—–w- c:\program files\LogMeIn
2011-03-16 17:25:02 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-16 17:24:58 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-03-16 17:24:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-03-16 17:15:43 801792 —-a-w- c:\windows\system32\FntCache.dll
2011-03-12 20:24:09 ——– d—–w- c:\users\user\appdata\local\Diagnostics
2011-03-09 18:11:19 850432 —-a-w- c:\windows\system32\sbe.dll
2011-03-09 18:11:19 642048 —-a-w- c:\windows\system32\CPFilters.dll
2011-03-09 18:11:19 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-03-09 18:11:19 199680 —-a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 18:11:14 2690560 —-a-w- c:\windows\system32\mstscax.dll
2011-03-09 18:11:14 1034240 —-a-w- c:\windows\system32\mstsc.exe
2011-03-08 20:08:46 1473608 —-a-w- c:\users\user\gotomypc_597.exe
2011-03-02 22:13:25 4277016 —-a-w- c:\progra~2\microsoft\ehome\packages\mceclientux\updateablemarkup-6\markup.dll
2011-02-19 22:48:22 4277016 —-a-w- c:\progra~2\microsoft\ehome\packages\mceclientux\updateablemarkup-7\markup.dll
2011-02-16 22:42:56 42776 —-a-w- c:\progra~2\microsoft\ehome\packages\mceclientux\dsm-2\StartResources.dll
2011-02-16 21:42:46 737072 —-a-w- c:\progra~2\microsoft\ehome\packages\sportsv2\sportstemplatecore\Microsoft.MediaCenter.Sports.UI.dll
2011-02-16 21:41:59 42776 —-a-w- c:\progra~2\microsoft\ehome\packages\mceclientux\dsm\StartResources.dll
2011-02-16 21:41:57 539968 —-a-w- c:\progra~2\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll
.
==================== Find3M ====================
.
2011-03-16 17:15:43 739840 —-a-w- c:\windows\system32\d2d1.dll
2011-03-16 17:15:43 283648 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-03-16 17:15:43 218624 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-03-16 17:15:43 1619456 —-a-w- c:\windows\system32\WMVDECOD.DLL
2011-03-16 17:15:43 161792 —-a-w- c:\windows\system32\d3d10_1.dll
2011-03-16 17:15:43 135168 —-a-w- c:\windows\system32\XpsRasterService.dll
2011-03-16 17:15:43 1170944 —-a-w- c:\windows\system32\d3d10warp.dll
2011-03-16 17:15:43 1074176 —-a-w- c:\windows\system32\DWrite.dll
2011-03-16 17:15:42 442880 —-a-w- c:\windows\system32\XpsPrint.dll
2011-03-16 17:15:42 3181568 —-a-w- c:\windows\system32\mf.dll
2011-03-16 17:15:42 196608 —-a-w- c:\windows\system32\mfreadwrite.dll
2011-03-16 17:15:42 1495040 —-a-w- c:\windows\system32\ExplorerFrame.dll
2011-03-16 17:15:42 107520 —-a-w- c:\windows\system32\cdd.dll
2011-01-07 07:27:11 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-01-07 05:33:11 294400 —-a-w- c:\windows\system32\atmfd.dll
2011-01-05 03:37:38 2329088 —-a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 11:28:11.43 ===============
