What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Windows Media/Ctrl-Alt-Delete failures?

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Me again. I''m writing this time because a couple of strange things have happened in the last few days. For some reason, when I'm watching a video on Windows Media Player, eventually it'll slow down and stop. When this happens, if I try to C-A-D to the task manager and shut it down, it hangs the whole system up. If I then manually restart it, it goes to black and says something about (NTSB corrupted disk?) from a recently installed item - but I don't think i've installed anything in at least a month.

I then tried to post a HJT file, but it says my system has denied access to a Hosts file? My computer works completely fine otherwise, so it may be one of the torrents I did (I didn't think so, because I ran everything through AVG before dl'ing anything, but you never know, I guess.

Here is what HJT DID come up with:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:59:22 PM, on 4/14/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16766)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Encore\Hoyle Card Games 2011\Ereg\encore_reg.exe
C:\Users\Joshua\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\AVG\AVG10\avgtray.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Joshua\Downloads\HiJackThis (1).exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [20090604] C:\Program Files (x86)\Encore\Hoyle Card Games 2011\Ereg\encore_reg.exe /r "C:\Program Files (x86)\Encore\Hoyle Card Games 2011\Ereg\encore_reg.rpd"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files (x86)\Bodog Poker\BPGame.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O12 - Plugin for .spop: C:\Program Files (x86)\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Health Check Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HPWMISVC - Unknown owner - C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: RtVOsdService Installer (RtVOsdService) - Realtek Semiconductor Corp. - C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 15015 bytes


I'll be on today, and then very sporadically (if at all) until Monday, so if y'all aren't able to get to this today, please don't lock this thread. As always, appreciate your help.
Post #2
Alyaz,

First off… If you've been downloading torrents, you need to stop. I realize you think you've been taking precautions, but I can assure you that well over 90% of them carry infections. I suggest that you uninstall all Peer-to-peer probrams… limewire, utorrent, bittorent, azereus, whatever.

I'd like to see a deeper scan.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
. DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 12:21:06.98 on Sun 04/17/2011 Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3003.1431 [GMT -4:00] . AV: Norton Internet Security *Disabled/Outdated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} AV: AVG Internet Security 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Internet Security 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} FW: Norton Internet Security *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} . ============== Running Processes =============== . C:\PROGRA~2\AVG\AVG10\avgchsva.exe C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\AVG\AVG10\avgfws.exe C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe C:\Windows\system32\conhost.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\System32\igfxtray.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\System32\StikyNot.exe C:\Users\Joshua\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe C:\Program Files (x86)\Encore\Hoyle Card Games 2011\Ereg\encore_reg.exe C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\AVG\AVG10\avgtray.exe C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe C:\Windows\SysWOW64\DllHost.exe C:\Windows\system32\conhost.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\PROGRA~2\AVG\AVG10\avgrsa.exe C:\Program Files (x86)\AVG\AVG10\avgcsrva.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\WUDFHost.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Joshua\Downloads\dds.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = my.daemon-search.com uInternet Settings,ProxyOverride = *.local uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe uRun: [Google Update] "C:\Users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [20090604] C:\Program Files (x86)\Encore\Hoyle Card Games 2011\Ereg\encore_reg.exe /r "C:\Program Files (x86)\Encore\Hoyle Card Games 2011\Ereg\encore_reg.rpd" uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe StartupFolder: C:\Users\Joshua\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\PDANET~1.LNK - C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files (x86)\Bodog Poker\BPGame.exe IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssiea.dll BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll TB-X64: DAEMON Tools Toolbar: {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun-x64: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s mRun-x64: [RtkOSD] C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe mRun-x64: [HP Quick Launch] C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun-x64: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\ooxr6vxk.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.mydtzone.com/startpage FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4d7c893d&v=6.011.025.001&i=26&tp=ab&iy=&ychte=us&lng=en-US&q= FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox\components\avgssff.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll FF - component: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll FF - component: C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\ooxr6vxk.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\FFExternalAlert.dll FF - component: C:\Users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\ooxr6vxk.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\components\RadioWMPCore.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60129.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Joshua\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: C:\Users\Joshua\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: C:\Users\Joshua\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;C:\Windows\System32\drivers\AVGIDSEH.sys [2010-9-13 27216] R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2010-9-7 30288] R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1108000.005\symds64.sys [2010-9-23 433200] R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1108000.005\symefa64.sys [2010-9-23 221232] R1 Avgfwfd;AVG network filter service;C:\Windows\System32\drivers\avgfwd6a.sys [2010-7-12 57696] R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2010-12-8 308304] R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2010-9-7 41040] R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2010-11-12 382032] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx64.sys [2010-10-5 954928] R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\NISx64\1108000.005\cchpx64.sys [2010-9-23 615040] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2011-4-4 254528] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101028.001\IDSviA64.sys [2010-10-19 476720] R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1108000.005\ironx64.sys [2010-9-23 150064] R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\NISx64\1108000.005\symtdiv.sys [2010-9-23 451120] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-7-8 98208] R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG10\avgfws.exe [2010-11-22 3226632] R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [2010-10-22 265400] R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-2-4 92216] R2 HPWMISVC;HPWMISVC;C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-1-18 20480] R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe [2010-9-23 126392] R2 pgsql-8.3;PostgreSQL Database Server 8.3;C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2009-12-10 65536] R2 RtVOsdService;RtVOsdService Installer;C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-6-24 315392] R3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\System32\drivers\lgandbus64.sys [2011-4-14 19456] R3 androidusb;ADB Interface Driver;C:\Windows\System32\drivers\androidusb.sys [2011-4-14 36256] R3 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\AVGIDSDriver.sys [2010-8-3 157264] R3 AVGIDSFilter;AVGIDSFilter;C:\Windows\System32\drivers\AVGIDSFilter.sys [2010-8-3 35920] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-9-11 132656] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\System32\drivers\IntcHdmi.sys [2010-3-5 144896] R3 pneteth;PdaNet Broadband;C:\Windows\System32\drivers\pneteth.sys [2011-4-14 15360] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-11-13 347680] R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\Windows\System32\drivers\rtl8192se.sys [2010-7-8 1088544] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920] S2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-1-6 6128720] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-9-2 136176] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-3-13 517448] S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe [2011-3-14 25832] S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-22 48488] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-7-8 225280] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864] S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864] S3 uts_bus;UTStarcom USB Composite Device driver (WDM);C:\Windows\System32\drivers\uts_bus.sys [2010-9-1 109568] S3 uts_mdfl;UTStarcom USB Modem Filter;C:\Windows\System32\drivers\uts_mdfl.sys [2010-9-1 18944] S3 uts_mdm;UTStarcom USB Modem Drivers;C:\Windows\System32\drivers\uts_mdm.sys [2010-9-1 146944] S3 uts_serd;UTStarcom USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\uts_serd.sys [2010-9-1 118784] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-9-5 1255736] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2011-04-15 00:00:42 1490656 —-a-w- C:\Windows\System32\wdfcoinstaller01007.dll 2011-04-15 00:00:41 36256 —-a-w- C:\Windows\System32\drivers\androidusb.sys 2011-04-15 00:00:41 19456 —-a-w- C:\Windows\System32\drivers\lgandbus64.sys 2011-04-15 00:00:41 15360 —-a-w- C:\Windows\System32\drivers\pneteth.sys 2011-04-15 00:00:41 ——– d—–w- C:\Program Files (x86)\PdaNet for Android 2011-04-12 19:53:44 ——– d—–w- C:\Users\Joshua\AppData\Local\Microsoft Help 2011-04-11 02:11:39 ——– d—–w- C:\Users\Joshua\AppData\Local\{FEE0C1EA-0ACF-4C32-A4F4-2471CF196AAD} 2011-04-08 00:33:03 ——– d—–w- C:\Program Files (x86)\Bethesda Softworks 2011-04-04 21:38:52 254528 —-a-w- C:\Windows\System32\drivers\dtsoftbus01.sys 2011-04-04 21:37:57 ——– d—–w- C:\Program Files (x86)\DAEMON Tools Toolbar 2011-04-04 21:37:49 ——– d—–w- C:\Program Files (x86)\DAEMON Tools Lite 2011-04-04 02:39:23 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2011-04-02 01:01:39 ——– d—–w- C:\Users\Joshua\AppData\Local\{242139E3-CF4A-44E6-AEB7-C94A2FCE3078} 2011-04-02 01:00:39 ——– d—–w- C:\Users\Joshua\AppData\Local\{91026747-3BFE-4411-B07F-D56EC082C6A3} 2011-04-01 03:12:37 ——– d—–w- C:\Users\Joshua\AppData\Local\{5D934132-8015-4525-9720-F380237387A0} 2011-04-01 00:04:55 ——– d—–w- C:\Users\Joshua\AppData\Roaming\Hoyle FaceCreator 2011-04-01 00:04:53 ——– d—–w- C:\Users\Joshua\AppData\Roaming\Hoyle 2011-04-01 00:01:06 ——– d—–w- C:\Program Files (x86)\Encore 2011-03-30 20:23:29 ——– d—–w- C:\Program Files (x86)\Microsoft Games 2011-03-30 03:20:22 ——– d—–w- C:\Windows\Governor of Poker 2011-03-30 03:20:22 ——– d—–w- C:\Program Files (x86)\Governor of Poker 2011-03-29 18:57:42 197120 —-a-w- C:\Windows\patchw32.dll 2011-03-29 18:57:41 ——– d—–w- C:\Program Files (x86)\Common Files\PocketSoft 2011-03-29 18:54:28 ——– d—–w- C:\Program Files (x86)\Atari 2011-03-29 18:53:02 692224 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll 2011-03-29 18:53:02 57344 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll 2011-03-29 18:53:02 5632 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe 2011-03-29 18:53:02 282756 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll 2011-03-29 18:53:02 237568 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll 2011-03-29 18:53:02 163972 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll 2011-03-29 18:53:02 155648 —-a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll 2011-03-29 15:52:42 ——– d—–w- C:\Users\Joshua\Calibre Library 2011-03-29 15:52:32 ——– d—–w- C:\Users\Joshua\AppData\Roaming\calibre 2011-03-24 12:10:49 ——– d—–w- C:\Program Files (x86)\Calibre2 2011-03-24 10:44:40 781272 —-a-w- C:\Program Files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-03-24 10:44:40 728024 —-a-w- C:\Program Files (x86)\Mozilla Firefox\libGLESv2.dll 2011-03-24 10:44:40 1975768 —-a-w- C:\Program Files (x86)\Mozilla Firefox\D3DCompiler_42.dll 2011-03-24 10:44:40 1893336 —-a-w- C:\Program Files (x86)\Mozilla Firefox\d3dx9_42.dll 2011-03-24 10:44:40 1874904 —-a-w- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2011-03-24 10:44:40 15832 —-a-w- C:\Program Files (x86)\Mozilla Firefox\mozalloc.dll 2011-03-24 10:44:40 142296 —-a-w- C:\Program Files (x86)\Mozilla Firefox\libEGL.dll 2011-03-24 10:44:40 142296 —-a-w- C:\Program Files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-03-22 22:08:22 ——– d—–w- C:\Program Files\iPod 2011-03-22 22:08:21 ——– d—–w- C:\Program Files\iTunes 2011-03-22 22:08:21 ——– d—–w- C:\Program Files (x86)\iTunes 2011-03-22 22:07:34 ——– d—–w- C:\Users\Joshua\AppData\Local\Apple Computer 2011-03-22 22:04:45 ——– d—–w- C:\Program Files\Bonjour 2011-03-22 22:04:45 ——– d—–w- C:\Program Files (x86)\Bonjour 2011-03-21 02:05:06 178800 —-a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll 2011-03-21 02:03:20 ——– d—–w- C:\Windows\SysWow64\xlive 2011-03-21 02:03:19 ——– d—–w- C:\Program Files (x86)\Microsoft Games for Windows - LIVE 2011-03-21 01:33:39 ——– d—–w- C:\Program Files (x86)\Rockstar Games . ==================== Find3M ==================== . 2011-03-11 06:19:26 1395712 —-a-w- C:\Windows\System32\mfc42.dll 2011-03-11 06:19:26 1359872 —-a-w- C:\Windows\System32\mfc42u.dll 2011-03-11 05:40:24 1164288 —-a-w- C:\Windows\SysWow64\mfc42u.dll 2011-03-11 05:40:24 1137664 —-a-w- C:\Windows\SysWow64\mfc42.dll 2011-03-08 06:14:30 976896 —-a-w- C:\Windows\System32\inetcomm.dll 2011-03-08 05:38:13 740864 —-a-w- C:\Windows\SysWow64\inetcomm.dll 2011-03-03 06:17:10 182272 —-a-w- C:\Windows\System32\dnsrslvr.dll 2011-03-03 06:14:38 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe 2011-03-03 05:27:30 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe 2011-03-03 03:58:32 3133440 —-a-w- C:\Windows\System32\win32k.sys 2011-02-24 06:30:00 476160 —-a-w- C:\Windows\System32\XpsGdiConverter.dll 2011-02-24 06:29:15 1197056 —-a-w- C:\Windows\System32\wininet.dll 2011-02-24 06:24:57 57856 —-a-w- C:\Windows\System32\licmgr10.dll 2011-02-24 05:32:52 288256 —-a-w- C:\Windows\SysWow64\XpsGdiConverter.dll 2011-02-24 05:32:44 981504 —-a-w- C:\Windows\SysWow64\wininet.dll 2011-02-24 05:30:16 44544 —-a-w- C:\Windows\SysWow64\licmgr10.dll 2011-02-24 05:05:13 482816 —-a-w- C:\Windows\System32\html.iec 2011-02-24 04:24:04 1638912 —-a-w- C:\Windows\System32\mshtml.tlb 2011-02-24 04:23:48 386048 —-a-w- C:\Windows\SysWow64\html.iec 2011-02-24 03:50:26 1638912 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2011-02-23 05:16:28 461312 —-a-w- C:\Windows\System32\drivers\srv.sys 2011-02-23 05:16:01 401920 —-a-w- C:\Windows\System32\drivers\srv2.sys 2011-02-23 05:15:50 161792 —-a-w- C:\Windows\System32\drivers\srvnet.sys 2011-02-23 05:15:27 157696 —-a-w- C:\Windows\System32\drivers\mrxsmb.sys 2011-02-23 05:15:14 286720 —-a-w- C:\Windows\System32\drivers\mrxsmb10.sys 2011-02-23 05:15:13 126464 —-a-w- C:\Windows\System32\drivers\mrxsmb20.sys 2011-02-23 05:15:06 90624 —-a-w- C:\Windows\System32\drivers\bowser.sys 2011-02-19 06:37:44 1135104 —-a-w- C:\Windows\System32\FntCache.dll 2011-02-19 06:37:10 1540608 —-a-w- C:\Windows\System32\DWrite.dll 2011-02-19 06:36:49 902656 —-a-w- C:\Windows\System32\d2d1.dll 2011-02-19 06:36:13 46080 —-a-w- C:\Windows\System32\atmlib.dll 2011-02-19 05:32:48 1074176 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-02-19 05:32:35 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-02-19 05:32:08 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2011-02-19 04:13:39 367104 —-a-w- C:\Windows\System32\atmfd.dll 2011-02-19 03:37:02 294912 —-a-w- C:\Windows\SysWow64\atmfd.dll 2011-02-18 06:37:05 612352 —-a-w- C:\Windows\System32\vbscript.dll 2011-02-18 05:36:26 428032 —-a-w- C:\Windows\SysWow64\vbscript.dll 2011-02-12 06:14:41 267776 —-a-w- C:\Windows\System32\FXSCOVER.exe 2011-02-06 01:56:42 332392 —-a-w- C:\Windows\System32\RtlCPAPI64.dll 2011-02-06 01:56:42 2048104 —-a-w- C:\Windows\System32\RtPgEx64.dll 2011-02-06 01:56:42 1146984 —-a-w- C:\Windows\System32\RTSnMg64.cpl 2011-02-06 01:56:41 2494056 —-a-w- C:\Windows\System32\drivers\RTKVHD64.sys 2011-02-06 01:56:40 80488 —-a-w- C:\Windows\System32\RCoInst64.dll 2011-02-06 01:56:40 569960 —-a-w- C:\Windows\System32\RtkApi64.dll 2011-02-06 01:56:40 2625640 —-a-w- C:\Windows\System32\RtkAPO64.dll 2011-02-06 01:56:40 149608 —-a-w- C:\Windows\System32\RtkCfg64.dll 2011-02-06 01:56:40 1215592 —-a-w- C:\Windows\System32\RTCOM64.dll 2011-02-06 01:56:39 200800 —-a-w- C:\Windows\System32\AERTAC64.dll 2011-02-06 01:56:37 1251944 —-a-w- C:\Windows\RtlExUpd.dll 2011-02-05 12:41:43 556928 —-a-w- C:\Windows\System32\winresume.efi 2011-02-05 12:41:35 640896 —-a-w- C:\Windows\System32\winload.efi 2011-02-05 12:41:24 20352 —-a-w- C:\Windows\System32\kdusb.dll 2011-02-05 12:41:24 19328 —-a-w- C:\Windows\System32\kd1394.dll 2011-02-05 12:41:23 17792 —-a-w- C:\Windows\System32\kdcom.dll 2011-02-05 12:39:21 603976 —-a-w- C:\Windows\System32\winload.exe 2011-02-05 12:39:21 518160 —-a-w- C:\Windows\System32\winresume.exe 2011-02-03 02:40:23 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-02-02 22:11:20 270720 ——w- C:\Windows\System32\MpSigStub.exe 2011-01-26 06:53:10 982912 —-a-w- C:\Windows\System32\drivers\dxgkrnl.sys 2011-01-26 06:53:10 265088 —-a-w- C:\Windows\System32\drivers\dxgmms1.sys 2011-01-26 06:31:20 144384 —-a-w- C:\Windows\System32\cdd.dll . ============= FINISH: 12:22:44.94 ===============

Attachments:

Post #4
Alyaz,

Okay… you have a couple things going on there.

First off, you have two antivirus programs running. Norton and AVG. They will conflict with each other and cause a myriad of problems. Your Norton is out of date so I suggest that you just uninstall it. After uninstalling in add or remove programs:

Use the link below to see how to run the Norton Removal Tool
http://service1.symantec.com/SUPPORT/tsgen…005033108162039

Secondly, your C: drive has very little free space left on it. You've got like 9% free. Rule of thumb says you need to keep at least 15% free. I suggest that you go through it and delete everything you don't want/need.

After you've done all of that… AVG doesn't play nice with the tool I'd like you to run. You will need to uninstall AVG for now. You can re-install once we are done.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #5
ComboFix 11-04-13.03 - Joshua 04/17/2011 21:25:30.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3003.1642 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2011-03-18 to 2011-04-18 ))))))))))))))))))))))))))))))) . . 2011-04-18 02:10 . 2011-04-18 02:10 ——– d—–w- c:\users\Public\AppData\Local\temp 2011-04-18 02:10 . 2011-04-18 02:10 ——– d—–w- c:\users\postgres\AppData\Local\temp 2011-04-18 02:10 . 2011-04-18 02:10 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-04-18 00:53 . 2011-04-18 00:53 ——– d—–w- c:\windows\SysWow64\drivers\AVG 2011-04-18 00:07 . 2011-04-18 00:07 ——– d—–w- C:\found.000 2011-04-15 00:00 . 2009-11-08 06:41 1490656 —-a-w- c:\windows\system32\wdfcoinstaller01007.dll 2011-04-15 00:00 . 2011-04-15 00:00 ——– d—–w- c:\program files (x86)\PdaNet for Android 2011-04-15 00:00 . 2010-09-02 21:49 15360 —-a-w- c:\windows\system32\drivers\pneteth.sys 2011-04-15 00:00 . 2010-08-06 17:22 19456 —-a-w- c:\windows\system32\drivers\lgandbus64.sys 2011-04-15 00:00 . 2009-11-14 04:05 36256 —-a-w- c:\windows\system32\drivers\androidusb.sys 2011-04-12 19:53 . 2011-04-12 19:53 ——– d—–w- c:\users\Joshua\AppData\Local\Microsoft Help 2011-04-11 02:11 . 2011-04-11 02:11 ——– d—–w- c:\users\Joshua\AppData\Local\{FEE0C1EA-0ACF-4C32-A4F4-2471CF196AAD} 2011-04-08 00:33 . 2011-04-08 00:33 ——– d—–w- c:\program files (x86)\Bethesda Softworks 2011-04-04 21:38 . 2011-04-04 21:38 254528 —-a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-04-04 21:37 . 2011-04-04 21:38 ——– d—–w- c:\program files (x86)\DAEMON Tools Toolbar 2011-04-04 21:37 . 2011-04-04 21:39 ——– d—–w- c:\program files (x86)\DAEMON Tools Lite 2011-04-04 02:39 . 2011-04-04 02:39 ——– d—–w- c:\program files (x86)\MSXML 4.0 2011-04-02 01:01 . 2011-04-02 01:01 ——– d—–w- c:\users\Joshua\AppData\Local\{242139E3-CF4A-44E6-AEB7-C94A2FCE3078} 2011-04-02 01:00 . 2011-04-02 01:00 ——– d—–w- c:\users\Joshua\AppData\Local\{91026747-3BFE-4411-B07F-D56EC082C6A3} 2011-04-01 03:12 . 2011-04-01 03:12 ——– d—–w- c:\users\Joshua\AppData\Local\{5D934132-8015-4525-9720-F380237387A0} 2011-04-01 00:04 . 2011-04-01 00:13 ——– d—–w- c:\users\Joshua\AppData\Roaming\Hoyle FaceCreator 2011-04-01 00:04 . 2011-04-02 00:17 ——– d—–w- c:\users\Joshua\AppData\Roaming\Hoyle 2011-04-01 00:01 . 2011-04-01 00:01 ——– d—–w- c:\program files (x86)\Encore 2011-03-30 20:23 . 2011-03-30 20:23 ——– d—–w- c:\program files (x86)\Microsoft Games 2011-03-30 03:20 . 2011-03-30 03:20 ——– d—–w- c:\program files (x86)\Governor of Poker 2011-03-30 03:20 . 2011-03-30 03:20 ——– d—–w- c:\windows\Governor of Poker 2011-03-29 18:57 . 2011-03-29 18:57 ——– d—–w- c:\users\Joshua\AppData\Roaming\Leadertech 2011-03-29 18:57 . 2002-02-27 22:50 197120 —-a-w- c:\windows\patchw32.dll 2011-03-29 18:57 . 2011-03-29 18:57 ——– d—–w- c:\program files (x86)\Common Files\PocketSoft 2011-03-29 18:54 . 2011-03-29 18:54 ——– d—–w- c:\program files (x86)\Atari 2011-03-29 18:53 . 2011-03-29 18:53 282756 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll 2011-03-29 18:53 . 2011-03-29 18:53 163972 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll 2011-03-29 18:53 . 2002-12-05 18:12 692224 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll 2011-03-29 18:53 . 2002-12-05 18:10 155648 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll 2011-03-29 18:53 . 2002-12-02 19:22 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe 2011-03-29 18:53 . 2002-12-02 17:33 57344 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll 2011-03-29 18:53 . 2002-12-02 17:33 237568 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll 2011-03-29 15:52 . 2011-04-15 22:33 ——– d—–w- c:\users\Joshua\Calibre Library 2011-03-29 15:52 . 2011-04-06 03:38 ——– d—–w- c:\users\Joshua\AppData\Roaming\calibre 2011-03-24 12:10 . 2011-03-24 12:11 ——– d—–w- c:\program files (x86)\Calibre2 2011-03-24 10:44 . 2011-03-18 17:53 142296 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-03-24 10:44 . 2011-03-18 17:53 781272 —-a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-03-24 10:44 . 2011-03-18 17:53 1874904 —-a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll 2011-03-24 10:44 . 2011-03-18 17:53 15832 —-a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll 2011-03-24 10:44 . 2011-03-18 17:53 728024 —-a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll 2011-03-24 10:44 . 2011-03-18 17:53 142296 —-a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll 2011-03-24 10:44 . 2011-03-18 17:53 1893336 —-a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_42.dll 2011-03-24 10:44 . 2011-03-18 17:53 1975768 —-a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_42.dll 2011-03-22 22:08 . 2011-03-22 22:08 ——– d—–w- c:\program files\iPod 2011-03-22 22:08 . 2011-03-22 22:08 ——– d—–w- c:\program files\iTunes 2011-03-22 22:08 . 2011-03-22 22:08 ——– d—–w- c:\program files (x86)\iTunes 2011-03-22 22:07 . 2011-04-15 19:27 ——– d—–w- c:\users\Joshua\AppData\Local\Apple Computer 2011-03-22 22:04 . 2011-03-22 22:04 ——– d—–w- c:\program files\Bonjour 2011-03-22 22:04 . 2011-03-22 22:04 ——– d—–w- c:\program files (x86)\Bonjour 2011-03-21 02:07 . 2011-03-21 02:07 ——– d–h–r- c:\users\Joshua\AppData\Roaming\SecuROM 2011-03-21 02:03 . 2011-03-21 02:03 ——– d—–w- c:\windows\SysWow64\xlive 2011-03-21 02:03 . 2011-03-21 02:03 ——– d—–w- c:\program files (x86)\Microsoft Games for Windows - LIVE 2011-03-21 01:33 . 2011-04-18 00:51 ——– d—–w- c:\program files (x86)\Rockstar Games . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-09 15:49 . 2010-06-24 15:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-02-19 06:37 . 2011-03-09 04:57 1135104 —-a-w- c:\windows\system32\FntCache.dll 2011-02-19 06:37 . 2011-03-09 04:57 1540608 —-a-w- c:\windows\system32\DWrite.dll 2011-02-19 06:36 . 2011-03-09 04:57 902656 —-a-w- c:\windows\system32\d2d1.dll 2011-02-19 05:32 . 2011-03-09 04:57 1074176 —-a-w- c:\windows\SysWow64\DWrite.dll 2011-02-19 05:32 . 2011-03-09 04:57 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2011-02-11 07:30 . 2011-03-11 10:02 7947600 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E7390F48-6E87-4061-9D0C-82E4066DA2F4}\mpengine.dll 2011-02-06 01:56 . 2011-02-06 01:57 2048104 —-a-w- c:\windows\system32\RtPgEx64.dll 2011-02-06 01:56 . 2011-02-06 01:57 1146984 —-a-w- c:\windows\system32\RTSnMg64.cpl 2011-02-06 01:56 . 2011-02-06 01:57 332392 —-a-w- c:\windows\system32\RtlCPAPI64.dll 2011-02-06 01:56 . 2011-02-06 01:57 2494056 —-a-w- c:\windows\system32\drivers\RTKVHD64.sys 2011-02-06 01:56 . 2011-02-06 01:57 80488 —-a-w- c:\windows\system32\RCoInst64.dll 2011-02-06 01:56 . 2011-02-06 01:57 569960 —-a-w- c:\windows\system32\RtkApi64.dll 2011-02-06 01:56 . 2011-02-06 01:57 2625640 —-a-w- c:\windows\system32\RtkAPO64.dll 2011-02-06 01:56 . 2011-02-06 01:57 149608 —-a-w- c:\windows\system32\RtkCfg64.dll 2011-02-06 01:56 . 2011-02-06 01:57 1215592 —-a-w- c:\windows\system32\RTCOM64.dll 2011-02-06 01:56 . 2011-02-06 01:57 200800 —-a-w- c:\windows\system32\AERTAC64.dll 2011-02-06 01:56 . 2010-07-08 08:25 1251944 —-a-w- c:\windows\RtlExUpd.dll 2011-02-03 02:40 . 2010-09-02 05:04 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-02-02 22:11 . 2010-09-02 04:03 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-01-26 06:53 . 2011-02-10 00:40 982912 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-01-26 06:53 . 2011-02-10 00:40 265088 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-01-26 06:31 . 2011-02-10 00:40 144384 —-a-w- c:\windows\system32\cdd.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-06-16 2736128] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] "Google Update"="c:\users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe" [2011-02-09 136176] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] . c:\users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ PdaNet Desktop.lnk - c:\program files (x86)\PdaNet for Android\PdaNetPC.exe [2011-4-14 477736] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-02 136176] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 uts_bus;UTStarcom USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\uts_bus.sys [x] R3 uts_mdfl;UTStarcom USB Modem Filter;c:\windows\system32\DRIVERS\uts_mdfl.sys [x] R3 uts_mdm;UTStarcom USB Modem Drivers;c:\windows\system32\DRIVERS\uts_mdm.sys [x] R3 uts_serd;UTStarcom USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\uts_serd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-02-04 92216] S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-01-18 20480] S2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2009-12-10 65536] S2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392] S3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x] S3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x] S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x] S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-06-16 17:38 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-02 05:28] . 2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-02 05:28] . 2011-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1913400786-887883318-3225438093-1000Core.job - c:\users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-09 21:44] . 2011-04-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1913400786-887883318-3225438093-1000UA.job - c:\users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-09 21:44] . 2011-04-18 c:\windows\Tasks\HPCeeScheduleForJoshua.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 11:22] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-02-06 6489704] "RtkOSD"="c:\program files (x86)\Realtek\Audio\OSD\RtVOsd64.exe" [2010-01-13 995840] "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-01-18 451072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-04-22 172032] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] . ——- Supplementary Scan ——- . uStart Page = my.daemon-search.com uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\ooxr6vxk.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.mydtzone.com/startpage FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4d7c893d&v=6.011.025.001&i=26&tp=ab&iy=&ychte=us&lng=en-US&q= . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe AddRemove-Final Fantasy VII - c:\program files (x86)\Square Soft AddRemove-{08DB3902-2CE0-474D-BCE3-0177766CE9F1} - c:\program files (x86)\InstallShield Installation Information\{08DB3902-2CE0-474D-BCE3-0177766CE9F1}\setup.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1913400786-887883318-3225438093-1000\Software\SecuROM\License information*] "datasecu"=hex:33,3b,28,f5,81,e1,16,c6,01,1d,cd,b5,10,1c,33,00,ae,5a,5e,c1,d0, 90,70,a2,2e,37,04,ad,10,22,68,48,d3,70,2d,60,29,11,0f,5a,00,2d,bb,db,38,0f,\ "rkeysecu"=hex:37,56,83,d6,ff,0d,77,ec,21,b3,9b,7d,bb,45,09,08 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-04-17 22:36:11 ComboFix-quarantined-files.txt 2011-04-18 02:36 ComboFix2.txt 2011-02-27 01:32 . Pre-Run: 57,892,728,832 bytes free Post-Run: 57,913,319,424 bytes free . - - End Of File - - F0274CDD5726B1043E4FF80A8C85B5FE
Post #6
Alyaz,

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Folder::
c:\program files (x86)\McAfee Security Scan

Driver::
McComponentHostService
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #7
ComboFix 11-04-16.03 - Joshua 04/18/2011 1:12.4.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3003.1402 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Joshua\Desktop\CFScript.txt SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\McAfee Security Scan c:\program files (x86)\McAfee Security Scan\2.0.181\AVScanComponent.dll c:\program files (x86)\McAfee Security Scan\2.0.181\AVScanner.ini c:\program files (x86)\McAfee Security Scan\2.0.181\avvclean.dat c:\program files (x86)\McAfee Security Scan\2.0.181\avvnames.dat c:\program files (x86)\McAfee Security Scan\2.0.181\avvscan.dat c:\program files (x86)\McAfee Security Scan\2.0.181\config.dat c:\program files (x86)\McAfee Security Scan\2.0.181\ftconfig.ini c:\program files (x86)\McAfee Security Scan\2.0.181\McAfee.ico c:\program files (x86)\McAfee Security Scan\2.0.181\mcbrwsr2.dll c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe c:\program files (x86)\McAfee Security Scan\2.0.181\MCCompHostConfig.ini c:\program files (x86)\McAfee Security Scan\2.0.181\mcscan32.dll c:\program files (x86)\McAfee Security Scan\2.0.181\mcuicnt.exe c:\program files (x86)\McAfee Security Scan\2.0.181\McUpdater.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sa_cache_sqlite.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sa_http_win32.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sa_mbl.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sa_store_sqlite.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sacore.db c:\program files (x86)\McAfee Security Scan\2.0.181\sacore.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sacoredata\uds_filetypes.txt c:\program files (x86)\McAfee Security Scan\2.0.181\sacoredata\uds_hosting.txt c:\program files (x86)\McAfee Security Scan\2.0.181\sacoredata\uds_tlds.txt c:\program files (x86)\McAfee Security Scan\2.0.181\SecurityScanner.dll c:\program files (x86)\McAfee Security Scan\2.0.181\SecurityScanner_LD.dll c:\program files (x86)\McAfee Security Scan\2.0.181\sqlite3.dll c:\program files (x86)\McAfee Security Scan\2.0.181\SSCustom_LD.dll c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe c:\program files (x86)\McAfee Security Scan\2.0.181\WebInfoScanner.dll c:\program files (x86)\McAfee Security Scan\2.0.181\WMIScanner.dll c:\program files (x86)\McAfee Security Scan\uninstall.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . ——-\Service_McComponentHostService . . ((((((((((((((((((((((((( Files Created from 2011-03-18 to 2011-04-18 ))))))))))))))))))))))))))))))) . . 2011-04-18 05:18 . 2011-04-18 05:18 ——– d—–w- c:\users\Public\AppData\Local\temp 2011-04-18 05:18 . 2011-04-18 05:18 ——– d—–w- c:\users\postgres\AppData\Local\temp 2011-04-18 05:18 . 2011-04-18 05:18 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-04-18 00:53 . 2011-04-18 00:53 ——– d—–w- c:\windows\SysWow64\drivers\AVG 2011-04-18 00:07 . 2011-04-18 00:07 ——– d—–w- C:\found.000 2011-04-15 00:00 . 2009-11-08 06:41 1490656 —-a-w- c:\windows\system32\wdfcoinstaller01007.dll 2011-04-15 00:00 . 2011-04-15 00:00 ——– d—–w- c:\program files (x86)\PdaNet for Android 2011-04-15 00:00 . 2010-09-02 21:49 15360 —-a-w- c:\windows\system32\drivers\pneteth.sys 2011-04-15 00:00 . 2010-08-06 17:22 19456 —-a-w- c:\windows\system32\drivers\lgandbus64.sys 2011-04-15 00:00 . 2009-11-14 04:05 36256 —-a-w- c:\windows\system32\drivers\androidusb.sys 2011-04-12 19:53 . 2011-04-12 19:53 ——– d—–w- c:\users\Joshua\AppData\Local\Microsoft Help 2011-04-11 02:11 . 2011-04-11 02:11 ——– d—–w- c:\users\Joshua\AppData\Local\{FEE0C1EA-0ACF-4C32-A4F4-2471CF196AAD} 2011-04-08 00:33 . 2011-04-08 00:33 ——– d—–w- c:\program files (x86)\Bethesda Softworks 2011-04-04 21:38 . 2011-04-04 21:38 254528 —-a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2011-04-04 21:37 . 2011-04-04 21:38 ——– d—–w- c:\program files (x86)\DAEMON Tools Toolbar 2011-04-04 21:37 . 2011-04-04 21:39 ——– d—–w- c:\program files (x86)\DAEMON Tools Lite 2011-04-04 02:39 . 2011-04-04 02:39 ——– d—–w- c:\program files (x86)\MSXML 4.0 2011-04-02 01:01 . 2011-04-02 01:01 ——– d—–w- c:\users\Joshua\AppData\Local\{242139E3-CF4A-44E6-AEB7-C94A2FCE3078} 2011-04-02 01:00 . 2011-04-02 01:00 ——– d—–w- c:\users\Joshua\AppData\Local\{91026747-3BFE-4411-B07F-D56EC082C6A3} 2011-04-01 03:12 . 2011-04-01 03:12 ——– d—–w- c:\users\Joshua\AppData\Local\{5D934132-8015-4525-9720-F380237387A0} 2011-04-01 00:04 . 2011-04-01 00:13 ——– d—–w- c:\users\Joshua\AppData\Roaming\Hoyle FaceCreator 2011-04-01 00:04 . 2011-04-02 00:17 ——– d—–w- c:\users\Joshua\AppData\Roaming\Hoyle 2011-04-01 00:01 . 2011-04-01 00:01 ——– d—–w- c:\program files (x86)\Encore 2011-03-30 20:23 . 2011-03-30 20:23 ——– d—–w- c:\program files (x86)\Microsoft Games 2011-03-30 03:20 . 2011-03-30 03:20 ——– d—–w- c:\program files (x86)\Governor of Poker 2011-03-30 03:20 . 2011-03-30 03:20 ——– d—–w- c:\windows\Governor of Poker 2011-03-29 18:57 . 2011-03-29 18:57 ——– d—–w- c:\users\Joshua\AppData\Roaming\Leadertech 2011-03-29 18:57 . 2002-02-27 22:50 197120 —-a-w- c:\windows\patchw32.dll 2011-03-29 18:57 . 2011-03-29 18:57 ——– d—–w- c:\program files (x86)\Common Files\PocketSoft 2011-03-29 18:54 . 2011-03-29 18:54 ——– d—–w- c:\program files (x86)\Atari 2011-03-29 18:53 . 2011-03-29 18:53 282756 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll 2011-03-29 18:53 . 2011-03-29 18:53 163972 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll 2011-03-29 18:53 . 2002-12-05 18:12 692224 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll 2011-03-29 18:53 . 2002-12-05 18:10 155648 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll 2011-03-29 18:53 . 2002-12-02 19:22 5632 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe 2011-03-29 18:53 . 2002-12-02 17:33 57344 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll 2011-03-29 18:53 . 2002-12-02 17:33 237568 —-a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll 2011-03-29 15:52 . 2011-04-15 22:33 ——– d—–w- c:\users\Joshua\Calibre Library 2011-03-29 15:52 . 2011-04-06 03:38 ——– d—–w- c:\users\Joshua\AppData\Roaming\calibre 2011-03-24 12:10 . 2011-03-24 12:11 ——– d—–w- c:\program files (x86)\Calibre2 2011-03-24 10:44 . 2011-03-18 17:53 142296 —-a-w- c:\program files (x86)\Mozilla Firefox\components\browsercomps.dll 2011-03-24 10:44 . 2011-03-18 17:53 781272 —-a-w- c:\program files (x86)\Mozilla Firefox\mozsqlite3.dll 2011-03-24 10:44 . 2011-03-18 17:53 1874904 —-a-w- c:\program files (x86)\Mozilla Firefox\mozjs.dll 2011-03-24 10:44 . 2011-03-18 17:53 15832 —-a-w- c:\program files (x86)\Mozilla Firefox\mozalloc.dll 2011-03-24 10:44 . 2011-03-18 17:53 728024 —-a-w- c:\program files (x86)\Mozilla Firefox\libGLESv2.dll 2011-03-24 10:44 . 2011-03-18 17:53 142296 —-a-w- c:\program files (x86)\Mozilla Firefox\libEGL.dll 2011-03-24 10:44 . 2011-03-18 17:53 1893336 —-a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_42.dll 2011-03-24 10:44 . 2011-03-18 17:53 1975768 —-a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_42.dll 2011-03-22 22:08 . 2011-03-22 22:08 ——– d—–w- c:\program files\iPod 2011-03-22 22:08 . 2011-03-22 22:08 ——– d—–w- c:\program files\iTunes 2011-03-22 22:08 . 2011-03-22 22:08 ——– d—–w- c:\program files (x86)\iTunes 2011-03-22 22:07 . 2011-04-15 19:27 ——– d—–w- c:\users\Joshua\AppData\Local\Apple Computer 2011-03-22 22:04 . 2011-03-22 22:04 ——– d—–w- c:\program files\Bonjour 2011-03-22 22:04 . 2011-03-22 22:04 ——– d—–w- c:\program files (x86)\Bonjour 2011-03-21 02:07 . 2011-03-21 02:07 ——– d–h–r- c:\users\Joshua\AppData\Roaming\SecuROM 2011-03-21 02:03 . 2011-03-21 02:03 ——– d—–w- c:\windows\SysWow64\xlive 2011-03-21 02:03 . 2011-03-21 02:03 ——– d—–w- c:\program files (x86)\Microsoft Games for Windows - LIVE 2011-03-21 01:33 . 2011-04-18 00:51 ——– d—–w- c:\program files (x86)\Rockstar Games . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-09 15:49 . 2010-06-24 15:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-02-19 06:37 . 2011-03-09 04:57 1135104 —-a-w- c:\windows\system32\FntCache.dll 2011-02-19 06:37 . 2011-03-09 04:57 1540608 —-a-w- c:\windows\system32\DWrite.dll 2011-02-19 06:36 . 2011-03-09 04:57 902656 —-a-w- c:\windows\system32\d2d1.dll 2011-02-19 05:32 . 2011-03-09 04:57 1074176 —-a-w- c:\windows\SysWow64\DWrite.dll 2011-02-19 05:32 . 2011-03-09 04:57 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2011-02-11 07:30 . 2011-03-11 10:02 7947600 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E7390F48-6E87-4061-9D0C-82E4066DA2F4}\mpengine.dll 2011-02-06 01:56 . 2011-02-06 01:57 2048104 —-a-w- c:\windows\system32\RtPgEx64.dll 2011-02-06 01:56 . 2011-02-06 01:57 1146984 —-a-w- c:\windows\system32\RTSnMg64.cpl 2011-02-06 01:56 . 2011-02-06 01:57 332392 —-a-w- c:\windows\system32\RtlCPAPI64.dll 2011-02-06 01:56 . 2011-02-06 01:57 2494056 —-a-w- c:\windows\system32\drivers\RTKVHD64.sys 2011-02-06 01:56 . 2011-02-06 01:57 80488 —-a-w- c:\windows\system32\RCoInst64.dll 2011-02-06 01:56 . 2011-02-06 01:57 569960 —-a-w- c:\windows\system32\RtkApi64.dll 2011-02-06 01:56 . 2011-02-06 01:57 2625640 —-a-w- c:\windows\system32\RtkAPO64.dll 2011-02-06 01:56 . 2011-02-06 01:57 149608 —-a-w- c:\windows\system32\RtkCfg64.dll 2011-02-06 01:56 . 2011-02-06 01:57 1215592 —-a-w- c:\windows\system32\RTCOM64.dll 2011-02-06 01:56 . 2011-02-06 01:57 200800 —-a-w- c:\windows\system32\AERTAC64.dll 2011-02-06 01:56 . 2010-07-08 08:25 1251944 —-a-w- c:\windows\RtlExUpd.dll 2011-02-03 02:40 . 2010-09-02 05:04 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll 2011-02-02 22:11 . 2010-09-02 04:03 270720 ——w- c:\windows\system32\MpSigStub.exe 2011-01-26 06:53 . 2011-02-10 00:40 982912 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-01-26 06:53 . 2011-02-10 00:40 265088 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-01-26 06:31 . 2011-02-10 00:40 144384 —-a-w- c:\windows\system32\cdd.dll . . ((((((((((((((((((((((((((((( SnapShot@2011-04-18_02.11.42 ))))))))))))))))))))))))))))))))))))))))) . + 2010-09-02 06:28 . 2011-04-18 05:22 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-09-02 06:28 . 2011-04-18 00:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-09-02 06:28 . 2011-04-18 00:57 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2010-09-02 06:28 . 2011-04-18 05:22 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2010-09-02 06:28 . 2011-04-18 00:57 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-09-02 06:28 . 2011-04-18 05:22 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2010-09-02 02:26 . 2011-04-18 15:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2010-09-02 02:26 . 2011-04-18 02:11 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2010-09-02 02:26 . 2011-04-18 15:38 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2010-09-02 02:26 . 2011-04-18 02:11 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2011-04-18 00:54 . 2011-04-18 00:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-04-18 05:19 . 2011-04-18 05:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2011-04-18 05:19 . 2011-04-18 05:19 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2011-04-18 00:54 . 2011-04-18 00:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2010-09-02 14:00 . 2011-04-18 04:29 300412 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin + 2010-09-02 03:18 . 2011-04-18 15:38 367820 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2009-07-14 02:36 . 2011-04-17 02:59 624178 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-04-18 04:31 624178 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-04-18 04:31 106522 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2011-04-17 02:59 106522 c:\windows\system32\perfc009.dat - 2009-07-14 05:01 . 2011-04-18 00:53 310812 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2011-04-18 05:18 310812 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2010-11-06 14:09 . 2011-04-18 05:18 3664816 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1913400786-887883318-3225438093-1000-8192.dat - 2010-11-06 14:09 . 2011-04-15 22:33 3664816 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1913400786-887883318-3225438093-1000-8192.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-06-16 2736128] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] . c:\users\Joshua\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ PdaNet Desktop.lnk - c:\program files (x86)\PdaNet for Android\PdaNetPC.exe [2011-4-14 477736] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [N/A] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-02 136176] R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [x] R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 uts_bus;UTStarcom USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\uts_bus.sys [x] R3 uts_mdfl;UTStarcom USB Modem Filter;c:\windows\system32\DRIVERS\uts_mdfl.sys [x] R3 uts_mdm;UTStarcom USB Modem Drivers;c:\windows\system32\DRIVERS\uts_mdm.sys [x] R3 uts_serd;UTStarcom USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\uts_serd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-02-04 92216] S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-01-18 20480] S2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [2009-12-10 65536] S2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392] S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x] S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-06-16 17:38 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-02 05:28] . 2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-02 05:28] . 2011-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1913400786-887883318-3225438093-1000Core.job - c:\users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-09 21:44] . 2011-04-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1913400786-887883318-3225438093-1000UA.job - c:\users\Joshua\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-09 21:44] . 2011-04-18 c:\windows\Tasks\HPCeeScheduleForJoshua.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 11:22] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "combofix"="c:\combofix\CF3791.cfxxe" [X] "SynTPEnh"="%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe" [BU] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-02-06 6489704] "RtkOSD"="c:\program files (x86)\Realtek\Audio\OSD\RtVOsd64.exe" [2010-01-13 995840] "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-01-18 451072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-04-22 172032] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] . ——- Supplementary Scan ——- . uStart Page = my.daemon-search.com uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\users\Joshua\AppData\Roaming\Mozilla\Firefox\Profiles\ooxr6vxk.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.mydtzone.com/startpage FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4d7c893d&v=6.011.025.001&i=26&tp=ab&iy=&ychte=us&lng=en-US&q= . - - - - ORPHANS REMOVED - - - - . Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) AddRemove-McAfee Security Scan - c:\program files (x86)\McAfee Security Scan\uninstall.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1913400786-887883318-3225438093-1000\Software\SecuROM\License information*] "datasecu"=hex:33,3b,28,f5,81,e1,16,c6,01,1d,cd,b5,10,1c,33,00,ae,5a,5e,c1,d0, 90,70,a2,2e,37,04,ad,10,22,68,48,d3,70,2d,60,29,11,0f,5a,00,2d,bb,db,38,0f,\ "rkeysecu"=hex:37,56,83,d6,ff,0d,77,ec,21,b3,9b,7d,bb,45,09,08 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Bonjour\mDNSResponder.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\CyberLink\Shared files\RichVideo.exe c:\program files (x86)\PostgreSQL\8.3\bin\postgres.exe c:\program files (x86)\PostgreSQL\8.3\bin\postgres.exe c:\program files (x86)\PostgreSQL\8.3\bin\postgres.exe c:\program files (x86)\PostgreSQL\8.3\bin\postgres.exe c:\program files (x86)\PostgreSQL\8.3\bin\postgres.exe c:\program files (x86)\PostgreSQL\8.3\bin\postgres.exe c:\windows\SysWOW64\DllHost.exe . ************************************************************************** . Completion time: 2011-04-18 11:42:13 - machine was rebooted ComboFix-quarantined-files.txt 2011-04-18 15:42 ComboFix2.txt 2011-04-18 02:36 ComboFix3.txt 2011-02-27 01:32 . Pre-Run: 57,944,932,352 bytes free Post-Run: 57,213,435,904 bytes free . - - End Of File - - D4FD94F605D85EF46DB311AB632E0D46
Post #8
Alyaz,

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #11
ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=c2e741f34cfbb94c97f7983fe36393c0 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-04-18 07:40:13 # local_time=2011-04-18 03:40:13 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=1024 16777215 100 0 2229207 2229207 0 0 # compatibility_mode=5893 16776574 100 94 0 54699011 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=1089 # found=0 # cleaned=0 # scan_time=53 ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=53251 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=c2e741f34cfbb94c97f7983fe36393c0 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-04-19 03:58:58 # local_time=2011-04-18 11:58:58 (-0500, Eastern Daylight Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=1024 16777215 100 0 2257273 2257273 0 0 # compatibility_mode=5893 16776574 100 94 0 54727077 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=99265 # found=0 # cleaned=0 # scan_time=1911
Post #12
Alyaz,

I don't think this is a malware problem… but I don't know what it is. I suggest that you will be better served in the Windows Forum. Maybe the Tech Team can find the problem. When you post there, please include a link back to this thread so they can see what you've posted here.

But first we need to straighten up a bit.

Time for some housekeeping
  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved (at least as far as malware goes). :thumbup:
Post #13
Thank you so much for all of your help. At least I can be sure it's not malware related, and that's a big sigh of relief (maybe? we'll see!) You were awesome.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI