What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

A pop-up on my laptop that always shows up when i start my laptop or r

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I have a problem similar to this post by another member (http://forums.whatthetech.com/index.php?showtopic=120114&st=0). But i was wondering how do i apply the solution to my laptop because some of the file names and stuff are different. Thanks, adaptable
Post #2
Hello adaptable and :welcome:
I'm RedCar92 and my name is Bill, I'll be glad to help you with your computer problems.

  • Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear. Malware removal can be stressful but we will clean it.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperative and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
Post #4
Oh yeah. The popup keep showing up every time after i click the 'close' button. It only stops when i end the mshta.exe process but when i restart my laptop or when i turn it on another time, the popup shows up again.
Post #5
Greetings adaptable,
Let's do this first please,

  • Please download aswMBR to your desktop.
  • Double click the aswMBR.exe icon to run it
  • If asked, accept the AVAST virus definitions.
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Next
Please download DDS from LINK 1 or LINK 2
and save it to your desktop.

Vista and Windows 7 users:
  • These tools MUST be run from the executable. (.exe) every time you run them
  • With Admin Rights (Right click, choose "Run as Administrator")


XP users
Double click dds.scr to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.
Please include the contents of the following in your reply using Copy / Paste:
DDS.txt & Attach.txt

logs to post: Please Note: (When posting logs please use copy/paste method. Only attach files when requested)
  • aswmbr.txt
  • dds.txt
  • attach.txt
Post #6
I have followed the instructions and these are the results. aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-12 02:27:08 —————————– 02:27:08.151 OS Version: Windows 6.1.7601 Service Pack 1 02:27:08.151 Number of processors: 4 586 0x2502 02:27:08.152 ComputerName: JUSTIN-THINK UserName: Justin 02:27:36.360 Initialize success 02:29:06.657 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 02:29:06.664 Disk 0 Vendor: HITACHI_ PC4Z Size: 476940MB BusType: 3 02:29:06.670 Disk 0 MBR read successfully 02:29:06.674 Disk 0 MBR scan 02:29:06.678 Disk 0 unknown MBR code 02:29:06.685 Disk 0 scanning sectors +976771120 02:29:06.761 Disk 0 scanning C:\Windows\system32\drivers 02:29:13.272 Service scanning 02:29:14.197 Service MpKsl8c57dd4a c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0A8F5618-2D4E-4341-B5E6-DE3C685BB589}\MpKsl8c57dd4a.sys **LOCKED** 32 02:29:14.213 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 02:29:15.050 Modules scanning 02:29:26.698 Disk 0 trace - called modules: 02:29:26.724 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys 02:29:26.733 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8825b030] 02:29:26.744 3 CLASSPNP.SYS[8bc0459e] -> nt!IofCallDriver -> [0x866e3850] 02:29:26.760 5 ACPI.sys[8b69d3d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86748028] 02:29:26.777 Scan finished successfully 02:29:43.313 Disk 0 MBR has been saved successfully to "C:\Users\Justin\Desktop\MBR.dat" 02:29:43.319 The log file has been saved successfully to "C:\Users\Justin\Desktop\aswMBR.txt" . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 2:30:36 on 2011-10-12 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.65.1033.18.3060.1708 [GMT 8:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\ibmpmsvc.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\WUDFHost.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k WbioSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\LENOVO\HOTKEY\CAMMUTE.exe C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Lenovo\Access Connections\AcSvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskhost.exe C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe C:\Windows\Explorer.EXE c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Integrated Camera Driver\RCIMGDIR.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Windows\System32\TpShocks.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Windows\System32\rundll32.exe C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Users\Justin\Documents\For Movies\Funshion\Funshion.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Justin\Documents\Daemon Lite\DAEMON Tools Lite\DTLite.exe C:\Program Files\Steam\Steam.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Steam\SteamService.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Justin\Documents\For Movies\Funshion\FunshionService.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\taskeng.exe C:\Program Files\Lenovo\Client Security Solution\cssauth.exe C:\Windows\system32\DllHost.exe C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe C:\Windows\system32\svchost.exe -k HsfXAudioService C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\Program Files\Lenovo\System Update\SUService.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\Macromed\Flash\FlashUtil10v_ActiveX.exe C:\Users\Justin\Desktop\aswMBR.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.facebook.com/ uDefault_Page_URL = hxxp://lenovo.msn.com uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll mURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll BHO: IePasswordManagerHelper Class: {bf468356-bb7e-42d7-9f15-4f3b9bcfced2} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll BHO: C7F8562B-9B0E-7BB7-490C-BDEBD98975CF Class: {c7f8562b-9b0e-7bb7-490c-bdebd98975cf} - c:\users\justin\documents\funshionaddr\funshionAddr.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: @c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Google Update] "c:\users\justin\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [DAEMON Tools Lite] "c:\users\justin\documents\daemon lite\daemon tools lite\DTLite.exe" -autorun uRun: [Steam] "c:\program files\steam\steam.exe" -silent uRun: [webcsdat] mshta "c:\programdata\csdat\4XV74876.hta" mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun: [IMSS] "c:\program files\intel\intel® management engine components\imss\PIconStartup.exe" mRun: [RotateImage] c:\program files\integrated camera driver\RCIMGDIR.exe mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe mRun: [] mRun: [TpShocks] TpShocks.exe mRun: [PSQLLauncher] "c:\program files\thinkvantage fingerprint software\launcher.exe" /startup mRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /t mRun: [nwiz] nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start mRun: [AcWin7Hlpr] c:\program files\lenovo\access connections\AcTBenabler.exe mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Funshion] c:\users\justin\documents\for movies\funshion\Funshion.exe startbywindows tray mRun: [Freecorder FLV Service] "c:\program files\youtube download\FLVSrvc.exe" /run StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: DisableCAD = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL IE: {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{24580380-D0B2-4485-B1BC-3D34935FCD45} : DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{2F17B39A-EC0E-4E0D-9EA5-171CBAA78389} : DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{2F17B39A-EC0E-4E0D-9EA5-171CBAA78389}\2375942554137383 : DhcpNameServer = 192.168.1.254 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: psfus - c:\program files\thinkvantage fingerprint software\psqlpwd.dll LSA: Notification Packages = scecli c:\program files\thinkvantage fingerprint software\psqlpwd.dll ACGina . ============= SERVICES / DRIVERS =============== . R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2011-3-16 24304] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-10-10 20520] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-6-19 218688] R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2009-11-27 13480] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648] R1 MpKsl8c57dd4a;MpKsl8c57dd4a;c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\MpKsl8c57dd4a.sys [2011-10-11 28752] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2011-3-16 132456] R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-14 20992] R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\lenovo\hotkey\cammute.exe [2009-11-27 54632] R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-11-27 44984] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032] R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [2011-3-16 48640] R2 smihlp;SMI Helper Driver (smihlp);c:\program files\thinkvantage fingerprint software\smihlp.sys [2009-3-14 12560] R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-11-27 62904] R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\drivers\TurboB.sys [2009-9-30 13752] R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2011-3-16 2320920] R3 5U877;USB Video Device;c:\windows\system32\drivers\5U877.sys [2011-3-16 126080] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2011-3-16 29472] R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6232.sys [2011-3-16 214696] R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2011-3-16 125696] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392] R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-16 6114816] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2011-3-16 66664] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2009-10-9 38336] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-3-16 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840] S3 GarenaPEngine;GarenaPEngine;c:\users\justin\appdata\local\temp\NIE780C.tmp [2011-5-25 25616] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168] S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2011-3-16 75112] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drLS\x00\x00\x00\x00
Post #7
I have followed the instructions and these are the results. aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-12 02:27:08 —————————– 02:27:08.151 OS Version: Windows 6.1.7601 Service Pack 1 02:27:08.151 Number of processors: 4 586 0x2502 02:27:08.152 ComputerName: JUSTIN-THINK UserName: Justin 02:27:36.360 Initialize success 02:29:06.657 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 02:29:06.664 Disk 0 Vendor: HITACHI_ PC4Z Size: 476940MB BusType: 3 02:29:06.670 Disk 0 MBR read successfully 02:29:06.674 Disk 0 MBR scan 02:29:06.678 Disk 0 unknown MBR code 02:29:06.685 Disk 0 scanning sectors +976771120 02:29:06.761 Disk 0 scanning C:\Windows\system32\drivers 02:29:13.272 Service scanning 02:29:14.197 Service MpKsl8c57dd4a c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0A8F5618-2D4E-4341-B5E6-DE3C685BB589}\MpKsl8c57dd4a.sys **LOCKED** 32 02:29:14.213 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32 02:29:15.050 Modules scanning 02:29:26.698 Disk 0 trace - called modules: 02:29:26.724 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys 02:29:26.733 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8825b030] 02:29:26.744 3 CLASSPNP.SYS[8bc0459e] -> nt!IofCallDriver -> [0x866e3850] 02:29:26.760 5 ACPI.sys[8b69d3d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86748028] 02:29:26.777 Scan finished successfully 02:29:43.313 Disk 0 MBR has been saved successfully to "C:\Users\Justin\Desktop\MBR.dat" 02:29:43.319 The log file has been saved successfully to "C:\Users\Justin\Desktop\aswMBR.txt" . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 2:38:04 on 2011-10-12 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.65.1033.18.3060.1683 [GMT 8:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\ibmpmsvc.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\WUDFHost.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k WbioSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\LENOVO\HOTKEY\CAMMUTE.exe C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Lenovo\Access Connections\AcSvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskhost.exe C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe C:\Windows\Explorer.EXE c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Integrated Camera Driver\RCIMGDIR.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Windows\System32\TpShocks.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Windows\System32\rundll32.exe C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Users\Justin\Documents\For Movies\Funshion\Funshion.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Justin\Documents\Daemon Lite\DAEMON Tools Lite\DTLite.exe C:\Program Files\Steam\Steam.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Steam\SteamService.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Justin\Documents\For Movies\Funshion\FunshionService.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\taskeng.exe C:\Program Files\Lenovo\Client Security Solution\cssauth.exe C:\Windows\system32\DllHost.exe C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe C:\Windows\system32\svchost.exe -k HsfXAudioService C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\Program Files\Lenovo\System Update\SUService.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\Macromed\Flash\FlashUtil10v_ActiveX.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.facebook.com/ uDefault_Page_URL = hxxp://lenovo.msn.com uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll mURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll BHO: IePasswordManagerHelper Class: {bf468356-bb7e-42d7-9f15-4f3b9bcfced2} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll BHO: C7F8562B-9B0E-7BB7-490C-BDEBD98975CF Class: {c7f8562b-9b0e-7bb7-490c-bdebd98975cf} - c:\users\justin\documents\funshionaddr\funshionAddr.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: @c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Google Update] "c:\users\justin\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [DAEMON Tools Lite] "c:\users\justin\documents\daemon lite\daemon tools lite\DTLite.exe" -autorun uRun: [Steam] "c:\program files\steam\steam.exe" -silent uRun: [webcsdat] mshta "c:\programdata\csdat\4XV74876.hta" mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun: [IMSS] "c:\program files\intel\intel® management engine components\imss\PIconStartup.exe" mRun: [RotateImage] c:\program files\integrated camera driver\RCIMGDIR.exe mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe mRun: [] mRun: [TpShocks] TpShocks.exe mRun: [PSQLLauncher] "c:\program files\thinkvantage fingerprint software\launcher.exe" /startup mRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /t mRun: [nwiz] nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start mRun: [AcWin7Hlpr] c:\program files\lenovo\access connections\AcTBenabler.exe mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Funshion] c:\users\justin\documents\for movies\funshion\Funshion.exe startbywindows tray mRun: [Freecorder FLV Service] "c:\program files\youtube download\FLVSrvc.exe" /run StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: DisableCAD = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL IE: {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{24580380-D0B2-4485-B1BC-3D34935FCD45} : DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{2F17B39A-EC0E-4E0D-9EA5-171CBAA78389} : DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{2F17B39A-EC0E-4E0D-9EA5-171CBAA78389}\2375942554137383 : DhcpNameServer = 192.168.1.254 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: psfus - c:\program files\thinkvantage fingerprint software\psqlpwd.dll LSA: Notification Packages = scecli c:\program files\thinkvantage fingerprint software\psqlpwd.dll ACGina . ============= SERVICES / DRIVERS =============== . R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2011-3-16 24304] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-10-10 20520] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-6-19 218688] R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2009-11-27 13480] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648] R1 MpKsl8c57dd4a;MpKsl8c57dd4a;c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\MpKsl8c57dd4a.sys [2011-10-11 28752] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2011-3-16 132456] R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-14 20992] R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\lenovo\hotkey\cammute.exe [2009-11-27 54632] R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-11-27 44984] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032] R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [2011-3-16 48640] R2 smihlp;SMI Helper Driver (smihlp);c:\program files\thinkvantage fingerprint software\smihlp.sys [2009-3-14 12560] R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-11-27 62904] R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\drivers\TurboB.sys [2009-9-30 13752] R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2011-3-16 2320920] R3 5U877;USB Video Device;c:\windows\system32\drivers\5U877.sys [2011-3-16 126080] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2011-3-16 29472] R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6232.sys [2011-3-16 214696] R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2011-3-16 125696] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392] R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-16 6114816] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2011-3-16 66664] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2009-10-9 38336] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-3-16 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840] S3 GarenaPEngine;GarenaPEngine;c:\users\justin\appdata\local\temp\NIE780C.tmp [2011-5-25 25616] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168] S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2011-3-16 75112] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-7 52224] S3 TurboBoost;TurboBoost;c:\program files\intel\turboboost\TurboBoost.exe [2009-9-30 99768] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-3-17 1343400] S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040] . =============== Created Last 30 ================ . 2011-10-11 14:05:17 703824 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{61a0a96d-5a0f-4eab-8c39-946ba90c3d86}\gapaengine.dll 2011-10-11 14:05:17 28752 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\MpKsl8c57dd4a.sys 2011-10-11 14:05:10 56200 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\offreg.dll 2011-10-11 14:05:08 7269712 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\mpengine.dll 2011-10-11 13:51:32 ——– d—–w- c:\users\justin\appdata\local\{46847985-E659-47DE-AC87-01BD844F1B09} 2011-10-11 13:51:18 ——– d—–w- c:\users\justin\appdata\local\{D3CE25D8-E1DD-4AF0-BA5D-D7D62EF818FF} 2011-10-10 04:46:47 ——– d—–w- c:\users\justin\appdata\local\{14BB231A-5624-4ECF-A641-B0A8E0AE9369} 2011-10-10 04:46:35 ——– d—–w- c:\users\justin\appdata\local\{B68D367A-CAA1-43DA-9F1C-7B85C291FAE1} 2011-10-09 07:32:12 ——– d—–w- c:\users\justin\appdata\local\{3C80CB3E-3ED1-417F-895A-D3E8712F47AF} 2011-10-09 07:31:57 ——– d—–w- c:\users\justin\appdata\local\{B62BDB11-FD05-4707-B37E-8641DAC4FAB5} 2011-10-08 07:57:13 ——– d—–w- c:\programdata\csdat 2011-10-08 04:27:02 ——– d—–w- c:\users\justin\appdata\local\{54EC63D7-9167-4895-B72D-98C70AF92708} 2011-10-08 04:26:45 ——– d—–w- c:\users\justin\appdata\local\{D5DCB644-5634-49B6-A660-25CC386CBE71} 2011-10-07 15:07:47 ——– d—–w- c:\users\justin\appdata\local\{FE81841A-EB9B-4FC4-9127-4123C95F7CDD} 2011-10-07 15:07:36 ——– d—–w- c:\users\justin\appdata\local\{3B6C9879-F05F-415F-8DD9-B0A05EB1C45E} 2011-10-06 14:21:08 ——– d—–w- c:\users\justin\appdata\local\{C8AB271C-297B-4590-A5AF-D8FB71A5F2C9} 2011-10-06 14:20:52 ——– d—–w- c:\users\justin\appdata\local\{5F419388-5E89-4D32-B062-109CCDC2BA40} 2011-10-05 16:17:57 ——– d—–w- c:\users\justin\appdata\local\{7EBD3893-3948-4DA8-8886-1A90BEA8847A} 2011-10-05 16:17:46 ——– d—–w- c:\users\justin\appdata\local\{CD341D2C-7FA2-498F-8E3F-B74451649984} 2011-10-05 03:22:43 ——– d—–w- c:\users\justin\appdata\local\{7E767BBF-52E9-4725-B2FC-CAA351C36D15} 2011-10-05 03:22:32 ——– d—–w- c:\users\justin\appdata\local\{84559E61-FB55-4D90-A508-CD9AD048E72E} 2011-10-04 15:56:15 ——– d—–w- c:\users\justin\appdata\local\{CF44C03B-721F-4AD0-95E4-85AB00CBA23A} 2011-10-04 15:56:03 ——– d—–w- c:\users\justin\appdata\local\{35355021-6A5C-4244-93C1-F5E5BAD66C37} 2011-10-03 03:59:42 ——– d—–w- c:\users\justin\appdata\local\{66FCC901-28B1-4D1C-943C-ABCFE39B8772} 2011-10-03 03:59:30 ——– d—–w- c:\users\justin\appdata\local\{05C6FFF8-0690-421C-AB08-060007ABF9E8} 2011-10-02 01:37:42 ——– d—–w- c:\users\justin\appdata\local\{C38E424A-48C0-4BE5-992F-23A7ED54C38D} 2011-10-02 01:37:29 ——– d—–w- c:\users\justin\appdata\local\{CBD7293A-2841-4CD2-A6A1-E83359C8E71C} 2011-10-01 03:14:14 ——– d—–w- c:\users\justin\appdata\local\{4118771E-8383-4257-A9A3-477C3BAF2DDE} 2011-10-01 03:14:03 ——– d—–w- c:\users\justin\appdata\local\{D2EB7CCE-C1E2-4953-91D1-388F73EC864D} 2011-09-30 06:16:45 ——– d—–w- c:\users\justin\appdata\local\{FE52C76D-81B6-4EF7-B0E0-40A7C09FE92C} 2011-09-30 06:16:31 ——– d—–w- c:\users\justin\appdata\local\{DC124C79-B296-4126-9368-580667666975} 2011-09-30 06:16:01 ——– d—–w- c:\users\justin\appdata\local\{C55BA840-FD7C-4002-A4B6-AA5DCF7FE605} 2011-09-30 06:15:46 ——– d—–w- c:\users\justin\appdata\local\{73C82787-903C-447A-B75C-1C3AE487D45C} 2011-09-30 02:01:56 ——– d—–w- c:\programdata\Premium 2011-09-30 02:01:55 ——– d—–w- c:\programdata\InstallMate 2011-09-30 01:07:40 ——– d—–w- c:\users\justin\appdata\local\{DD231359-63FD-42E0-B90A-9E37AEB1AFE9} 2011-09-29 01:35:04 ——– d—–w- c:\users\justin\appdata\local\{2BE79B16-43B2-47B7-B726-49CE904B55B8} 2011-09-29 01:34:50 ——– d—–w- c:\users\justin\appdata\local\{8D094517-C219-4875-A3A3-ACE4161BBDD1} 2011-09-28 04:17:20 ——– d—–w- c:\users\justin\appdata\local\{405C2725-3E1C-4188-844A-47A13BA3F748} 2011-09-28 04:17:06 ——– d—–w- c:\users\justin\appdata\local\{50958852-522A-41D0-B14C-E3B64B8BC2D4} 2011-09-27 11:41:29 ——– d—–w- c:\users\justin\appdata\local\{6AE129B5-F65C-4FE7-8D8F-24FB5F546A37} 2011-09-27 11:41:18 ——– d—–w- c:\users\justin\appdata\local\{01C95C44-572B-443F-B321-7081D201E9C6} 2011-09-26 01:06:06 ——– d—–w- c:\users\justin\appdata\local\{4497D6CE-9A33-4A61-8CC3-387319F9D5CA} 2011-09-26 01:05:54 ——– d—–w- c:\users\justin\appdata\local\{8430DA9C-31AF-4ECB-BC22-A4B5932931CC} 2011-09-25 08:16:53 ——– d—–w- c:\users\justin\appdata\local\Darksiders 2011-09-25 08:11:03 ——– d–h–w- c:\windows\msdownld.tmp 2011-09-25 07:54:39 ——– d—–w- c:\program files\Darksiders 2011-09-25 07:49:38 ——– d—–w- c:\users\justin\appdata\local\{EFEFC664-7FF1-4B31-BCC1-D6CEC2AC2997} 2011-09-25 07:49:25 ——– d—–w- c:\users\justin\appdata\local\{A9A82F0D-5CE1-44DC-88E2-A8D79C83D03F} 2011-09-24 06:13:28 ——– d—–w- c:\windows\system32\directx 2011-09-24 05:00:42 ——– d—–w- c:\users\justin\appdata\local\{C002449E-65A6-45D0-B206-FA04CC2716A2} 2011-09-24 05:00:25 ——– d—–w- c:\users\justin\appdata\local\{7A0A384C-D6DB-4DC1-BFAE-C8B8BC34D9E7} 2011-09-24 04:48:50 ——– d—–w- c:\users\justin\appdata\local\{64610D3D-264C-48D4-90D6-B9BD159FD661} 2011-09-24 04:38:07 ——– d—–w- c:\users\justin\appdata\local\{E736B413-15D6-4AB9-9B72-CC5B4A9A37DC} 2011-09-24 02:52:01 ——– d—–w- c:\users\justin\appdata\local\{BACCE5B3-C573-4E50-B879-28F71B80F706} 2011-09-23 13:48:45 ——– d—–w- c:\users\justin\appdata\local\{3046B5CE-CF20-4B9E-AC7E-C8ACA3B8EA36} 2011-09-23 13:48:34 ——– d—–w- c:\users\justin\appdata\local\{2343F0AE-A1B6-4FF5-A77F-E3BE3655FED3} 2011-09-22 02:08:21 ——– d—–w- c:\users\justin\appdata\local\{4195EC92-CAE8-4904-AB8E-AF5B30B9FBC9} 2011-09-22 02:08:06 ——– d—–w- c:\users\justin\appdata\local\{26F5DBCF-853E-4934-9177-987C22D459D1} 2011-09-21 02:03:04 ——– d—–w- c:\users\justin\appdata\local\{71AD6843-99F0-48CF-960C-7BFC9FFD837C} 2011-09-21 02:02:42 ——– d—–w- c:\users\justin\appdata\local\{8B9752EC-CC2A-456C-8B8A-057B58AF4A1F} 2011-09-20 14:02:15 ——– d—–w- c:\users\justin\appdata\local\{CEA19C44-BB3D-4C8F-A3DA-0335A3DA24E8} 2011-09-20 14:02:01 ——– d—–w- c:\users\justin\appdata\local\{D1C8984C-721B-44C4-BA6F-7589EC02F3A8} 2011-09-19 12:10:25 ——– d—–w- c:\users\justin\appdata\local\{BD3C2FDA-5848-4A18-B1FB-E11FCAFC679E} 2011-09-19 12:10:13 ——– d—–w- c:\users\justin\appdata\local\{D5D66466-03D9-4566-A66B-0B9496C54286} 2011-09-18 07:39:06 ——– d—–w- c:\users\justin\appdata\local\{D6D0F295-00E4-4013-B7BE-5331F6312987} 2011-09-18 07:38:54 ——– d—–w- c:\users\justin\appdata\local\{D2F80487-68E3-4031-8DA7-AFC0DAA38B57} 2011-09-17 02:55:59 ——– d—–w- c:\users\justin\appdata\local\{05D2B17A-AF14-4A0A-BF3C-B01BA9553EE5} 2011-09-16 14:49:04 ——– d—–w- c:\users\justin\appdata\local\{9E747C20-4EBA-4D42-B5ED-FA22813B0707} 2011-09-16 14:48:52 ——– d—–w- c:\users\justin\appdata\local\{59A71FB1-8C79-45D5-9C62-B1BD13A8F6BB} 2011-09-15 02:31:07 ——– d—–w- c:\users\justin\appdata\local\{34B922A3-B4B4-4CA1-ACB0-DAD3F88664D3} 2011-09-15 02:30:55 ——– d—–w- c:\users\justin\appdata\local\{E76A48C3-3183-4154-95CD-854DCBEEC439} 2011-09-14 02:50:30 ——– d—–w- c:\users\justin\appdata\local\{948EA166-99B5-461A-A867-5368DDA8FAD9} 2011-09-14 02:50:18 ——– d—–w- c:\users\justin\appdata\local\{DAE6E64E-962D-4591-AE0D-EADA0A39018F} 2011-09-13 14:43:41 ——– d—–w- c:\users\justin\appdata\local\{8FC340C1-442A-4B36-8264-F2E5C1CFAA2A} 2011-09-13 14:43:27 ——– d—–w- c:\users\justin\appdata\local\{389C50FE-1CA0-459C-B5FD-622167085024} 2011-09-12 13:02:42 ——– d—–w- c:\users\justin\appdata\local\{FD0716BA-F49F-433C-B305-801EAD87821B} 2011-09-12 13:02:28 ——– d—–w- c:\users\justin\appdata\local\{583F8228-DA6B-4555-9AC0-3DD9505E745A} . ==================== Find3M ==================== . 2011-10-01 03:17:02 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-08-18 04:09:34 516096 —-a-w- c:\windows\system32\Funshion.scr 2011-07-22 02:54:43 1797632 —-a-w- c:\windows\system32\jscript9.dll 2011-07-22 02:48:26 1126912 —-a-w- c:\windows\system32\wininet.dll 2011-07-22 02:44:36 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2011-07-16 04:27:30 290816 —-a-w- c:\windows\system32\KernelBase.dll 2011-07-16 02:17:19 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2011-07-16 02:17:19 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2011-07-16 02:17:19 3584 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2011-07-16 02:17:19 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll . ============= FINISH: 2:38:17.26 =============== . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 2:38:04 on 2011-10-12 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.65.1033.18.3060.1683 [GMT 8:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\ibmpmsvc.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\WUDFHost.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k WbioSvcGroup C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Program Files\LENOVO\HOTKEY\CAMMUTE.exe C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Lenovo\Access Connections\AcSvc.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskhost.exe C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe C:\Windows\Explorer.EXE c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Integrated Camera Driver\RCIMGDIR.exe C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe C:\Windows\System32\TpShocks.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\Zoom\TpScrex.exe C:\Windows\System32\rundll32.exe C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Users\Justin\Documents\For Movies\Funshion\Funshion.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Lenovo\Access Connections\SvcGuiHlpr.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Justin\Documents\Daemon Lite\DAEMON Tools Lite\DTLite.exe C:\Program Files\Steam\Steam.exe C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Steam\SteamService.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Justin\Documents\For Movies\Funshion\FunshionService.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\taskeng.exe C:\Program Files\Lenovo\Client Security Solution\cssauth.exe C:\Windows\system32\DllHost.exe C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe C:\Windows\system32\svchost.exe -k HsfXAudioService C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\Program Files\Lenovo\System Update\SUService.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe C:\Users\Justin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\Macromed\Flash\FlashUtil10v_ActiveX.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.facebook.com/ uDefault_Page_URL = hxxp://lenovo.msn.com uURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll mURLSearchHooks: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll BHO: IePasswordManagerHelper Class: {bf468356-bb7e-42d7-9f15-4f3b9bcfced2} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll BHO: C7F8562B-9B0E-7BB7-490C-BDEBD98975CF Class: {c7f8562b-9b0e-7bb7-490c-bdebd98975cf} - c:\users\justin\documents\funshionaddr\funshionAddr.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: @c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2322.0\npwinext.dll TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\prxtbFree.dll TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [Google Update] "c:\users\justin\appdata\local\google\update\GoogleUpdate.exe" /c uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [DAEMON Tools Lite] "c:\users\justin\documents\daemon lite\daemon tools lite\DTLite.exe" -autorun uRun: [Steam] "c:\program files\steam\steam.exe" -silent uRun: [webcsdat] mshta "c:\programdata\csdat\4XV74876.hta" mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe mRun: [IMSS] "c:\program files\intel\intel® management engine components\imss\PIconStartup.exe" mRun: [RotateImage] c:\program files\integrated camera driver\RCIMGDIR.exe mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe mRun: [] mRun: [TpShocks] TpShocks.exe mRun: [PSQLLauncher] "c:\program files\thinkvantage fingerprint software\launcher.exe" /startup mRun: [SmartAudio] c:\program files\conexant\saii\SAIICpl.exe /t mRun: [nwiz] nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [PWMTRV] rundll32 c:\progra~1\thinkpad\utilit~1\PWMTR32V.DLL,PwrMgrBkGndMonitor mRun: [Message Center Plus] c:\program files\lenovo\message center plus\MCPLaunch.exe /start mRun: [AcWin7Hlpr] c:\program files\lenovo\access connections\AcTBenabler.exe mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Funshion] c:\users\justin\documents\for movies\funshion\Funshion.exe startbywindows tray mRun: [Freecorder FLV Service] "c:\program files\youtube download\FLVSrvc.exe" /run StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\thinkpad\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: DisableCAD = 1 (0x1) IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL IE: {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} - c:\program files\lenovo\client security solution\tvtpwm_ie_com.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{24580380-D0B2-4485-B1BC-3D34935FCD45} : DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{2F17B39A-EC0E-4E0D-9EA5-171CBAA78389} : DhcpNameServer = [removed] [removed] [removed] TCP: Interfaces\{2F17B39A-EC0E-4E0D-9EA5-171CBAA78389}\2375942554137383 : DhcpNameServer = 192.168.1.254 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll Notify: psfus - c:\program files\thinkvantage fingerprint software\psqlpwd.dll LSA: Notification Packages = scecli c:\program files\thinkvantage fingerprint software\psqlpwd.dll ACGina . ============= SERVICES / DRIVERS =============== . R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2011-3-16 24304] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2009-10-10 20520] R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-6-19 218688] R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2009-11-27 13480] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648] R1 MpKsl8c57dd4a;MpKsl8c57dd4a;c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\MpKsl8c57dd4a.sys [2011-10-11 28752] R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128] R2 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2011-3-16 132456] R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-14 20992] R2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\lenovo\hotkey\cammute.exe [2009-11-27 54632] R2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-11-27 44984] R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032] R2 rimspci;rimspci;c:\windows\system32\drivers\rimspe86.sys [2011-3-16 48640] R2 smihlp;SMI Helper Driver (smihlp);c:\program files\thinkvantage fingerprint software\smihlp.sys [2009-3-14 12560] R2 TPHKSVC;On Screen Display;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-11-27 62904] R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\drivers\TurboB.sys [2009-9-30 13752] R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2011-3-16 2320920] R3 5U877;USB Video Device;c:\windows\system32\drivers\5U877.sys [2011-3-16 126080] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2011-3-16 29472] R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6232.sys [2011-3-16 214696] R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2011-3-16 125696] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392] R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-16 6114816] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2011-3-16 66664] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2009-10-9 38336] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888] S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-3-16 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840] S3 GarenaPEngine;GarenaPEngine;c:\users\justin\appdata\local\temp\NIE780C.tmp [2011-5-25 25616] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168] S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2011-3-16 75112] S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360] S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992] S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-7 52224] S3 TurboBoost;TurboBoost;c:\program files\intel\turboboost\TurboBoost.exe [2009-9-30 99768] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-3-17 1343400] S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040] . =============== Created Last 30 ================ . 2011-10-11 14:05:17 703824 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{61a0a96d-5a0f-4eab-8c39-946ba90c3d86}\gapaengine.dll 2011-10-11 14:05:17 28752 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\MpKsl8c57dd4a.sys 2011-10-11 14:05:10 56200 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\offreg.dll 2011-10-11 14:05:08 7269712 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{0a8f5618-2d4e-4341-b5e6-de3c685bb589}\mpengine.dll 2011-10-11 13:51:32 ——– d—–w- c:\users\justin\appdata\local\{46847985-E659-47DE-AC87-01BD844F1B09} 2011-10-11 13:51:18 ——– d—–w- c:\users\justin\appdata\local\{D3CE25D8-E1DD-4AF0-BA5D-D7D62EF818FF} 2011-10-10 04:46:47 ——– d—–w- c:\users\justin\appdata\local\{14BB231A-5624-4ECF-A641-B0A8E0AE9369} 2011-10-10 04:46:35 ——– d—–w- c:\users\justin\appdata\local\{B68D367A-CAA1-43DA-9F1C-7B85C291FAE1} 2011-10-09 07:32:12 ——– d—–w- c:\users\justin\appdata\local\{3C80CB3E-3ED1-417F-895A-D3E8712F47AF} 2011-10-09 07:31:57 ——– d—–w- c:\users\justin\appdata\local\{B62BDB11-FD05-4707-B37E-8641DAC4FAB5} 2011-10-08 07:57:13 ——– d—–w- c:\programdata\csdat 2011-10-08 04:27:02 ——– d—–w- c:\users\justin\appdata\local\{54EC63D7-9167-4895-B72D-98C70AF92708} 2011-10-08 04:26:45 ——– d—–w- c:\users\justin\appdata\local\{D5DCB644-5634-49B6-A660-25CC386CBE71} 2011-10-07 15:07:47 ——– d—–w- c:\users\justin\appdata\local\{FE81841A-EB9B-4FC4-9127-4123C95F7CDD} 2011-10-07 15:07:36 ——– d—–w- c:\users\justin\appdata\local\{3B6C9879-F05F-415F-8DD9-B0A05EB1C45E} 2011-10-06 14:21:08 ——– d—–w- c:\users\justin\appdata\local\{C8AB271C-297B-4590-A5AF-D8FB71A5F2C9} 2011-10-06 14:20:52 ——– d—–w- c:\users\justin\appdata\local\{5F419388-5E89-4D32-B062-109CCDC2BA40} 2011-10-05 16:17:57 ——– d—–w- c:\users\justin\appdata\local\{7EBD3893-3948-4DA8-8886-1A90BEA8847A} 2011-10-05 16:17:46 ——– d—–w- c:\users\justin\appdata\local\{CD341D2C-7FA2-498F-8E3F-B74451649984} 2011-10-05 03:22:43 ——– d—–w- c:\users\justin\appdata\local\{7E767BBF-52E9-4725-B2FC-CAA351C36D15} 2011-10-05 03:22:32 ——– d—–w- c:\users\justin\appdata\local\{84559E61-FB55-4D90-A508-CD9AD048E72E} 2011-10-04 15:56:15 ——– d—–w- c:\users\justin\appdata\local\{CF44C03B-721F-4AD0-95E4-85AB00CBA23A} 2011-10-04 15:56:03 ——– d—–w- c:\users\justin\appdata\local\{35355021-6A5C-4244-93C1-F5E5BAD66C37} 2011-10-03 03:59:42 ——– d—–w- c:\users\justin\appdata\local\{66FCC901-28B1-4D1C-943C-ABCFE39B8772} 2011-10-03 03:59:30 ——– d—–w- c:\users\justin\appdata\local\{05C6FFF8-0690-421C-AB08-060007ABF9E8} 2011-10-02 01:37:42 ——– d—–w- c:\users\justin\appdata\local\{C38E424A-48C0-4BE5-992F-23A7ED54C38D} 2011-10-02 01:37:29 ——– d—–w- c:\users\justin\appdata\local\{CBD7293A-2841-4CD2-A6A1-E83359C8E71C} 2011-10-01 03:14:14 ——– d—–w- c:\users\justin\appdata\local\{4118771E-8383-4257-A9A3-477C3BAF2DDE} 2011-10-01 03:14:03 ——– d—–w- c:\users\justin\appdata\local\{D2EB7CCE-C1E2-4953-91D1-388F73EC864D} 2011-09-30 06:16:45 ——– d—–w- c:\users\justin\appdata\local\{FE52C76D-81B6-4EF7-B0E0-40A7C09FE92C} 2011-09-30 06:16:31 ——– d—–w- c:\users\justin\appdata\local\{DC124C79-B296-4126-9368-580667666975} 2011-09-30 06:16:01 ——– d—–w- c:\users\justin\appdata\local\{C55BA840-FD7C-4002-A4B6-AA5DCF7FE605} 2011-09-30 06:15:46 ——– d—–w- c:\users\justin\appdata\local\{73C82787-903C-447A-B75C-1C3AE487D45C} 2011-09-30 02:01:56 ——– d—–w- c:\programdata\Premium 2011-09-30 02:01:55 ——– d—–w- c:\programdata\InstallMate 2011-09-30 01:07:40 ——– d—–w- c:\users\justin\appdata\local\{DD231359-63FD-42E0-B90A-9E37AEB1AFE9} 2011-09-29 01:35:04 ——– d—–w- c:\users\justin\appdata\local\{2BE79B16-43B2-47B7-B726-49CE904B55B8} 2011-09-29 01:34:50 ——– d—–w- c:\users\justin\appdata\local\{8D094517-C219-4875-A3A3-ACE4161BBDD1} 2011-09-28 04:17:20 ——– d—–w- c:\users\justin\appdata\local\{405C2725-3E1C-4188-844A-47A13BA3F748} 2011-09-28 04:17:06 ——– d—–w- c:\users\justin\appdata\local\{50958852-522A-41D0-B14C-E3B64B8BC2D4} 2011-09-27 11:41:29 ——– d—–w- c:\users\justin\appdata\local\{6AE129B5-F65C-4FE7-8D8F-24FB5F546A37} 2011-09-27 11:41:18 ——– d—–w- c:\users\justin\appdata\local\{01C95C44-572B-443F-B321-7081D201E9C6} 2011-09-26 01:06:06 ——– d—–w- c:\users\justin\appdata\local\{4497D6CE-9A33-4A61-8CC3-387319F9D5CA} 2011-09-26 01:05:54 ——– d—–w- c:\users\justin\appdata\local\{8430DA9C-31AF-4ECB-BC22-A4B5932931CC} 2011-09-25 08:16:53 ——– d—–w- c:\users\justin\appdata\local\Darksiders 2011-09-25 08:11:03 ——– d–h–w- c:\windows\msdownld.tmp 2011-09-25 07:54:39 ——– d—–w- c:\program files\Darksiders 2011-09-25 07:49:38 ——– d—–w- c:\users\justin\appdata\local\{EFEFC664-7FF1-4B31-BCC1-D6CEC2AC2997} 2011-09-25 07:49:25 ——– d—–w- c:\users\justin\appdata\local\{A9A82F0D-5CE1-44DC-88E2-A8D79C83D03F} 2011-09-24 06:13:28 ——– d—–w- c:\windows\system32\directx 2011-09-24 05:00:42 ——– d—–w- c:\users\justin\appdata\local\{C002449E-65A6-45D0-B206-FA04CC2716A2} 2011-09-24 05:00:25 ——– d—–w- c:\users\justin\appdata\local\{7A0A384C-D6DB-4DC1-BFAE-C8B8BC34D9E7} 2011-09-24 04:48:50 ——– d—–w- c:\users\justin\appdata\local\{64610D3D-264C-48D4-90D6-B9BD159FD661} 2011-09-24 04:38:07 ——– d—–w- c:\users\justin\appdata\local\{E736B413-15D6-4AB9-9B72-CC5B4A9A37DC} 2011-09-24 02:52:01 ——– d—–w- c:\users\justin\appdata\local\{BACCE5B3-C573-4E50-B879-28F71B80F706} 2011-09-23 13:48:45 ——– d—–w- c:\users\justin\appdata\local\{3046B5CE-CF20-4B9E-AC7E-C8ACA3B8EA36} 2011-09-23 13:48:34 ——– d—–w- c:\users\justin\appdata\local\{2343F0AE-A1B6-4FF5-A77F-E3BE3655FED3} 2011-09-22 02:08:21 ——– d—–w- c:\users\justin\appdata\local\{4195EC92-CAE8-4904-AB8E-AF5B30B9FBC9} 2011-09-22 02:08:06 ——– d—–w- c:\users\justin\appdata\local\{26F5DBCF-853E-4934-9177-987C22D459D1} 2011-09-21 02:03:04 ——– d—–w- c:\users\justin\appdata\local\{71AD6843-99F0-48CF-960C-7BFC9FFD837C} 2011-09-21 02:02:42 ——– d—–w- c:\users\justin\appdata\local\{8B9752EC-CC2A-456C-8B8A-057B58AF4A1F} 2011-09-20 14:02:15 ——– d—–w- c:\users\justin\appdata\local\{CEA19C44-BB3D-4C8F-A3DA-0335A3DA24E8} 2011-09-20 14:02:01 ——– d—–w- c:\users\justin\appdata\local\{D1C8984C-721B-44C4-BA6F-7589EC02F3A8} 2011-09-19 12:10:25 ——– d—–w- c:\users\justin\appdata\local\{BD3C2FDA-5848-4A18-B1FB-E11FCAFC679E} 2011-09-19 12:10:13 ——– d—–w- c:\users\justin\appdata\local\{D5D66466-03D9-4566-A66B-0B9496C54286} 2011-09-18 07:39:06 ——– d—–w- c:\users\justin\appdata\local\{D6D0F295-00E4-4013-B7BE-5331F6312987} 2011-09-18 07:38:54 ——– d—–w- c:\users\justin\appdata\local\{D2F80487-68E3-4031-8DA7-AFC0DAA38B57} 2011-09-17 02:55:59 ——– d—–w- c:\users\justin\appdata\local\{05D2B17A-AF14-4A0A-BF3C-B01BA9553EE5} 2011-09-16 14:49:04 ——– d—–w- c:\users\justin\appdata\local\{9E747C20-4EBA-4D42-B5ED-FA22813B0707} 2011-09-16 14:48:52 ——– d—–w- c:\users\justin\appdata\local\{59A71FB1-8C79-45D5-9C62-B1BD13A8F6BB} 2011-09-15 02:31:07 ——– d—–w- c:\users\justin\appdata\local\{34B922A3-B4B4-4CA1-ACB0-DAD3F88664D3} 2011-09-15 02:30:55 ——– d—–w- c:\users\justin\appdata\local\{E76A48C3-3183-4154-95CD-854DCBEEC439} 2011-09-14 02:50:30 ——– d—–w- c:\users\justin\appdata\local\{948EA166-99B5-461A-A867-5368DDA8FAD9} 2011-09-14 02:50:18 ——– d—–w- c:\users\justin\appdata\local\{DAE6E64E-962D-4591-AE0D-EADA0A39018F} 2011-09-13 14:43:41 ——– d—–w- c:\users\justin\appdata\local\{8FC340C1-442A-4B36-8264-F2E5C1CFAA2A} 2011-09-13 14:43:27 ——– d—–w- c:\users\justin\appdata\local\{389C50FE-1CA0-459C-B5FD-622167085024} 2011-09-12 13:02:42 ——– d—–w- c:\users\justin\appdata\local\{FD0716BA-F49F-433C-B305-801EAD87821B} 2011-09-12 13:02:28 ——– d—–w- c:\users\justin\appdata\local\{583F8228-DA6B-4555-9AC0-3DD9505E745A} . ==================== Find3M ==================== . 2011-10-01 03:17:02 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-08-18 04:09:34 516096 —-a-w- c:\windows\system32\Funshion.scr 2011-07-22 02:54:43 1797632 —-a-w- c:\windows\system32\jscript9.dll 2011-07-22 02:48:26 1126912 —-a-w- c:\windows\system32\wininet.dll 2011-07-22 02:44:36 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2011-07-16 04:27:30 290816 —-a-w- c:\windows\system32\KernelBase.dll 2011-07-16 02:17:19 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2011-07-16 02:17:19 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2011-07-16 02:17:19 3584 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2011-07-16 02:17:19 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll . ============= FINISH: 2:38:17.26 ===============
Post #8
Greetings adaptable,
***Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.***
Download Combofix from any of the links below. Save it to your desktop.

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.
  • Right click on ComboFix.exe then select Run as Administrator & follow the prompts.

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #9
This is the result after scanning with ComboFix. ComboFix 11-10-13.02 - Justin 13/10/2011 20:17:21.1.4 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.65.1033.18.3060.1868 [GMT 8:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\Thumbs.db Q:\Autorun.inf . . ((((((((((((((((((((((((( Files Created from 2011-09-13 to 2011-10-13 ))))))))))))))))))))))))))))))) . . 2011-10-13 12:02 . 2011-10-13 12:02 28752 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4FA586C1-0DA5-4FD6-B068-A9EF3361CBDE}\MpKsl901e5bef.sys 2011-10-13 12:02 . 2011-10-13 12:23 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4FA586C1-0DA5-4FD6-B068-A9EF3361CBDE}\offreg.dll 2011-10-13 12:01 . 2011-09-12 23:14 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4FA586C1-0DA5-4FD6-B068-A9EF3361CBDE}\mpengine.dll 2011-10-11 14:05 . 2011-10-11 14:05 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{61A0A96D-5A0F-4EAB-8C39-946BA90C3D86}\gapaengine.dll 2011-10-08 07:57 . 2011-10-08 07:57 ——– d—–w- c:\programdata\csdat 2011-09-30 02:01 . 2011-09-30 02:01 ——– d—–w- c:\programdata\Premium 2011-09-30 02:01 . 2011-09-30 02:02 ——– d—–w- c:\programdata\InstallMate 2011-09-25 08:16 . 2011-09-25 08:19 ——– d—–w- c:\users\Justin\AppData\Local\Darksiders 2011-09-25 08:11 . 2011-09-25 08:14 ——– d–h–w- c:\windows\msdownld.tmp 2011-09-25 07:54 . 2011-09-25 08:18 ——– d—–w- c:\program files\Darksiders . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-01 03:17 . 2011-05-17 05:39 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-09-12 23:14 . 2011-03-16 04:02 7269712 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-08-18 04:09 . 2011-08-18 04:09 516096 —-a-w- c:\windows\system32\Funshion.scr 2011-08-16 13:38 . 2011-08-16 13:38 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-07-22 02:54 . 2011-08-10 17:43 1797632 —-a-w- c:\windows\system32\jscript9.dll 2011-07-22 02:48 . 2011-08-10 17:43 1126912 —-a-w- c:\windows\system32\wininet.dll 2011-07-22 02:44 . 2011-08-10 17:43 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2011-07-16 04:27 . 2011-08-10 08:27 290816 —-a-w- c:\windows\system32\KernelBase.dll 2011-07-16 04:15 . 2011-08-10 08:27 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 4096 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2011-07-16 04:15 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2011-07-16 02:17 . 2011-08-10 08:27 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2011-07-16 02:17 . 2011-08-10 08:27 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2011-07-16 02:17 . 2011-08-10 08:27 3584 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2011-07-16 02:17 . 2011-08-10 08:27 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2011-01-17 08:54 175912 —-a-w- c:\program files\Freecorder\prxtbFree.dll . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-01-17 08:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "webcsdat"="mshta" [X] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "DAEMON Tools Lite"="c:\users\Justin\Documents\Daemon Lite\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Steam"="c:\program files\Steam\steam.exe" [2011-08-02 1242448] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-12 1594664] "IMSS"="c:\program files\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2009-10-01 111640] "RotateImage"="c:\program files\Integrated Camera Driver\RCIMGDIR.exe" [2008-10-30 31744] "TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-11-17 69568] "TpShocks"="TpShocks.exe" [2009-11-28 337256] "PSQLLauncher"="c:\program files\ThinkVantage Fingerprint Software\launcher.exe" [2009-08-17 55048] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768] "nwiz"="nwiz.exe" [2009-11-12 1657448] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-18 13838952] "PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2009-11-26 853352] "Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976] "AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2009-10-14 36864] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "Funshion"="c:\users\Justin\Documents\For Movies\Funshion\Funshion.exe" [2011-09-02 2507504] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-8-12 795936] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2011-3-16 50688] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "DisableCAD"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2009-08-17 21:27 100104 —-a-w- c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer4"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R1 MpKsl196fb241;MpKsl196fb241;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1247DBDF-8AD7-44B7-97B3-3041FA6FBD73}\MpKsl196fb241.sys [x] R1 MpKsl1c1345ee;MpKsl1c1345ee;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9968D329-3FA8-436B-9992-E968DE02F52A}\MpKsl1c1345ee.sys [x] R1 MpKsl2b0ecf63;MpKsl2b0ecf63;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{904CEC5D-4CF3-470C-A3A0-9B3CDB33F692}\MpKsl2b0ecf63.sys [x] R1 MpKsl34440195;MpKsl34440195;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{852C9955-805F-4C8E-A931-4C2CA738333D}\MpKsl34440195.sys [x] R1 MpKsl382a4fbf;MpKsl382a4fbf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D22AA96F-D337-426D-BE8F-5ECC30FB3027}\MpKsl382a4fbf.sys [x] R1 MpKsl5caecefb;MpKsl5caecefb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BD5CC54F-311D-45E8-BEA6-3224644C4000}\MpKsl5caecefb.sys [x] R1 MpKsla70b8b5e;MpKsla70b8b5e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E3C73963-0D79-49E2-B378-80B8343819EE}\MpKsla70b8b5e.sys [x] R1 MpKsla78acba9;MpKsla78acba9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{08C63FBB-5FDA-4789-9853-B2B710981C13}\MpKsla78acba9.sys [x] R1 MpKsla87e6960;MpKsla87e6960;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC96B00E-32FD-4A31-A540-253F58A52197}\MpKsla87e6960.sys [x] R1 MpKslb3bdf171;MpKslb3bdf171;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C579F5D9-3597-4F92-B7B1-2BEBA1A3A518}\MpKslb3bdf171.sys [x] R1 MpKslf3c339f1;MpKslf3c339f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7F747021-DF06-4CEE-9340-BD95E153DD9E}\MpKslf3c339f1.sys [x] R1 MpKslf3fd1e9e;MpKslf3fd1e9e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{414780D4-9EFC-41FA-8AF7-A1AF1314AD20}\MpKslf3fd1e9e.sys [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2009-07-14 20992] R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x] R3 GarenaPEngine;GarenaPEngine;c:\users\Justin\AppData\Local\Temp\NIE780C.tmp [x] R3 GGSAFERDriver;GGSAFER Driver;c:\users\Justin\Documents\1. Games\Garena\safedrv.sys [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944] R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2009-11-26 75112] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-09-30 99768] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-16 1343400] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040] S0 DozeHDD;DozeHDD;c:\windows\System32\DRIVERS\DozeHDD.sys [2009-11-26 24304] S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2009-10-09 20520] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-19 218688] S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [2008-05-12 13480] S1 MpKsl901e5bef;MpKsl901e5bef;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4FA586C1-0DA5-4FD6-B068-A9EF3361CBDE}\MpKsl901e5bef.sys [2011-10-13 28752] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [2009-11-26 132456] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 20992] S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\LENOVO\HOTKEY\CAMMUTE.exe [2009-11-09 54632] S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2009-11-17 44984] S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032] S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [2009-10-26 48640] S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 12560] S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2009-11-16 62904] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-09-30 13752] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2320920] S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [2009-10-27 126080] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472] S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2009-11-19 214696] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696] S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-11-12 66664] S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys [2009-09-24 38336] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HsfXAudioService REG_MULTI_SZ HsfXAudioService . Contents of the 'Scheduled Tasks' folder . 2011-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732128862-1727073337-814988786-1001Core.job - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-15 14:57] . 2011-10-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732128862-1727073337-814988786-1001UA.job - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-15 14:57] . 2011-09-29 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\PC-Doctor\pcdr5cuiw32.exe [2009-10-08 21:43] . 2011-10-10 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\PC-Doctor\pcdr5cuiw32.exe [2009-10-08 21:43] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.facebook.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = [removed] [removed] [removed] . - - - - ORPHANS REMOVED - - - - . BHO-{C7F8562B-9B0E-7BB7-490C-BDEBD98975CF} - c:\users\Justin\Documents\FunshionAddr\funshionAddr.dll Toolbar-Locked - (no file) HKLM-Run-Freecorder FLV Service - c:\program files\Youtube Download\FLVSrvc.exe AddRemove-Freecorder5.02 - c:\program files\Youtube Download\uninstall.exe AddRemove-Funshion - c:\users\Justin\Documents\Uninstall.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GarenaPEngine] "ImagePath"="\??\c:\users\Justin\AppData\Local\Temp\NIE780C.tmp" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1732128862-1727073337-814988786-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1732128862-1727073337-814988786-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'lsass.exe'(660) c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll c:\program files\ThinkVantage Fingerprint Software\homefus2.dll c:\program files\ThinkVantage Fingerprint Software\infql2.dll . - - - - - - - > 'Explorer.exe'(4972) c:\program files\Lenovo\Access Connections\ACDeskBand.dll c:\program files\Lenovo\Access Connections\AcLocSettings.dll c:\program files\Lenovo\Access Connections\AcSvcStub.dll c:\program files\Lenovo\Access Connections\ACHelper.dll c:\program files\ThinkPad\Bluetooth Software\btncopy.dll . ———————— Other Running Processes ———————— . c:\windows\system32\ibmpmsvc.exe c:\windows\system32\nvvsvc.exe c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe c:\windows\system32\WUDFHost.exe c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\windows\system32\nvvsvc.exe c:\program files\Lenovo\Access Connections\AcPrfMgrSvc.exe c:\progra~1\Lenovo\HOTKEY\tpnumlk.exe c:\program files\ThinkVantage Fingerprint Software\upeksvr.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Lenovo\Access Connections\AcSvc.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\progra~1\Lenovo\HOTKEY\tpnumlkd.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\program files\Lenovo\Client Security Solution\cssauth.exe c:\windows\system32\DllHost.exe c:\program files\ThinkPad\Bluetooth Software\btwdins.exe c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\windows\system32\sppsvc.exe c:\program files\Lenovo\System Update\SUService.exe c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe c:\program files\Windows Media Player\wmpnetwk.exe . ************************************************************************** . Completion time: 2011-10-13 20:26:45 - machine was rebooted ComboFix-quarantined-files.txt 2011-10-13 12:26 . Pre-Run: 259,336,892,416 bytes free Post-Run: 259,304,591,360 bytes free . - - End Of File - - EB2733BDAA49F46735900675C37F813C
Post #10
Greetings adaptable,

  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Open notepad and copy/paste the text in the quotebox below into it:

File::
Folder::
c:\programdata\csdat
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"webcsdat"=-
DirLook::
c:\users\justin\appdata\local\{583F8228-DA6B-4555-9AC0-3DD9505E745A}
c:\users\justin\appdata\local\{DAE6E64E-962D-4591-AE0D-EADA0A39018F}


Save this as "CFScript.txt", and as  Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
Also let me know if there is any improvement in your PC's performance.
Post #11
I did followed the instructions and this is the log. The pop up doesn't show up anymore. :) So i'm guessing that's a good thing. :) Thank you so much Bill. :) ComboFix 11-10-16.03 - Justin 17/10/2011 12:35:05.2.4 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.65.1033.18.3060.1993 [GMT 8:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Justin\Desktop\CFScript.txt AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\csdat c:\programdata\csdat\2.dat c:\programdata\csdat\4XV74876.hta c:\programdata\csdat\bg.jpg c:\users\Justin\AppData\Roaming\mm c:\users\Justin\AppData\Roaming\mm\cache\.cache c:\users\Justin\AppData\Roaming\mm\cache\ImageLoader\0D51E9900D2C17AA30F9D5B537BA8FCE c:\users\Justin\AppData\Roaming\mm\cache\ImageLoader\9E438F0E811F2B3FFC329276A1DA58F8 c:\users\Justin\AppData\Roaming\mm\cache\ImageLoader\F722CF962F4FCDC6D9D98B6BDE3E35D8 . . ((((((((((((((((((((((((( Files Created from 2011-09-17 to 2011-10-17 ))))))))))))))))))))))))))))))) . . 2011-10-17 04:41 . 2011-10-17 04:41 ——– d—–w- c:\users\Justin\AppData\Local\temp 2011-10-17 04:41 . 2011-10-17 04:41 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-10-17 04:41 . 2011-10-17 04:41 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2011-10-17 04:24 . 2011-10-17 04:24 28752 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC7A8906-474C-4C15-A2DF-97762D6572B0}\MpKslb144e5ce.sys 2011-10-17 04:24 . 2011-10-17 04:24 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC7A8906-474C-4C15-A2DF-97762D6572B0}\offreg.dll 2011-10-15 15:04 . 2011-09-12 23:14 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC7A8906-474C-4C15-A2DF-97762D6572B0}\mpengine.dll 2011-10-13 12:42 . 2011-08-17 04:24 465408 —-a-w- c:\windows\system32\psisdecd.dll 2011-10-13 12:42 . 2011-08-17 04:19 75776 —-a-w- c:\windows\system32\psisrndr.ax 2011-10-13 12:37 . 2011-08-27 04:26 571904 —-a-w- c:\windows\system32\oleaut32.dll 2011-10-13 12:37 . 2011-08-27 04:26 233472 —-a-w- c:\windows\system32\oleacc.dll 2011-10-13 12:35 . 2011-09-06 02:28 2334720 —-a-w- c:\windows\system32\win32k.sys 2011-10-11 14:05 . 2011-10-11 14:05 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{61A0A96D-5A0F-4EAB-8C39-946BA90C3D86}\gapaengine.dll 2011-09-30 02:01 . 2011-09-30 02:01 ——– d—–w- c:\programdata\Premium 2011-09-30 02:01 . 2011-09-30 02:02 ——– d—–w- c:\programdata\InstallMate 2011-09-25 08:16 . 2011-09-25 08:19 ——– d—–w- c:\users\Justin\AppData\Local\Darksiders 2011-09-25 08:11 . 2011-09-25 08:14 ——– d–h–w- c:\windows\msdownld.tmp 2011-09-25 07:54 . 2011-09-25 08:18 ——– d—–w- c:\program files\Darksiders . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-10-01 03:17 . 2011-05-17 05:39 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-09-12 23:14 . 2011-03-16 04:02 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-08-18 04:09 . 2011-08-18 04:09 516096 —-a-w- c:\windows\system32\Funshion.scr 2011-08-16 13:38 . 2011-08-16 13:38 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll . . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . —- Directory of c:\users\justin\appdata\local\{583F8228-DA6B-4555-9AC0-3DD9505E745A} —- . . —- Directory of c:\users\justin\appdata\local\{DAE6E64E-962D-4591-AE0D-EADA0A39018F} —- . . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2011-01-17 08:54 175912 —-a-w- c:\program files\Freecorder\prxtbFree.dll . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}] 2011-01-17 08:54 175912 —-a-w- c:\program files\ConduitEngine\prxConduitEngine.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912] "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912] . [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] . [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "DAEMON Tools Lite"="c:\users\Justin\Documents\Daemon Lite\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408] "Steam"="c:\program files\Steam\steam.exe" [2011-08-02 1242448] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-12 1594664] "IMSS"="c:\program files\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2009-10-01 111640] "RotateImage"="c:\program files\Integrated Camera Driver\RCIMGDIR.exe" [2008-10-30 31744] "TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2009-11-17 69568] "TpShocks"="TpShocks.exe" [2009-11-28 337256] "PSQLLauncher"="c:\program files\ThinkVantage Fingerprint Software\launcher.exe" [2009-08-17 55048] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768] "nwiz"="nwiz.exe" [2009-11-12 1657448] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-18 13838952] "PWMTRV"="c:\progra~1\ThinkPad\UTILIT~1\PWMTR32V.DLL" [2009-11-26 853352] "Message Center Plus"="c:\program files\LENOVO\Message Center Plus\MCPLaunch.exe" [2009-05-28 49976] "AcWin7Hlpr"="c:\program files\Lenovo\Access Connections\AcTBenabler.exe" [2009-10-14 36864] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "Funshion"="c:\users\Justin\Documents\For Movies\Funshion\Funshion.exe" [2011-09-02 2507504] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2009-8-12 795936] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2011-3-16 50688] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "DisableCAD"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2009-08-17 21:27 100104 —-a-w- c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer4"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R1 MpKsl196fb241;MpKsl196fb241;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1247DBDF-8AD7-44B7-97B3-3041FA6FBD73}\MpKsl196fb241.sys [x] R1 MpKsl1c1345ee;MpKsl1c1345ee;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9968D329-3FA8-436B-9992-E968DE02F52A}\MpKsl1c1345ee.sys [x] R1 MpKsl2b0ecf63;MpKsl2b0ecf63;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{904CEC5D-4CF3-470C-A3A0-9B3CDB33F692}\MpKsl2b0ecf63.sys [x] R1 MpKsl34440195;MpKsl34440195;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{852C9955-805F-4C8E-A931-4C2CA738333D}\MpKsl34440195.sys [x] R1 MpKsl382a4fbf;MpKsl382a4fbf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D22AA96F-D337-426D-BE8F-5ECC30FB3027}\MpKsl382a4fbf.sys [x] R1 MpKsl5caecefb;MpKsl5caecefb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BD5CC54F-311D-45E8-BEA6-3224644C4000}\MpKsl5caecefb.sys [x] R1 MpKsla70b8b5e;MpKsla70b8b5e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E3C73963-0D79-49E2-B378-80B8343819EE}\MpKsla70b8b5e.sys [x] R1 MpKsla78acba9;MpKsla78acba9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{08C63FBB-5FDA-4789-9853-B2B710981C13}\MpKsla78acba9.sys [x] R1 MpKsla87e6960;MpKsla87e6960;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CC96B00E-32FD-4A31-A540-253F58A52197}\MpKsla87e6960.sys [x] R1 MpKslb3bdf171;MpKslb3bdf171;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C579F5D9-3597-4F92-B7B1-2BEBA1A3A518}\MpKslb3bdf171.sys [x] R1 MpKslf3c339f1;MpKslf3c339f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7F747021-DF06-4CEE-9340-BD95E153DD9E}\MpKslf3c339f1.sys [x] R1 MpKslf3fd1e9e;MpKslf3fd1e9e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{414780D4-9EFC-41FA-8AF7-A1AF1314AD20}\MpKslf3fd1e9e.sys [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2009-07-14 20992] R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x] R3 GarenaPEngine;GarenaPEngine;c:\users\Justin\AppData\Local\Temp\NIE780C.tmp [x] R3 GGSAFERDriver;GGSAFER Driver;c:\users\Justin\Documents\1. Games\Garena\safedrv.sys [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944] R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\ThinkPad\Utilities\PWMDBSVC.EXE [2009-11-26 75112] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-09-30 99768] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-16 1343400] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040] S0 DozeHDD;DozeHDD;c:\windows\System32\DRIVERS\DozeHDD.sys [2009-11-26 24304] S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM86.sys [2009-10-09 20520] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-06-19 218688] S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiif32.sys [2008-05-12 13480] S1 MpKslb144e5ce;MpKslb144e5ce;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC7A8906-474C-4C15-A2DF-97762D6572B0}\MpKslb144e5ce.sys [2011-10-17 28752] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [2009-11-26 132456] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 20992] S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\LENOVO\HOTKEY\CAMMUTE.exe [2009-11-09 54632] S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2009-11-17 44984] S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032] S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [2009-10-26 48640] S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 12560] S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2009-11-16 62904] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-09-30 13752] S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-10-01 2320920] S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [2009-10-27 126080] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472] S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2009-11-19 214696] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696] S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2009-09-15 6114816] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-11-12 66664] S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys [2009-09-24 38336] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336] . . — Other Services/Drivers In Memory — . *NewlyCreated* - MPKSLB144E5CE . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HsfXAudioService REG_MULTI_SZ HsfXAudioService . Contents of the 'Scheduled Tasks' folder . 2011-10-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732128862-1727073337-814988786-1001Core.job - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-15 14:57] . 2011-10-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1732128862-1727073337-814988786-1001UA.job - c:\users\Justin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-15 14:57] . 2011-09-29 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\PC-Doctor\pcdr5cuiw32.exe [2009-10-08 21:43] . 2011-10-15 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\PC-Doctor\pcdr5cuiw32.exe [2009-10-08 21:43] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.facebook.com/ IE: E&xport; to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000 IE: Send image to &Bluetooth; Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth; Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = [removed] [removed] [removed] . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GarenaPEngine] "ImagePath"="\??\c:\users\Justin\AppData\Local\Temp\NIE780C.tmp" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-1732128862-1727073337-814988786-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.Email.1" . [HKEY_USERS\S-1-5-21-1732128862-1727073337-814988786-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="WindowsLiveMail.VCard.1" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'lsass.exe'(660) c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll c:\program files\ThinkVantage Fingerprint Software\homefus2.dll c:\program files\ThinkVantage Fingerprint Software\infql2.dll . Completion time: 2011-10-17 12:42:12 ComboFix-quarantined-files.txt 2011-10-17 04:42 ComboFix2.txt 2011-10-13 12:26 . Pre-Run: 259,162,136,576 bytes free Post-Run: 259,115,864,064 bytes free . - - End Of File - - 8C9401332DF5FF622F55177F80A73FF4
Post #13
Greetings adaptable,
Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean

Next
Please download Malwarebytes' Anti-Malware from Here.
Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.


Next
Please use Internet Explorer to download and run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes if there are any infections you will see a List of found threats.
  • Click Export to text file
  • Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.
  • If no threats are found there will be no list, this is good, just tell me that no threats were found.

Logs to post:
  • mbam.txt
  • ESET report.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI