PING.exe [Closed] (page 5) — What the Tech Forum Archive

mistaben

Post #61December 10, 2011, 5:10 PM UTC

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-12-10 08:28:09 —————————– 08:28:09.326 OS Version: Windows x64 6.1.7601 Service Pack 1 08:28:09.326 Number of processors: 8 586 0x2A07 08:28:09.326 ComputerName: TONY-HP UserName: Tony 08:28:12.477 Initialize success 08:29:14.905 AVAST engine defs: 11120901 08:29:38.071 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 08:29:38.071 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3 08:29:38.087 Disk 0 MBR read successfully 08:29:38.087 Disk 0 MBR scan 08:29:38.087 Disk 0 unknown MBR code 08:29:38.087 Service scanning 08:29:39.070 Modules scanning 08:29:39.070 Disk 0 trace - called modules: 08:29:39.101 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll 08:29:39.101 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007c72790] 08:29:39.101 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa8007b79b10] 08:29:39.117 5 hpdskflt.sys[fffff88001bee189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007a32050] 08:29:42.049 AVAST engine scan C:\ 08:48:12.165 File: C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir **INFECTED** Win64:Sirefef-C [Drp] 08:50:56.839 File: C:\Windows\assembly\GAC_32\Desktop.ini **INFECTED** Win32:Sirefef-FQ [Drp] 08:50:58.929 File: C:\Windows\assembly\GAC_64\Desktop.ini **INFECTED** Win64:Sirefef-C [Drp] 08:51:47.461 File: C:\Windows\assembly\temp\U\80000032.@ **INFECTED** Win32:DNSChanger-VJ [Trj] 09:31:07.644 Scan finished successfully 10:10:05.063 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat" 10:10:05.063 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt" ok… so what else do you know that can fix this. or is there a manual way to pull these files on this laptop?

ken545

Post #62December 10, 2011, 5:47 PM UTC

Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File:

File::
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini


Folder::
C:\Windows\assembly\temp\U

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

Post the new Combofix log and then run aswMBR and post the new log

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

mistaben

Post #63December 11, 2011, 7:45 AM UTC

ComboFix 11-12-10.01 - Tony 12/11/2011 0:39.4.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.4877 [GMT -7:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Tony\Desktop\CFScript.txt SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\windows\assembly\GAC_32\Desktop.ini" "c:\windows\assembly\GAC_64\Desktop.ini" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\assembly\GAC_32\Desktop.ini c:\windows\assembly\GAC_64\Desktop.ini c:\windows\assembly\temp\U c:\windows\assembly\temp\U\00000001.@ c:\windows\assembly\temp\U\00000002.@ c:\windows\assembly\temp\U\00000004.@ c:\windows\assembly\temp\U\000000c0.@ c:\windows\assembly\temp\U\000000cb.@ c:\windows\assembly\temp\U\000000cf.@ c:\windows\assembly\temp\U\80000000.@ c:\windows\assembly\temp\U\80000004.@ c:\windows\assembly\temp\U\80000032.@ c:\windows\assembly\temp\U\80000064.@ c:\windows\assembly\temp\U\800000c0.@ c:\windows\assembly\temp\U\800000cb.@ c:\windows\assembly\temp\U\800000cf.@ . . ((((((((((((((((((((((((( Files Created from 2011-11-11 to 2011-12-11 ))))))))))))))))))))))))))))))) . . 2011-12-11 07:42 . 2011-12-11 07:42 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-12-10 12:51 . 2011-12-10 12:51 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CAA4F759-7CBA-4053-A4E1-0F401F306CA3}\offreg.dll 2011-12-09 08:49 . 2011-11-21 11:40 8822856 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CAA4F759-7CBA-4053-A4E1-0F401F306CA3}\mpengine.dll 2011-12-04 04:00 . 2011-12-04 04:00 ——– d—–w- c:\program files (x86)\Apex Fitness 2011-12-03 13:32 . 2011-12-03 13:32 ——– d—–w- c:\program files (x86)\VS Revo Group 2011-12-03 03:04 . 2011-12-03 03:04 ——– d—–w- C:\_OTM 2011-12-02 01:10 . 2011-12-02 01:10 ——– d—–w- c:\program files (x86)\ESET 2011-12-01 22:46 . 2011-12-01 22:46 ——– d—–w- C:\_OTL 2011-12-01 15:41 . 2011-12-01 15:41 ——– d—–w- c:\programdata\Malwarebytes 2011-12-01 15:41 . 2011-12-01 15:41 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-12-01 15:41 . 2011-09-01 00:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-12-01 05:51 . 2011-12-01 05:51 ——– d—–w- c:\programdata\Visan 2011-12-01 05:49 . 2011-12-01 05:49 ——– d—–w- c:\programdata\WEBREG 2011-12-01 05:47 . 2009-07-14 01:41 230400 —-a-w- c:\windows\system32\Spool\prtprocs\x64\hpzppw71.dll 2011-12-01 05:30 . 2011-02-19 12:05 1139200 —-a-w- c:\windows\system32\FntCache.dll 2011-12-01 05:30 . 2011-02-19 12:04 1544192 —-a-w- c:\windows\system32\DWrite.dll 2011-12-01 05:30 . 2011-02-19 12:04 902656 —-a-w- c:\windows\system32\d2d1.dll 2011-12-01 05:30 . 2011-02-19 06:30 1076736 —-a-w- c:\windows\SysWow64\DWrite.dll 2011-12-01 05:30 . 2011-02-19 06:30 739840 —-a-w- c:\windows\SysWow64\d2d1.dll 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Yahoo! 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\Yahoo! Companion 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\program files (x86)\Coupons 2011-12-01 05:22 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP Product Assistant 2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\HP 2011-12-01 05:21 . 2011-12-01 05:21 ——– d—–w- c:\program files (x86)\Common Files\Hewlett-Packard 2011-12-01 05:20 . 2011-12-01 05:22 ——– d—–w- c:\programdata\HP 2011-11-29 02:41 . 2009-05-18 20:17 34152 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2011-11-29 02:41 . 2008-04-17 19:12 126312 —-a-w- c:\windows\system32\GEARAspi64.dll 2011-11-29 02:41 . 2008-04-17 19:12 107368 —-a-w- c:\windows\SysWow64\GEARAspi.dll 2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files\iTunes 2011-11-29 02:40 . 2011-11-29 02:41 ——– d—–w- c:\program files (x86)\iTunes 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple Computer 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\iPod 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Apple Software Update 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Common Files\Apple 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files\Bonjour 2011-11-29 02:40 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Bonjour 2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\program files (x86)\Common Files\Apple 2011-11-29 02:39 . 2011-11-29 02:40 ——– d—–w- c:\programdata\Apple 2011-11-29 02:38 . 2011-11-29 02:38 ——– d—–w- C:\itunes 2011-11-26 02:13 . 2011-11-26 02:13 8507392 —-a-w- c:\windows\system32\drivers\NETwNs64.sys 2011-11-26 02:13 . 2011-11-26 02:13 799232 —-a-w- c:\windows\system32\NETwNc64.dll 2011-11-26 02:13 . 2011-11-26 02:13 2750464 —-a-w- c:\windows\system32\NETwNr64.dll 2011-11-24 13:55 . 2011-11-24 13:55 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2011-11-24 13:54 . 2011-12-07 07:51 ——– dc—-w- c:\windows\system32\DRVSTORE 2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\programdata\Lavasoft 2011-11-24 13:54 . 2011-11-24 13:54 ——– d—–w- c:\program files (x86)\Lavasoft 2011-11-24 13:24 . 2011-11-24 13:47 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3 2011-11-24 11:39 . 2011-11-24 11:39 ——– d—–w- c:\windows\en 2011-11-24 11:37 . 2011-11-24 11:37 ——– d—–w- c:\program files\Windows Live 2011-11-21 05:30 . 2011-11-21 05:30 ——– d—–w- c:\windows\Sun 2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\SPReview 2011-11-21 04:01 . 2011-11-21 04:01 ——– d—–w- c:\windows\system32\EventProviders 2011-11-20 20:34 . 2011-03-02 10:43 203264 —-a-w- c:\windows\system32\unrar.dll 2011-11-20 20:34 . 2011-11-20 20:34 ——– d—–w- c:\program files\K-Lite Codec Pack x64 2011-11-20 20:34 . 2011-10-04 18:00 86016 —-a-w- c:\windows\system32\ff_vfw.dll 2011-11-20 16:24 . 2011-11-20 16:24 ——– d—–w- c:\program files (x86)\FVD Suite 2011-11-20 16:12 . 2011-11-20 16:12 ——– d—–w- c:\program files (x86)\Common Files\Java 2011-11-20 14:24 . 2011-11-20 14:24 ——– d—–w- C:\firefox 2011-11-20 13:47 . 2011-11-20 16:10 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\windows\system32\Macromed 2011-11-20 13:47 . 2011-11-20 13:47 ——– d—–w- c:\programdata\McAfee 2011-11-20 13:25 . 2011-11-20 13:25 ——– d—–w- C:\direct x files 2011-11-20 13:13 . 2011-11-20 13:13 ——– d—–w- c:\program files\Media Player Classic - Home Cinema 2011-11-20 13:01 . 2010-11-05 01:57 48976 —-a-w- c:\windows\system32\netfxperf.dll 2011-11-20 13:01 . 2010-11-05 01:57 1942856 —-a-w- c:\windows\system32\dfshim.dll 2011-11-20 13:01 . 2010-11-05 01:58 1130824 —-a-w- c:\windows\SysWow64\dfshim.dll 2011-11-20 13:01 . 2010-11-20 13:27 12288 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2011-11-20 13:01 . 2010-11-20 13:27 3715584 —-a-w- c:\windows\system32\mstscax.dll 2011-11-20 13:01 . 2010-11-20 13:26 1838080 —-a-w- c:\windows\system32\d3d10warp.dll 2011-11-20 13:01 . 2010-11-20 11:07 59392 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys 2011-11-20 13:01 . 2010-11-20 13:27 14967808 —-a-w- c:\program files\DVD Maker\OmdBase.dll 2011-11-20 12:59 . 2010-11-20 13:27 266240 —-a-w- c:\windows\system32\QAGENT.DLL 2011-11-20 12:58 . 2010-11-20 13:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2011-11-20 12:57 . 2010-11-20 13:01 2560 —-a-w- c:\windows\system32\drivers\en-US\rdpwd.sys.mui 2011-11-20 12:57 . 2010-11-20 12:57 3072 —-a-w- c:\windows\system32\drivers\en-US\tsusbflt.sys.mui 2011-11-20 12:57 . 2010-11-20 13:11 6144 —-a-w- c:\windows\system32\drivers\en-US\IPMIDrv.sys.mui 2011-11-20 12:57 . 2010-11-20 13:10 4608 —-a-w- c:\windows\system32\drivers\en-US\kbdclass.sys.mui 2011-11-20 12:57 . 2010-11-20 13:26 399872 —-a-w- c:\windows\system32\dpx.dll 2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\wdscore.dll 2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\windows\SysWow64\sqmapi.dll 2011-11-20 12:57 . 2010-11-20 12:21 363008 —-a-w- c:\windows\SysWow64\wbemcomn.dll 2011-11-20 12:57 . 2010-11-20 12:21 189952 —-a-w- c:\program files (x86)\Windows Portable Devices\sqmapi.dll 2011-11-20 12:57 . 2010-11-20 12:19 606208 —-a-w- c:\windows\SysWow64\wbem\fastprox.dll 2011-11-20 12:55 . 2010-11-20 13:27 529408 —-a-w- c:\windows\system32\wbemcomn.dll 2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\program files\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55 . 2010-11-20 13:27 244736 —-a-w- c:\windows\system32\sqmapi.dll 2011-11-20 12:44 . 2011-11-20 12:44 ——– d–h–w- c:\programdata\Common Files 2011-11-20 12:44 . 2011-11-20 12:44 ——– d—–w- c:\program files (x86)\AVG 2011-11-20 12:42 . 2011-11-20 12:44 ——– d—–w- c:\programdata\MFAData 2011-11-20 12:33 . 2011-03-11 06:41 1659776 —-a-w- c:\windows\system32\drivers\ntfs.sys 2011-11-20 12:33 . 2011-03-11 06:41 189824 —-a-w- c:\windows\system32\drivers\storport.sys 2011-11-20 12:33 . 2011-03-11 06:41 166272 —-a-w- c:\windows\system32\drivers\nvstor.sys 2011-11-20 12:33 . 2011-03-11 06:41 148352 —-a-w- c:\windows\system32\drivers\nvraid.sys 2011-11-20 12:33 . 2011-03-11 06:41 410496 —-a-w- c:\windows\system32\drivers\iaStorV.sys 2011-11-20 12:33 . 2011-03-11 06:41 27008 —-a-w- c:\windows\system32\drivers\amdxata.sys 2011-11-20 12:33 . 2011-03-11 06:41 107904 —-a-w- c:\windows\system32\drivers\amdsata.sys 2011-11-20 12:33 . 2011-03-11 06:33 2565632 —-a-w- c:\windows\system32\esent.dll 2011-11-20 12:33 . 2011-03-11 06:30 96768 —-a-w- c:\windows\system32\fsutil.exe 2011-11-20 12:33 . 2011-03-11 05:33 1699328 —-a-w- c:\windows\SysWow64\esent.dll 2011-11-20 12:33 . 2011-03-11 05:31 74240 —-a-w- c:\windows\SysWow64\fsutil.exe 2011-11-20 12:32 . 2011-03-25 03:29 343040 —-a-w- c:\windows\system32\drivers\usbhub.sys 2011-11-20 12:32 . 2011-03-25 03:29 98816 —-a-w- c:\windows\system32\drivers\usbccgp.sys 2011-11-20 12:32 . 2011-03-25 03:29 325120 —-a-w- c:\windows\system32\drivers\usbport.sys 2011-11-20 12:32 . 2011-03-25 03:29 52736 —-a-w- c:\windows\system32\drivers\usbehci.sys 2011-11-20 12:32 . 2011-03-25 03:29 25600 —-a-w- c:\windows\system32\drivers\usbohci.sys 2011-11-20 12:32 . 2011-03-25 03:29 30720 —-a-w- c:\windows\system32\drivers\usbuhci.sys 2011-11-20 12:32 . 2011-03-25 03:28 7936 —-a-w- c:\windows\system32\drivers\usbd.sys 2011-11-20 12:32 . 2011-04-28 03:55 552960 —-a-w- c:\windows\system32\drivers\bthport.sys 2011-11-20 12:32 . 2011-04-28 03:54 80384 —-a-w- c:\windows\system32\drivers\BTHUSB.SYS 2011-11-20 12:32 . 2010-11-20 13:24 229376 —-a-w- c:\windows\system32\fsquirt.exe 2011-11-20 12:02 . 2011-11-20 12:02 ——– d—–w- c:\program files (x86)\uTorrent 2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\SysWow64\Wat 2011-11-20 10:31 . 2011-11-20 10:31 ——– d—–w- c:\windows\system32\Wat 2011-11-20 10:04 . 2011-11-20 10:04 ——– d—–w- c:\program files (x86)\MSXML 4.0 2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\programdata\Blizzard Entertainment 2011-11-20 05:01 . 2011-11-20 06:23 ——– d—–w- c:\program files (x86)\StarCraft II 2011-11-20 05:01 . 2011-11-20 05:25 ——– d—–w- c:\program files (x86)\Common Files\Blizzard Entertainment 2011-11-20 04:22 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-11-20 04:20 . 2011-03-03 06:24 183296 —-a-w- c:\windows\system32\dnsrslvr.dll 2011-11-20 04:20 . 2011-03-03 06:21 30208 —-a-w- c:\windows\system32\dnscacheugc.exe 2011-11-20 04:20 . 2011-03-03 05:36 28672 —-a-w- c:\windows\SysWow64\dnscacheugc.exe 2011-11-20 04:20 . 2011-04-29 03:06 467456 —-a-w- c:\windows\system32\drivers\srv.sys 2011-11-20 04:20 . 2011-04-29 03:05 410112 —-a-w- c:\windows\system32\drivers\srv2.sys . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-04 03:52 . 2010-10-26 22:01 627600 —-a-w- c:\windows\system32\deployJava1.dll 2011-11-24 11:36 . 2010-06-24 18:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-11-21 04:34 . 2009-07-14 02:36 175616 —-a-w- c:\windows\system32\msclmd.dll 2011-11-21 04:34 . 2009-07-14 02:36 152576 —-a-w- c:\windows\SysWow64\msclmd.dll 2011-10-03 12:06 . 2010-10-26 22:01 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll . . ((((((((((((((((((((((((((((( SnapShot_2011-12-10_12.57.50 ))))))))))))))))))))))))))))))))))))))))) . + 2011-11-18 23:31 . 2011-12-11 07:23 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-11-18 23:31 . 2011-12-10 12:51 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2011-12-04 00:27 . 2011-12-10 12:51 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2011-12-04 00:27 . 2011-12-11 07:23 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2011-12-11 07:23 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2011-12-10 12:51 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2011-11-20 02:45 . 2011-12-11 07:23 275008 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2009-07-14 02:36 . 2011-12-10 12:54 624178 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-12-11 00:19 624178 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2011-12-11 00:19 106522 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2011-12-10 12:54 106522 c:\windows\system32\perfc009.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128] "Corel Photo Downloader"="c:\program files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-09-07 525968] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-09-14 283160] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576] "HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-09-29 584760] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320] HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072] Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . R2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57;c:\program files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2010-09-21 245232] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992] R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [x] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-06 681528] S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-05-21 103992] S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x] S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-09-29 26680] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336] S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-09-30 2655768] S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176] S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x] S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x] S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x] S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x] S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x] S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x] . . — Other Services/Drivers In Memory — . *Deregistered* - aswMBR *Deregistered* - CLKMDRV10_C6F09094 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-08-16 21:43 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2011-12-11 c:\windows\Tasks\HP Photo Creations Communicator.job - c:\programdata\HP Photo Creations\MessageCheck.exe [2011-12-01 05:51] . 2011-11-26 c:\windows\Tasks\HPCeeScheduleForTony.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter] @="{D25B32FE-CB96-491A-98FF-AD59DA382D69}" [HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter] @="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}" [HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter] @="{B3C78E40-6B64-47C3-AE34-60B770881EB8}" [HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll. [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter] @="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}" [HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter] @="{855156F0-2A0F-11DE-8C30-0800200C9A66}" [HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}] 2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-22 487424] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896] "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler] "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744] . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\ FF - prefs.js: browser.search.selectedEngine - Google Custom Search FF - prefs.js: browser.startup.homepage - hxxp://my.apexfitness.com/ . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-12-11 00:43:52 ComboFix-quarantined-files.txt 2011-12-11 07:43 ComboFix2.txt 2011-12-10 12:59 ComboFix3.txt 2011-12-01 12:56 ComboFix4.txt 2011-12-01 12:31 . Pre-Run: 885,587,181,568 bytes free Post-Run: 885,653,315,584 bytes free . - - End Of File - - D8A76DF264F9E8A94B80482E860C85A2

mistaben

Post #64December 11, 2011, 9:30 AM UTC

Hizzah! you got two of them! ~ can we do the same for the last 2 files now too, or not?

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-12-10 08:28:09 —————————– 08:28:09.326 OS Version: Windows x64 6.1.7601 Service Pack 1 08:28:09.326 Number of processors: 8 586 0x2A07 08:28:09.326 ComputerName: TONY-HP UserName: Tony 08:28:12.477 Initialize success 08:29:14.905 AVAST engine defs: 11120901 08:29:38.071 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 08:29:38.071 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3 08:29:38.087 Disk 0 MBR read successfully 08:29:38.087 Disk 0 MBR scan 08:29:38.087 Disk 0 unknown MBR code 08:29:38.087 Service scanning 08:29:39.070 Modules scanning 08:29:39.070 Disk 0 trace - called modules: 08:29:39.101 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll 08:29:39.101 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007c72790] 08:29:39.101 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa8007b79b10] 08:29:39.117 5 hpdskflt.sys[fffff88001bee189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007a32050] 08:29:42.049 AVAST engine scan C:\ 08:48:12.165 File: C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir **INFECTED** Win64:Sirefef-C [Drp] 08:50:56.839 File: C:\Windows\assembly\GAC_32\Desktop.ini **INFECTED** Win32:Sirefef-FQ [Drp] 08:50:58.929 File: C:\Windows\assembly\GAC_64\Desktop.ini **INFECTED** Win64:Sirefef-C [Drp] 08:51:47.461 File: C:\Windows\assembly\temp\U\80000032.@ **INFECTED** Win32:DNSChanger-VJ [Trj] 09:31:07.644 Scan finished successfully 10:10:05.063 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat" 10:10:05.063 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-12-11 00:45:35 —————————– 00:45:35.348 OS Version: Windows x64 6.1.7601 Service Pack 1 00:45:35.348 Number of processors: 8 586 0x2A07 00:45:35.348 ComputerName: TONY-HP UserName: Tony 00:45:38.734 Initialize success 00:46:08.189 AVAST engine defs: 11121001 00:46:46.001 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 00:46:46.001 Disk 0 Vendor: TOSHIBA_ GL00 Size: 953869MB BusType: 3 00:46:46.094 Disk 0 MBR read successfully 00:46:46.094 Disk 0 MBR scan 00:46:46.110 Disk 0 unknown MBR code 00:46:46.157 Service scanning 00:46:47.062 Modules scanning 00:46:47.062 Disk 0 trace - called modules: 00:46:47.155 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys hal.dll 00:46:47.155 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007c72790] 00:46:47.155 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa8007b79b10] 00:46:47.155 5 hpdskflt.sys[fffff88001bee189] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007a32050] 00:46:50.494 AVAST engine scan C:\ 01:13:13.663 File: C:\Qoobox\Quarantine\C\Windows\assembly\temp\U\80000032.@.vir **INFECTED** Win32:DNSChanger-VJ [Trj] 01:13:13.826 File: C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir **INFECTED** Win64:Sirefef-C [Drp] 01:58:35.312 Scan finished successfully 02:02:12.863 Disk 0 MBR has been saved successfully to "C:\Users\Tony\Desktop\MBR.dat" 02:02:12.863 The log file has been saved successfully to "C:\Users\Tony\Desktop\aswMBR.txt"

ken545

Post #65December 11, 2011, 11:18 AM UTC

Hey, Those two files that still show up on the aswMBR log are in Qoobox which are just backups of what Combofix removed, there harmless where they are and we will remove the entire folder when where done. Run DDS and post a new log and let me know how things are running now ?

mistaben

Post #66December 11, 2011, 2:56 PM UTC

seems to be running pretty good so far still. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 7:55:20 on 2011-12-11 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.4802 [GMT -7:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files\IDT\WDM\STacSV64.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\Hpservice.exe C:\Windows\system32\vcsFPService.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\IDT\WDM\AESTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Windows\system32\taskhost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Windows\system32\Dwm.exe C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\rundll32.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{1D586EF4-8011-4DD6-BAD2-3280827F2C4D} : DhcpNameServer = 192.168.1.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO-X64: 0x1 - No File BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO-X64: HP Print Enhancer - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll BHO-X64: HP Smart BHO Class - No File TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 178.250.45.15 www.google-analytics.com. Hosts: 178.250.45.15 ad-emea.doubleclick.net. . Note: multiple HOSTS entries found. Please refer to Attach.txt . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\ FF - prefs.js: browser.search.selectedEngine - Google Custom Search FF - prefs.js: browser.startup.homepage - hxxp://my.apexfitness.com/ FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-11-18 89600] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?] R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-8-5 681528] R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896] R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?] R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-9-28 26680] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-18 13336] R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-18 2655768] R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys –> C:\Windows\system32\drivers\btwampfl.sys [?] R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?] R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?] S2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57:59;C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2011-11-18 245232] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?] S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?] . =============== Created Last 30 ================ . 2011-12-10 12:51:29 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CAA4F759-7CBA-4053-A4E1-0F401F306CA3}\offreg.dll 2011-12-09 08:49:02 8822856 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CAA4F759-7CBA-4053-A4E1-0F401F306CA3}\mpengine.dll 2011-12-04 04:00:05 ——– d—–w- C:\Program Files (x86)\Apex Fitness 2011-12-03 13:32:24 ——– d—–w- C:\Program Files (x86)\VS Revo Group 2011-12-03 03:04:21 ——– d—–w- C:\_OTM 2011-12-02 01:10:39 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-01 22:46:23 ——– d—–w- C:\_OTL 2011-12-01 17:14:11 ——– d—–w- C:\Users\Tony\AppData\Local\Corel 2011-12-01 15:41:42 ——– d—–w- C:\Users\Tony\AppData\Roaming\Malwarebytes 2011-12-01 15:41:39 ——– d—–w- C:\ProgramData\Malwarebytes 2011-12-01 15:41:36 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-12-01 15:41:36 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-12-01 12:16:54 98816 —-a-w- C:\Windows\sed.exe 2011-12-01 12:16:54 518144 —-a-w- C:\Windows\SWREG.exe 2011-12-01 12:16:54 256000 —-a-w- C:\Windows\PEV.exe 2011-12-01 12:16:54 208896 —-a-w- C:\Windows\MBR.exe 2011-12-01 08:37:06 ——– d—–w- C:\Users\Tony\AppData\Local\ElevatedDiagnostics 2011-12-01 05:51:36 ——– d—–w- C:\Users\Tony\AppData\Roaming\Visan 2011-12-01 05:51:36 ——– d—–w- C:\ProgramData\Visan 2011-12-01 05:49:48 ——– d—–w- C:\ProgramData\WEBREG 2011-12-01 05:47:01 230400 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll 2011-12-01 05:37:25 ——– d—–w- C:\Windows\pss 2011-12-01 05:30:33 902656 —-a-w- C:\Windows\System32\d2d1.dll 2011-12-01 05:30:33 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-12-01 05:30:33 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2011-12-01 05:30:33 1139200 —-a-w- C:\Windows\System32\FntCache.dll 2011-12-01 05:30:33 1076736 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-12-01 05:22:47 ——– d—–w- C:\Program Files (x86)\Yahoo! 2011-12-01 05:22:43 ——– d—–w- C:\Users\Tony\AppData\Roaming\HpUpdate 2011-12-01 05:22:34 ——– d—–w- C:\Program Files (x86)\Coupons 2011-12-01 05:21:42 ——– d—–w- C:\Program Files (x86)\Common Files\HP 2011-12-01 05:21:30 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard 2011-11-29 02:42:08 ——– d—–w- C:\Users\Tony\AppData\Local\Apple Computer 2011-11-29 02:41:40 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2011-11-29 02:41:40 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2011-11-29 02:41:40 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2011-11-29 02:40:51 ——– d—–w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iTunes 2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iPod 2011-11-29 02:40:51 ——– d—–w- C:\Program Files (x86)\iTunes 2011-11-29 02:40:29 ——– d—–w- C:\Users\Tony\AppData\Local\Apple 2011-11-29 02:40:03 ——– d—–w- C:\Program Files\Bonjour 2011-11-29 02:40:03 ——– d—–w- C:\Program Files (x86)\Bonjour 2011-11-29 02:38:48 ——– d—–w- C:\itunes 2011-11-27 07:05:27 ——– d—–w- C:\Users\Tony\AppData\Local\CyberLink 2011-11-27 07:05:26 ——– d—–w- C:\Users\Tony\AppData\Local\PowerCinema 2011-11-26 02:13:25 8507392 —-a-w- C:\Windows\System32\drivers\NETwNs64.sys 2011-11-26 02:13:25 799232 —-a-w- C:\Windows\System32\NETwNc64.dll 2011-11-26 02:13:25 2750464 —-a-w- C:\Windows\System32\NETwNr64.dll 2011-11-24 13:55:32 55384 —-a-w- C:\Windows\System32\drivers\SBREDrv.sys 2011-11-24 13:54:08 ——– d—–w- C:\Program Files (x86)\Lavasoft 2011-11-24 13:24:17 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3 2011-11-24 11:39:27 ——– d—–w- C:\Windows\en 2011-11-24 11:17:16 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live 2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Roaming\Windows Live Writer 2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live Writer 2011-11-22 13:12:24 8822856 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2011-11-21 04:01:50 ——– d—–w- C:\Windows\System32\SPReview 2011-11-21 04:01:27 ——– d—–w- C:\Windows\System32\EventProviders 2011-11-20 20:34:35 203264 —-a-w- C:\Windows\System32\unrar.dll 2011-11-20 20:34:34 86016 —-a-w- C:\Windows\System32\ff_vfw.dll 2011-11-20 20:34:34 ——– d—–w- C:\Program Files\K-Lite Codec Pack x64 2011-11-20 16:29:38 ——– d—–w- C:\Users\Tony\AppData\Local\FVD Suite 2011-11-20 16:24:16 ——– d—–w- C:\Program Files (x86)\FVD Suite 2011-11-20 14:24:42 ——– d—–w- C:\firefox 2011-11-20 14:22:11 ——– d—–w- C:\Users\Tony\AppData\Local\Adobe 2011-11-20 13:47:56 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-20 13:34:41 ——– d—–w- C:\Users\Tony\AppData\Local\Mozilla 2011-11-20 13:25:30 ——– d—–w- C:\direct x files 2011-11-20 13:16:08 ——– d—–w- C:\Windows\SysWow64\directx 2011-11-20 13:13:52 ——– d—–w- C:\Program Files\Media Player Classic - Home Cinema 2011-11-20 13:11:12 ——– d—–w- C:\Users\Tony\AppData\Local\Programs 2011-11-20 13:01:16 48976 —-a-w- C:\Windows\System32\netfxperf.dll 2011-11-20 13:01:16 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2011-11-20 13:01:08 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2011-11-20 13:01:02 59392 —-a-w- C:\Windows\System32\drivers\TsUsbFlt.sys 2011-11-20 13:01:02 3715584 —-a-w- C:\Windows\System32\mstscax.dll 2011-11-20 13:01:02 1838080 —-a-w- C:\Windows\System32\d3d10warp.dll 2011-11-20 13:01:02 12288 —-a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll 2011-11-20 13:01:01 14967808 —-a-w- C:\Program Files\DVD Maker\OmdBase.dll 2011-11-20 12:59:59 705024 —-a-w- C:\Windows\System32\BFE.DLL 2011-11-20 12:58:59 856576 —-a-w- C:\Windows\SysWow64\FirewallControlPanel.dll 2011-11-20 12:57:58 3072 —-a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui 2011-11-20 12:57:58 2560 —-a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui 2011-11-20 12:57:56 6144 —-a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui 2011-11-20 12:57:56 4608 —-a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui 2011-11-20 12:57:55 399872 —-a-w- C:\Windows\System32\dpx.dll 2011-11-20 12:57:55 189952 —-a-w- C:\Windows\SysWow64\wdscore.dll 2011-11-20 12:57:49 189952 —-a-w- C:\Windows\SysWow64\sqmapi.dll 2011-11-20 12:57:40 606208 —-a-w- C:\Windows\SysWow64\wbem\fastprox.dll 2011-11-20 12:57:40 363008 —-a-w- C:\Windows\SysWow64\wbemcomn.dll 2011-11-20 12:57:40 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55:56 529408 —-a-w- C:\Windows\System32\wbemcomn.dll 2011-11-20 12:55:56 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55:45 244736 —-a-w- C:\Windows\System32\sqmapi.dll 2011-11-20 12:44:54 ——– d–h–w- C:\ProgramData\Common Files 2011-11-20 12:44:53 ——– d—–w- C:\Program Files (x86)\AVG 2011-11-20 12:42:12 ——– d—–w- C:\ProgramData\MFAData 2011-11-20 12:33:03 1659776 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2011-11-20 12:33:02 96768 —-a-w- C:\Windows\System32\fsutil.exe 2011-11-20 12:33:02 74240 —-a-w- C:\Windows\SysWow64\fsutil.exe 2011-11-20 12:33:02 410496 —-a-w- C:\Windows\System32\drivers\iaStorV.sys 2011-11-20 12:33:02 27008 —-a-w- C:\Windows\System32\drivers\amdxata.sys 2011-11-20 12:33:02 2565632 —-a-w- C:\Windows\System32\esent.dll 2011-11-20 12:33:02 189824 —-a-w- C:\Windows\System32\drivers\storport.sys 2011-11-20 12:33:02 1699328 —-a-w- C:\Windows\SysWow64\esent.dll 2011-11-20 12:33:02 166272 —-a-w- C:\Windows\System32\drivers\nvstor.sys 2011-11-20 12:33:02 148352 —-a-w- C:\Windows\System32\drivers\nvraid.sys 2011-11-20 12:33:02 107904 —-a-w- C:\Windows\System32\drivers\amdsata.sys 2011-11-20 12:32:56 98816 —-a-w- C:\Windows\System32\drivers\usbccgp.sys 2011-11-20 12:32:56 7936 —-a-w- C:\Windows\System32\drivers\usbd.sys 2011-11-20 12:32:56 52736 —-a-w- C:\Windows\System32\drivers\usbehci.sys 2011-11-20 12:32:56 343040 —-a-w- C:\Windows\System32\drivers\usbhub.sys 2011-11-20 12:32:56 325120 —-a-w- C:\Windows\System32\drivers\usbport.sys 2011-11-20 12:32:56 30720 —-a-w- C:\Windows\System32\drivers\usbuhci.sys 2011-11-20 12:32:56 25600 —-a-w- C:\Windows\System32\drivers\usbohci.sys 2011-11-20 12:32:55 80384 —-a-w- C:\Windows\System32\drivers\BTHUSB.SYS 2011-11-20 12:32:55 552960 —-a-w- C:\Windows\System32\drivers\bthport.sys 2011-11-20 12:32:55 229376 —-a-w- C:\Windows\System32\fsquirt.exe 2011-11-20 12:29:57 ——– d—–w- C:\Users\Tony\AppData\Local\Diagnostics 2011-11-20 12:02:40 ——– d—–w- C:\Program Files (x86)\uTorrent 2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Roaming\uTorrent 2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Local\uTorrent 2011-11-20 11:26:26 ——– d—–w- C:\Users\Tony\AppData\Local\CrashDumps 2011-11-20 10:31:58 ——– d—–w- C:\Windows\SysWow64\Wat 2011-11-20 10:31:58 ——– d—–w- C:\Windows\System32\Wat 2011-11-20 10:04:22 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2011-11-20 05:01:00 ——– d—–w- C:\ProgramData\Blizzard Entertainment 2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\StarCraft II 2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\Common Files\Blizzard Entertainment 2011-11-20 04:22:59 86528 —-a-w- C:\Windows\SysWow64\SearchFilterHost.exe 2011-11-20 04:20:46 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe 2011-11-20 04:20:46 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe 2011-11-20 04:20:46 183296 —-a-w- C:\Windows\System32\dnsrslvr.dll 2011-11-20 04:20:03 467456 —-a-w- C:\Windows\System32\drivers\srv.sys 2011-11-20 04:20:03 410112 —-a-w- C:\Windows\System32\drivers\srv2.sys 2011-11-20 04:20:03 168448 —-a-w- C:\Windows\System32\drivers\srvnet.sys 2011-11-20 04:20:01 321024 —-a-w- C:\Windows\System32\d3d10_1core.dll 2011-11-20 04:20:01 219136 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2011-11-20 04:20:01 197120 —-a-w- C:\Windows\System32\d3d10_1.dll 2011-11-20 04:20:01 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2011-11-20 04:15:40 270720 ——w- C:\Windows\System32\MpSigStub.exe 2011-11-20 03:59:15 ——– d—–w- C:\Users\Tony\AppData\Roaming\Blio 2011-11-20 03:52:42 ——– d—–w- C:\Users\Tony\AppData\Local\ATI 2011-11-20 03:52:29 ——– d—–w- C:\Users\Tony\AppData\Roaming\PictureMover 2011-11-20 02:54:16 ——– d—–w- C:\Users\Tony\AppData\Local\Broadcom 2011-11-20 02:54:13 ——– d—–w- C:\Users\Tony\AppData\Roaming\Intel Corporation 2011-11-20 02:54:12 ——– d—–w- C:\Users\Tony\AppData\Roaming\Stardock 2011-11-20 02:54:11 ——– d—–w- C:\Users\Tony\AppData\Roaming\hpqLog 2011-11-20 02:53:24 ——– d—–w- C:\Users\Tony\AppData\Local\RemEngine 2011-11-20 02:48:58 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard 2011-11-20 02:48:41 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard_Company 2011-11-18 22:15:54 39464 —-a-w- C:\Windows\System32\drivers\btwl2cap.sys 2011-11-18 22:15:54 344616 —-a-w- C:\Windows\System32\drivers\btwampfl.sys 2011-11-18 22:15:54 21544 —-a-w- C:\Windows\System32\drivers\btwrchid.sys 2011-11-18 22:15:54 135720 —-a-w- C:\Windows\System32\drivers\btwavdt.sys 2011-11-18 22:15:54 102952 —-a-w- C:\Windows\System32\drivers\btwaudio.sys 2011-11-18 22:15:28 ——– d—–w- C:\Program Files\WIDCOMM 2011-11-18 22:15:20 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-11-18 22:14:49 ——– d—–w- C:\ProgramData\Downloaded Installations 2011-11-18 22:10:15 ——– d—–w- C:\Program Files (x86)\HP Games 2011-11-18 22:10:12 ——– d—–w- C:\ProgramData\WildTangent 2011-11-18 22:09:26 ——– d—–w- C:\ProgramData\Norton 2011-11-18 22:09:05 ——– d—–w- C:\ProgramData\NortonInstaller 2011-11-18 22:08:39 ——– d—–w- C:\ProgramData\Uninstall 2011-11-18 22:08:21 ——– d—–w- C:\Program Files (x86)\Microsoft WSE 2011-11-18 22:08:16 ——– d—–w- C:\ProgramData\RoxioNow 2011-11-18 22:08:13 ——– d—–w- C:\Program Files (x86)\Roxio 2011-11-18 22:08:01 ——– d—–w- C:\ProgramData\PictureMover 2011-11-18 22:08:01 ——– d—–w- C:\Program Files (x86)\PictureMover 2011-11-18 22:05:44 ——– d—–w- C:\Program Files (x86)\Times Reader 2011-11-18 22:05:31 ——– dc-h–w- C:\ProgramData\{05971B75-B620-4D64-9985-7971BEF763A2} 2011-11-18 22:05:30 ——– d—–w- C:\Program Files\Stardock 2011-11-18 21:55:41 0 —-a-w- C:\Windows\ativpsrm.bin 2011-11-18 21:54:26 53248 —-a-w- C:\Windows\SysWow64\CSVer.dll 2011-11-18 21:54:19 ——– d—–w- C:\Windows\Hewlett-Packard 2011-11-18 21:53:27 ——– d—–w- C:\Windows\Driver Cache 2011-11-18 21:53:27 ——– d—–w- C:\Program Files (x86)\HP 2011-11-18 21:50:56 9112168 —-a-w- C:\Windows\SysWow64\RtsUStoricon.dll 2011-11-18 21:50:56 422504 —-a-w- C:\Windows\System32\RtsUStor.dll 2011-11-18 21:50:56 246376 —-a-w- C:\Windows\System32\drivers\RtsUStor.sys 2011-11-18 21:50:56 ——– d—–w- C:\Program Files (x86)\Realtek 2011-11-18 21:50:22 ——– d—–w- C:\Program Files\Validity Sensors 2011-11-18 21:49:59 437272 —-a-w- C:\Windows\System32\drivers\iaStor.sys 2011-11-18 21:49:56 8192 —-a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll 2011-11-18 21:49:56 8192 —-a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll 2011-11-18 21:49:50 ——– d—–w- C:\Program Files (x86)\Common Files\postureAgent 2011-11-18 21:49:38 ——– d—–w- C:\Program Files\Synaptics 2011-11-18 21:48:11 ——– d—–w- C:\Program Files\ATI 2011-11-18 21:48:09 ——– d—–w- C:\Program Files (x86)\ATI Technologies 2011-11-18 21:38:29 ——– d—–w- C:\Windows\ehome . ==================== Find3M ==================== . 2011-12-04 03:52:23 627600 —-a-w- C:\Windows\System32\deployJava1.dll 2011-11-21 04:34:49 175616 —-a-w- C:\Windows\System32\msclmd.dll 2011-11-21 04:34:49 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2011-10-03 12:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:03:32 3144704 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 7:55:34.60 ===============

mistaben

Post #67December 11, 2011, 2:56 PM UTC

seems to be running pretty good so far still. . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 7:55:20 on 2011-12-11 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8174.4802 [GMT -7:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Program Files\IDT\WDM\STacSV64.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\Hpservice.exe C:\Windows\system32\vcsFPService.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\IDT\WDM\AESTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Windows\system32\taskhost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe C:\Windows\system32\Dwm.exe C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\System32\rundll32.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Windows\system32\taskeng.exe C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden uRun: [Corel Photo Downloader] "C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAPFI~1.LNK - C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{1D586EF4-8011-4DD6-BAD2-3280827F2C4D} : DhcpNameServer = 192.168.1.1 Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll BHO-X64: 0x1 - No File BHO-X64: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll BHO-X64: HP Print Enhancer - No File BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll BHO-X64: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll BHO-X64: HP Smart BHO Class - No File TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun-x64: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm Hosts: 217.23.4.166 www.google-analytics.com. Hosts: 217.23.4.166 ad-emea.doubleclick.net. Hosts: 217.23.4.166 www.statcounter.com. Hosts: 178.250.45.15 www.google-analytics.com. Hosts: 178.250.45.15 ad-emea.doubleclick.net. . Note: multiple HOSTS entries found. Please refer to Attach.txt . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Tony\AppData\Roaming\Mozilla\Firefox\Profiles\b57io866.default\ FF - prefs.js: browser.search.selectedEngine - Google Custom Search FF - prefs.js: browser.startup.homepage - hxxp://my.apexfitness.com/ FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-11-18 89600] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?] R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-8-5 681528] R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896] R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-5-21 103992] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?] R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-9-28 26680] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-18 13336] R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-18 2655768] R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\system32\drivers\btwampfl.sys –> C:\Windows\system32\drivers\btwampfl.sys [?] R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys –> C:\Windows\system32\DRIVERS\btwl2cap.sys [?] R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?] R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?] R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?] S2 CLKMSVC10_C6F09094;CyberLink Product - 2011/11/18 13:57:59;C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\HDDVD\NavFilter\kmsvc.exe [2011-11-18 245232] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?] S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?] S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?] . =============== Created Last 30 ================ . 2011-12-10 12:51:29 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CAA4F759-7CBA-4053-A4E1-0F401F306CA3}\offreg.dll 2011-12-09 08:49:02 8822856 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CAA4F759-7CBA-4053-A4E1-0F401F306CA3}\mpengine.dll 2011-12-04 04:00:05 ——– d—–w- C:\Program Files (x86)\Apex Fitness 2011-12-03 13:32:24 ——– d—–w- C:\Program Files (x86)\VS Revo Group 2011-12-03 03:04:21 ——– d—–w- C:\_OTM 2011-12-02 01:10:39 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-01 22:46:23 ——– d—–w- C:\_OTL 2011-12-01 17:14:11 ——– d—–w- C:\Users\Tony\AppData\Local\Corel 2011-12-01 15:41:42 ——– d—–w- C:\Users\Tony\AppData\Roaming\Malwarebytes 2011-12-01 15:41:39 ——– d—–w- C:\ProgramData\Malwarebytes 2011-12-01 15:41:36 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys 2011-12-01 15:41:36 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-12-01 12:16:54 98816 —-a-w- C:\Windows\sed.exe 2011-12-01 12:16:54 518144 —-a-w- C:\Windows\SWREG.exe 2011-12-01 12:16:54 256000 —-a-w- C:\Windows\PEV.exe 2011-12-01 12:16:54 208896 —-a-w- C:\Windows\MBR.exe 2011-12-01 08:37:06 ——– d—–w- C:\Users\Tony\AppData\Local\ElevatedDiagnostics 2011-12-01 05:51:36 ——– d—–w- C:\Users\Tony\AppData\Roaming\Visan 2011-12-01 05:51:36 ——– d—–w- C:\ProgramData\Visan 2011-12-01 05:49:48 ——– d—–w- C:\ProgramData\WEBREG 2011-12-01 05:47:01 230400 —-a-w- C:\Windows\System32\Spool\prtprocs\x64\hpzppw71.dll 2011-12-01 05:37:25 ——– d—–w- C:\Windows\pss 2011-12-01 05:30:33 902656 —-a-w- C:\Windows\System32\d2d1.dll 2011-12-01 05:30:33 739840 —-a-w- C:\Windows\SysWow64\d2d1.dll 2011-12-01 05:30:33 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2011-12-01 05:30:33 1139200 —-a-w- C:\Windows\System32\FntCache.dll 2011-12-01 05:30:33 1076736 —-a-w- C:\Windows\SysWow64\DWrite.dll 2011-12-01 05:22:47 ——– d—–w- C:\Program Files (x86)\Yahoo! 2011-12-01 05:22:43 ——– d—–w- C:\Users\Tony\AppData\Roaming\HpUpdate 2011-12-01 05:22:34 ——– d—–w- C:\Program Files (x86)\Coupons 2011-12-01 05:21:42 ——– d—–w- C:\Program Files (x86)\Common Files\HP 2011-12-01 05:21:30 ——– d—–w- C:\Program Files (x86)\Common Files\Hewlett-Packard 2011-11-29 02:42:08 ——– d—–w- C:\Users\Tony\AppData\Local\Apple Computer 2011-11-29 02:41:40 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2011-11-29 02:41:40 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2011-11-29 02:41:40 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2011-11-29 02:40:51 ——– d—–w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001} 2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iTunes 2011-11-29 02:40:51 ——– d—–w- C:\Program Files\iPod 2011-11-29 02:40:51 ——– d—–w- C:\Program Files (x86)\iTunes 2011-11-29 02:40:29 ——– d—–w- C:\Users\Tony\AppData\Local\Apple 2011-11-29 02:40:03 ——– d—–w- C:\Program Files\Bonjour 2011-11-29 02:40:03 ——– d—–w- C:\Program Files (x86)\Bonjour 2011-11-29 02:38:48 ——– d—–w- C:\itunes 2011-11-27 07:05:27 ——– d—–w- C:\Users\Tony\AppData\Local\CyberLink 2011-11-27 07:05:26 ——– d—–w- C:\Users\Tony\AppData\Local\PowerCinema 2011-11-26 02:13:25 8507392 —-a-w- C:\Windows\System32\drivers\NETwNs64.sys 2011-11-26 02:13:25 799232 —-a-w- C:\Windows\System32\NETwNc64.dll 2011-11-26 02:13:25 2750464 —-a-w- C:\Windows\System32\NETwNr64.dll 2011-11-24 13:55:32 55384 —-a-w- C:\Windows\System32\drivers\SBREDrv.sys 2011-11-24 13:54:08 ——– d—–w- C:\Program Files (x86)\Lavasoft 2011-11-24 13:24:17 ——– d—–w- C:\f7bf4a5b04f1dad3f79b7d80c634b0c3 2011-11-24 11:39:27 ——– d—–w- C:\Windows\en 2011-11-24 11:17:16 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live 2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Roaming\Windows Live Writer 2011-11-24 11:16:47 ——– d—–w- C:\Users\Tony\AppData\Local\Windows Live Writer 2011-11-22 13:12:24 8822856 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll 2011-11-21 04:01:50 ——– d—–w- C:\Windows\System32\SPReview 2011-11-21 04:01:27 ——– d—–w- C:\Windows\System32\EventProviders 2011-11-20 20:34:35 203264 —-a-w- C:\Windows\System32\unrar.dll 2011-11-20 20:34:34 86016 —-a-w- C:\Windows\System32\ff_vfw.dll 2011-11-20 20:34:34 ——– d—–w- C:\Program Files\K-Lite Codec Pack x64 2011-11-20 16:29:38 ——– d—–w- C:\Users\Tony\AppData\Local\FVD Suite 2011-11-20 16:24:16 ——– d—–w- C:\Program Files (x86)\FVD Suite 2011-11-20 14:24:42 ——– d—–w- C:\firefox 2011-11-20 14:22:11 ——– d—–w- C:\Users\Tony\AppData\Local\Adobe 2011-11-20 13:47:56 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-20 13:34:41 ——– d—–w- C:\Users\Tony\AppData\Local\Mozilla 2011-11-20 13:25:30 ——– d—–w- C:\direct x files 2011-11-20 13:16:08 ——– d—–w- C:\Windows\SysWow64\directx 2011-11-20 13:13:52 ——– d—–w- C:\Program Files\Media Player Classic - Home Cinema 2011-11-20 13:11:12 ——– d—–w- C:\Users\Tony\AppData\Local\Programs 2011-11-20 13:01:16 48976 —-a-w- C:\Windows\System32\netfxperf.dll 2011-11-20 13:01:16 1942856 —-a-w- C:\Windows\System32\dfshim.dll 2011-11-20 13:01:08 1130824 —-a-w- C:\Windows\SysWow64\dfshim.dll 2011-11-20 13:01:02 59392 —-a-w- C:\Windows\System32\drivers\TsUsbFlt.sys 2011-11-20 13:01:02 3715584 —-a-w- C:\Windows\System32\mstscax.dll 2011-11-20 13:01:02 1838080 —-a-w- C:\Windows\System32\d3d10warp.dll 2011-11-20 13:01:02 12288 —-a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll 2011-11-20 13:01:01 14967808 —-a-w- C:\Program Files\DVD Maker\OmdBase.dll 2011-11-20 12:59:59 705024 —-a-w- C:\Windows\System32\BFE.DLL 2011-11-20 12:58:59 856576 —-a-w- C:\Windows\SysWow64\FirewallControlPanel.dll 2011-11-20 12:57:58 3072 —-a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui 2011-11-20 12:57:58 2560 —-a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui 2011-11-20 12:57:56 6144 —-a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui 2011-11-20 12:57:56 4608 —-a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui 2011-11-20 12:57:55 399872 —-a-w- C:\Windows\System32\dpx.dll 2011-11-20 12:57:55 189952 —-a-w- C:\Windows\SysWow64\wdscore.dll 2011-11-20 12:57:49 189952 —-a-w- C:\Windows\SysWow64\sqmapi.dll 2011-11-20 12:57:40 606208 —-a-w- C:\Windows\SysWow64\wbem\fastprox.dll 2011-11-20 12:57:40 363008 —-a-w- C:\Windows\SysWow64\wbemcomn.dll 2011-11-20 12:57:40 189952 —-a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55:56 529408 —-a-w- C:\Windows\System32\wbemcomn.dll 2011-11-20 12:55:56 244736 —-a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll 2011-11-20 12:55:45 244736 —-a-w- C:\Windows\System32\sqmapi.dll 2011-11-20 12:44:54 ——– d–h–w- C:\ProgramData\Common Files 2011-11-20 12:44:53 ——– d—–w- C:\Program Files (x86)\AVG 2011-11-20 12:42:12 ——– d—–w- C:\ProgramData\MFAData 2011-11-20 12:33:03 1659776 —-a-w- C:\Windows\System32\drivers\ntfs.sys 2011-11-20 12:33:02 96768 —-a-w- C:\Windows\System32\fsutil.exe 2011-11-20 12:33:02 74240 —-a-w- C:\Windows\SysWow64\fsutil.exe 2011-11-20 12:33:02 410496 —-a-w- C:\Windows\System32\drivers\iaStorV.sys 2011-11-20 12:33:02 27008 —-a-w- C:\Windows\System32\drivers\amdxata.sys 2011-11-20 12:33:02 2565632 —-a-w- C:\Windows\System32\esent.dll 2011-11-20 12:33:02 189824 —-a-w- C:\Windows\System32\drivers\storport.sys 2011-11-20 12:33:02 1699328 —-a-w- C:\Windows\SysWow64\esent.dll 2011-11-20 12:33:02 166272 —-a-w- C:\Windows\System32\drivers\nvstor.sys 2011-11-20 12:33:02 148352 —-a-w- C:\Windows\System32\drivers\nvraid.sys 2011-11-20 12:33:02 107904 —-a-w- C:\Windows\System32\drivers\amdsata.sys 2011-11-20 12:32:56 98816 —-a-w- C:\Windows\System32\drivers\usbccgp.sys 2011-11-20 12:32:56 7936 —-a-w- C:\Windows\System32\drivers\usbd.sys 2011-11-20 12:32:56 52736 —-a-w- C:\Windows\System32\drivers\usbehci.sys 2011-11-20 12:32:56 343040 —-a-w- C:\Windows\System32\drivers\usbhub.sys 2011-11-20 12:32:56 325120 —-a-w- C:\Windows\System32\drivers\usbport.sys 2011-11-20 12:32:56 30720 —-a-w- C:\Windows\System32\drivers\usbuhci.sys 2011-11-20 12:32:56 25600 —-a-w- C:\Windows\System32\drivers\usbohci.sys 2011-11-20 12:32:55 80384 —-a-w- C:\Windows\System32\drivers\BTHUSB.SYS 2011-11-20 12:32:55 552960 —-a-w- C:\Windows\System32\drivers\bthport.sys 2011-11-20 12:32:55 229376 —-a-w- C:\Windows\System32\fsquirt.exe 2011-11-20 12:29:57 ——– d—–w- C:\Users\Tony\AppData\Local\Diagnostics 2011-11-20 12:02:40 ——– d—–w- C:\Program Files (x86)\uTorrent 2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Roaming\uTorrent 2011-11-20 12:02:05 ——– d—–w- C:\Users\Tony\AppData\Local\uTorrent 2011-11-20 11:26:26 ——– d—–w- C:\Users\Tony\AppData\Local\CrashDumps 2011-11-20 10:31:58 ——– d—–w- C:\Windows\SysWow64\Wat 2011-11-20 10:31:58 ——– d—–w- C:\Windows\System32\Wat 2011-11-20 10:04:22 ——– d—–w- C:\Program Files (x86)\MSXML 4.0 2011-11-20 05:01:00 ——– d—–w- C:\ProgramData\Blizzard Entertainment 2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\StarCraft II 2011-11-20 05:01:00 ——– d—–w- C:\Program Files (x86)\Common Files\Blizzard Entertainment 2011-11-20 04:22:59 86528 —-a-w- C:\Windows\SysWow64\SearchFilterHost.exe 2011-11-20 04:20:46 30208 —-a-w- C:\Windows\System32\dnscacheugc.exe 2011-11-20 04:20:46 28672 —-a-w- C:\Windows\SysWow64\dnscacheugc.exe 2011-11-20 04:20:46 183296 —-a-w- C:\Windows\System32\dnsrslvr.dll 2011-11-20 04:20:03 467456 —-a-w- C:\Windows\System32\drivers\srv.sys 2011-11-20 04:20:03 410112 —-a-w- C:\Windows\System32\drivers\srv2.sys 2011-11-20 04:20:03 168448 —-a-w- C:\Windows\System32\drivers\srvnet.sys 2011-11-20 04:20:01 321024 —-a-w- C:\Windows\System32\d3d10_1core.dll 2011-11-20 04:20:01 219136 —-a-w- C:\Windows\SysWow64\d3d10_1core.dll 2011-11-20 04:20:01 197120 —-a-w- C:\Windows\System32\d3d10_1.dll 2011-11-20 04:20:01 161792 —-a-w- C:\Windows\SysWow64\d3d10_1.dll 2011-11-20 04:15:40 270720 ——w- C:\Windows\System32\MpSigStub.exe 2011-11-20 03:59:15 ——– d—–w- C:\Users\Tony\AppData\Roaming\Blio 2011-11-20 03:52:42 ——– d—–w- C:\Users\Tony\AppData\Local\ATI 2011-11-20 03:52:29 ——– d—–w- C:\Users\Tony\AppData\Roaming\PictureMover 2011-11-20 02:54:16 ——– d—–w- C:\Users\Tony\AppData\Local\Broadcom 2011-11-20 02:54:13 ——– d—–w- C:\Users\Tony\AppData\Roaming\Intel Corporation 2011-11-20 02:54:12 ——– d—–w- C:\Users\Tony\AppData\Roaming\Stardock 2011-11-20 02:54:11 ——– d—–w- C:\Users\Tony\AppData\Roaming\hpqLog 2011-11-20 02:53:24 ——– d—–w- C:\Users\Tony\AppData\Local\RemEngine 2011-11-20 02:48:58 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard 2011-11-20 02:48:41 ——– d—–w- C:\Users\Tony\AppData\Local\Hewlett-Packard_Company 2011-11-18 22:15:54 39464 —-a-w- C:\Windows\System32\drivers\btwl2cap.sys 2011-11-18 22:15:54 344616 —-a-w- C:\Windows\System32\drivers\btwampfl.sys 2011-11-18 22:15:54 21544 —-a-w- C:\Windows\System32\drivers\btwrchid.sys 2011-11-18 22:15:54 135720 —-a-w- C:\Windows\System32\drivers\btwavdt.sys 2011-11-18 22:15:54 102952 —-a-w- C:\Windows\System32\drivers\btwaudio.sys 2011-11-18 22:15:28 ——– d—–w- C:\Program Files\WIDCOMM 2011-11-18 22:15:20 ——– d—–w- C:\Program Files (x86)\Microsoft 2011-11-18 22:14:49 ——– d—–w- C:\ProgramData\Downloaded Installations 2011-11-18 22:10:15 ——– d—–w- C:\Program Files (x86)\HP Games 2011-11-18 22:10:12 ——– d—–w- C:\ProgramData\WildTangent 2011-11-18 22:09:26 ——– d—–w- C:\ProgramData\Norton 2011-11-18 22:09:05 ——– d—–w- C:\ProgramData\NortonInstaller 2011-11-18 22:08:39 ——– d—–w- C:\ProgramData\Uninstall 2011-11-18 22:08:21 ——– d—–w- C:\Program Files (x86)\Microsoft WSE 2011-11-18 22:08:16 ——– d—–w- C:\ProgramData\RoxioNow 2011-11-18 22:08:13 ——– d—–w- C:\Program Files (x86)\Roxio 2011-11-18 22:08:01 ——– d—–w- C:\ProgramData\PictureMover 2011-11-18 22:08:01 ——– d—–w- C:\Program Files (x86)\PictureMover 2011-11-18 22:05:44 ——– d—–w- C:\Program Files (x86)\Times Reader 2011-11-18 22:05:31 ——– dc-h–w- C:\ProgramData\{05971B75-B620-4D64-9985-7971BEF763A2} 2011-11-18 22:05:30 ——– d—–w- C:\Program Files\Stardock 2011-11-18 21:55:41 0 —-a-w- C:\Windows\ativpsrm.bin 2011-11-18 21:54:26 53248 —-a-w- C:\Windows\SysWow64\CSVer.dll 2011-11-18 21:54:19 ——– d—–w- C:\Windows\Hewlett-Packard 2011-11-18 21:53:27 ——– d—–w- C:\Windows\Driver Cache 2011-11-18 21:53:27 ——– d—–w- C:\Program Files (x86)\HP 2011-11-18 21:50:56 9112168 —-a-w- C:\Windows\SysWow64\RtsUStoricon.dll 2011-11-18 21:50:56 422504 —-a-w- C:\Windows\System32\RtsUStor.dll 2011-11-18 21:50:56 246376 —-a-w- C:\Windows\System32\drivers\RtsUStor.sys 2011-11-18 21:50:56 ——– d—–w- C:\Program Files (x86)\Realtek 2011-11-18 21:50:22 ——– d—–w- C:\Program Files\Validity Sensors 2011-11-18 21:49:59 437272 —-a-w- C:\Windows\System32\drivers\iaStor.sys 2011-11-18 21:49:56 8192 —-a-w- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll 2011-11-18 21:49:56 8192 —-a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll 2011-11-18 21:49:50 ——– d—–w- C:\Program Files (x86)\Common Files\postureAgent 2011-11-18 21:49:38 ——– d—–w- C:\Program Files\Synaptics 2011-11-18 21:48:11 ——– d—–w- C:\Program Files\ATI 2011-11-18 21:48:09 ——– d—–w- C:\Program Files (x86)\ATI Technologies 2011-11-18 21:38:29 ——– d—–w- C:\Windows\ehome . ==================== Find3M ==================== . 2011-12-04 03:52:23 627600 —-a-w- C:\Windows\System32\deployJava1.dll 2011-11-21 04:34:49 175616 —-a-w- C:\Windows\System32\msclmd.dll 2011-11-21 04:34:49 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll 2011-10-03 12:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll 2011-09-29 16:29:28 1923952 —-a-w- C:\Windows\System32\drivers\tcpip.sys 2011-09-29 04:03:32 3144704 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 7:55:34.60 ===============

ken545

Post #68December 11, 2011, 4:35 PM UTC

I am glad things are better but it looks like your Hosts File is still infected and needs to be replaced, now with ZeroAccess gone (Hopefully) we may be able to fix it. Combofix should have fixed the hosts file but it looks like it did not, lets try the fix again, if it still wont replace it than we need to look deeper.

Open OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:processes
killallprocesses

:OTL:Services

:Reg

:Files
c:\windows\system32\drivers\etc\hosts
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top. <–Not run Scan
Let the program run unhindered, reboot when it is done
Then post the results of the log it produces.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

mistaben

Post #69December 11, 2011, 6:21 PM UTC

cannot create file c:\ etc… hosts\ is it some kind of administrator lockout error? is there a way to manually delete the file?

ken545

Post #70December 11, 2011, 6:46 PM UTC last edited December 11, 2011, 6:47 PM UTC

If you still have OTM on your system then disregard the download instructions, and you should also have HostsXpert still on your system, use OTM to delete the file and then HostsXpert to create a new one

Please download OTM by OldTimer and save it to your desktop.
Double click the [external image: Posted Image] icon on your desktop.

Paste the following code under the [external image: Posted Image] area.
Do not include the word "Code".

:Processes
explorer.exe

:Services

:Reg

:Files
c:\windows\system32\drivers\etc\hosts


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Push the large [external image: Posted Image] button.
OTM may ask to reboot the machine. Please do so if asked.
Copy/Paste the contents under the [external image: Posted Image] line here in your next reply.
If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Now run HostsXpert

Restore Microsoft's Hosts file <– You will get a message stating that there is no hosts file available do you want to create one SAY YES

This may fail also, I will be surprised if it works, but give it a shot.

Now, after running aswMBR it left two files on your desktop, aswMBR.text is what you posted, I want you to look for MBR.dat and upload it to VirusTotal and this will check to see if your Master Boot Record is infected

You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see. If the site says this file has been checked before, have them check it again

Your desktop <– aswMBR.dat

If the site is busy you can try this one
http://virusscan.jotti.org/en

mistaben

Post #71December 14, 2011, 4:40 PM UTC

All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== File move failed. c:\windows\system32\drivers\etc\hosts scheduled to be moved on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: Tony ->Temp folder emptied: 50639794 bytes ->Temporary Internet Files folder emptied: 180877250 bytes ->Java cache emptied: 1926006 bytes ->FireFox cache emptied: 66419449 bytes ->Flash cache emptied: 505 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 6864 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 286.00 mb OTM by OldTimer - Version 3.1.19.0 log created on 12142011_093602 Files moved on Reboot… File move failed. c:\windows\system32\drivers\etc\hosts scheduled to be moved on reboot. C:\Users\Tony\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. Registry entries deleted on Reboot…

mistaben

Post #72December 14, 2011, 4:41 PM UTC

Files\Folders moved on Reboot… File move failed. c:\windows\system32\drivers\etc\hosts scheduled to be moved on reboot. Registry entries deleted on Reboot…

mistaben

Post #73December 14, 2011, 4:41 PM UTC last edited December 14, 2011, 4:43 PM UTC

hosts expert failed.

mistaben

Post #74December 14, 2011, 4:50 PM UTC

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: MBR.dat Submission date: 2011-12-14 16:38:59 (UTC) Current status: finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.12.13.01 2011.12.14 - AntiVir 7.11.19.106 2011.12.14 - Antiy-AVL 2.0.3.7 2011.12.14 - Avast 6.0.1289.0 2011.12.14 - AVG 10.0.0.1190 2011.12.14 - BitDefender 7.2 2011.12.14 - ByteHero 1.0.0.1 2011.12.07 - CAT-QuickHeal 12.00 2011.12.14 - ClamAV 0.97.3.0 2011.12.14 - Commtouch 5.3.2.6 2011.12.14 - Comodo 10955 2011.12.14 - DrWeb 5.0.2.03300 2011.12.14 - Emsisoft 5.1.0.11 2011.12.14 - eSafe 7.0.17.0 2011.12.13 - eTrust-Vet 37.0.9623 2011.12.14 - F-Prot 4.6.5.141 2011.12.13 - F-Secure 9.0.16440.0 2011.12.14 - Fortinet 4.3.388.0 2011.12.14 - GData 22.307/22.576 2011.12.14 - Ikarus T3.1.1.109.0 2011.12.14 - Jiangmin 13.0.900 2011.12.14 - K7AntiVirus 9.119.5684 2011.12.14 - Kaspersky 9.0.0.837 2011.12.14 - McAfee 5.400.0.1158 2011.12.14 - McAfee-GW-Edition 2010.1E 2011.12.14 - Microsoft 1.7903 2011.12.14 - NOD32 6711 2011.12.14 - Norman 6.07.13 2011.12.14 - nProtect 2011-12-14.01 2011.12.14 - Panda 10.0.3.5 2011.12.14 - PCTools [removed] 2011.12.14 - Prevx 3.0 2011.12.14 - Rising 23.88.02.02 2011.12.14 - Sophos 4.72.0 2011.12.14 - SUPERAntiSpyware 4.40.0.1006 2011.12.14 - Symantec 20111.2.0.82 2011.12.14 - TheHacker 6.7.0.1.356 2011.12.11 - TrendMicro 9.500.0.1008 2011.12.14 - TrendMicro-HouseCall 9.500.0.1008 2011.12.14 - VBA32 [removed] 2011.12.14 - VIPRE 11249 2011.12.14 - ViRobot 2011.12.14.4825 2011.12.14 - VirusBuster [removed] 2011.12.14 - Additional information Show all MD5 : a313c38c91e2101a5873f84d64754dea SHA1 : b1593a31d473be9d7b30ff555ad3094e847bbd0f SHA256: cf1f934a806a59db7728d4d297650dd8b969ba07b7758b62b077956941ea2938 ssdeep: 6:k7qSeK6HRb1LItaw8T9wqdt7zWnA8fd5Kfo/GVOcAlS04lUKr6ucTnd6s0lilTF6:k+dDYawG fWB5r/XcAeUKubnddcGTeN File size : 512 bytes First seen: 2011-12-14 16:38:59 Last seen : 2011-12-14 16:38:59 TrID: Unknown! sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned ExifTool: file metadata Error: Unknown file type FileSize: 512 bytes

ken545

Post #75December 14, 2011, 5:37 PM UTC

There is something on your system that is preventing the infected hosts file from being replaced with a good one, lets check one more time for a rootkit that may still be active.

Make sure you look at the picture of the GMER instructions and follow them to a T

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Next:

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click GMER.exe.
[external image: Posted Image]
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
  [external image: Posted Image]
  Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

PING.exe [Closed]

✨ Ask AI

Ask AI