Ping.exe virus problems [Solved]

. DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_22 Run by [removed] at 11:49:33 on 2011-12-21 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3562.1686 [GMT -5:00] . SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\windows\system32\wininit.exe C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\system32\atiesrxx.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\Windows\System32\GFNEXSrv.exe C:\windows\system32\WLANExt.exe C:\windows\system32\conhost.exe C:\windows\System32\spoolsv.exe C:\windows\System32\svchost.exe -k LocalServiceNoNetwork C:\windows\SysWOW64\svchost.exe -k hpdevmgmt C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe C:\windows\system32\svchost.exe -k imgsvc C:\windows\system32\TODDSrv.exe C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe C:\Program Files\TOSHIBA\TECO\TecoService.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\wbem\unsecapp.exe C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE C:\windows\system32\svchost.exe -k HPService C:\windows\system32\atieclxx.exe C:\windows\system32\taskhost.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Program Files\Toshiba\Power Saver\TPwrMain.exe C:\Program Files\Toshiba\FlashCards\TCrdMain.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Toshiba\TECO\Teco.exe C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe C:\windows\system32\taskmgr.exe C:\windows\splwow64.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe C:\Program Files (x86)\Corel\WordPerfect Family Pack 4\Programs\wpwin10.exe C:\Program Files (x86)\Winamp\winamp.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\windows\System32\svchost.exe -k swprv C:\windows\servicing\TrustedInstaller.exe C:\windows\SysWOW64\cmd.exe C:\windows\system32\conhost.exe C:\windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://start.toshiba.com uInternet Settings,ProxyOverride = BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll {555d4d79-4bd2-4094-a395-cfc534424a05} uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\{A0273F09-A733-49EC-9049-CD0F840D449E} : DhcpNameServer = 192.168.1.1 BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File mRun-x64: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun-x64: [AmazonGSDownloaderTray] C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll FF - plugin: C:\Users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed] FF - Ext: Webmail Ad Blocker: [removed] - %profile%\extensions\[removed] FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} FF - Ext: DeSopa: [removed] - %profile%\extensions\[removed] . ============= SERVICES / DRIVERS =============== . R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys –> C:\windows\system32\DRIVERS\vwififlt.sys [?] R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys –> C:\windows\system32\DRIVERS\TVALZFL.sys [?] R3 amdkmdag;amdkmdag;C:\windows\system32\DRIVERS\atikmdag.sys –> C:\windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\windows\system32\DRIVERS\atikmpag.sys –> C:\windows\system32\DRIVERS\atikmpag.sys [?] R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\windows\system32\drivers\AtihdW76.sys –> C:\windows\system32\drivers\AtihdW76.sys [?] R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys –> C:\windows\system32\drivers\mbam.sys [?] R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys –> C:\windows\system32\DRIVERS\pgeffect.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys –> C:\windows\system32\DRIVERS\Rt64win7.sys [?] R3 Sftfs;Sftfs;C:\windows\system32\DRIVERS\Sftfslh.sys –> C:\windows\system32\DRIVERS\Sftfslh.sys [?] R3 Sftplay;Sftplay;C:\windows\system32\DRIVERS\Sftplaylh.sys –> C:\windows\system32\DRIVERS\Sftplaylh.sys [?] R3 Sftredir;Sftredir;C:\windows\system32\DRIVERS\Sftredirlh.sys –> C:\windows\system32\DRIVERS\Sftredirlh.sys [?] R3 Sftvol;Sftvol;C:\windows\system32\DRIVERS\Sftvollh.sys –> C:\windows\system32\DRIVERS\Sftvollh.sys [?] R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys –> C:\windows\system32\DRIVERS\vwifimp.sys [?] S3 BtFilter;Bluetooth LowerFilter Class Filter Driver;C:\windows\system32\DRIVERS\btfilter.sys –> C:\windows\system32\DRIVERS\btfilter.sys [?] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys –> C:\windows\system32\Drivers\RtsUStor.sys [?] S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys –> C:\windows\system32\drivers\tsusbflt.sys [?] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys –> C:\windows\system32\drivers\TsUsbGD.sys [?] S3 WSDPrintDevice;WSD Print Support via UMB;C:\windows\system32\DRIVERS\WSDPrint.sys –> C:\windows\system32\DRIVERS\WSDPrint.sys [?] . =============== Created Last 30 ================ . 2011-12-21 16:32:09 ——– d—–w- C:\ProgramData\Uniblue 2011-12-20 08:10:59 ——– d—–w- C:\ProgramData\Rumbic Studio 2011-12-20 05:47:07 ——– d—–w- C:\Program Files (x86)\Maestro - Music of Death 2011-12-20 05:13:42 ——– d—–w- C:\Users\laptop\AppData\Roaming\Playrix Entertainment 2011-12-20 04:51:00 ——– d—–w- C:\Program Files (x86)\Bubble Odyssey 2011-12-20 04:49:49 ——– d—–w- C:\Program Files (x86)\Royal Envoy 2 Collector's Edition 2011-12-20 04:12:59 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-20 00:02:54 ——– d—–w- C:\_OTL 2011-12-17 17:17:09 ——– d—–w- C:\Users\laptop\AppData\Roaming\QuickScan 2011-12-16 16:10:32 ——– d—–w- C:\Program Files (x86)\ESET 2011-12-16 09:11:33 ——– d—–w- C:\Program Files (x86)\SeaMonkey 2011-12-16 08:32:54 ——– d—–w- C:\Users\laptop\AppData\Roaming\Disruptive Innovations SARL 2011-12-16 08:32:54 ——– d—–w- C:\Users\laptop\AppData\Local\Disruptive Innovations SARL 2011-12-16 07:47:06 ——– d—–w- C:\ProgramData\Blumentals 2011-12-15 20:12:11 98816 —-a-w- C:\windows\sed.exe 2011-12-15 20:12:11 518144 —-a-w- C:\windows\SWREG.exe 2011-12-15 20:12:11 256000 —-a-w- C:\windows\PEV.exe 2011-12-15 20:12:11 208896 —-a-w- C:\windows\MBR.exe 2011-12-13 23:01:15 ——– d—–w- C:\ProgramData\AVG2012 2011-12-13 23:00:29 ——– d—–w- C:\Program Files (x86)\AVG 2011-12-13 22:50:16 ——– d–h–w- C:\ProgramData\Common Files 2011-12-13 22:49:48 ——– d—–w- C:\ProgramData\MFAData 2011-12-13 19:45:38 ——– d—–w- C:\Users\laptop\AppData\Roaming\Malwarebytes 2011-12-13 19:44:51 ——– d—–w- C:\ProgramData\Malwarebytes 2011-12-13 19:44:48 25416 —-a-w- C:\windows\System32\drivers\mbam.sys 2011-12-13 19:44:48 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2011-12-04 04:36:47 ——– d—–w- C:\Program Files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition 2011-12-03 23:49:57 ——– d—–w- C:\ProgramData\Playrix Entertainment 2011-12-03 22:21:27 ——– d—–w- C:\ProgramData\TERMINAL Studio 2011-12-03 17:45:35 ——– d—–w- C:\Users\laptop\AppData\Local\Tific 2011-12-03 16:17:22 ——– d—–w- C:\Program Files (x86)\Luxor Adventures 2011-12-03 16:17:05 57344 —-a-w- C:\windows\SysWow64\Big Kahuna Reef.scr 2011-12-03 16:17:03 ——– d—–w- C:\Program Files (x86)\Big Kahuna Reef 2011-12-03 16:02:43 ——– d—–w- C:\Program Files (x86)\Double Play Jewel Quest 2 and 3 2011-12-03 15:55:01 ——– d—–w- C:\Program Files (x86)\Royal Envoy 2011-12-03 15:42:33 ——– d—–w- C:\Program Files (x86)\Samantha Swift and the Mystery from Atlantis 2011-12-03 15:26:52 ——– d—–w- C:\Program Files (x86)\Big Kahuna Reef 2 2011-12-03 15:25:26 ——– d—–w- C:\Program Files (x86)\The Rise Of Atlantis 2011-12-03 15:23:37 ——– d—–w- C:\Program Files (x86)\Sky Kingdoms 2011-12-03 15:20:42 ——– d—–w- C:\Program Files (x86)\Heroes Of Hellas 2011-12-03 15:19:21 ——– d—–w- C:\Program Files (x86)\Call Of Atlantis 2011-12-03 15:13:13 ——– d—–w- C:\Program Files (x86)\Atlantis Quest 2011-12-03 15:11:54 ——– d—–w- C:\Program Files (x86)\Luxor HD 2011-12-03 15:10:00 ——– d—–w- C:\Program Files (x86)\Samantha Swift Fountains of Fate 2011-12-03 14:52:40 ——– d—–w- C:\ProgramData\Amazon 2011-12-03 14:52:33 ——– d—–w- C:\Program Files (x86)\Amazon 2011-12-03 04:34:22 ——– d—–w- C:\ProgramData\Fugazo 2011-12-02 21:57:00 ——– d—–w- C:\Program Files (x86)\Mythic Pearls - The Legend of Tirnanog 2011-12-02 21:53:49 ——– d—–w- C:\ProgramData\Intenium 2011-12-02 21:45:22 ——– d—–w- C:\Program Files (x86)\Luxor - 5th Passage 2011-11-30 17:10:59 ——– d—–w- C:\Users\laptop\AppData\Roaming\OpenOffice.org 2011-11-30 17:08:59 ——– d—–w- C:\Program Files (x86)\OpenOffice.org 3 2011-11-30 17:08:17 472808 —-a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll 2011-11-28 00:04:22 ——– d—–w- C:\Users\laptop\AppData\Roaming\Oberon Games . ==================== Find3M ==================== . 2011-11-30 17:08:07 472808 —-a-w- C:\windows\SysWow64\deployJava1.dll 2011-10-16 09:05:43 2951 —-a-w- C:\windows\SysWow64\settings.bin 2011-10-07 01:29:46 414368 —-a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl . ============= FINISH: 11:50:33.67 =============== my computer's still running really slow. when i hit the key to turn on/off my laptop mouse it takes a minute or more for it to pop up. then again i'm seeing some system interrupts showing up. before i thought it was that ping.exe file since that coincided with the slowdowns as well.