• Announcements

    • LS.Andy

      Support for other products than adaware, ad block, web protection and Web Companion   05/05/2017

      Support for the following products is handled by the Lavasoft support team: Lavasoft Tuneup Kit Lavasoft PC Optimizer Lavasoft Driver Updater Lavasoft Registry Tuner Lavasoft Privacy Toolbox Lavasoft File Shredder Lavasoft Digital Lock

      For help with these products, contact the support team here: http://www.lavasoft.com/support/supportcenter/
       
Sign in to follow this  
csalis75

Stubborn Infection Driving Me NUTS!

Recommended Posts

I have a pretty stubborn virus or spyware that I can't seem to get rid of for the life of me. I've run Windows Defender and Spyware Doctor, but neither of them picks anything up. I try to run Ad-Aware SE, but it crashes after just a few seconds. I've tried starting up my laptop in Safe Mode and then running the Ad-Aware scan, which seems to work, but it doesn't pick anything up.

 

Basically, I keep getting random IE pop ups for either casinos or some online university. I can't upload files because the file select gets hijacked and the address ends up being 'c:/false/Documents/....'. Also, when I do a Google search I get a totally bogus results page and when I look at the source code I can see that something's being iframed in. Finally, when I try to type in any browser form I can't type normal speed.

 

So please, please, please help me figure out how to get rid of this nasty bug before it drives me completely mad!!

 

Here's the HijackThis log:

 

* * * * * * * * * * * * * * * * * * * * * *

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:08:37 PM, on 8/2/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v8.00 (8.00.6001.18813)

Boot mode: Normal

 

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\PSIService.exe

C:\Program Files\Google\Google Talk\googletalk.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\Online Backup\OnlineBackup.exe

C:\Program Files\Citrix\GoToMeeting\320\g2mstart.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\eFax Messenger 4.3\J2GTray.exe

C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe

C:\Program Files\Dropbox\Dropbox.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Users\ChestinDSalisbury\AppData\Local\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe

C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Citrix\GoToMeeting\320\g2mcomm.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Program Files\Citrix\GoToMeeting\320\g2mlauncher.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\mobsync.exe

C:\Windows\system32\wbem\wmiprvse.exe

c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\rundll32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\wbem\wmiprvse.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer.5.30.0\gears.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [iSBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"

O4 - HKLM\..\Run: [VAIO Center Access Bar] "c:\program files\sony\VAIO Center Access Bar\VCAB.exe" 1

O4 - HKLM\..\Run: [VAIO Help and Support Demo] "C:\Program Files\Sony\VAIO Help and Support Demo\LaunchVHSD.exe"

O4 - HKLM\..\Run: [VWLASU] "C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe"

O4 - HKLM\..\Run: [VAIORegistration] "C:\Program Files\Sony\First Experience\WelcomeLauncher.exe"

O4 - HKLM\..\Run: [VAIOSurvey] "C:\Program Files\Sony\VAIO Survey\Vista VAIO Survey.exe"

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [blackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [commentsniper] "C:\Program Files\Comment Sniper\CommentSniper.exe" startup

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [RunSpySweeperScheduleAtStartup] "C:\Windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{BC296A9B-7063-45E3-93DB-31EAD8970815}

O4 - HKCU\..\Run: [Google Update] "C:\Users\ChestinDSalisbury\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s

O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

O4 - HKCU\..\Run: [@BackupScheduler] C:\Program Files\Online Backup\OnlineBackup.exe

O4 - HKCU\..\Run: [GoToMeeting] C:\Program Files\Citrix\GoToMeeting\320\g2mstart.exe "/Trigger RunAtLogon"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [AdobeUpdater6] "C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')

O4 - Startup: Dropbox.lnk = C:\Program Files\Dropbox\Dropbox.exe

O4 - Global Startup: AOL DDI.lnk = C:\DDI\AOLICON.exe

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe

O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer.5.30.0\gears.dll

O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer.5.30.0\gears.dll

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O13 - Gopher Prefix:

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1249182936708

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL,avgrsstx.dll,C:\Windows\System32\drmmgrtn32.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate1c8f5d17bcf56f6) (gupdate1c8f5d17bcf56f6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe

O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe

O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe

O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: CamMonitor (uCamMonitor) - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe

O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe

O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe

O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

 

--

End of file - 18476 bytes

 

* * * * * * * * * * * * * * *

 

Thanks so much for any help you can offer!!

 

 

chestin

Share this post


Link to post
Share on other sites
I try to run Ad-Aware SE

Hi,

 

That version is not supported anymore. You should uninstall it and get Ad-Aware AE instead.

 

 

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.

  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt

    [*]Save both reports to your desktop. Post them back to your topic.

Download GMER here by clicking download exe -button and then saving it your desktop:

  • Double-click .exe that you downloaded
  • Click rootkit-tab and then scan.
  • Don't check
    Show All
    box while scanning in progress!
  • When scanning is ready, click Copy.
  • This copies log to clipboard
  • Post log in your reply.

Share this post


Link to post
Share on other sites

First off, I do have AdAware AE, not SE as posted previously. Sorry 'bout that.

 

Here is the DDS.txt log and the Attach.txt file is attached:

 

 

DDS (Ver_09-07-30.01) - NTFSx86

Run by ChestinDSalisbury at 12:00:46.14 on Sat 08/08/2009

Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_13

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3062.1730 [GMT -4:00]

 

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

 

============== Running Processes ===============

 

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe

C:\Program Files\Google\Google Talk\googletalk.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\Online Backup\OnlineBackup.exe

C:\Program Files\Citrix\GoToMeeting\320\g2mstart.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\eFax Messenger 4.3\J2GTray.exe

C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe

C:\Program Files\Dropbox\Dropbox.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Windows\system32\atashost.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\PSIService.exe

C:\Users\ChestinDSalisbury\AppData\Local\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Program Files\Citrix\GoToMeeting\320\g2mcomm.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Citrix\GoToMeeting\320\g2mlauncher.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\rundll32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\taskeng.exe

C:\Users\ChestinDSalisbury\Software\Malware\dds.scr

 

============== Pseudo HJT Report ===============

 

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.yahoo.com/

uDefault_Page_URL = hxxp://www.sony.com/vaiopeople

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

mDefault_Page_URL = hxxp://www.sony.com/vaiopeople

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer.5.30.0\gears.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File

uRun: [sidebar] "c:\program files\windows sidebar\sidebar.exe" /autoRun

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [RunSpySweeperScheduleAtStartup] "c:\windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{BC296A9B-7063-45E3-93DB-31EAD8970815}

uRun: [Google Update] "c:\users\chestindsalisbury\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [CollaborationHost] c:\windows\system32\p2phost.exe -s

uRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler

uRun: [@BackupScheduler] c:\program files\online backup\OnlineBackup.exe

uRun: [GoToMeeting] c:\program files\citrix\gotomeeting\320\g2mstart.exe "/Trigger RunAtLogon"

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [AdobeUpdater6] "c:\program files\common files\adobe\updater6\Adobe_Updater.exe"

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [iSBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe"

mRun: [VAIO Center Access Bar] "c:\program files\sony\vaio center access bar\VCAB.exe" 1

mRun: [VAIO Help and Support Demo] "c:\program files\sony\vaio help and support demo\LaunchVHSD.exe"

mRun: [VWLASU] "c:\program files\sony\vaio pc wireless lan wizard\AutoLaunchWLASU.exe"

mRun: [VAIORegistration] "c:\program files\sony\first experience\WelcomeLauncher.exe"

mRun: [VAIOSurvey] "c:\program files\sony\vaio survey\Vista VAIO Survey.exe"

mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

mRun: [eFax 4.3] "c:\program files\efax messenger 4.3\J2GDllCmd.exe" /R

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe

mRun: [blackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [commentsniper] "c:\program files\comment sniper\CommentSniper.exe" startup

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"

dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe

StartupFolder: c:\users\chesti~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\program files\dropbox\Dropbox.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\aolddi~1.lnk - c:\ddi\AOLICON.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\efax43~1.lnk - c:\program files\efax messenger 4.3\J2GTray.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\google~1.lnk - c:\program files\google\google calendar sync\GoogleCalendarSync.exe

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer.5.30.0\gears.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

Trusted Zone: topproduceronline.com\www

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1249182936708

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

Notify: igfxcui - igfxdev.dll

Notify: VESWinlogon - VESWinlogon.dll

AppInit_DLLs: c:\progra~1\google\google~4\goec62~1.dll,avgrsstx.dll,c:\windows\system32\drmmgrtn32.dll

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\users\chesti~1\appdata\roaming\mozilla\firefox\profiles\jttamvr7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk

FF - component: c:\program files\google\google gears\firefox\lib\ff30\gears.dll

FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.131.11\npGoogleOneClick5.dll

FF - plugin: c:\program files\google\update\1.2.133.33\npGoogleOneClick7.dll

FF - plugin: c:\program files\google\update\1.2.145.5\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npxsciter.dll

FF - plugin: c:\program files\picasa2\npPicasa2.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\chestindsalisbury\appdata\local\google\update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\users\chestindsalisbury\appdata\roaming\mozilla\plugins\npatgpc.dll

FF - plugin: c:\users\chestindsalisbury\appdata\roaming\mozilla\plugins\npgoogletalk.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

 

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4E7FF8BB-0A5A-4AA3-B764-B39BA9A13E38", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CIDB24F189F-FB14-4EFD-8B9D-217EC6C84EA1", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID86ED3659-02F6-465D-8F19-A9334614CCC3", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID5D7F48C0-CB49-4ea6-97D4-04F4EACC2F3B", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CIDA43C6FC7-09F6-4E04-B8E3-683F3BDFEF7C", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4C8D6404-A9F6-4236-8488-6C5732CB3BFA", "AllAccess");

============= SERVICES / DRIVERS ===============

 

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-7 64160]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-5-18 130936]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-9-29 335752]

R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2009-8-7 20376]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-9-29 298776]

R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]

R2 uCamMonitor;CamMonitor;c:\program files\arcsoft\magic-i visual effects\uCamMonitor.exe [2008-3-3 125440]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [2008-3-3 17920]

R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-8-3 18912]

R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]

R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2008-2-16 73472]

R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2008-2-16 43904]

R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2008-2-16 9344]

R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2008-2-16 818688]

S2 gupdate1c8f5d17bcf56f6;Google Update Service (gupdate1c8f5d17bcf56f6);c:\program files\google\update\GoogleUpdate.exe [2008-8-3 133104]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2008-2-16 28464]

S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-5-30 55280]

S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-1 29744]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-23 348752]

S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2008-3-3 745472]

S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\sony\vaio media integrated server\platform\SV_Httpd.exe [2008-3-3 397312]

S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2008-3-3 1089536]

S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2008-2-16 292128]

S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2008-2-16 79136]

 

=============== Created Last 30 ================

 

2009-08-07 11:19 <DIR> --d----- c:\users\chesti~1\appdata\roaming\Malwarebytes

2009-08-07 11:19 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-07 11:18 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-08-07 11:18 <DIR> --d----- c:\programdata\Malwarebytes

2009-08-07 11:18 <DIR> --d----- c:\progra~2\Malwarebytes

2009-08-07 11:18 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware

2009-08-07 09:37 76,192 a------- c:\windows\system32\atsckernel.exe

2009-08-07 09:37 20,376 a------- c:\windows\system32\atashost.exe

2009-08-02 09:02 <DIR> --d----- c:\program files\Trend Micro

2009-07-26 21:17 1,372 a------- c:\windows\system32\18yk428opC3py.vbs

2009-07-26 20:37 1,372 a------- c:\windows\system32\ohCbauKcmBi4H.vbs

2009-07-26 20:35 1,372 a------- c:\windows\system32\N1bC2diGZTTQPMQ.vbs

2009-07-26 20:33 121,344 a------- c:\windows\system32\drmmgrtn32.dll

2009-07-26 20:33 1,372 a------- c:\windows\system32\zUmLrhz.vbs

2009-07-20 14:06 <DIR> --d----- c:\users\chesti~1\appdata\roaming\webex

2009-07-20 14:05 <DIR> --d----- c:\programdata\WebEx

2009-07-20 14:05 <DIR> --d----- c:\progra~2\WebEx

2009-07-18 20:15 <DIR> --d----- c:\program files\common files\Sonic Shared

2009-07-18 20:15 <DIR> --d----- c:\program files\Roxio

2009-07-18 00:56 27,136 a------- c:\windows\system32\drivers\RimSerial.sys

2009-07-15 23:59 <DIR> --d----- c:\users\chesti~1\appdata\roaming\PCF-VLC

2009-07-15 21:25 <DIR> --d----- c:\users\chesti~1\appdata\roaming\Participatory Culture Foundation

2009-07-15 21:24 <DIR> --d----- c:\program files\Participatory Culture Foundation

2009-07-15 03:50 156,672 a------- c:\windows\system32\t2embed.dll

2009-07-15 03:50 289,792 a------- c:\windows\system32\atmfd.dll

2009-07-15 03:50 72,704 a------- c:\windows\system32\fontsub.dll

2009-07-15 03:50 10,240 a------- c:\windows\system32\dciman32.dll

 

==================== Find3M ====================

 

2009-07-31 08:01 335,752 a------- c:\windows\system32\drivers\avgldx86.sys

2009-07-21 17:52 915,456 a------- c:\windows\system32\wininet.dll

2009-07-21 17:47 109,056 a------- c:\windows\system32\iesysprep.dll

2009-07-21 17:47 71,680 a------- c:\windows\system32\iesetup.dll

2009-07-21 16:13 133,632 a------- c:\windows\system32\ieUnatt.exe

2009-07-18 00:58 143,360 a------- c:\windows\inf\infstrng.dat

2009-07-18 00:58 51,200 a------- c:\windows\inf\infpub.dat

2009-07-18 00:58 86,016 a------- c:\windows\inf\infstor.dat

2009-07-07 17:44 15,688 a------- c:\windows\system32\lsdelete.exe

2009-07-07 17:44 64,160 a------- c:\windows\system32\drivers\Lbd.sys

2009-06-30 09:57 11,952 a------- c:\windows\system32\avgrsstx.dll

2009-04-21 15:56 264 a------- c:\users\chesti~1\appdata\roaming\wklnhst.dat

2009-01-25 19:24 32 a------- c:\programdata\ezsid.dat

2009-01-25 19:24 32 a------- c:\progra~2\ezsid.dat

2008-08-01 21:29 665,600 a------- c:\windows\inf\drvindex.dat

2008-01-20 22:43 174 a--sh--- c:\program files\desktop.ini

2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib409\perfi.dat

2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib409\perfh.dat

2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib409\perfd.dat

2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib409\perfc.dat

2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib00\perfi.dat

2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib00\perfh.dat

2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib00\perfd.dat

2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib00\perfc.dat

2008-08-02 15:55 88 ---shr-- c:\windows\system32\7397FF66E8.sys

2008-08-02 16:01 2,828 a--sh--- c:\windows\system32\KGyGaAvL.sys

 

============= FINISH: 12:03:33.76 ===============

Attach.txt

Share this post


Link to post
Share on other sites

GMER results here:

 

GMER 1.0.15.15020 [89uslpzu.exe] - http://www.gmer.net

Rootkit scan 2009-08-08 20:19:15

Windows 6.0.6001 Service Pack 1

 

 

---- System - GMER 1.0.15 ----

 

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x82E08282]

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x82E08474]

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0x82E07F32]

SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwWriteVirtualMemory [0x82FE6384]

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x82E0867C]

 

---- Kernel code sections - GMER 1.0.15 ----

 

.text ntkrnlpa.exe!KeSetTimerEx + 43C 828CEA00 3 Bytes [82, 82, E0]

.text ntkrnlpa.exe!KeSetTimerEx + 440 828CEA04 3 Bytes [74, 84, E0]

.text ntkrnlpa.exe!KeSetTimerEx + 854 828CEE18 3 Bytes [32, 7F, E0] {XOR BH, [EDI-0x20]}

.text ntkrnlpa.exe!KeSetTimerEx + 8B4 828CEE78 3 Bytes [84, 63, FE] {TEST [EBX-0x2], AH}

.text ntkrnlpa.exe!KeSetTimerEx + 918 828CEEDC 3 Bytes [7C, 86, E0]

? C:\Windows\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. !

 

---- User code sections - GMER 1.0.15 ----

 

.text C:\Windows\Explorer.EXE[1880] kernel32.dll!CreateProcessW 75BC1C01 5 Bytes JMP 1000E3CD C:\Windows\System32\drmmgrtn32.dll

.text C:\Windows\Explorer.EXE[1880] kernel32.dll!CreateProcessA 75BC1C36 5 Bytes JMP 1000E375 C:\Windows\System32\drmmgrtn32.dll

.text C:\Windows\Explorer.EXE[1880] ADVAPI32.dll!CreateProcessAsUserW 75FDA8F5 5 Bytes JMP 1000E4B4 C:\Windows\System32\drmmgrtn32.dll

.text C:\Windows\Explorer.EXE[1880] ADVAPI32.dll!CreateProcessAsUserA 760248A6 5 Bytes JMP 1000E43F C:\Windows\System32\drmmgrtn32.dll

.text C:\Windows\Explorer.EXE[1880] ADVAPI32.dll!CreateProcessWithLogonW 760286A9 5 Bytes JMP 1000E529 C:\Windows\System32\drmmgrtn32.dll

.text C:\Windows\Explorer.EXE[1880] ADVAPI32.dll!CreateProcessWithTokenW 760286DF 5 Bytes JMP 1000E59E C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2800] kernel32.dll!ExitProcess 75BE3B54 5 Bytes JMP 05052422 C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)

.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2800] USER32.dll!MessageBoxA 75D2D619 5 Bytes JMP 050523CC C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)

.text C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[2800] USER32.dll!MessageBoxW 75D2D667 5 Bytes JMP 050523F7 C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] kernel32.dll!CreateProcessW 75BC1C01 5 Bytes JMP 1000E3CD C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] kernel32.dll!CreateProcessA 75BC1C36 5 Bytes JMP 1000E375 C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] ADVAPI32.dll!CreateProcessAsUserW 75FDA8F5 5 Bytes JMP 1000E4B4 C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] ADVAPI32.dll!CreateProcessAsUserA 760248A6 5 Bytes JMP 1000E43F C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] ADVAPI32.dll!CreateProcessWithLogonW 760286A9 5 Bytes JMP 1000E529 C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] ADVAPI32.dll!CreateProcessWithTokenW 760286DF 5 Bytes JMP 1000E59E C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] WS2_32.dll!closesocket 75CA330C 5 Bytes JMP 10011BF3 C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] WS2_32.dll!WSASocketW 75CA34EB 7 Bytes JMP 10011B1A C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] WS2_32.dll!connect 75CA40D9 5 Bytes JMP 10011B7D C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] WS2_32.dll!bind 75CA652F 5 Bytes JMP 10011AA4 C:\Windows\System32\drmmgrtn32.dll

.text C:\Program Files\Mozilla Firefox\firefox.exe[6940] WS2_32.dll!WSAConnect 75CAD7B0 5 Bytes JMP 10011BB2 C:\Windows\System32\drmmgrtn32.dll

 

---- User IAT/EAT - GMER 1.0.15 ----

 

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73FF7BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [740398C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73FFD3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73FEF527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73FF7599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73FEE43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7402B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [73FFD68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73FF012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73FF0095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73FE71F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7407D802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [740175E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73FEDAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73FE668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73FE66BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT C:\Windows\Explorer.EXE[1880] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73FF1E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

 

---- Devices - GMER 1.0.15 ----

 

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

 

---- Registry - GMER 1.0.15 ----

 

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys1bfb8cdb86

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys1e3d880371

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\[email protected] 0x85 0x56 0x02 0x1D ...

Reg HKLM\SYSTEM\ControlSet015\Services\BTHPORT\Parameters\Keys1bfb8cdb86 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet015\Services\BTHPORT\Parameters\Keys1e3d880371 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet015\Services\BTHPORT\Parameters\[email protected] 0x85 0x56 0x02 0x1D ...

 

---- EOF - GMER 1.0.15 ----

Share this post


Link to post
Share on other sites

Ok. Let's do some cleaning there.

 

 

Please visit this webpage for download links, and instructions for running ComboFix tool:

 

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

 

Please ensure you read this guide carefully first.

 

 

Please continue as follows:

  1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.
     
     
  2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

 

Please include the following reports for further review, and so we may continue cleansing the system:

 

C:\ComboFix.txt

New dds.txt log.

 

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Share this post


Link to post
Share on other sites

Okay, first is the ComboFix log:

 

ComboFix 09-08-09.03 - ChestinDSalisbury 08/09/2009 17:40.1.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3062.1480 [GMT -4:00]

Running from: c:\users\ChestinDSalisbury\Desktop\Combo-Fix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\$recycle.bin\S-1-5-21-161932567-4025616276-2336866693-500

c:\$recycle.bin\S-1-5-21-2068866768-3888667489-438035881-500

c:\users\CHESTI~1\AppData\Local\Temp\9F98.tmp

c:\users\ChestinDSalisbury\AppData\Local\Temp\9F98.tmp

c:\users\ChestinDSalisbury\AppData\Roaming200000006d2e068648C.manifest

c:\users\ChestinDSalisbury\AppData\Roaming200000006d2e068648O.manifest

c:\users\ChestinDSalisbury\AppData\Roaming200000006d2e068648P.manifest

c:\users\ChestinDSalisbury\AppData\Roaming200000006d2e068648S.manifest

c:\windows\Installer\162b4577.msi

c:\windows\Installer\735874.msi

c:\windows\Installer\735a12.msi

c:\windows\system32\18yk428opC3py.vbs

c:\windows\system32\N1bC2diGZTTQPMQ.vbs

c:\windows\system32\ohCbauKcmBi4H.vbs

c:\windows\system32\zUmLrhz.vbs

 

.

((((((((((((((((((((((((( Files Created from 2009-07-09 to 2009-08-09 )))))))))))))))))))))))))))))))

.

 

2009-08-09 22:01 . 2009-08-09 22:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-08-09 20:53 . 2009-08-09 20:53 74 ---ha-w- C:\aaw7boot.cmd

2009-08-07 15:19 . 2009-08-07 15:19 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\Malwarebytes

2009-08-07 15:19 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-07 15:18 . 2009-08-07 15:18 -------- d-----w- c:\programdata\Malwarebytes

2009-08-07 15:18 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-07 15:18 . 2009-08-07 15:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-07 13:36 . 2009-08-07 13:36 76192 ----a-w- c:\programdata\WebEx\WebEx\832\atsckernel.exe

2009-08-07 13:22 . 2009-08-07 13:22 131072 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\savapi3.dll

2009-08-02 13:02 . 2009-08-02 13:02 -------- d-----w- c:\program files\Trend Micro

2009-07-27 00:33 . 2009-07-27 00:33 121344 ------w- c:\windows\system32\drmmgrtn32.dll

2009-07-25 01:14 . 2009-07-25 01:14 713992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-07-20 18:06 . 2009-07-20 18:06 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\webex

2009-07-19 00:15 . 2009-07-19 00:15 -------- d-----w- c:\program files\Common Files\Sonic Shared

2009-07-19 00:15 . 2009-07-19 00:19 -------- d-----w- c:\program files\Roxio

2009-07-18 04:56 . 2009-01-09 20:18 27136 ----a-w- c:\windows\system32\drivers\RimSerial.sys

2009-07-16 05:48 . 2009-07-30 00:13 -------- d-----w- c:\program files\7-Zip

2009-07-16 03:59 . 2009-07-16 03:59 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\PCF-VLC

2009-07-16 01:25 . 2009-07-16 01:25 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\Participatory Culture Foundation

2009-07-16 01:24 . 2009-07-30 00:12 -------- d-----w- c:\program files\Participatory Culture Foundation

2009-07-15 07:50 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll

2009-07-15 07:50 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll

2009-07-15 07:50 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll

2009-07-15 07:50 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-09 18:44 . 2008-08-02 00:34 -------- d-----w- c:\programdata\Google Updater

2009-08-08 15:50 . 2009-01-19 15:59 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\Skype

2009-08-08 15:46 . 2008-12-22 03:52 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\Dropbox

2009-08-08 15:43 . 2008-02-16 21:41 12 ----a-w- c:\windows\bthservsdp.dat

2009-08-07 15:03 . 2009-07-20 18:05 -------- d-----w- c:\programdata\WebEx

2009-08-07 14:49 . 2008-08-02 00:37 -------- d-----w- c:\program files\Spyware Doctor

2009-08-07 13:36 . 2009-08-07 13:36 20376 ----a-w- c:\programdata\WebEx\WebEx\832\atashost.exe

2009-08-07 13:22 . 2009-08-07 13:22 131072 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\pcre.dll

2009-08-06 22:46 . 2008-08-19 14:33 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\FileZilla

2009-08-05 17:53 . 2009-04-17 19:37 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\Power Sound Editor Free

2009-08-02 17:24 . 2009-05-10 21:34 1356 ----a-w- c:\users\ChestinDSalisbury\AppData\Local\d3d9caps.dat

2009-08-01 16:44 . 2008-02-16 23:01 -------- d-----w- c:\programdata\Sonic

2009-07-31 12:01 . 2008-09-29 18:14 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2009-07-31 01:54 . 2009-06-23 19:33 -------- d-----w- c:\program files\Yahoo!

2009-07-30 00:13 . 2009-06-17 18:05 -------- d-----w- c:\program files\Comment Sniper

2009-07-27 02:16 . 2008-08-01 14:41 179512 ----a-w- c:\users\ChestinDSalisbury\AppData\Local\GDIPFONTCACHEV1.DAT

2009-07-21 21:52 . 2009-07-28 20:01 915456 ----a-w- c:\windows\system32\wininet.dll

2009-07-21 21:47 . 2009-07-28 20:01 109056 ----a-w- c:\windows\system32\iesysprep.dll

2009-07-21 21:47 . 2009-07-28 20:01 71680 ----a-w- c:\windows\system32\iesetup.dll

2009-07-21 20:13 . 2009-07-28 20:01 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-07-19 00:20 . 2008-02-16 22:58 -------- d-----w- c:\program files\Common Files\Roxio Shared

2009-07-19 00:20 . 2008-02-16 22:58 -------- d-----w- c:\program files\Common Files\PX Storage Engine

2009-07-19 00:15 . 2008-12-05 03:05 -------- d-----w- c:\programdata\Roxio

2009-07-18 05:06 . 2008-08-02 00:34 -------- d-----w- c:\program files\Google

2009-07-18 04:50 . 2008-08-01 23:09 -------- d-----w- c:\program files\Common Files\Research in Motion

2009-07-16 07:25 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2009-07-16 07:24 . 2008-03-03 14:12 -------- d-----w- c:\programdata\Microsoft Help

2009-07-16 05:35 . 2008-11-03 21:58 -------- d-----w- c:\program files\TechSmith

2009-07-16 05:35 . 2008-11-03 21:58 -------- d-----w- c:\programdata\TechSmith

2009-07-08 02:43 . 2009-04-03 03:24 -------- d-----w- c:\program files\FileZilla FTP Client

2009-07-07 21:45 . 2009-07-07 21:24 -------- d-----w- c:\programdata\Lavasoft

2009-07-07 21:25 . 2009-07-07 21:25 -------- dc-h--w- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

2009-07-07 21:24 . 2009-07-07 21:24 -------- d-----w- c:\program files\Lavasoft

2009-06-30 13:57 . 2008-09-29 18:14 11952 ----a-w- c:\windows\system32\avgrsstx.dll

2009-06-30 13:57 . 2008-09-29 18:14 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2009-06-23 19:35 . 2009-06-23 19:33 -------- d-----w- c:\programdata\Yahoo!

2009-06-23 02:39 . 2008-02-16 22:56 -------- d-----w- c:\program files\Common Files\Adobe

2009-06-23 00:00 . 2009-06-22 23:48 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\Download Manager

2009-06-22 19:23 . 2009-06-22 19:23 239088 ----a-w- c:\users\ChestinDSalisbury\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

2009-06-18 21:26 . 2009-06-18 21:26 -------- d-----w- c:\program files\Common Files\TechSmith Shared

2009-06-15 14:36 . 2009-06-15 14:36 -------- d-----w- c:\program files\TweetDeck

2009-06-11 15:52 . 2009-06-11 15:51 -------- d-----w- c:\program files\iTunes

2009-06-11 15:51 . 2009-06-11 15:51 -------- d-----w- c:\program files\iPod

2009-06-11 15:51 . 2008-08-02 02:07 -------- d-----w- c:\program files\Common Files\Apple

2009-06-11 15:47 . 2009-06-11 15:47 -------- d-----w- c:\program files\QuickTime

2009-06-11 15:09 . 2009-06-11 15:07 -------- d-----w- c:\users\ChestinDSalisbury\AppData\Roaming\MXSkypeRecorder

2009-06-11 05:23 . 2008-03-03 14:07 -------- d-----w- c:\program files\Microsoft Works

2009-06-05 17:57 . 2009-06-05 17:57 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe

2009-05-16 03:13 . 2009-05-16 03:13 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll

2008-08-02 00:36 . 2008-08-02 00:36 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2008-08-02 19:55 . 2008-08-02 19:55 88 --sh--r- c:\windows\System32\7397FF66E8.sys

2008-08-02 20:01 . 2008-08-02 19:55 2828 --sha-w- c:\windows\System32\KGyGaAvL.sys

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AOLOverlayIcon]

@="{AB0C8BE3-041C-47d6-8195-E089D32B38DD}"

[HKEY_CLASSES_ROOT\CLSID\{AB0C8BE3-041C-47d6-8195-E089D32B38DD}]

2007-10-05 17:54 303104 ------w- c:\ddi\OverIcon.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2008-09-07 07:20 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-11 24095528]

"RunSpySweeperScheduleAtStartup"="c:\windows\system32\msfeedssync.exe" [2009-07-21 13312]

"Google Update"="c:\users\ChestinDSalisbury\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-08-30 133104]

"CollaborationHost"="c:\windows\system32\p2phost.exe" [2008-01-21 192000]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]

"@BackupScheduler"="c:\program files\Online Backup\OnlineBackup.exe" [2009-01-16 611768]

"GoToMeeting"="c:\program files\Citrix\GoToMeeting\320\g2mstart.exe" [2008-11-04 31552]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"AdobeUpdater6"="c:\program files\Common Files\Adobe\Updater6\Adobe_Updater.exe" [2009-01-08 2521464]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-08 835584]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-19 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-19 154136]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-19 137752]

"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-09-19 311296]

"VAIO Center Access Bar"="c:\program files\sony\VAIO Center Access Bar\VCAB.exe" [2007-09-06 53248]

"VAIO Help and Support Demo"="c:\program files\Sony\VAIO Help and Support Demo\LaunchVHSD.exe" [2007-08-28 290816]

"VWLASU"="c:\program files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe" [2007-10-13 45056]

"VAIORegistration"="c:\program files\Sony\First Experience\WelcomeLauncher.exe" [2007-10-17 20480]

"VAIOSurvey"="c:\program files\Sony\VAIO Survey\Vista VAIO Survey.exe" [2007-07-20 577536]

"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-02 29744]

"eFax 4.3"="c:\program files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 116224]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-30 1948440]

"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-07 520024]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-04-06 4423680]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

 

c:\users\ChestinDSalisbury\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\program files\Dropbox\Dropbox.exe [2008-9-26 24096981]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2007-08-15 04:05 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~4\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *SsiEfr.exelsdelete

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{55688134-F902-47E3-9ADC-FE538BC0CBE5}"= UDP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player

"{AF5392A8-C5FB-4838-A27A-D9BCAA7D640D}"= TCP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player

"{7E9F0B31-E32B-4425-BAB9-31A9543BC718}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media

"{5DCEBC23-46A1-41DD-AEFA-973C7AC9FE8C}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media

"{EBB99B1A-C26F-4E05-A596-C2913E28BD4B}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{D8205B81-5EC5-49F5-8531-35F0C1F342C0}"= UDP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk

"{BDA96217-CC7C-4E70-9E0F-E9E27BBA86FE}"= TCP:c:\program files\Google\Google Talk\googletalk.exe:Google Talk

"{90290D69-FD28-407B-9EBE-0BEF7DDDEF20}"= UDP:c:\program files\SmartFTP Client\SmartFTP.exe:SmartFTP Client

"{06CED286-30E6-4391-8463-1A73E348DFAE}"= TCP:c:\program files\SmartFTP Client\SmartFTP.exe:SmartFTP Client

"{C7C0BFD2-6778-489B-A1ED-33A9100C76AF}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{D319850A-21AD-43B9-8DE9-74E250013F85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{080F244B-74CF-43F1-B543-52ABB212B3BF}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{FA4FFAD9-9295-4A35-8CFC-91476A495403}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

"{206E4CD1-C086-459D-BA15-EF8402E38FE2}"= UDP:58638:Pando P2P TCP Listening Port

"{D78E472F-1A9D-40FA-A585-073E78E68AA1}"= TCP:58638:Pando P2P UDP Listening Port

"{064EE03C-8665-420D-AB41-FE0FF4E5DD3F}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe

"TCP Query User{3424CCB8-6257-4B82-8833-7694EC906E37}c:\\program files\\pando networks\\pando\\pando.exe"= UDP:c:\program files\pando networks\pando\pando.exe:pando

"UDP Query User{DAFE7FF9-3D98-4355-8716-E9BDF45D1B42}c:\\program files\\pando networks\\pando\\pando.exe"= TCP:c:\program files\pando networks\pando\pando.exe:pando

"TCP Query User{FB5EFA32-0629-465D-9C1C-B2205362B49F}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox

"UDP Query User{CF4CE4EC-0267-4FC0-A5A2-DAB4CDDF79C3}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox

"TCP Query User{42322592-7A66-40DF-917B-5FB14D4DB924}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{C9BA00A6-6F08-4A85-898E-31C45D93166B}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"TCP Query User{C54D1985-BBEA-4257-BD7B-F837933CE74E}c:\\users\\chestindsalisbury\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= UDP:c:\users\chestindsalisbury\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe

"UDP Query User{44332B5C-18D7-4530-BD05-54E9C9A55DB8}c:\\users\\chestindsalisbury\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= TCP:c:\users\chestindsalisbury\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe

"TCP Query User{D523107C-95E8-4C3F-9FC4-BA0FAECB6E87}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"UDP Query User{7DC99063-9F87-420A-82EF-0C1F5410664F}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

"{B1E81AC6-0ADD-4C24-A081-8814184297E0}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{F3D70E98-B8F9-4243-A0DF-EB3ACE113D60}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{731763E8-0D15-4A35-8F26-63BC80E6E7A9}"= c:\program files\Skype\Phone\Skype.exe:Skype

"{19FF6424-49CB-4838-BB26-086D0263C609}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync

"{131BD3F8-9D1C-4512-8787-9374EC623CB8}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes

"{84F91FD4-7635-46C4-81A9-869ABF5CC3E9}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

"{4A2F3787-36D0-43FB-AB06-47B8471CECE7}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

"{AB44D610-E383-449D-ABE6-045AFC83A911}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

"TCP Query User{D77226F3-3F5D-4617-A2D7-9D863CFEE76C}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger

"UDP Query User{E053E612-149F-416E-93EB-714F0A0ADD7A}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger

"TCP Query User{55CA5678-A578-4E82-B6DE-DDEFFADAF92E}c:\\program files\\participatory culture foundation\\miro\\miro_downloader.exe"= UDP:c:\program files\participatory culture foundation\miro\miro_downloader.exe:Miro_Downloader

"UDP Query User{1406A6F5-C066-4D82-897D-F0E4C58E741E}c:\\program files\\participatory culture foundation\\miro\\miro_downloader.exe"= TCP:c:\program files\participatory culture foundation\miro\miro_downloader.exe:Miro_Downloader

"TCP Query User{30D4B94D-447A-4106-9060-27DE2D33A5C7}c:\\windows\\system32\\ftp.exe"= UDP:c:\windows\system32\ftp.exe:File Transfer Program

"UDP Query User{FBD6ECCD-DC60-4912-90EC-1C15DF70BD9F}c:\\windows\\system32\\ftp.exe"= TCP:c:\windows\system32\ftp.exe:File Transfer Program

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)

 

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [7/7/2009 5:45 PM 64160]

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [5/18/2009 9:07 AM 130936]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [9/29/2008 2:14 PM 335752]

R2 atashost;WebEx Service Host for Support Center;c:\windows\System32\atashost.exe [8/7/2009 9:37 AM 20376]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/29/2008 2:13 PM 298776]

R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [1/11/2008 5:50 PM 30312]

R2 regi;regi;c:\windows\System32\drivers\regi.sys [4/18/2007 12:09 AM 11032]

R2 uCamMonitor;CamMonitor;c:\program files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe [3/3/2008 10:10 AM 125440]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\System32\drivers\ArcSoftKsUFilter.sys [3/3/2008 10:10 AM 17920]

R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\System32\drivers\lmvac.sys [8/3/2008 9:50 PM 18912]

R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [11/24/2008 10:31 PM 29263712]

R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\System32\drivers\R5U870FLx86.sys [2/16/2008 6:02 PM 73472]

R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\System32\drivers\R5U870FUx86.sys [2/16/2008 6:02 PM 43904]

R3 SFEP;Sony Firmware Extension Parser;c:\windows\System32\drivers\SFEP.sys [2/16/2008 6:03 PM 9344]

R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [2/16/2008 6:03 PM 818688]

S2 gupdate1c8f5d17bcf56f6;Google Update Service (gupdate1c8f5d17bcf56f6);c:\program files\Google\Update\GoogleUpdate.exe [8/3/2008 9:30 PM 133104]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1029456]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [2/16/2008 5:55 PM 28464]

S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [5/30/2009 4:17 PM 55280]

S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 6:08 PM 533360]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [8/1/2008 8:36 PM 29744]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/23/2009 7:17 PM 348752]

S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [3/3/2008 10:23 AM 745472]

S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [3/3/2008 10:23 AM 397312]

S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [3/3/2008 10:23 AM 1089536]

S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2/16/2008 7:04 PM 292128]

S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2/16/2008 7:05 PM 79136]

 

--- Other Services/Drivers In Memory ---

 

*NewlyCreated* - AUJASNKJ

*Deregistered* - aujasnkj

*Deregistered* - mchInjDrv

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs REG_MULTI_SZ BthServ

 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

 

2009-08-09 c:\windows\Tasks\Ad-Aware Update (Daily).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 21:44]

 

2009-08-08 c:\windows\Tasks\DesktopMentorDaily.job

- c:\program files\DotComSecrets\DesktopMentor\DesktopMentor.exe [2008-10-06 13:23]

 

2009-08-09 c:\windows\Tasks\DesktopMentorDynamic.job

- c:\program files\DotComSecrets\DesktopMentor\DesktopMentor.exe [2008-10-06 13:23]

 

2009-08-09 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-02 15:28]

 

2009-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2008-08-04 13:06]

 

2009-08-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2008-08-04 13:06]

 

2009-08-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1743907559-1835032200-1908479622-1000Core.job

- c:\users\ChestinDSalisbury\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-02 13:06]

 

2009-08-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1743907559-1835032200-1908479622-1000UA.job

- c:\users\ChestinDSalisbury\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-02 13:06]

 

2009-08-09 c:\windows\Tasks\User_Feed_Synchronization-{02279225-1377-4755-8C33-35CC4E8F7A50}.job

- c:\windows\system32\msfeedssync.exe [2009-07-28 20:13]

.

- - - - ORPHANS REMOVED - - - -

 

HKLM-Run-commentsniper - c:\program files\Comment Sniper\CommentSniper.exe

 

 

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

Trusted Zone: topproduceronline.com\www

FF - ProfilePath - c:\users\ChestinDSalisbury\AppData\Roaming\Mozilla\Firefox\Profiles\jttamvr7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk

FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff30\gears.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npxsciter.dll

FF - plugin: c:\program files\Picasa2\npPicasa2.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: c:\users\ChestinDSalisbury\AppData\Local\Google\Update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\users\ChestinDSalisbury\AppData\Roaming\Mozilla\plugins\npatgpc.dll

FF - plugin: c:\users\ChestinDSalisbury\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4E7FF8BB-0A5A-4AA3-B764-B39BA9A13E38", "AllAccess");

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CIDB24F189F-FB14-4EFD-8B9D-217EC6C84EA1", "AllAccess");

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID86ED3659-02F6-465D-8F19-A9334614CCC3", "AllAccess");

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID5D7F48C0-CB49-4ea6-97D4-04F4EACC2F3B", "AllAccess");

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B", "AllAccess");

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CIDA43C6FC7-09F6-4E04-B8E3-683F3BDFEF7C", "AllAccess");

c:\program files\Mozilla Firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4C8D6404-A9F6-4236-8488-6C5732CB3BFA", "AllAccess");.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-09 18:02

Windows 6.0.6001 Service Pack 1 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}00\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}01\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}02\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'winlogon.exe'(768)

c:\windows\System32\drmmgrtn32.dll

 

- - - - - - - > 'lsass.exe'(760)

c:\windows\System32\drmmgrtn32.dll

.

Completion time: 2009-08-09 18:08

ComboFix-quarantined-files.txt 2009-08-09 22:08

 

Pre-Run: 25,502,990,336 bytes free

Post-Run: 25,609,216,000 bytes free

 

Current=1 Default=1 Failed=0 LastKnownGood=15 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15

371 --- E O F --- 2009-08-07 05:32

Share this post


Link to post
Share on other sites

And here's the DDS log. I did a quick Google search and it looks like everything might be back to normal, but I'll wait to get your final diagnosis.

 

* * * * * * *

 

DDS (Ver_09-07-30.01) - NTFSx86

Run by ChestinDSalisbury at 20:20:59.35 on Sun 08/09/2009

Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_13

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3062.1716 [GMT -4:00]

 

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning enabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

 

============== Running Processes ===============

 

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe

C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

C:\Program Files\Google\Google Talk\googletalk.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Common Files\Research in Motion\Auto Update\RIMAutoUpdate.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\Online Backup\OnlineBackup.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\eFax Messenger 4.3\J2GTray.exe

C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe

C:\Program Files\Dropbox\Dropbox.exe

C:\Users\ChestinDSalisbury\AppData\Local\Google\Update\1.2.183.7\GoogleCrashHandler.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Windows\system32\atashost.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\PSIService.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Users\ChestinDSalisbury\Software\Malware\dds.scr

C:\Windows\system32\wbem\wmiprvse.exe

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.yahoo.com/

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer.5.30.0\gears.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File

uRun: [sidebar] "c:\program files\windows sidebar\sidebar.exe" /autoRun

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [RunSpySweeperScheduleAtStartup] "c:\windows\system32\msfeedssync.exe" /ScheduleSweep=User_Feed_Synchronization-{BC296A9B-7063-45E3-93DB-31EAD8970815}

uRun: [Google Update] "c:\users\chestindsalisbury\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [CollaborationHost] c:\windows\system32\p2phost.exe -s

uRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler

uRun: [@BackupScheduler] c:\program files\online backup\OnlineBackup.exe

uRun: [GoToMeeting] c:\program files\citrix\gotomeeting\320\g2mstart.exe "/Trigger RunAtLogon"

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [AdobeUpdater6] "c:\program files\common files\adobe\updater6\Adobe_Updater.exe"

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [iSBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe"

mRun: [VAIO Center Access Bar] "c:\program files\sony\vaio center access bar\VCAB.exe" 1

mRun: [VAIO Help and Support Demo] "c:\program files\sony\vaio help and support demo\LaunchVHSD.exe"

mRun: [VWLASU] "c:\program files\sony\vaio pc wireless lan wizard\AutoLaunchWLASU.exe"

mRun: [VAIORegistration] "c:\program files\sony\first experience\WelcomeLauncher.exe"

mRun: [VAIOSurvey] "c:\program files\sony\vaio survey\Vista VAIO Survey.exe"

mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

mRun: [eFax 4.3] "c:\program files\efax messenger 4.3\J2GDllCmd.exe" /R

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe

mRun: [blackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"

dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe

StartupFolder: c:\users\chesti~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\program files\dropbox\Dropbox.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\aolddi~1.lnk - c:\ddi\AOLICON.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\efax43~1.lnk - c:\program files\efax messenger 4.3\J2GTray.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\google~1.lnk - c:\program files\google\google calendar sync\GoogleCalendarSync.exe

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer.5.30.0\gears.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

Trusted Zone: topproduceronline.com\www

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1249182936708

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

Notify: igfxcui - igfxdev.dll

Notify: VESWinlogon - VESWinlogon.dll

AppInit_DLLs: c:\progra~1\google\google~4\googledesktopnetwork3.dll c:\windows\system32\avgrsstx.dll,c:\windows\system32\drmmgrtn32.dll

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\users\chesti~1\appdata\roaming\mozilla\firefox\profiles\jttamvr7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk

FF - component: c:\program files\google\google gears\firefox\lib\ff30\gears.dll

FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npxsciter.dll

FF - plugin: c:\program files\picasa2\npPicasa2.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\chestindsalisbury\appdata\local\google\update\1.2.183.7\npGoogleOneClick8.dll

FF - plugin: c:\users\chestindsalisbury\appdata\roaming\mozilla\plugins\npatgpc.dll

FF - plugin: c:\users\chestindsalisbury\appdata\roaming\mozilla\plugins\npgoogletalk.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

 

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4E7FF8BB-0A5A-4AA3-B764-B39BA9A13E38", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CIDB24F189F-FB14-4EFD-8B9D-217EC6C84EA1", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID86ED3659-02F6-465D-8F19-A9334614CCC3", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID5D7F48C0-CB49-4ea6-97D4-04F4EACC2F3B", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CIDA43C6FC7-09F6-4E04-B8E3-683F3BDFEF7C", "AllAccess");

c:\program files\mozilla firefox\defaults\pref\activexFF15.js - pref("capability.policy.default.ClassID.CID4C8D6404-A9F6-4236-8488-6C5732CB3BFA", "AllAccess");

============= SERVICES / DRIVERS ===============

 

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-7 64160]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-5-18 130936]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-9-29 335752]

R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2009-8-7 20376]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-9-29 298776]

R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-18 11032]

R2 uCamMonitor;CamMonitor;c:\program files\arcsoft\magic-i visual effects\uCamMonitor.exe [2008-3-3 125440]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [2008-3-3 17920]

R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-8-3 18912]

R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]

R3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\drivers\R5U870FLx86.sys [2008-2-16 73472]

R3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\drivers\R5U870FUx86.sys [2008-2-16 43904]

R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2008-2-16 9344]

R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2008-2-16 818688]

S2 gupdate1c8f5d17bcf56f6;Google Update Service (gupdate1c8f5d17bcf56f6);c:\program files\google\update\GoogleUpdate.exe [2008-8-3 133104]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2008-2-16 28464]

S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-5-30 55280]

S3 fsssvc;Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-8-1 29744]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-23 348752]

S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2008-3-3 745472]

S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\sony\vaio media integrated server\platform\SV_Httpd.exe [2008-3-3 397312]

S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2008-3-3 1089536]

S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2008-2-16 292128]

S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2008-2-16 79136]

 

=============== Created Last 30 ================

 

2009-08-09 19:56 <DIR> --dsh--- C:\$RECYCLE.BIN

2009-08-09 17:30 216,064 a------- c:\windows\PEV.exe

2009-08-09 17:30 161,792 a------- c:\windows\SWREG.exe

2009-08-09 17:30 98,816 a------- c:\windows\sed.exe

2009-08-07 11:19 <DIR> --d----- c:\users\chesti~1\appdata\roaming\Malwarebytes

2009-08-07 11:19 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-07 11:18 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-08-07 11:18 <DIR> --d----- c:\programdata\Malwarebytes

2009-08-07 11:18 <DIR> --d----- c:\progra~2\Malwarebytes

2009-08-07 11:18 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware

2009-08-07 09:37 76,192 a------- c:\windows\system32\atsckernel.exe

2009-08-07 09:37 20,376 a------- c:\windows\system32\atashost.exe

2009-08-02 09:02 <DIR> --d----- c:\program files\Trend Micro

2009-07-20 14:06 <DIR> --d----- c:\users\chesti~1\appdata\roaming\webex

2009-07-20 14:05 <DIR> --d----- c:\programdata\WebEx

2009-07-20 14:05 <DIR> --d----- c:\progra~2\WebEx

2009-07-18 20:15 <DIR> --d----- c:\program files\common files\Sonic Shared

2009-07-18 20:15 <DIR> --d----- c:\program files\Roxio

2009-07-18 00:56 27,136 a------- c:\windows\system32\drivers\RimSerial.sys

2009-07-15 23:59 <DIR> --d----- c:\users\chesti~1\appdata\roaming\PCF-VLC

2009-07-15 21:25 <DIR> --d----- c:\users\chesti~1\appdata\roaming\Participatory Culture Foundation

2009-07-15 21:24 <DIR> --d----- c:\program files\Participatory Culture Foundation

2009-07-15 03:50 156,672 a------- c:\windows\system32\t2embed.dll

2009-07-15 03:50 289,792 a------- c:\windows\system32\atmfd.dll

2009-07-15 03:50 72,704 a------- c:\windows\system32\fontsub.dll

2009-07-15 03:50 10,240 a------- c:\windows\system32\dciman32.dll

 

==================== Find3M ====================

 

2009-07-31 08:01 335,752 a------- c:\windows\system32\drivers\avgldx86.sys

2009-07-21 17:52 915,456 a------- c:\windows\system32\wininet.dll

2009-07-21 17:47 109,056 a------- c:\windows\system32\iesysprep.dll

2009-07-21 17:47 71,680 a------- c:\windows\system32\iesetup.dll

2009-07-21 16:13 133,632 a------- c:\windows\system32\ieUnatt.exe

2009-07-18 00:58 143,360 a------- c:\windows\inf\infstrng.dat

2009-07-18 00:58 51,200 a------- c:\windows\inf\infpub.dat

2009-07-18 00:58 86,016 a------- c:\windows\inf\infstor.dat

2009-07-07 17:44 15,688 a------- c:\windows\system32\lsdelete.exe

2009-07-07 17:44 64,160 a------- c:\windows\system32\drivers\Lbd.sys

2009-06-30 09:57 11,952 a------- c:\windows\system32\avgrsstx.dll

2009-04-21 15:56 264 a------- c:\users\chesti~1\appdata\roaming\wklnhst.dat

2009-01-25 19:24 32 a------- c:\programdata\ezsid.dat

2009-01-25 19:24 32 a------- c:\progra~2\ezsid.dat

2008-08-01 21:29 665,600 a------- c:\windows\inf\drvindex.dat

2008-01-20 22:43 174 a--sh--- c:\program files\desktop.ini

2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib409\perfi.dat

2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib409\perfh.dat

2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib409\perfd.dat

2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib409\perfc.dat

2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib00\perfi.dat

2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib00\perfh.dat

2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib00\perfd.dat

2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib00\perfc.dat

2008-08-02 15:55 88 ---shr-- c:\windows\system32\7397FF66E8.sys

2008-08-02 16:01 2,828 a--sh--- c:\windows\system32\KGyGaAvL.sys

 

============= FINISH: 20:21:56.96 ===============

Share this post


Link to post
Share on other sites

Hi,

 

Upload following file to Virustotal and post back the results or a link to the results:

c:\windows\system32\drmmgrtn32.dll

 

 

Get update 9.1.3 for Adobe Reader here or uninstall Adobe Reader and get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.

 

Uninstall vulnerable Flash versions by following instructions here. Fresh version can be obtained here.

 

 

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

 

Updating Java:

  • Download the latest version of Java Runtime Environment (JRE) 6 Update 15.
  • Click the
    Download
    button to the right.
  • Select Windows on platform combobox and check the box that says:
    Accept License Agreement. Click continue.
     
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u15-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.

 

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

 

Double-click ATF Cleaner.exe to open it

 

Under Main choose:

Windows Temp

Current User Temp

All Users Temp

Cookies

Temporary Internet Files

Java Cache

*The other boxes are optional*

Then click the Empty Selected button.

 

If you use Firefox:

Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

 

If you use Opera:

Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

 

Click Exit on the Main menu to close the program.

 

 

Kaspersky Online Scanner

 

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

 

  • Read the requirements and privacy statement then click on the Accept button.

  • The program will launch and start to download the latest definition files.

  • You will be prompted to install an application from Kaspersky. Click Run

  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives

  • Click on My Computer under Scan.

  • Once the scan is complete, it will display the results. Click on View Scan Report.

  • Click on Save Report As....

  • Change the Files of type to Text file (.txt) before clicking on the Save button.

  • Save this report to a convenient place.

  • Copy and paste that information into your topic.

  • The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.

If you need a tutorial, see here

Share this post


Link to post
Share on other sites

Here's the Virustotal results. Will post the other results after they've completed.

 

* * * * * * * * * * * * * * * *

 

Antivirus Version Last Update Result

a-squared 4.5.0.24 2009.08.10 -

AhnLab-V3 5.0.0.2 2009.08.10 -

AntiVir 7.9.0.248 2009.08.10 -

Antiy-AVL 2.0.3.7 2009.08.10 -

Authentium 5.1.2.4 2009.08.10 -

Avast 4.8.1335.0 2009.08.10 -

AVG 8.5.0.406 2009.08.10 -

BitDefender 7.2 2009.08.11 -

CAT-QuickHeal 10.00 2009.08.10 -

ClamAV 0.94.1 2009.08.10 -

Comodo 1937 2009.08.11 -

DrWeb 5.0.0.12182 2009.08.11 -

eSafe 7.0.17.0 2009.08.10 -

eTrust-Vet 31.6.6670 2009.08.10 -

F-Prot 4.4.4.56 2009.08.10 -

F-Secure 8.0.14470.0 2009.08.10 -

Fortinet 3.120.0.0 2009.08.10 -

GData 19 2009.08.10 -

Ikarus T3.1.1.64.0 2009.08.10 -

Jiangmin 11.0.800 2009.08.10 -

K7AntiVirus 7.10.815 2009.08.10 -

Kaspersky 7.0.0.125 2009.08.10 -

McAfee 5705 2009.08.10 -

McAfee+Artemis 5705 2009.08.10 -

McAfee-GW-Edition 6.8.5 2009.08.10 -

Microsoft 1.4903 2009.08.10 -

NOD32 4323 2009.08.10 -

Norman 6.01.09 2009.08.10 -

nProtect 2009.1.8.0 2009.08.10 -

Panda 10.0.0.14 2009.08.10 -

PCTools 4.4.2.0 2009.08.10 -

Prevx 3.0 2009.08.11 -

Rising 21.42.04.00 2009.08.10 -

Sophos 4.44.0 2009.08.10 -

Sunbelt 3.2.1858.2 2009.08.10 -

Symantec 1.4.4.12 2009.08.10 -

TheHacker 6.3.4.3.379 2009.08.10 -

TrendMicro 8.950.0.1094 2009.08.10 -

VBA32 3.12.10.9 2009.08.10 -

ViRobot 2009.8.10.1877 2009.08.10 -

VirusBuster 4.6.5.0 2009.08.10 -

Additional information

File size: 284672 bytes

MD5...: b2ae82d82c142eab4a1c57438e1ff414

SHA1..: 618adf736ce6d287418e9cf1fb01ea7049d0ed38

SHA256: 156fc93d50994a4ebe9b55813f631b0b3c527027eef6cf9b2c6475005614c008

ssdeep: 6144:Ut+xTVI+0/ym+BDCDsGaS2pnR3fjlEo5cDrd3mQxos5pnMJvnr:9xhI+AkD

CDsGaS2pR3imns5p8r

PEiD..: -

TrID..: File type identification

DirectShow filter (46.7%)

Windows OCX File (28.6%)

Win64 Executable Generic (19.8%)

Win32 Executable Generic (1.9%)

Win32 Dynamic Link Library (generic) (1.7%)

PEInfo: PE Structure information

 

( base data )

entrypointaddress.: 0x14ccb

timedatestamp.....: 0x4791a6aa (Sat Jan 19 07:28:42 2008)

machinetype.......: 0x14c (I386)

 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x4008b 0x40200 6.62 d2a3afe619cef64c899e20273206ea08

.data 0x42000 0x2a59 0x2c00 3.67 3f44959650d331935a620328e22e0600

.rsrc 0x45000 0x4e0 0x600 3.24 110dbe19e64a95826613b95585e89f6d

.reloc 0x46000 0x1e14 0x2000 6.51 6e0c8fe09afdcad0613054491befe925

 

( 11 imports )

> msvcrt.dll: _adjust_fdiv, _wfopen, _amsg_exit, malloc, atol, _initterm, _XcptFilter, wcsrchr, [email protected]@Z, _wcsnicmp, free, wcsncmp, fread, fclose, [email protected]@Z, memset, fprintf, fflush, memmove, _onexit, _lock, __dllonexit, _unlock, realloc, _CIsqrt, _CIpow, _vsnprintf, _errno, [email protected]@Z, _wcsicmp, _purecall, _vsnwprintf, memcpy, [email protected]@Z

> ntdll.dll: RtlUnwind

> KERNEL32.dll: ReadFile, SetFilePointer, LockFileEx, UnlockFileEx, SetEndOfFile, GetFileSize, FlushFileBuffers, GetModuleHandleA, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, InterlockedCompareExchange, CreateDirectoryW, RemoveDirectoryW, ExpandEnvironmentStringsW, GetWindowsDirectoryW, GetCurrentThread, GetDateFormatA, GetTimeFormatA, WriteFile, CloseHandle, FindFirstFileW, FindNextFileW, FindClose, CopyFileW, CreateFileW, GetFileAttributesW, SetFileAttributesW, lstrlenW, RaiseException, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, GetLastError, GetModuleFileNameW, InterlockedIncrement, InterlockedDecrement, FreeLibrary, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetModuleHandleW, SetThreadLocale, GetThreadLocale, GetVersionExA, GetProcAddress, LoadLibraryA, GetVersion, LockResource, FindResourceExW, HeapFree, GetProcessHeap, HeapAlloc, GetVersionExW, GetSystemDirectoryW, LoadLibraryW, DeleteFileW, Sleep, VirtualProtect, VirtualAlloc, HeapDestroy, HeapReAlloc, HeapSize, InterlockedExchange, lstrlenA, OutputDebugStringA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, LocalFree, GetSystemTime, FileTimeToSystemTime, SystemTimeToFileTime, SetLastError, InitializeCriticalSectionAndSpinCount, VirtualFree, DeviceIoControl, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, GetDiskFreeSpaceA, GlobalMemoryStatus, GetLocalTime, UnmapViewOfFile, ExitProcess, LocalAlloc, MapViewOfFile, lstrcmpiW, CreateFileMappingW

> ole32.dll: CoTaskMemFree, StringFromGUID2, CoCreateInstance, StgOpenStorage, CoTaskMemRealloc, CoTaskMemAlloc, StringFromCLSID, PropVariantClear

> OLEAUT32.dll: -, -, -, -, -, -, -, -, -

> USER32.dll: UnregisterClassA, CharNextW

> SHELL32.dll: SHGetFileInfoW

> ADVAPI32.dll: RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, RegDeleteValueW, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, RegQueryInfoKeyW, RegSetValueExA, RegCreateKeyExA, UnregisterTraceGuids, ConvertStringSecurityDescriptorToSecurityDescriptorW, SetFileSecurityW, RegQueryValueExW, RegQueryValueExA, RegOpenKeyExA, GetSecurityDescriptorDacl, CreatePrivateObjectSecurityEx, GetNamedSecurityInfoW, SetNamedSecurityInfoW, GetSecurityDescriptorSacl, DestroyPrivateObjectSecurity, OpenThreadToken, OpenProcessToken

> VERSION.dll: GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW

> RPCRT4.dll: UuidCreate

> WINTRUST.dll: CryptCATAdminReleaseContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminAcquireContext, CryptCATCatalogInfoFromContext

 

( 5 exports )

DllCanUnloadNow, DllGetClassObject, DllMain, DllRegisterServer, DllUnregisterServer

PDFiD.: -

RDS...: NSRL Reference Data Set

Share this post


Link to post
Share on other sites

Any progress with other steps? I read users have had problems getting Kaspersky online scanner (KOS) work (some problem on vendor side). You may use following scanner if KOS fails.

 

Download the latest version of Kaspersky Virus Removal Tool

 

* Close all other applications and double-click and run the installer.

* When AVPTool starts, select all the scanable items except for CD-ROM drives and click the Scan button.

* If malware is detected, don't remove anything.

* After the scan finishes, don't neutralize anything.

* In the Scan window click the Reports button and select Save to file.

* Name the report AVPT.txt, and save it to the Desktop.

* Close AVPTool.

* You will be prompted if you want to uninstall the program; click Yes.

* You will then be prompted that to complete the uninstallation, the computer must be restarted. Select Yes to restart the system.

* Copy and paste the first part of the report (Detected) that you saved in your next reply. Do not include the longer list marked Events.

Share this post


Link to post
Share on other sites

Due to lack of feedback, this topic has been closed.

 

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

 

Everyone else please begin a New Topic.

 

Thank You !

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this