Here is my DDS,
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Michael at 17:27:14.72 on Wed 03/30/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3326.1917 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\System32\StkASv2K.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ManyCam\Bin\ManyCam.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Fraps\fraps.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Audacity\audacity.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Michael\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = my.daemon-search.com
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~2\SEARCH~1.DLL
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\speedb~2\toolbar\grabber.dll
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [Google Update] "c:\users\michael\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [ManyCam] "c:\program files\manycam\bin\ManyCam.exe" /silent
uRun: [SpeedBitVideoAccelerator] "c:\program files\speedbit video accelerator\VideoAccelerator.exe" /startup
uRun: [AdobeBridge]
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [UVS10 Preload] c:\program files\ulead systems\ulead videostudio se dvd\uvPL.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\bdarem~1.lnk - c:\program files\usb tv\em28xx\BDARemote.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: UACDisableNotify = 0 (0x0)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\program files\speedbit video accelerator\SBLSP.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Notify: AtiExtEvent - Ati2evxx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\michael\appdata\roaming\mozilla\firefox\profiles\xgjyuxwc.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://my.daemon-search.com/
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - component: c:\program files\speedbit video downloader\spfirefox\components\Engine.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol500.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\id software\quakelive\npquakezero.dll
FF - plugin: c:\users\michael\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl3af2dfa1;MpKsl3af2dfa1;c:\programdata\microsoft\microsoft antimalware\definition updates\{a4a66da7-a6d3-4a5f-816b-98eb3cfd2b8a}\MpKsl3af2dfa1.sys [2011-3-30 28752]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-7-13 20992]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-1-15 1153368]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\speedb~1\videoacceleratorservice.exe -start -scm --> c:\progra~1\speedb~1\VideoAcceleratorService.exe -start -scm [?]
R3 HPKBCCID;HP Keyboard Smart Card Driver;c:\windows\system32\drivers\HPKBCCID.sys [2006-11-7 46976]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-4-14 45736]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-7-1 34896]
S3 StkTMini;Syntek AVStream USB2.0 ATV;c:\windows\system32\drivers\StkTMini.sys [2011-2-19 468096]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-15 1343400]
.
=============== Created Last 30 ================
.
2011-03-30 21:14:00 -------- d-----w- c:\program files\Audacity
2011-03-30 21:06:46 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2011-03-30 20:19:19 28752 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{a4a66da7-a6d3-4a5f-816b-98eb3cfd2b8a}\MpKsl3af2dfa1.sys
2011-03-30 01:41:55 -------- d-----w- c:\users\michael\appdata\local\QuakeLiveConfigGenerator
2011-03-29 00:20:40 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-03-29 00:20:39 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{656c848e-1a18-453a-bc83-366613f2ac02}\gapaengine.dll
2011-03-29 00:20:20 6792528 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{a4a66da7-a6d3-4a5f-816b-98eb3cfd2b8a}\mpengine.dll
2011-03-29 00:02:26 -------- d-----w- c:\users\michael\appdata\roaming\wolfcamql
2011-03-29 00:01:01 -------- d-----w- c:\users\michael\wolfcam
2011-03-27 23:26:36 -------- d-----w- c:\users\michael\appdata\roaming\Warsow 0.6
2011-03-27 23:26:36 -------- d-----w- c:\program files\Warsow 0.6
2011-03-27 22:31:47 -------- d-----w- c:\progra~2\id Software
2011-03-27 22:03:45 -------- d-----w- c:\program files\iPod
2011-03-27 22:03:44 -------- d-----w- c:\program files\iTunes
2011-03-27 21:55:25 -------- d-----w- c:\users\michael\appdata\local\ManyCam
2011-03-27 21:14:37 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-03-27 04:10:28 -------- d-----w- c:\users\michael\appdata\local\Desura
2011-03-27 04:07:09 -------- d-----w- c:\progra~2\Desura
2011-03-27 04:07:06 -------- d-----w- c:\program files\Desura
2011-03-24 21:00:28 -------- d-----w- c:\users\michael\appdata\local\LAG
2011-03-24 21:00:28 -------- d-----w- c:\progra~2\LAG
2011-03-24 21:00:02 -------- d-----w- c:\windows\system32\AGEIA
2011-03-24 20:59:53 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2011-03-22 20:07:13 -------- d-----w- c:\users\michael\appdata\roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-03-20 22:41:17 160560 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2011-03-20 22:40:36 44784 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2011-03-20 22:40:28 -------- d-----w- c:\program files\Oracle
2011-03-18 20:53:47 -------- d-----w- c:\progra~2\regid.1986-12.com.adobe
2011-03-17 23:45:53 -------- d-----w- c:\program files\Window Title Changer
2011-03-17 23:34:34 -------- d-----w- c:\program files\common files\Akamai
2011-03-17 22:09:53 -------- d-----w- c:\program files\common files\Macrovision Shared
2011-03-13 07:37:21 -------- d-----w- c:\program files\YouTube Downloader
2011-03-11 07:14:50 -------- d-----w- c:\users\michael\appdata\local\CrashRpt
2011-03-11 05:44:58 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
2011-03-11 04:44:50 -------- d-----w- c:\program files\PowerISO
2011-03-08 23:35:20 33280 ----a-w- c:\windows\system32\HUFFYUV.DLL
2011-03-08 23:33:45 -------- d-----w- c:\program files\VirtualDub-1.9.11
2011-03-08 20:43:45 802304 ----a-w- c:\windows\system32\FntCache.dll
2011-03-08 20:43:45 739840 ----a-w- c:\windows\system32\d2d1.dll
2011-03-08 20:43:45 1074176 ----a-w- c:\windows\system32\DWrite.dll
2011-03-08 20:43:44 642048 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-08 20:43:44 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-03-08 20:43:43 850432 ----a-w- c:\windows\system32\sbe.dll
2011-03-08 20:43:43 2690560 ----a-w- c:\windows\system32\mstscax.dll
2011-03-08 20:43:43 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-08 20:43:42 1034240 ----a-w- c:\windows\system32\mstsc.exe
2011-03-06 20:31:47 -------- d-----w- C:\SauerbratenPortable
2011-03-06 20:19:16 -------- d-----w- c:\program files\common files\Pinnacle
2011-03-06 20:18:54 -------- d-----w- c:\users\michael\appdata\local\Downloaded Installations
2011-03-06 20:18:47 -------- d-----w- c:\progra~2\Pinnacle Studio Ultimate
2011-03-06 20:17:55 69632 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\Studio.exe
2011-03-06 20:17:55 69632 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_ContentTransfer.exe
2011-03-06 20:17:55 65536 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_ReadMe.exe
2011-03-06 20:17:55 49152 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_Check3D.exe
2011-03-06 20:17:55 45056 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_Help_HH.exe
2011-03-06 20:17:55 434176 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_GuidedTour.exe
2011-03-06 20:17:55 40960 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_AMCap.exe
2011-03-06 20:14:55 -------- d-----w- c:\program files\common files\Yahoo!
2011-03-06 20:14:54 -------- d-----w- c:\program files\Pinnacle
2011-03-06 04:00:11 50688 ----a-w- c:\windows\system32\wbhelp2.dll
2011-03-06 04:00:11 479298 ----a-w- c:\windows\system32\wbocx.ocx
2011-03-06 03:59:46 -------- d-----w- c:\program files\DAP
2011-03-06 02:42:40 709456 ----a-w- c:\windows\isRS-000.tmp
2011-03-01 21:51:55 -------- d-----w- c:\progra~2\AVS4YOU
2011-03-01 21:51:49 -------- d-----w- c:\users\michael\appdata\roaming\AVS4YOU
2011-03-01 21:46:38 10833920 ----a-w- c:\windows\system32\libmfxsw32.dll
2011-03-01 21:46:37 10915840 ----a-w- c:\windows\system32\libmfxhw32.dll
2011-03-01 21:46:31 -------- d-----w- c:\program files\common files\AVSMedia
2011-03-01 21:46:28 24576 ----a-w- c:\windows\system32\msxml3a.dll
2011-03-01 21:46:28 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2011-03-01 21:46:28 -------- d-----w- c:\program files\AVS4YOU
.
==================== Find3M ====================
.
2011-03-28 01:42:02 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-03-28 01:42:02 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-03-28 01:41:22 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-02-26 01:19:32 41872 ----a-w- c:\windows\system32\xfcodec.dll
2011-02-17 22:06:08 135472 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2011-02-03 06:54:36 86016 ----a-w- c:\windows\system32\frapsvid.dll
2011-02-03 02:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 23:53:48 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-01-20 21:31:17 22328 ----a-w- c:\users\michael\appdata\roaming\PnkBstrK.sys
2011-01-20 01:48:08 37376 ----a-w- c:\windows\system32\themeservice.dll
2011-01-20 01:48:08 2755072 ----a-w- c:\windows\system32\themeui.dll
2011-01-20 01:48:07 249856 ----a-w- c:\windows\system32\uxtheme.dll
2011-01-15 22:26:16 0 ----a-w- c:\windows\ativpsrm.bin
2011-01-07 07:31:10 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-07 07:31:10 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-07 07:27:11 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 05:33:11 294400 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 05:37:33 428032 ----a-w- c:\windows\system32\vbscript.dll
2011-01-05 03:37:38 2329088 ----a-w- c:\windows\system32\win32k.sys
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600 Disk: ST3160815AS rev.4.ADA -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-2
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8674F439]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x867557d0]; MOV EAX, [0x8675584c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x82C74448] -> \Device\Harddisk0\DR0[0x8672B4B0]
3 CLASSPNP[0x8BD8759E] -> ntkrnlpa!IofCallDriver[0x82C74448] -> [0x859AAF08]
\Driver\atapi[0x8672D030] -> IRP_MJ_CREATE -> 0x8674F439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x147; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP2T0L0-2 -> \??\IDE#DiskST3160815AS_____________________________4.ADA___#5&118455e0&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user != kernel MBR !!!
sectors 312499998 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
.
============= FINISH: 17:28:12.40 ===============
Please Help! I always have click.GiftLoad and others in my S&D scans, even if I remove them.
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Michael at 17:27:14.72 on Wed 03/30/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3326.1917 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\System32\StkASv2K.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ManyCam\Bin\ManyCam.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Fraps\fraps.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Audacity\audacity.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe
C:\Users\Michael\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Michael\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = my.daemon-search.com
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~2\SEARCH~1.DLL
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\speedb~2\toolbar\grabber.dll
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [Google Update] "c:\users\michael\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [ManyCam] "c:\program files\manycam\bin\ManyCam.exe" /silent
uRun: [SpeedBitVideoAccelerator] "c:\program files\speedbit video accelerator\VideoAccelerator.exe" /startup
uRun: [AdobeBridge]
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [UVS10 Preload] c:\program files\ulead systems\ulead videostudio se dvd\uvPL.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\bdarem~1.lnk - c:\program files\usb tv\em28xx\BDARemote.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: UACDisableNotify = 0 (0x0)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mif5ba~1\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\program files\speedbit video accelerator\SBLSP.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Notify: AtiExtEvent - Ati2evxx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\michael\appdata\roaming\mozilla\firefox\profiles\xgjyuxwc.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://my.daemon-search.com/
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - component: c:\program files\speedbit video downloader\spfirefox\components\Engine.dll
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPcol500.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\id software\quakelive\npquakezero.dll
FF - plugin: c:\users\michael\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl3af2dfa1;MpKsl3af2dfa1;c:\programdata\microsoft\microsoft antimalware\definition updates\{a4a66da7-a6d3-4a5f-816b-98eb3cfd2b8a}\MpKsl3af2dfa1.sys [2011-3-30 28752]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-7-13 20992]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-1-15 1153368]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\speedb~1\videoacceleratorservice.exe -start -scm --> c:\progra~1\speedb~1\VideoAcceleratorService.exe -start -scm [?]
R3 HPKBCCID;HP Keyboard Smart Card Driver;c:\windows\system32\drivers\HPKBCCID.sys [2006-11-7 46976]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-4-14 45736]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-7-1 34896]
S3 StkTMini;Syntek AVStream USB2.0 ATV;c:\windows\system32\drivers\StkTMini.sys [2011-2-19 468096]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-15 1343400]
.
=============== Created Last 30 ================
.
2011-03-30 21:14:00 -------- d-----w- c:\program files\Audacity
2011-03-30 21:06:46 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2011-03-30 20:19:19 28752 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{a4a66da7-a6d3-4a5f-816b-98eb3cfd2b8a}\MpKsl3af2dfa1.sys
2011-03-30 01:41:55 -------- d-----w- c:\users\michael\appdata\local\QuakeLiveConfigGenerator
2011-03-29 00:20:40 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2011-03-29 00:20:39 439632 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{656c848e-1a18-453a-bc83-366613f2ac02}\gapaengine.dll
2011-03-29 00:20:20 6792528 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{a4a66da7-a6d3-4a5f-816b-98eb3cfd2b8a}\mpengine.dll
2011-03-29 00:02:26 -------- d-----w- c:\users\michael\appdata\roaming\wolfcamql
2011-03-29 00:01:01 -------- d-----w- c:\users\michael\wolfcam
2011-03-27 23:26:36 -------- d-----w- c:\users\michael\appdata\roaming\Warsow 0.6
2011-03-27 23:26:36 -------- d-----w- c:\program files\Warsow 0.6
2011-03-27 22:31:47 -------- d-----w- c:\progra~2\id Software
2011-03-27 22:03:45 -------- d-----w- c:\program files\iPod
2011-03-27 22:03:44 -------- d-----w- c:\program files\iTunes
2011-03-27 21:55:25 -------- d-----w- c:\users\michael\appdata\local\ManyCam
2011-03-27 21:14:37 -------- d-sh--w- c:\windows\system32\%APPDATA%
2011-03-27 04:10:28 -------- d-----w- c:\users\michael\appdata\local\Desura
2011-03-27 04:07:09 -------- d-----w- c:\progra~2\Desura
2011-03-27 04:07:06 -------- d-----w- c:\program files\Desura
2011-03-24 21:00:28 -------- d-----w- c:\users\michael\appdata\local\LAG
2011-03-24 21:00:28 -------- d-----w- c:\progra~2\LAG
2011-03-24 21:00:02 -------- d-----w- c:\windows\system32\AGEIA
2011-03-24 20:59:53 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2011-03-22 20:07:13 -------- d-----w- c:\users\michael\appdata\roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2011-03-20 22:41:17 160560 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2011-03-20 22:40:36 44784 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2011-03-20 22:40:28 -------- d-----w- c:\program files\Oracle
2011-03-18 20:53:47 -------- d-----w- c:\progra~2\regid.1986-12.com.adobe
2011-03-17 23:45:53 -------- d-----w- c:\program files\Window Title Changer
2011-03-17 23:34:34 -------- d-----w- c:\program files\common files\Akamai
2011-03-17 22:09:53 -------- d-----w- c:\program files\common files\Macrovision Shared
2011-03-13 07:37:21 -------- d-----w- c:\program files\YouTube Downloader
2011-03-11 07:14:50 -------- d-----w- c:\users\michael\appdata\local\CrashRpt
2011-03-11 05:44:58 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
2011-03-11 04:44:50 -------- d-----w- c:\program files\PowerISO
2011-03-08 23:35:20 33280 ----a-w- c:\windows\system32\HUFFYUV.DLL
2011-03-08 23:33:45 -------- d-----w- c:\program files\VirtualDub-1.9.11
2011-03-08 20:43:45 802304 ----a-w- c:\windows\system32\FntCache.dll
2011-03-08 20:43:45 739840 ----a-w- c:\windows\system32\d2d1.dll
2011-03-08 20:43:45 1074176 ----a-w- c:\windows\system32\DWrite.dll
2011-03-08 20:43:44 642048 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-08 20:43:44 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-03-08 20:43:43 850432 ----a-w- c:\windows\system32\sbe.dll
2011-03-08 20:43:43 2690560 ----a-w- c:\windows\system32\mstscax.dll
2011-03-08 20:43:43 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-08 20:43:42 1034240 ----a-w- c:\windows\system32\mstsc.exe
2011-03-06 20:31:47 -------- d-----w- C:\SauerbratenPortable
2011-03-06 20:19:16 -------- d-----w- c:\program files\common files\Pinnacle
2011-03-06 20:18:54 -------- d-----w- c:\users\michael\appdata\local\Downloaded Installations
2011-03-06 20:18:47 -------- d-----w- c:\progra~2\Pinnacle Studio Ultimate
2011-03-06 20:17:55 69632 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\Studio.exe
2011-03-06 20:17:55 69632 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_ContentTransfer.exe
2011-03-06 20:17:55 65536 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_ReadMe.exe
2011-03-06 20:17:55 49152 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_Check3D.exe
2011-03-06 20:17:55 45056 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_Help_HH.exe
2011-03-06 20:17:55 434176 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_GuidedTour.exe
2011-03-06 20:17:55 40960 ----a-r- c:\users\michael\appdata\roaming\microsoft\installer\{d041eb9e-890a-4098-8f94-51da194ac72a}\SC_AMCap.exe
2011-03-06 20:14:55 -------- d-----w- c:\program files\common files\Yahoo!
2011-03-06 20:14:54 -------- d-----w- c:\program files\Pinnacle
2011-03-06 04:00:11 50688 ----a-w- c:\windows\system32\wbhelp2.dll
2011-03-06 04:00:11 479298 ----a-w- c:\windows\system32\wbocx.ocx
2011-03-06 03:59:46 -------- d-----w- c:\program files\DAP
2011-03-06 02:42:40 709456 ----a-w- c:\windows\isRS-000.tmp
2011-03-01 21:51:55 -------- d-----w- c:\progra~2\AVS4YOU
2011-03-01 21:51:49 -------- d-----w- c:\users\michael\appdata\roaming\AVS4YOU
2011-03-01 21:46:38 10833920 ----a-w- c:\windows\system32\libmfxsw32.dll
2011-03-01 21:46:37 10915840 ----a-w- c:\windows\system32\libmfxhw32.dll
2011-03-01 21:46:31 -------- d-----w- c:\program files\common files\AVSMedia
2011-03-01 21:46:28 24576 ----a-w- c:\windows\system32\msxml3a.dll
2011-03-01 21:46:28 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2011-03-01 21:46:28 -------- d-----w- c:\program files\AVS4YOU
.
==================== Find3M ====================
.
2011-03-28 01:42:02 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-03-28 01:42:02 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-03-28 01:41:22 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-02-26 01:19:32 41872 ----a-w- c:\windows\system32\xfcodec.dll
2011-02-17 22:06:08 135472 ----a-w- c:\windows\system32\VBoxNetFltNotify.dll
2011-02-03 06:54:36 86016 ----a-w- c:\windows\system32\frapsvid.dll
2011-02-03 02:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 23:53:48 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-01-20 21:31:17 22328 ----a-w- c:\users\michael\appdata\roaming\PnkBstrK.sys
2011-01-20 01:48:08 37376 ----a-w- c:\windows\system32\themeservice.dll
2011-01-20 01:48:08 2755072 ----a-w- c:\windows\system32\themeui.dll
2011-01-20 01:48:07 249856 ----a-w- c:\windows\system32\uxtheme.dll
2011-01-15 22:26:16 0 ----a-w- c:\windows\ativpsrm.bin
2011-01-07 07:31:10 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-07 07:31:10 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-07 07:27:11 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 05:33:11 294400 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 05:37:33 428032 ----a-w- c:\windows\system32\vbscript.dll
2011-01-05 03:37:38 2329088 ----a-w- c:\windows\system32\win32k.sys
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600 Disk: ST3160815AS rev.4.ADA -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-2
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8674F439]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x867557d0]; MOV EAX, [0x8675584c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x82C74448] -> \Device\Harddisk0\DR0[0x8672B4B0]
3 CLASSPNP[0x8BD8759E] -> ntkrnlpa!IofCallDriver[0x82C74448] -> [0x859AAF08]
\Driver\atapi[0x8672D030] -> IRP_MJ_CREATE -> 0x8674F439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x147; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP2T0L0-2 -> \??\IDE#DiskST3160815AS_____________________________4.ADA___#5&118455e0&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user != kernel MBR !!!
sectors 312499998 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.
.
============= FINISH: 17:28:12.40 ===============
Please Help! I always have click.GiftLoad and others in my S&D scans, even if I remove them.
