foggy22
2010-05-09, 16:36
I have started to have random windows opening in IE redirecting to various websites.
DDS (Ver_10-03-17.01) - NTFSx86
Run by David at 14:20:10.79 on 09/05/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3070.1881 [GMT 1:00]
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Program Files\amBX\System\amBX_Service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\runservice.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\aol\1256234988\ee\aolsoftware.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Microsoft Office\Office14\OfficeSAS\officeSASscheduler.exe
C:\Program Files\Microsoft Office\Office14\OfficeSAS\OfficeSAS.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\RealVNC\VNC4\winvnc4.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\RealVNC\VNC4\vncviewer.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aol toolbar\aoltbServer.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Downloads\dds.scr
C:\Windows\system32\conhost.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - c:\program files\aol toolbar\aoltb.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live
\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mif5ba~1\office14\URLREDIR.DLL
BHO: Free Download Manager: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - c:\program files\aol toolbar\aoltb.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [fsm]
mRun: [HostManager] c:\program files\common files\aol\1256234988\ee\AOLSoftware.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office14\officesas
\officeSASscheduler.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - /105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.165.133,93.188.161.131
TCP: {20F2958E-A05B-4910-88C4-B720DAC6931A} = 93.188.165.133,93.188.161.131
TCP: {7DEF9DAE-77E1-4CF8-A200-988B5BAC319F} = 93.188.165.133,93.188.161.131
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-5-8 64288]
R2 amBX Service;amBX Service;c:\program files\ambx\system\amBX_Service.exe [2007-10-10 66560]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-2-25 12672]
R2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-3-25 20968]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-9-11 735960]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1228208]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2009-10-24 2560]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-12-3 1153368]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-9-28 315392]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-24 133104]
S3 amBX Engine;amBX Engine;c:\program files\ambx\system\amBX_Engine.exe [2007-10-10 433664]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2009-10-22 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-26
4639136]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S4 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2009-9-11 38240]
=============== Created Last 30 ================
2010-05-08 13:24:03 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-08 13:07:04 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-08 13:06:31 0 dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-08 13:06:07 0 d-----w- c:\programdata\Lavasoft
2010-05-08 13:06:07 0 d-----w- c:\program files\Lavasoft
2010-05-03 15:55:58 0 d-----w- c:\windows\system32\appmgmt
2010-05-02 19:52:34 176128 ----a-w- c:\windows\Tzobya.exe
2010-05-02 19:44:35 0 d-----w- c:\users\david\appdata\roaming\BitTorrent
2010-05-02 19:44:22 0 d-----w- c:\program files\BitTorrent
2010-05-02 09:44:02 869175010 ----a-w- c:\windows\MEMORY.DMP
2010-05-02 09:38:58 0 d-----w- c:\users\david\appdata\roaming\Tropico 3
2010-05-02 09:32:51 0 d-----w- c:\program files\Kalypso
2010-05-02 09:28:27 0 d-----w- c:\temp\Tropico3
2010-05-01 18:30:51 0 d-----w- c:\programdata\Sports Interactive
2010-05-01 17:09:24 0 dc----w- C:\BraCa Soft
2010-04-30 18:22:41 0 d-----w- c:\program files\common files\PX Storage Engine
2010-04-30 18:21:15 0 d-----w- c:\program files\common files\Sonic Shared
2010-04-30 18:21:14 0 d-----w- c:\program files\Roxio
2010-04-29 19:04:46 0 d-----w- c:\program files\iPod
2010-04-29 19:04:45 0 d-----w- c:\program files\iTunes
2010-04-29 18:58:01 0 d-----w- c:\program files\Bonjour
2010-04-27 17:52:12 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-04-27 17:52:11 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-04-26 12:19:19 0 d-----w- c:\users\david\appdata\roaming\Software Informer
2010-04-26 12:19:16 0 d-----w- c:\program files\Software Informer
2010-04-26 11:31:44 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-17 08:24:25 0 d-----w- c:\programdata\Trymedia
2010-04-17 08:15:12 0 d-----w- c:\program files\Contendo Games
2010-04-17 07:01:27 0 d-----w- c:\program files\dumps
2010-04-14 17:19:15 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-14 17:19:14 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-14 17:19:03 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 17:18:59 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 17:18:59 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 17:18:58 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 17:18:43 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 17:18:41 132608 ----a-w- c:\windows\system32\cabview.dll
2010-04-11 14:32:00 0 d-----w- c:\program files\Secunia
==================== Find3M ====================
2010-05-09 12:29:28 1793 --sha-w- c:\windows\system32\mmf.sys
2010-04-08 12:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-04-08 12:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-03-22 14:11:40 313168 ----a-w- c:\windows\system32\WPPFilt.dll
2010-03-16 19:46:00 985704 ----a-w- c:\windows\system32\nvsvc.dll
2010-03-16 19:46:00 66664 ----a-w- c:\windows\system32\nvshext.dll
2010-03-16 19:46:00 1515624 ----a-w- c:\windows\system32\nvsvcr.dll
2010-03-16 19:46:00 13684328 ----a-w- c:\windows\system32\nvcpl.dll
2010-03-16 19:46:00 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-03-16 19:46:00 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-03-16 19:45:52 95994 ----a-w- c:\windows\system32\nvcoproc.bin
2010-03-16 19:45:00 82024 ----a-w- c:\windows\system32\nv3dappshextr.dll
2010-03-16 19:45:00 149608 ----a-w- c:\windows\system32\nv3dappshext.dll
2010-03-10 17:25:58 20968 ----a-w- c:\windows\system32\drivers\cpuz133_x32.sys
2010-02-24 10:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-23 07:56:00 977920 ----a-w- c:\windows\system32\wininet.dll
2010-02-11 07:10:14 293376 ----a-w- c:\windows\system32\browserchoice.exe
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2010-02-06 09:01:40 245760 --sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-11-30 19:55:04 16384 --sha-w- c:\windows\temp\cookies\index.dat
2009-11-30 19:55:04 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat
2009-11-30 19:55:04 16384 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c
\WinMail.exe
============= FINISH: 14:21:08.90 ===============
DDS (Ver_10-03-17.01) - NTFSx86
Run by David at 14:20:10.79 on 09/05/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3070.1881 [GMT 1:00]
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Program Files\amBX\System\amBX_Service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\runservice.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\aol\1256234988\ee\aolsoftware.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Microsoft Office\Office14\OfficeSAS\officeSASscheduler.exe
C:\Program Files\Microsoft Office\Office14\OfficeSAS\OfficeSAS.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\RealVNC\VNC4\winvnc4.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\RealVNC\VNC4\vncviewer.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aol toolbar\aoltbServer.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Downloads\dds.scr
C:\Windows\system32\conhost.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - c:\program files\aol toolbar\aoltb.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live
\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\mif5ba~1\office14\URLREDIR.DLL
BHO: Free Download Manager: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - c:\program files\aol toolbar\aoltb.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
uRun: [fsm]
mRun: [HostManager] c:\program files\common files\aol\1256234988\ee\AOLSoftware.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office14\officesas
\officeSASscheduler.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - /105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 93.188.165.133,93.188.161.131
TCP: {20F2958E-A05B-4910-88C4-B720DAC6931A} = 93.188.165.133,93.188.161.131
TCP: {7DEF9DAE-77E1-4CF8-A200-988B5BAC319F} = 93.188.165.133,93.188.161.131
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-5-8 64288]
R2 amBX Service;amBX Service;c:\program files\ambx\system\amBX_Service.exe [2007-10-10 66560]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-2-25 12672]
R2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-3-25 20968]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-9-11 735960]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1228208]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2009-10-24 2560]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-12-3 1153368]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-9-28 315392]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-24 133104]
S3 amBX Engine;amBX Engine;c:\program files\ambx\system\amBX_Engine.exe [2007-10-10 433664]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2009-10-22 54632]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2009-9-26
4639136]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-6-17 12648]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S4 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2009-9-11 38240]
=============== Created Last 30 ================
2010-05-08 13:24:03 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-08 13:07:04 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-08 13:06:31 0 dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-08 13:06:07 0 d-----w- c:\programdata\Lavasoft
2010-05-08 13:06:07 0 d-----w- c:\program files\Lavasoft
2010-05-03 15:55:58 0 d-----w- c:\windows\system32\appmgmt
2010-05-02 19:52:34 176128 ----a-w- c:\windows\Tzobya.exe
2010-05-02 19:44:35 0 d-----w- c:\users\david\appdata\roaming\BitTorrent
2010-05-02 19:44:22 0 d-----w- c:\program files\BitTorrent
2010-05-02 09:44:02 869175010 ----a-w- c:\windows\MEMORY.DMP
2010-05-02 09:38:58 0 d-----w- c:\users\david\appdata\roaming\Tropico 3
2010-05-02 09:32:51 0 d-----w- c:\program files\Kalypso
2010-05-02 09:28:27 0 d-----w- c:\temp\Tropico3
2010-05-01 18:30:51 0 d-----w- c:\programdata\Sports Interactive
2010-05-01 17:09:24 0 dc----w- C:\BraCa Soft
2010-04-30 18:22:41 0 d-----w- c:\program files\common files\PX Storage Engine
2010-04-30 18:21:15 0 d-----w- c:\program files\common files\Sonic Shared
2010-04-30 18:21:14 0 d-----w- c:\program files\Roxio
2010-04-29 19:04:46 0 d-----w- c:\program files\iPod
2010-04-29 19:04:45 0 d-----w- c:\program files\iTunes
2010-04-29 18:58:01 0 d-----w- c:\program files\Bonjour
2010-04-27 17:52:12 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-04-27 17:52:11 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-04-26 12:19:19 0 d-----w- c:\users\david\appdata\roaming\Software Informer
2010-04-26 12:19:16 0 d-----w- c:\program files\Software Informer
2010-04-26 11:31:44 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-17 08:24:25 0 d-----w- c:\programdata\Trymedia
2010-04-17 08:15:12 0 d-----w- c:\program files\Contendo Games
2010-04-17 07:01:27 0 d-----w- c:\program files\dumps
2010-04-14 17:19:15 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-14 17:19:14 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-14 17:19:03 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 17:18:59 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 17:18:59 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 17:18:58 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 17:18:43 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 17:18:41 132608 ----a-w- c:\windows\system32\cabview.dll
2010-04-11 14:32:00 0 d-----w- c:\program files\Secunia
==================== Find3M ====================
2010-05-09 12:29:28 1793 --sha-w- c:\windows\system32\mmf.sys
2010-04-08 12:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-04-08 12:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-03-22 14:11:40 313168 ----a-w- c:\windows\system32\WPPFilt.dll
2010-03-16 19:46:00 985704 ----a-w- c:\windows\system32\nvsvc.dll
2010-03-16 19:46:00 66664 ----a-w- c:\windows\system32\nvshext.dll
2010-03-16 19:46:00 1515624 ----a-w- c:\windows\system32\nvsvcr.dll
2010-03-16 19:46:00 13684328 ----a-w- c:\windows\system32\nvcpl.dll
2010-03-16 19:46:00 129640 ----a-w- c:\windows\system32\nvvsvc.exe
2010-03-16 19:46:00 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-03-16 19:45:52 95994 ----a-w- c:\windows\system32\nvcoproc.bin
2010-03-16 19:45:00 82024 ----a-w- c:\windows\system32\nv3dappshextr.dll
2010-03-16 19:45:00 149608 ----a-w- c:\windows\system32\nv3dappshext.dll
2010-03-10 17:25:58 20968 ----a-w- c:\windows\system32\drivers\cpuz133_x32.sys
2010-02-24 10:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-23 07:56:00 977920 ----a-w- c:\windows\system32\wininet.dll
2010-02-11 07:10:14 293376 ----a-w- c:\windows\system32\browserchoice.exe
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2010-02-06 09:01:40 245760 --sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-11-30 19:55:04 16384 --sha-w- c:\windows\temp\cookies\index.dat
2009-11-30 19:55:04 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat
2009-11-30 19:55:04 16384 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c
\WinMail.exe
============= FINISH: 14:21:08.90 ===============