PDA

View Full Version : Google Links Me To Other Websites



Virus Hater
2010-06-15, 23:56
Google has been redirecting me lately to a websites it didn't even show in the url of the link. I believe this is a virus. Ran my routine virus scans and nothing found in:
AVG
Spybot
Ad-aware SE

DDS (Ver_10-03-17.01) - NTFSx86
Run by Azarithe at 16:53:55.88 on Tue 06/15/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2046.910 [GMT -4:00]

SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\DellTPad\Apoint.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Azarithe\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.consolediscussions.com/forum/
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GR469A~1.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [SandboxieControl] "c:\program files\sandboxie\SbieCtrl.exe"
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GRA32A~1.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: c:\windows\system32\guard32.dll,avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GR469A~1.DLL
Hosts: 127.0.0.1 www.spywareinfo.com (http://www.spywareinfo.com)

================= FIREFOX ===================

FF - ProfilePath - c:\users\azarithe\appdata\roaming\mozilla\firefox\profiles\c3mr1zk9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxp://www.consolediscussions.com/forum/
FF - component: c:\users\azarithe\appdata\roaming\mozilla\firefox\profiles\c3mr1zk9.default\extensions\{5f8873d1-1e07-4adc-8ab6-70dc72b353e2}\components\FFExternalAlert.dll
FF - component: c:\users\azarithe\appdata\roaming\mozilla\firefox\profiles\c3mr1zk9.default\extensions\{5f8873d1-1e07-4adc-8ab6-70dc72b353e2}\components\RadioWMPCore.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-6-3 64288]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-4-21 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-4-21 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-4-21 242896]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2010-4-9 225264]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-4-9 30112]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-4-21 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-4-21 308064]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\comodo\comodo livepcsupport\CLPSLS.exe [2010-2-19 148744]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1228208]
R2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;c:\program files\autodesk\3ds max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [2009-3-12 86016]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-4-21 1153368]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-4-17 115944]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-13 311296]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2010-06-11 18:11:51 0 d-----w- c:\users\azarithe\appdata\roaming\Sony Creative Software
2010-06-11 06:45:23 0 d-----w- c:\programdata\Adobe Systems
2010-06-11 06:37:56 0 d-----w- c:\program files\common files\Adobe Systems Shared
2010-06-09 13:50:43 0 d-----w- c:\program files\VirtualDJ
2010-06-09 03:33:56 977920 ----a-w- c:\windows\system32\wininet.dll
2010-06-09 03:33:09 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-06-09 03:33:07 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-09 03:33:05 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-06-09 03:33:05 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-06-09 02:55:13 0 d-----w- c:\users\azarithe\appdata\roaming\Autodesk
2010-06-08 20:06:29 0 d-----w- c:\program files\vBProductMaker
2010-06-08 18:23:20 0 d-----w- c:\program files\Lame for Audacity
2010-06-08 17:01:09 0 d-----w- c:\program files\common files\Autodesk Shared
2010-06-08 16:59:40 0 d-----w- c:\programdata\Autodesk
2010-06-08 16:58:39 0 d-----w- c:\program files\Autodesk
2010-06-08 16:58:29 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2010-06-08 16:58:29 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2010-06-08 16:58:28 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2010-06-06 05:20:12 0 d-----w- c:\users\azarithe\appdata\roaming\PACE Anti-Piracy
2010-06-06 05:20:12 0 d-----w- c:\programdata\PACE Anti-Piracy
2010-06-05 06:13:39 0 d-----w- c:\programdata\FLEXnet
2010-06-05 05:57:02 0 d-----w- c:\program files\common files\Macrovision Shared
2010-06-04 06:42:55 0 d-----w- c:\users\azarithe\appdata\roaming\NetMedia Providers
2010-06-04 06:31:28 0 d-----w- c:\programdata\Sony
2010-06-04 06:19:04 57344 ----a-w- c:\windows\system32\Wnaspint.dll
2010-06-04 06:19:04 0 d-----w- c:\users\azarithe\appdata\roaming\Acoustica
2010-06-04 06:18:40 0 d-----w- c:\program files\Acoustica Shared Effects
2010-06-04 05:53:07 0 d-----r- C:\Sandbox
2010-06-04 05:52:51 1246 ----a-w- c:\windows\Sandboxie.ini
2010-06-04 05:51:35 0 d-----w- c:\program files\Sandboxie
2010-06-04 05:34:26 0 d-----w- c:\program files\ASIO4ALL v2
2010-06-04 05:33:18 1554944 ----a-w- c:\windows\system32\vorbis.acm
2010-06-04 05:32:23 0 d-----w- c:\program files\VstPlugins
2010-06-04 05:32:20 0 d-----w- c:\program files\Outsim
2010-06-04 05:28:38 0 d-----w- c:\program files\Image-Line
2010-06-04 04:58:17 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-06-03 18:37:27 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-06-03 17:51:40 0 dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-06-03 17:50:49 0 d-----w- c:\programdata\Lavasoft
2010-06-03 17:50:49 0 d-----w- c:\program files\Lavasoft
2010-06-03 04:33:47 0 d-----w- c:\windows\XSxS
2010-06-03 04:33:47 0 d-----w- c:\program files\Xenocode
2010-06-03 04:30:38 0 d-----w- c:\program files\Sony
2010-06-03 04:27:20 0 d-----w- c:\program files\Sony Setup
2010-06-02 23:22:51 0 d-----w- c:\users\azarithe\appdata\roaming\Thinstall
2010-06-02 23:07:17 0 d-----w- c:\users\azarithe\appdata\roaming\DiskAid
2010-06-01 06:44:49 0 d-----w- c:\users\azarithe\appdata\roaming\Megaupload
2010-06-01 06:43:34 0 d-----w- c:\program files\Megaupload
2010-06-01 03:05:02 0 d-----w- c:\users\azarithe\appdata\roaming\bizarre creations
2010-06-01 03:01:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-06-01 03:01:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-06-01 03:01:00 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-06-01 03:01:00 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-06-01 02:43:08 0 d-----w- c:\program files\Activision
2010-05-30 22:27:11 0 d-----w- c:\programdata\Sun
2010-05-30 22:26:38 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-29 21:18:53 0 d-----w- c:\users\azarithe\appdata\roaming\Mael
2010-05-29 21:18:02 0 d-----w- c:\program files\HxD
2010-05-28 06:20:55 2048 ----a-w- c:\windows\system32\tzres.dll
2010-05-28 06:20:51 740864 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-26 02:27:26 0 d-----w- C:\pspdev
2010-05-24 21:06:46 0 d-----w- c:\program files\InterLok
2010-05-24 21:05:37 0 d-----w- c:\users\azarithe\appdata\roaming\Antares
2010-05-24 21:05:37 0 d-----w- c:\program files\Antares Audio Technologies
2010-05-24 20:36:31 0 d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-05-24 06:16:54 45 ----a-w- c:\windows\system32\initdebug.nfo
2010-05-24 06:04:08 0 d-----w- c:\program files\I8kfanGUI
2010-05-20 06:24:30 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-05-20 06:24:30 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-05-20 06:23:48 0 d-----w- c:\program files\iPod
2010-05-20 06:23:46 0 d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-05-20 06:23:46 0 d-----w- c:\program files\iTunes
2010-05-20 06:20:39 0 d-----w- c:\program files\Bonjour
2010-05-19 09:15:53 0 d-----w- c:\users\azarithe\appdata\roaming\TS3Client
2010-05-19 09:14:46 0 d-----w- c:\program files\TeamSpeak 3 Client
2010-05-19 06:02:22 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-05-19 06:02:19 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-05-19 05:59:52 0 d-----w- c:\program files\common files\PX Storage Engine

==================== Find3M ====================

2010-06-03 04:01:13 27620 ----a-w- c:\users\azarithe\appdata\roaming\nvModes.dat
2010-06-02 23:00:18 278288 ----a-w- c:\windows\system32\guard32.dll
2010-06-02 22:59:23 30112 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-06-02 22:59:12 16744 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-06-02 22:59:05 225264 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-06-02 22:38:32 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-05-10 22:02:20 56 ---ha-w- c:\programdata\ezsidmv.dat
2010-04-30 21:38:06 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-04-22 01:58:03 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-04-21 05:04:56 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-04-21 05:04:49 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-04-21 01:58:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2010-04-16 12:33:36 3003680 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-04-08 17:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-04-08 17:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 16:55:27.67 ===============

I tried to upload the attach file, but it wouldnt allow me.

Blade81
2010-06-20, 13:43
Hi,

Please post contents of attach.txt file.


Download GMER (http://www.gmer.net) here by clicking download exe -button and then saving it your desktop:
Double-click .exe that you downloaded
Click rootkit-tab, uncheck files option and then click scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log (if the log is long, archive it into a zip file and attach instead of posting) in your reply.

Virus Hater
2010-06-21, 04:11
Here ya go.

Blade81
2010-06-21, 07:50
Hello,

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.

Please continue as follows:


Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.


Click Yes to allow ComboFix to continue scanning for malware.


When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

Blade81
2010-06-27, 11:20
Still there?

Blade81
2010-07-02, 13:23
Due to inactivity, this thread will now be closed.

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.