Possible Virtuemonde?

[AFanCorp]

Hi,


So my computer acted somewhat strangely recently, so I went through the process of running various malware removal programs such as S&D to attempt to find the problem.

tl;dr

Virtumonde happened, S&D says its gone, pop-ups still occuring.


DDS Report




DDS (Ver_09-09-29.01) - NTFSx86
Run by Alex at 18:01:54.80 on 04/10/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.4095.2588 [GMT -7:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\DAODB\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files (x86)\Windows Live\Device Manager\msgrdvmn.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Users\Alex\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Alex\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Users\Alex\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Alex\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Users\Alex\Desktop\dds.com
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2535290
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\syswow64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - c:\program files (x86)\messenger_plus_live_ca-en\tbMess.dll
mURLSearchHooks: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - c:\program files (x86)\messenger_plus_live_ca-en\tbMess.dll
mWinlogon: Userinit=userinit.exe
BHO: {02d67f2c-49c5-4702-9791-324983d93856} - c:\windows\syswow64\dfshim32.dll
BHO: {03eb18eb-6f44-4093-bdec-d746e3809fc9} - c:\windows\syswow64\dwmcore32.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files (x86)\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - c:\program files (x86)\messenger_plus_live_ca-en\tbMess.dll
BHO: e090261: {8764358c-3e79-6510-7ab3-8d9d02c78c2f} - c:\windows\syswow64\DxpTaskSync32.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files (x86)\adobe\/Adobe Contribute CS4/contributeieplugin.dll
TB: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - c:\program files (x86)\messenger_plus_live_ca-en\tbMess.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WindowsLivePhone] "c:\program files (x86)\windows live\device manager\msgrdvmn.exe" /AutoRun
uRun: [AdobeBridge]
uRun: [Google Update] "c:\users\alex\appdata\local\google\update\GoogleUpdate.exe" /c
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p
uRunOnce: [SpybotDeletingB3165] command.com /c del "c:\windows\system32\dfshim32.dll"
uRunOnce: [SpybotDeletingD8769] cmd.exe /c del "c:\windows\system32\dfshim32.dll"
uRunOnce: [SpybotDeletingB893] command.com /c del "c:\windows\system32\dfshim32.dll"
uRunOnce: [SpybotDeletingD9958] cmd.exe /c del "c:\windows\system32\dfshim32.dll"
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "c:\program files (x86)\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe Acrobat Speed Launcher] "c:\program files (x86)\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [AdobeCS4ServiceManager] "c:\program files (x86)\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "c:\program files (x86)\common files\java\java update\jusched.exe"
mRun: [WindowsLivePhone] c:\program files (x86)\windows live\device manager\msgrdvmn.exe /AutoRun
mRun: [Adobe_ID0ENQBO] c:\progra~2\common~1\adobe\adobev~1\server\bin\VERSIO~3.EXE
mRun: [KKKQ Agent] c:\windows\syswow64\28463\KKKQ.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Corel File Shell Monitor] c:\program files (x86)\corel\corel paintshop photo pro\x3\pspclassic\CorelIOMonitor.exe
mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime
mRun: [RTHDBPL] c:\users\alex\appdata\roaming\syswin\lsass.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: c:\windows\system32\DxpTaskSync32.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2535290&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2535290&q=
FF - component: c:\program files (x86)\mozilla firefox\extensions\{01a8ca0a-4c96-465b-a49b-65c46fad54f9}\components\Contribute.dll
FF - component: c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\extensions\{437c4386-9237-441f-a940-009430030ee0}\components\FFExternalAlert.dll
FF - component: c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\extensions\{437c4386-9237-441f-a940-009430030ee0}\components\RadioWMPCore.dll
FF - component: c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\FFExternalAlert.dll
FF - component: c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\RadioWMPCore.dll
FF - plugin: c:\program files (x86)\ahnlab\asp\mykeydefense 2.5\npmkd25aos.dll
FF - plugin: c:\program files (x86)\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files (x86)\microsoft\office live\npOLW.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npContribute.dll
FF - plugin: c:\program files (x86)\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files (x86)\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\alex\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\alex\appdata\roaming\mozilla\firefox\profiles\7vlukm3x.default\extensions\battlefieldheroespatcher@ea.com\platform\winnt_x86-msvc\plugins\npBFHUpdater.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files (x86)\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files (x86)\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\pxhlpa64.sys --> c:\windows\system32\drivers\PxHlpa64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys --> c:\windows\system32\drivers\vwififlt.sys [?]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-7-13 20992]
R2 MSSQL$BWDATOOLSET;SQL Server (BWDATOOLSET);c:\program files (x86)\daodb\mssql.1\mssql\binn\sqlservr.exe [2009-5-27 29262680]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\spybot - search & destroy\SDWinSec.exe [2009-9-18 1153368]
R2 SSPORT;SSPORT;\??\c:\windows\system32\drivers\ssport.sys --> c:\windows\system32\drivers\SSPORT.sys [?]
R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\wacom_tablet.exe --> c:\windows\system32\Wacom_Tablet.exe [?]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\common files\microsoft shared\windows live\WLIDSVC.EXE [2009-8-18 2291568]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\common files\macrovision shared\flexnet publisher\FNPLicensingService64.exe [2009-8-18 1436424]
R3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [2010-5-22 106040]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\rt64win7.sys --> c:\windows\system32\drivers\Rt64win7.sys [?]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys --> c:\windows\system32\drivers\wacmoumonitor.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 mi-raysat_3dsmax2011_64;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit;c:\program files\autodesk\3ds max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe [2010-3-10 86016]
S2 odserv32;Microsoft Office Diagnostics Service ;c:\windows\system32\dxdiagn32.exe [2010-10-4 1108992]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 288112]
S3 athur;Wireless Network Adapter Service;c:\windows\system32\drivers\athurx.sys --> c:\windows\system32\drivers\athurx.sys [?]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\dragon age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]
S3 Mkd3kfNt;Mkd3kfNt;c:\windows\system32\drivers\mkd3kfnt.sys --> c:\windows\system32\drivers\Mkd3kfNt.sys [?]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys --> c:\windows\system32\drivers\teamviewervpn.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\watadminsvc.exe --> c:\windows\system32\wat\WatAdminSvc.exe [?]

=============== Created Last 30 ================

2010-10-04 16:21 <DIR> --d----- c:\program files (x86)\Sophos
2010-10-04 05:20 <DIR> --d----- C:\VundoFix Backups
2010-10-04 05:00 145 a------- c:\windows\wininit.ini
2010-10-04 00:54 <DIR> --dsh--- c:\programdata\SysWoW32
2010-10-04 00:54 <DIR> --dsh--- c:\progra~3\SysWoW32
2010-10-04 00:54 <DIR> --d----- c:\programdata\1279800659
2010-10-04 00:54 <DIR> --d----- c:\progra~3\1279800659
2010-10-04 00:54 203,776 ---sh--- c:\programdata\unrar.exe
2010-10-04 00:54 203,776 ---sh--- c:\progra~3\unrar.exe
2010-10-04 00:51 <DIR> --dsh--- c:\users\alex\appdata\roaming\SysWin
2010-10-04 00:51 4,207 a--sh--- c:\windows\system32\7e7a52341033P.manifest
2010-10-04 00:51 138 a--sh--- c:\windows\system32\7e7a52341033O.manifest
2010-10-04 00:51 51 a--sh--- c:\windows\system32\7e7a52341033C.manifest
2010-10-04 00:51 11 a--sh--- c:\windows\system32\7e7a52341033S.manifest
2010-10-04 00:51 1,108,992 a------- c:\windows\system32\dxdiagn32.exe
2010-10-04 00:51 98 a------- c:\windows\system32\81020227
2010-10-04 00:51 314,880 a------- c:\windows\system32\dwmcore32.dll
2010-10-04 00:48 <DIR> --d----- c:\programdata\Apple Computer
2010-10-04 00:32 <DIR> --d----- c:\program files (x86)\Incomplete
2010-09-30 04:30 <DIR> --d----- c:\windows\WICCodecs
2010-09-30 04:07 108,475 a------- c:\windows\Thumbplug TGA Uninstaller.exe
2010-09-30 04:07 <DIR> --d----- c:\program files (x86)\Thumbplug TGA
2010-09-30 03:46 <DIR> --d----- c:\programdata\Corel
2010-09-30 03:46 <DIR> --d----- c:\program files (x86)\common files\Protexis
2010-09-30 03:46 <DIR> --d----- c:\progra~3\Corel
2010-09-30 03:44 <DIR> --d----- c:\programdata\Ulead Systems
2010-09-30 03:44 <DIR> --d----- c:\program files (x86)\Corel
2010-09-30 03:44 <DIR> --d----- c:\program files (x86)\common files\Corel
2010-09-30 03:22 <DIR> --d----- c:\program files (x86)\common files\Akamai
2010-09-30 03:07 <DIR> --d----- C:\AirRivals Mods
2010-09-29 04:06 2,048 a------- c:\windows\system32\tzres.dll
2010-09-20 21:59 332 a------- c:\windows\system32\setupinfo.ver
2010-09-20 21:59 140 a------- c:\windows\system32\option.sys
2010-09-20 21:58 492 a------- c:\windows\system32\VersionInfo.ver
2010-09-16 20:57 471,040 a------- c:\windows\system32\SCDialer1.ocx
2010-09-16 20:57 323,584 a------- c:\windows\system32\SCDialer2.ocx
2010-09-16 20:57 118,272 a------- c:\windows\system32\SX5363S.DLL
2010-09-16 20:57 102,400 a------- c:\windows\system32\RV32RTP.dll
2010-09-16 20:57 40 a------- c:\windows\system32\Sx5363.ini
2010-09-16 16:50 151,552 a------- c:\windows\system32\nvRegDev.dll
2010-09-16 15:31 <DIR> --d----- c:\program files (x86)\common files\Autodesk Shared
2010-09-15 14:29 <DIR> --d----- c:\program files (x86)\LexWare
2010-09-15 01:14 262,272 a------- C:\ac4_tex_p.dds
2010-09-14 22:45 <DIR> --d----- c:\program files (x86)\CCP
2010-09-14 17:37 <DIR> --d----- c:\program files (x86)\common files\Alias Shared
2010-09-14 17:32 <DIR> --d----- C:\ja-JP
2010-09-14 17:32 <DIR> --d----- C:\en-US
2010-09-14 03:31 <DIR> --d----- c:\programdata\NVIDIA Corporation
2010-09-14 03:31 <DIR> --d----- c:\progra~3\NVIDIA Corporation
2010-09-14 03:18 <DIR> --d----- c:\windows\PCHEALTH
2010-09-14 02:53 <DIR> --d----- c:\windows\SQLTools9_KB970892_ENU
2010-09-14 02:52 <DIR> --d----- c:\windows\SQL9_KB970892_ENU
2010-09-10 14:45 <DIR> --d----- c:\users\alex\appdata\roaming\Dragon Age Toolset
2010-09-10 14:09 <DIR> --d----- c:\program files (x86)\Microsoft SQL Server
2010-09-10 14:09 <DIR> --d----- c:\program files (x86)\DAODB
2010-09-09 23:32 <DIR> --d----- c:\programdata\BioWare
2010-09-09 23:32 <DIR> --d----- c:\progra~3\BioWare
2010-09-08 11:17 94,208 a------- c:\windows\system32\QuickTimeVR.qtx
2010-09-08 11:17 69,632 a------- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2010-07-28 23:30 82,944 a------- c:\windows\system32\iccvid.dll
2010-07-22 17:14 65,536 a------- c:\windows\IFinst27.exe
2010-07-10 05:38 14,092,904 a------- c:\windows\system32\nvoglv32.dll
2010-07-10 05:38 10,267,240 a------- c:\windows\system32\nvcompiler.dll
2010-07-10 05:38 9,818,728 a------- c:\windows\system32\nvd3dum.dll
2010-07-10 05:38 5,107,816 a------- c:\windows\system32\nvwgf2um.dll
2010-07-10 05:38 4,553,832 a------- c:\windows\system32\nvcuda.dll
2010-07-10 05:38 2,892,904 a------- c:\windows\system32\nvcuvid.dll
2010-07-10 05:38 2,506,344 a------- c:\windows\system32\nvcuvenc.dll
2010-07-10 05:38 1,625,192 a------- c:\windows\system32\nvapi.dll
2010-07-10 05:38 314,984 a------- c:\windows\system32\nvdecodemft.dll
2010-07-10 05:38 56,936 a------- c:\windows\system32\OpenCL.dll
2010-07-06 22:52 135,168 a------- c:\windows\apppatch\apppatch64\AcXtrnal.dll
2010-07-06 22:52 347,648 a------- c:\windows\apppatch\apppatch64\AcLayers.dll
2010-01-21 12:31 157,694 a------- c:\windows\inf\perflib\0412\perfi.dat
2010-01-21 12:31 157,694 a------- c:\windows\inf\perflib\0412\perfh.dat
2010-01-21 12:31 31,548 a------- c:\windows\inf\perflib\0412\perfd.dat
2010-01-21 12:31 31,548 a------- c:\windows\inf\perflib\0412\perfc.dat
2010-01-21 12:23 141,988 a------- c:\windows\inf\perflib\0411\perfi.dat
2010-01-21 12:23 141,988 a------- c:\windows\inf\perflib\0411\perfh.dat
2010-01-21 12:23 31,548 a------- c:\windows\inf\perflib\0411\perfd.dat
2010-01-21 12:23 31,548 a------- c:\windows\inf\perflib\0411\perfc.dat
2009-07-13 22:37 291,294 a------- c:\windows\inf\perflib\0409\perfi.dat
2009-07-13 22:37 291,294 a------- c:\windows\inf\perflib\0409\perfh.dat
2009-07-13 22:37 31,548 a------- c:\windows\inf\perflib\0409\perfd.dat
2009-07-13 22:37 31,548 a------- c:\windows\inf\perflib\0409\perfc.dat
2009-07-13 21:54 174 a--sh--- c:\program files (x86)\desktop.ini
2009-07-13 18:00 291,294 a------- c:\windows\inf\perflib\0000\perfi.dat
2009-07-13 18:00 291,294 a------- c:\windows\inf\perflib\0000\perfh.dat
2009-07-13 18:00 31,548 a------- c:\windows\inf\perflib\0000\perfd.dat
2009-07-13 18:00 31,548 a------- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 13:44 9,633,792 a--shr-- c:\windows\fonts\StaticCache.dat
2009-12-01 18:44 16,384 a--sh--- c:\windows\temp\cookies\index.dat
2009-12-01 18:44 16,384 a--sh--- c:\windows\temp\history\history.ie5\index.dat
2009-12-01 18:44 16,384 a--sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat
2009-07-13 18:39 398,848 a--sh--- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-13 18:14 396,800 a--sh--- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 18:03:17.34 ===============

Attached is the S&D report.

[AFanCorp]

An update to include possibly critical information.


The OS I am running on is Windows 7. Several past fixes are 'incompatible'.







DDS (Ver_10-10-05.01) - NTFS_AMD64
Run by Alex at 8:58:05.14 on 07/10/2010
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_20
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.2.1033.18.4095.2667 [GMT -7:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe
C:\Program Files (x86)\DAODB\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\SysWOW64\dxdiagn32.exe
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\SysWOW64\DxpTaskSync32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files (x86)\Windows Live\Device Manager\msgrdvmn.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Alex\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WTablet\Wacom_TabletUser.exe
C:\Windows\system32\Wacom_Tablet.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Microsoft Games\solitaire\solitaire.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Alex\Desktop\dds.com
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2535290
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - C:\Program Files (x86)\Messenger_Plus_Live_CA-EN\tbMess.dll
mURLSearchHooks: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - C:\Program Files (x86)\Messenger_Plus_Live_CA-EN\tbMess.dll
mWinlogon: Userinit=userinit.exe
BHO: {01251d40-0767-4605-a47d-d963baad83e6} - C:\Windows\SysWow64\dpapiprovider32.dll
BHO: {01dfa5e1-0c68-4339-bfad-f738bb2def96} - C:\Windows\SysWow64\d3dx1032.dll
BHO: {02d67f2c-49c5-4702-9791-324983d93856} - C:\Windows\SysWow64\dfshim32.dll
BHO: {03eb18eb-6f44-4093-bdec-d746e3809fc9} - C:\Windows\SysWow64\dwmcore32.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: e090261: {3f09c57a-134b-2125-4487-e9b3320da4d9} - C:\Windows\SysWow64\AuxiliaryDisplayApi32.dll
BHO: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - C:\Program Files (x86)\Messenger_Plus_Live_CA-EN\tbMess.dll
BHO: e090261: {8764358c-3e79-6510-7ab3-8d9d02c78c2f} - C:\Windows\SysWow64\DxpTaskSync32.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: e090261: {c582f4f9-c1e4-c0b0-a4af-9540da2ff4cc} - C:\Windows\SysWow64\AuxiliaryDisplayApi32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: e090261: {f23ee513-cd0d-d148-b53d-faf6d7661237} - C:\Windows\SysWow64\AuxiliaryDisplayApi32.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
TB: Messenger Plus Live CA-EN Toolbar: {437c4386-9237-441f-a940-009430030ee0} - C:\Program Files (x86)\Messenger_Plus_Live_CA-EN\tbMess.dll
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [WindowsLivePhone] "C:\Program Files (x86)\Windows Live\Device Manager\msgrdvmn.exe" /AutoRun
uRun: [AdobeBridge]
uRun: [Google Update] "C:\Users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe" /c
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [WindowsLivePhone] C:\Program Files (x86)\Windows Live\Device Manager\msgrdvmn.exe /AutoRun
mRun: [Adobe_ID0ENQBO] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~3.EXE
mRun: [KKKQ Agent] C:\Windows\SysWOW64\28463\KKKQ.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Corel File Shell Monitor] c:\Program Files (x86)\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [RTHDBPL] C:\Users\Alex\AppData\Roaming\SysWin\lsass.exe
mRunOnce: [Spybot - Search & Destroy] "C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
AppInit_DLLs: C:\Windows\system32\DxpTaskSync32.dll,C:\Windows\system32\AuxiliaryDisplayApi32.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB-X64: {437C4386-9237-441F-A940-009430030EE0} - No File
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
mRun-x64: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
mRun-x64: [eplight1.0.exe] C:\
mRun-x64: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2535290&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2535290&q=
FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}\components\Contribute.dll
FF - component: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\extensions\{437c4386-9237-441f-a940-009430030ee0}\components\FFExternalAlert.dll
FF - component: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\extensions\{437c4386-9237-441f-a940-009430030ee0}\components\RadioWMPCore.dll
FF - component: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\FFExternalAlert.dll
FF - component: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\components\RadioWMPCore.dll
FF - plugin: C:\Program Files (x86)\AhnLab\ASP\MyKeyDefense 2.5\npmkd25aos.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npContribute.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Alex\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\7vlukm3x.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: Java Console: No Registry Reference - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falseC:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
C:\Program Files (x86)\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-8-18 54480]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
R2 mi-raysat_3dsmax2011_64;mental ray 3.8 Satellite for Autodesk 3ds Max 2011 64-bit 64-bit;C:\Program Files\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_64server.exe [2010-3-10 86016]
R2 MSSQL$BWDATOOLSET;SQL Server (BWDATOOLSET);C:\Program Files (x86)\DAODB\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-5-27 29262680]
R2 odserv32;Microsoft Office Diagnostics Service ;C:\Windows\system32\dxdiagn32.exe --> C:\Windows\system32\dxdiagn32.exe [?]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-9-18 1153368]
R2 SSPORT;SSPORT;C:\Windows\System32\drivers\SSPORT.SYS [2009-9-8 11576]
R2 TabletServiceWacom;TabletServiceWacom;C:\Windows\System32\Wacom_Tablet.exe [2009-8-28 3647272]
R3 Mkd2Nadr;Mkd2Nadr;C:\Windows\System32\drivers\Mkd2Nadr.sys [2010-5-21 106040]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-3-4 346144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-8-15 288112]
S3 athur;Wireless Network Adapter Service;C:\Windows\System32\drivers\athurx.sys [2010-5-11 1847296]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-12-15 25832]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-8-18 1436424]
S3 Mkd3kfNt;Mkd3kfNt;C:\Windows\System32\drivers\mkd3kfnt.sys [2010-5-21 180280]
S3 teamviewervpn;TeamViewer VPN Adapter;C:\Windows\System32\drivers\teamviewervpn.sys [2010-3-11 35112]
S3 wacmoumonitor;Wacom Mode Helper;C:\Windows\System32\drivers\wacmoumonitor.sys [2010-1-24 18216]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-2-26 1255736]

=============== Created Last 30 ================

2010-10-07 15:51:23 -------- d-----w- C:\Users\Alex\AppData\Roaming\Malwarebytes
2010-10-07 15:51:17 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-10-07 15:51:17 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-10-07 15:51:17 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-10-07 15:51:17 -------- d-----w- C:\PROGRA~3\Malwarebytes
2010-10-06 22:36:56 321536 ----a-w- C:\Windows\SysWow64\dpapiprovider32.dll
2010-10-06 04:42:34 -------- d-----w- C:\Users\Alex\.gimp-2.6
2010-10-05 10:01:57 149 --sha-w- C:\PROGRA~3\774505060
2010-10-05 10:01:16 219136 ----a-w- C:\Windows\SysWow64\AuxiliaryDisplayApi32.dll
2010-10-05 10:01:16 1108992 ----a-w- C:\Windows\SysWow64\DxpTaskSync32.exe
2010-10-05 09:52:07 -------- d-----w- C:\Program Files (x86)\GIMP-2.0
2010-10-05 09:08:23 -------- d-----w- C:\PROGRA~3\Minnetonka Audio Software
2010-10-04 23:21:21 -------- d-----w- C:\Program Files (x86)\Sophos
2010-10-04 12:20:53 -------- d-----w- C:\VundoFix Backups
2010-10-04 07:55:36 1185 ----a-w- C:\PROGRA~3\234891592
2010-10-04 07:54:54 -------- d-sh--w- C:\PROGRA~3\SysWoW32
2010-10-04 07:54:44 203776 --sh--w- C:\PROGRA~3\unrar.exe
2010-10-04 07:54:44 -------- d-----w- C:\PROGRA~3\1279800659
2010-10-04 07:51:54 -------- d-sh--w- C:\Users\Alex\AppData\Roaming\SysWin
2010-10-04 07:51:52 1108992 ----a-w- C:\Windows\SysWow64\dxdiagn32.exe
2010-10-04 07:51:51 314880 ----a-w- C:\Windows\SysWow64\dwmcore32.dll
2010-10-04 07:32:26 -------- d-----w- C:\Program Files (x86)\Incomplete
2010-10-01 02:04:44 1355776 ----a-w- C:\Windows\System32\MSVBVM50.DLL
2010-09-30 11:35:31 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
2010-09-30 11:30:38 -------- d-----w- C:\Windows\WICCodecs
2010-09-30 11:07:30 108475 ----a-w- C:\Windows\Thumbplug TGA Uninstaller.exe
2010-09-30 11:07:30 -------- d-----w- C:\Program Files (x86)\Thumbplug TGA
2010-09-30 10:46:21 -------- d-----w- C:\Program Files (x86)\Common Files\Protexis
2010-09-30 10:46:21 -------- d-----w- C:\PROGRA~3\Corel
2010-09-30 10:45:31 -------- d-----w- C:\Users\Alex\AppData\Local\Corel
2010-09-30 10:44:46 -------- d-----w- C:\Program Files (x86)\Corel
2010-09-30 10:44:46 -------- d-----w- C:\Program Files (x86)\Common Files\Corel
2010-09-30 10:22:18 -------- d-----w- C:\Program Files (x86)\Common Files\Akamai
2010-09-29 22:33:29 -------- d-----w- C:\Users\Alex\AppData\Local\THQ
2010-09-29 11:06:50 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2010-09-29 11:06:50 2048 ----a-w- C:\Windows\System32\tzres.dll
2010-09-29 03:20:02 -------- d-----w- C:\Users\Alex\AppData\Local\Apps
2010-09-29 03:20:01 -------- d-----w- C:\Users\Alex\AppData\Local\Deployment
2010-09-17 03:57:07 471040 ----a-w- C:\Windows\SysWow64\SCDialer1.ocx
2010-09-17 03:57:07 323584 ----a-w- C:\Windows\SysWow64\SCDialer2.ocx
2010-09-17 03:57:07 118272 ----a-w- C:\Windows\SysWow64\SX5363S.DLL
2010-09-17 03:57:07 102400 ----a-w- C:\Windows\SysWow64\RV32RTP.dll
2010-09-16 23:50:27 151552 ----a-w- C:\Windows\SysWow64\nvRegDev.dll
2010-09-16 22:31:45 -------- d-----w- C:\Program Files (x86)\Common Files\Autodesk Shared
2010-09-15 21:29:38 -------- d-----w- C:\Program Files (x86)\LexWare
2010-09-15 20:48:28 558592 ----a-w- C:\Windows\System32\spoolsv.exe
2010-09-15 08:14:35 262272 ----a-w- C:\ac4_tex_p.dds
2010-09-15 05:45:45 -------- d-----w- C:\Program Files (x86)\CCP
2010-09-15 00:37:43 -------- d-----w- C:\Program Files (x86)\Common Files\Alias Shared
2010-09-15 00:32:45 -------- d-----w- C:\ja-JP
2010-09-15 00:32:45 -------- d-----w- C:\en-US
2010-09-15 00:32:43 -------- d-----w- C:\Program Files\Common Files\Autodesk Shared
2010-09-14 10:31:24 -------- d-----w- C:\PROGRA~3\NVIDIA Corporation
2010-09-14 10:18:28 -------- d-----w- C:\Program Files\Microsoft IntelliPoint
2010-09-14 10:18:26 -------- d-----w- C:\Windows\PCHEALTH
2010-09-14 09:53:09 -------- d-----w- C:\Windows\SQLTools9_KB970892_ENU
2010-09-14 09:52:11 -------- d-----w- C:\Windows\SQL9_KB970892_ENU
2010-09-10 21:45:35 -------- d-----w- C:\Users\Alex\AppData\Roaming\Dragon Age Toolset
2010-09-10 21:10:03 -------- d-----w- C:\Program Files\Microsoft SQL Server
2010-09-10 21:09:50 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2010-09-10 21:09:45 -------- d-----w- C:\Program Files (x86)\DAODB
2010-09-10 06:32:18 -------- d-----w- C:\PROGRA~3\BioWare
2010-09-08 18:17:46 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2010-09-08 18:17:46 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts

==================== Find3M ====================

2010-07-29 06:30:34 82944 ----a-w- C:\Windows\SysWow64\iccvid.dll
2010-07-23 00:14:19 65536 ----a-w- C:\Windows\IFinst27.exe
2010-07-21 23:59:28 1721576 ----a-w- C:\Windows\System32\wdfcoinstaller01009.dll
2010-07-09 23:27:02 159336 ----a-w- C:\Windows\System32\nvvsvc.exe
2010-07-09 23:27:02 1585256 ----a-w- C:\Windows\System32\nvsvc64.dll
2010-07-09 23:27:02 15314024 ----a-w- C:\Windows\System32\nvcpl.dll
2010-07-09 23:27:02 116328 ----a-w- C:\Windows\System32\nvmctray.dll

============= FINISH: 8:58:31.53 ===============

[tashi]

Hello AFanCorp,

End of Post #1

Last edited by tashi; Oct 4th, 2010 at 09:25 PM. Reason: Merged two posts as per FAQ :-) "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Posting additional comments or logs before a volunteer responds, can push you back instead of forward, because your thread ends up with a newer date. In addition helpers would think you are already being assisted because of the post count, they look for topics with a 0 response. For that reason we may merge such posts but please do not count on it. Waiting for help in the Malware Forum FOUR days or longer? (http://forums.spybot.info/showthread.php?t=1137)

Best regards.