Cannot remove SmitFraud-C.gp
I have used Spybot in normal, administrator (normal), administrator (safe mode) and Spybot claims to fix the bug, but upon re-run of program bug still exists. Prior to and after these procedures, I performed a factory image restore, and bug still exists. I have used muliple anti virus/malware programs and one (besides Spybot) detected it, but it also did not remove the bug(Malwarebytes). Below is the log you've requested and below that log I've pasted the Spybot brief details of the infection. I did not back up my registry as recommended using ERUNT; it claimed to be compatible with only XP and Vista, and I am running Win7sp1. I have disabled the Spybot tea timer and will await your assistance. Thank you.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Pamela at 18:41:51 on 2011-11-29
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4058.1428 [GMT -6:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: PC Tools Spyware Doctor *Enabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe
C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files (x86)\PC Tools\PC Tools Security\pctsGui.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
-netsvcs
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\vds.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bing.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [ISTray] "C:\Program Files (x86)\PC Tools\PC Tools Security\pctsGui.exe" /hideGUI
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
mRunOnce: [STToasterLauncher] C:\program files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
StartupFolder: C:\Users\Pamela\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
LSP: C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{8FB89F68-6D08-4FC3-91A9-3F50A11A97ED} : DhcpNameServer = 192.168.0.1
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun-x64: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun-x64: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun-x64: [ISTray] "C:\Program Files (x86)\PC Tools\PC Tools Security\pctsGui.exe" /hideGUI
mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
mRunOnce-x64: [STToasterLauncher] C:\program files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R0 PCTCore;PCTools KDS;C:\Windows\system32\drivers\PCTCore64.sys --> C:\Windows\system32\drivers\PCTCore64.sys [?]
R0 pctDS;PC Tools Data Store;C:\Windows\system32\drivers\pctDS64.sys --> C:\Windows\system32\drivers\pctDS64.sys [?]
R0 pctEFA;PC Tools Extended File Attributes;C:\Windows\system32\drivers\pctEFA64.sys --> C:\Windows\system32\drivers\pctEFA64.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 PCTSD;PC Tools Spyware Doctor Driver;C:\Windows\system32\Drivers\PCTSD64.sys --> C:\Windows\system32\Drivers\PCTSD64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AESTFilters;Andrea ST Filters Service;C:\WINDOWS\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [2009-12-17 89600]
R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-11-28 1153368]
R2 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2011-11-28 402336]
R2 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe [2011-11-28 1117624]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-12-17 656624]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]
R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 McShield;McAfee Real-time Scanner;C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe --> C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [?]
S3 McSysmon;McAfee SystemGuards;C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe --> C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-11-30 00:30:14 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AD44E0F1-2B04-4FBF-8527-A64F13582487}\offreg.dll
2011-11-30 00:30:05 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AD44E0F1-2B04-4FBF-8527-A64F13582487}\mpengine.dll
2011-11-29 17:10:52 -------- d-----w- C:\Users\Pamela\AppData\Local\Threat Expert
2011-11-29 03:56:30 337048 ----a-w- C:\Windows\System32\drivers\pctgntdi64.sys
2011-11-29 03:56:30 141312 ----a-w- C:\Windows\System32\drivers\pctwfpfilter64.sys
2011-11-29 03:56:17 14776 ----a-w- C:\Windows\System32\drivers\pctBTFix64.sys
2011-11-29 03:56:06 92896 ----a-w- C:\Windows\System32\drivers\pctplsg64.sys
2011-11-29 03:55:17 -------- d-----w- C:\Program Files (x86)\PC Tools
2011-11-29 03:45:46 816016 ----a-w- C:\Windows\System32\drivers\pctEFA64.sys
2011-11-29 03:45:46 452872 ----a-w- C:\Windows\System32\drivers\pctDS64.sys
2011-11-29 03:45:41 367912 ----a-w- C:\Windows\System32\drivers\PCTCore64.sys
2011-11-29 03:45:36 230952 ----a-w- C:\Windows\System32\drivers\PCTSD64.sys
2011-11-29 03:45:33 -------- d-----w- C:\Program Files (x86)\Common Files\PC Tools
2011-11-29 03:44:27 -------- d-----w- C:\ProgramData\PC Tools
2011-11-29 03:44:25 -------- d-----w- C:\Users\Pamela\AppData\Roaming\TestApp
2011-11-28 23:57:19 -------- d-----w- C:\Users\Pamela\AppData\Local\adaware
2011-11-28 23:57:13 -------- d-----w- C:\ProgramData\Ad-Aware Browsing Protection
2011-11-28 23:57:08 -------- d-----w- C:\Program Files (x86)\Toolbar Cleaner
2011-11-28 23:56:55 -------- d-----w- C:\Program Files (x86)\adawaretb
2011-11-28 23:56:28 -------- d-----w- C:\Program Files (x86)\Lavasoft
2011-11-28 19:32:13 -------- d-----w- C:\Users\Pamela\AppData\Roaming\Malwarebytes
2011-11-28 19:32:00 -------- d-----w- C:\ProgramData\Malwarebytes
2011-11-28 19:31:54 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-11-28 18:54:25 -------- d-----w- C:\Users\Pamela\AppData\Local\Solid State Networks
2011-11-28 17:13:54 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2011-11-28 17:13:54 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2011-11-28 03:20:21 -------- d-----w- C:\Users\Pamela\AppData\Local\Apple Computer
2011-11-28 03:19:03 -------- d-----w- C:\Program Files\iPod
2011-11-28 03:19:02 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2011-11-28 03:19:02 -------- d-----w- C:\Program Files (x86)\iTunes
2011-11-27 19:57:46 -------- d-----w- C:\Windows\System32\SPReview
2011-11-27 19:34:00 2560 ----a-w- C:\Windows\System32\drivers\en-US\rdpwd.sys.mui
2011-11-27 19:33:51 3072 ----a-w- C:\Windows\System32\drivers\en-US\tsusbflt.sys.mui
2011-11-27 19:33:29 6144 ----a-w- C:\Windows\System32\drivers\en-US\IPMIDrv.sys.mui
2011-11-27 19:33:26 4608 ----a-w- C:\Windows\System32\drivers\en-US\kbdclass.sys.mui
2011-11-27 19:14:59 611840 ----a-w- C:\Windows\System32\wpd_ci.dll
2011-11-27 19:13:59 261632 ----a-w- C:\Windows\System32\drivers\netbt.sys
2011-11-27 19:12:59 850944 ----a-w- C:\Windows\System32\mmsys.cpl
2011-11-27 19:11:59 65536 ----a-w- C:\Windows\System32\RpcRtRemote.dll
2011-11-27 19:04:22 -------- d-----w- C:\Windows\System32\EventProviders
2011-11-27 18:59:49 -------- d-----w- C:\Windows\System32\catroot2
2011-11-22 21:44:44 -------- d-----w- C:\Users\Pamela\AppData\Local\Diagnostics
2011-11-22 14:54:57 -------- d-----w- C:\Users\Pamela\AppData\Local\ElevatedDiagnostics
2011-11-22 04:45:09 -------- d-----w- C:\Users\Pamela\AppData\Local\Adobe
2011-11-22 01:08:15 -------- d-----w- C:\Windows\CheckSur
2011-11-21 23:56:17 8570192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-21 21:03:29 -------- d-----w- C:\Intel
2011-11-21 21:01:23 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-11-21 20:49:27 1139200 ----a-w- C:\Windows\System32\FntCache.dll
2011-11-21 20:49:26 902656 ----a-w- C:\Windows\System32\d2d1.dll
2011-11-21 20:49:26 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
2011-11-21 20:49:26 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2011-11-21 20:49:26 1076736 ----a-w- C:\Windows\SysWow64\DWrite.dll
2011-11-21 20:25:28 -------- d-----w- C:\Windows\SysWow64\Wat
2011-11-21 20:25:28 -------- d-----w- C:\Windows\System32\Wat
2011-11-21 19:00:43 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2011-11-21 19:00:43 723968 ----a-w- C:\Windows\System32\EncDec.dll
2011-11-21 19:00:43 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2011-11-21 19:00:43 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2011-11-21 19:00:42 850944 ----a-w- C:\Windows\SysWow64\sbe.dll
2011-11-21 19:00:42 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
2011-11-21 19:00:42 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
2011-11-21 19:00:42 1118720 ----a-w- C:\Windows\System32\sbe.dll
2011-11-21 18:57:58 142336 ----a-w- C:\Windows\System32\poqexec.exe
2011-11-21 18:56:52 2871808 ----a-w- C:\Windows\explorer.exe
2011-11-21 18:55:55 974336 ----a-w- C:\Windows\System32\WFS.exe
2011-11-21 18:55:55 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2011-11-21 18:48:15 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
2011-11-21 18:48:09 861696 ----a-w- C:\Windows\System32\oleaut32.dll
2011-11-21 18:48:09 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
2011-11-21 18:48:09 331776 ----a-w- C:\Windows\System32\oleacc.dll
2011-11-21 18:48:09 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
2011-11-21 18:47:51 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-11-21 18:47:49 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2011-11-21 18:47:48 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2011-11-21 17:15:01 -------- d-----w- C:\Users\Pamela\AppData\Local\Apple
2011-11-21 17:07:59 -------- d-----w- C:\Program Files\Bonjour
2011-11-21 17:07:59 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-11-21 16:53:22 -------- d-----w- C:\Program Files\Dell Support Center
2011-11-21 16:48:05 -------- d-----w- C:\Users\Pamela\AppData\Roaming\PCDr
2011-11-21 16:45:12 -------- d-----w- C:\Users\Pamela\AppData\Local\Microsoft Help
2011-11-21 16:35:04 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2011-11-21 16:35:04 31232 ----a-w- C:\Windows\System32\prevhost.exe
2011-11-21 16:23:22 499200 ----a-w- C:\Windows\System32\drivers\afd.sys
2011-11-21 16:21:51 1401344 ----a-w- C:\Windows\SysWow64\mssrch.dll
2011-11-21 16:19:56 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-11-21 16:19:32 1395712 ----a-w- C:\Windows\System32\mfc42.dll
2011-11-21 16:08:35 -------- d-----w- C:\Users\Pamela\My Backup Files
2011-11-21 16:00:59 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-11-21 15:57:36 917840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4A51BFBB-E054-4E35-862E-BCD503E46B72}\gapaengine.dll
2011-11-21 15:46:18 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2011-11-21 15:45:57 -------- d-----w- C:\Program Files\Microsoft Security Client
2011-11-21 15:26:01 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
2011-11-21 15:19:26 -------- d-----w- C:\Users\Pamela\AppData\Roaming\Dell
2011-11-21 15:19:10 -------- d-----w- C:\Users\Pamela\AppData\Local\DataSafeOnline
2011-11-21 15:19:02 -------- d-----w- C:\Users\Pamela\AppData\Local\Stardock_Corporation
2011-11-21 15:18:47 -------- d-----w- C:\Users\Pamela\AppData\Local\SupportSoft
2011-11-21 15:17:51 -------- d-sh--w- C:\$RECYCLE.BIN
2011-11-21 15:17:48 -------- d-----w- C:\Users\Pamela\AppData\Local\VirtualStore
2011-11-21 14:10:36 20480 ----a-w- C:\Windows\svchost.exe
2011-11-21 14:09:24 -------- d-----w- C:\Emergency
2011-11-21 13:56:23 -------- d-----w- C:\Windows\SMINST
.
==================== Find3M ====================
.
2011-11-29 23:40:05 691 ----a-w- C:\Users\Pamela\AppData\Roaming\GetValue.vbs
2011-11-29 23:40:05 35 ----a-w- C:\Users\Pamela\AppData\Roaming\SetValue.bat
2011-11-29 23:40:05 2716 ----a-w- C:\Windows\SysWow64\tmp.reg
2011-11-27 19:50:14 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-11-27 19:50:14 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-09-29 16:29:28 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-09-29 04:03:32 3144704 ----a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 18:44:35.50 ===============
(Spybot brief)
--- Search result list ---
Smitfraud-C.gp: [SBI $8E7F06B8] Executable (File, nothing done)
C:\WINDOWS\svchost.exe
Properties.size=20480
Properties.md5=2CEFF13ACE25A40BD8D97654944297CD
Properties.filedate=1247534086
Properties.filedatetext=2009-07-13 19:14:45
--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
both programs are running on re-boot, thank you. Below is the fresh dds log and I've attached the zip as well.