Tech Support Forum banner
Status
Not open for further replies.
1 - 3 of 3 Posts

·
Registered
Joined
·
2 Posts
Discussion Starter · #1 ·
Hello! I used this service a few years ago when i thought i had a virus and it really helped me in a difficult situation. Well i think i have another virus. I recently reformatted my laptop and believe i picked it up before windows service packs were installed. I think its a 'google redirect' virus. Anyways, without further adieu here is the necessary info:

Laptop is capable to reformat as i mentioned. System restore is saved on the laptop itself, no disks came with purchase.


DDS (Ver_10-03-17.01) - NTFSx86
Run by Shawn at 8:36:28.96 on Thu 09/02/2010
Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_21
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2494.720 [GMT -7:00]

SP: COMODO Defense+ *enabled* (Updated) {043803A4-4F86-4ef7-AFC5-F6E02A79969B}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Logitech\SetPoint II\SetpointII.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Vista Anti-Lag\val.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files\IObit\Game Booster\gbtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Users\Public\Games\World of Warcraft\WoW.exe
C:\Users\Shawn\AppData\Local\Apps\2.0\N78G9OBP.BQW\75E52OHV.QCO\curs..tion_eee711038731a406_0004.0000_172b37d8269e5e48\CurseClient.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Shawn\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2405280
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: CKeyScramblerBHO Object: {2b9f5787-88a5-4945-90e7-c4b18563bc5e} - c:\program files\keyscrambler\KeyScramblerIE.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\users\shawn\appdata\roaming\microsoft\windows\start menu\programs\startup\CurseClientStartup.ccip
StartupFolder: c:\users\shawn\appdata\roaming\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\common files\logishrd\ereg\setpoint\eReg.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\setpoi~1.lnk - c:\program files\logitech\setpoint ii\SetpointII.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - {B745F984-EF2E-40D6-A9AC-D8CED7230E61} - c:\program files\keyscrambler\KeyScramblerIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
AppInit_DLLs: c:\windows\system32\guard32.dll c:\windows\system32\avgrsstx.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\users\shawn\appdata\roaming\mozilla\firefox\profiles\vkp7dez2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=OCYTDF&PC=OCDY&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=OCYTDF&PC=OCDY&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\users\shawn\appdata\roaming\mozilla\firefox\profiles\vkp7dez2.default\extensions\[email protected]\components\KeyScramblerIE.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-8-28 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-8-28 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-8-28 243024]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2010-6-4 224240]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-6-1 30112]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-8-28 921952]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-8-28 308136]
R3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2010-8-27 113896]

=============== Created Last 30 ================

2010-09-02 04:48:39 0 d-----w- c:\programdata\LightScribe
2010-09-02 03:09:50 60 ----a-w- c:\users\shawn\appdata\roaming\wklnhst.dat
2010-09-02 02:11:06 0 d-----w- c:\windows\system32\eu-ES
2010-09-02 02:11:06 0 d-----w- c:\windows\system32\ca-ES
2010-09-02 02:11:04 0 d-----w- c:\windows\system32\vi-VN
2010-09-02 01:35:25 0 d-----w- c:\windows\system32\EventProviders
2010-09-02 01:08:05 72704 ----a-w- c:\windows\system32\admparse.dll
2010-09-02 01:07:59 109568 ----a-w- c:\windows\system32\PDMSetup.exe
2010-09-02 01:07:59 107008 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2010-09-02 01:07:59 103936 ----a-w- c:\windows\system32\SetDepNx.exe
2010-09-02 00:54:37 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-09-02 00:54:37 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-09-02 00:54:37 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-09-02 00:54:37 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-09-02 00:54:37 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-09-01 23:12:59 1216000 ----a-w- c:\windows\system32\AuxiliaryDisplayCpl.dll
2010-09-01 23:11:59 84992 ----a-w- c:\windows\system32\mstlsapi.dll
2010-09-01 22:46:43 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-09-01 22:46:42 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-01 22:46:32 274944 ----a-w- c:\windows\system32\schannel.dll
2010-09-01 22:46:30 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-01 22:46:25 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-01 22:45:25 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-09-01 22:45:22 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 22:45:21 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-01 22:45:18 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-09-01 22:45:14 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-09-01 22:45:13 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-09-01 22:45:09 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-09-01 22:45:05 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-09-01 22:45:05 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-09-01 22:44:57 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-09-01 15:34:51 0 d-sh--w- C:\$RECYCLE.BIN
2010-09-01 15:04:04 117320520 ----a-w- c:\windows\MEMORY.DMP
2010-09-01 13:46:25 0 d-----w- c:\program files\Trend Micro
2010-09-01 00:45:04 0 d-----w- c:\users\shawn\appdata\roaming\Malwarebytes
2010-09-01 00:44:48 0 d-----w- c:\programdata\Malwarebytes
2010-08-31 07:39:08 705536 ----a-w- c:\windows\system32\imagesp1.dll
2010-08-31 07:39:01 116736 ----a-w- c:\windows\system32\sstpsvc.dll
2010-08-31 07:37:57 403968 ----a-w- c:\windows\system32\FirewallAPI.dll
2010-08-31 07:36:59 92160 ----a-w- c:\windows\system32\wlancfg.dll
2010-08-31 07:35:59 355328 ----a-w- c:\windows\system32\termmgr.dll
2010-08-31 07:34:59 55296 ----a-w- c:\windows\system32\fsutil.exe
2010-08-31 07:33:59 17408 ----a-w- c:\windows\system32\drivers\smclib.sys
2010-08-31 07:32:23 102400 ----a-w- c:\windows\system32\wbem\mofinstall.dll
2010-08-31 07:32:22 357888 ----a-w- c:\windows\system32\wbemcomn.dll
2010-08-31 07:32:16 129536 ----a-w- c:\windows\system32\sqmapi.dll
2010-08-31 07:32:15 139264 ----a-w- c:\windows\system32\SmiInstaller.dll
2010-08-31 07:31:44 35328 ----a-w- c:\windows\system32\mspatcha.dll
2010-08-31 07:31:44 305152 ----a-w- c:\windows\system32\msdelta.dll
2010-08-31 07:31:44 258560 ----a-w- c:\windows\system32\dpx.dll
2010-08-30 15:57:19 98816 ----a-w- c:\windows\sed.exe
2010-08-30 15:57:19 77312 ----a-w- c:\windows\MBR.exe
2010-08-30 15:57:19 256512 ----a-w- c:\windows\PEV.exe
2010-08-30 15:57:19 161792 ----a-w- c:\windows\SWREG.exe
2010-08-29 10:08:21 377344 ----a-w- c:\windows\system32\winhttp.dll
2010-08-28 14:48:59 0 d-----w- c:\program files\Vista Anti-Lag
2010-08-28 14:40:07 0 d-----w- c:\program files\Microsoft
2010-08-28 14:38:20 0 d-----w- c:\users\shawn\appdata\roaming\OpenCandy
2010-08-28 14:17:38 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-08-28 14:17:29 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-08-28 14:17:23 0 d-----w- c:\windows\system32\drivers\Avg
2010-08-28 14:16:47 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-08-28 14:14:09 0 d-----w- c:\program files\AVG
2010-08-28 14:13:48 0 d-----w- c:\programdata\avg9
2010-08-28 14:07:46 0 d-----w- c:\users\shawn\appdata\roaming\IObit
2010-08-28 14:07:44 0 d-----w- c:\program files\IObit
2010-08-28 13:59:35 0 d-----w- c:\program files\Curse
2010-08-28 13:09:11 91136 ----a-w- c:\windows\system32\avifil32.dll
2010-08-28 13:09:11 82944 ----a-w- c:\windows\system32\mciavi32.dll
2010-08-28 13:09:11 65024 ----a-w- c:\windows\system32\avicap32.dll
2010-08-28 13:09:11 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-08-28 13:09:11 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-08-28 13:09:11 123904 ----a-w- c:\windows\system32\msvfw32.dll
2010-08-28 13:09:10 1314816 ----a-w- c:\windows\system32\quartz.dll
2010-08-28 13:09:08 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-08-28 13:09:08 22528 ----a-w- c:\windows\system32\msyuv.dll
2010-08-28 13:09:07 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-08-28 12:31:50 0 d-----w- c:\programdata\WinZip
2010-08-28 12:15:35 0 d-----w- c:\users\shawn\appdata\roaming\ParetoLogic
2010-08-28 12:15:35 0 d-----w- c:\users\shawn\appdata\roaming\DriverCure
2010-08-28 12:15:23 0 d-----w- c:\programdata\ParetoLogic
2010-08-28 11:42:28 0 d-----w- c:\programdata\COMODO
2010-08-28 11:37:27 72704 ----a-w- c:\windows\system32\fontsub.dll
2010-08-28 11:37:27 23552 ----a-w- c:\windows\system32\lpk.dll
2010-08-28 11:37:27 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-08-28 11:37:27 10240 ----a-w- c:\windows\system32\dciman32.dll
2010-08-28 11:33:27 61440 ----a-w- c:\windows\system32\winipsec.dll
2010-08-28 11:33:27 272896 ----a-w- c:\windows\system32\polstore.dll
2010-08-28 11:32:32 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-08-28 11:30:22 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2010-08-28 11:30:22 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2010-08-28 11:30:22 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2010-08-28 11:30:22 19968 ----a-w- c:\windows\system32\ARP.EXE
2010-08-28 11:30:22 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2010-08-28 11:30:22 17920 ----a-w- c:\windows\system32\netevent.dll
2010-08-28 11:30:22 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2010-08-28 11:30:22 105984 ----a-w- c:\windows\system32\netiohlp.dll
2010-08-28 11:30:22 10240 ----a-w- c:\windows\system32\finger.exe
2010-08-28 11:28:00 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2010-08-28 11:27:59 2501921 ----a-w- c:\windows\system32\wlan.tmf
2010-08-28 11:27:58 68096 ----a-w- c:\windows\system32\wlanhlp.dll
2010-08-28 11:27:58 65024 ----a-w- c:\windows\system32\wlanapi.dll
2010-08-28 11:27:58 513536 ----a-w- c:\windows\system32\wlansvc.dll
2010-08-28 11:27:58 302592 ----a-w- c:\windows\system32\wlansec.dll
2010-08-28 11:27:58 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2010-08-28 11:27:56 2334 ----a-w- c:\windows\system32\wbem\L2SecHC.mof
2010-08-28 11:27:55 12880 ----a-w- c:\windows\system32\wbem\wlan.mof
2010-08-28 11:27:54 15181 ----a-w- c:\windows\system32\gatherWirelessInfo.vbs
2010-08-28 11:26:48 1401856 ----a-w- c:\windows\system32\msxml6.dll
2010-08-28 11:26:47 2048 ----a-w- c:\windows\system32\msxml3r.dll
2010-08-28 11:26:46 2048 ----a-w- c:\windows\system32\msxml6r.dll
2010-08-28 11:25:40 218624 ----a-w- c:\windows\system32\msv1_0.dll
2010-08-28 11:24:40 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-08-28 11:24:40 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-08-28 11:24:39 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-08-28 11:23:40 2868224 ----a-w- c:\windows\system32\mf.dll
2010-08-28 11:23:39 98816 ----a-w- c:\windows\system32\mfps.dll
2010-08-28 11:23:39 53248 ----a-w- c:\windows\system32\rrinstaller.exe
2010-08-28 11:23:39 24576 ----a-w- c:\windows\system32\mfpmp.exe
2010-08-28 11:23:39 2048 ----a-w- c:\windows\system32\mferror.dll
2010-08-28 11:19:02 71680 ----a-w- c:\windows\system32\atl.dll
2010-08-28 11:16:29 160256 ----a-w- c:\windows\system32\wkssvc.dll
2010-08-28 11:15:26 136192 ----a-w- c:\windows\system32\aaclient.dll
2010-08-28 11:15:25 53248 ----a-w- c:\windows\system32\tsgqec.dll
2010-08-28 11:15:25 2066432 ----a-w- c:\windows\system32\mstscax.dll
2010-08-28 11:06:08 623616 ----a-w- c:\windows\system32\localspl.dll
2010-08-28 11:04:46 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-08-28 11:04:00 9728 ----a-w- c:\windows\system32\lsass.exe
2010-08-28 11:04:00 72704 ----a-w- c:\windows\system32\secur32.dll
2010-08-28 11:04:00 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-08-28 11:04:00 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2010-08-28 11:04:00 175104 ----a-w- c:\windows\system32\wdigest.dll
2010-08-28 11:04:00 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2010-08-28 11:03:58 13780 ----a-w- c:\windows\system32\wbem\lsasrv.mof
2010-08-28 11:00:59 4497408 ----a-w- c:\windows\system32\NlsData0019.dll
2010-08-28 10:57:16 6656 ----a-w- c:\windows\system32\kbd106n.dll
2010-08-28 10:54:40 62464 ----a-w- c:\windows\system32\l3codeca.acm
2010-08-28 10:54:40 220672 ----a-w- c:\windows\system32\l3codecp.acm
2010-08-28 10:52:51 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2010-08-28 10:52:51 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-08-28 10:52:51 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-08-28 10:52:51 15360 ----a-w- c:\windows\system32\drivers\TUNMP.SYS
2010-08-28 10:52:50 814 ----a-w- c:\windows\system32\wbem\WFP.MOF
2010-08-28 10:50:09 98304 ----a-w- c:\windows\system32\cabview.dll
2010-08-28 10:49:30 37888 ----a-w- c:\windows\system32\printcom.dll
2010-08-28 10:47:32 14848 ----a-w- c:\windows\system32\wshrm.dll
2010-08-28 10:46:53 43520 ----a-w- c:\windows\system32\msdxm.tlb
2010-08-28 10:46:53 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2010-08-28 10:46:53 18432 ----a-w- c:\windows\system32\amcompat.tlb
2010-08-28 10:46:52 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2010-08-28 10:46:50 7680 ----a-w- c:\windows\system32\spwmp.dll
2010-08-28 10:46:50 4096 ----a-w- c:\windows\system32\dxmasf.dll
2010-08-28 10:46:49 4096 ----a-w- c:\windows\system32\msdxm.ocx
2010-08-28 10:27:13 0 d-----w- c:\program files\COMODO
2010-08-28 10:20:01 65536 ----a-w- c:\windows\ocsetup_cbs_install_NetFx3.dpx
2010-08-28 10:20:01 196608 ----a-w- c:\windows\ocsetup_cbs_install_NetFx3.perf
2010-08-28 10:20:00 23789568 ----a-w- c:\windows\ocsetup_install_NetFx3.etl
2010-08-28 10:18:00 84480 ----a-w- c:\windows\system32\INETRES.dll
2010-08-28 10:17:38 60928 ----a-w- c:\windows\system32\msasn1.dll
2010-08-28 10:16:59 0 d-----w- c:\programdata\Comodo Downloader
2010-08-28 10:16:47 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2010-08-28 10:15:38 411648 ----a-w- c:\windows\system32\drivers\http.sys
2010-08-28 10:15:38 30720 ----a-w- c:\windows\system32\httpapi.dll
2010-08-28 10:15:38 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-08-28 10:11:53 243712 ----a-w- c:\windows\system32\rastls.dll
2010-08-28 10:11:12 355328 ----a-w- c:\windows\system32\WSDApi.dll
2010-08-28 10:10:24 0 d-----w- c:\program files\MSXML 4.0
2010-08-28 10:07:47 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2010-08-28 10:07:39 0 d-----w- c:\programdata\Sun
2010-08-28 10:06:34 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-28 08:55:55 0 d-----w- c:\users\shawn\appdata\roaming\SUPERAntiSpyware.com
2010-08-28 08:55:55 0 d-----w- c:\programdata\SUPERAntiSpyware.com
2010-08-28 08:55:45 0 d-----w- c:\program files\SUPERAntiSpyware
2010-08-28 08:53:01 0 d-----r- C:\AHCache
2010-08-28 07:06:03 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-08-28 07:06:03 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-08-28 07:05:02 0 d-----w- c:\program files\iPod
2010-08-28 07:04:01 0 d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-28 07:04:01 0 d-----w- c:\program files\iTunes
2010-08-28 07:01:56 0 d-----w- c:\programdata\Apple Computer
2010-08-28 06:56:36 0 d-----w- c:\programdata\Apple
2010-08-28 06:54:41 0 d-----w- c:\program files\Conduit
2010-08-28 06:44:39 0 d-----w- C:\4chan folder
2010-08-28 06:28:19 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2010-08-28 06:28:19 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2010-08-28 06:25:43 0 d-----w- c:\programdata\LogiShrd
2010-08-28 04:54:56 0 d-----w- c:\program files\Ventrilo
2010-08-28 04:54:55 262 ----a-w- c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2010-08-28 04:54:48 0 d-----w- c:\programdata\Blizzard Entertainment
2010-08-28 04:12:35 113896 ----a-w- c:\windows\system32\drivers\keyscrambler.sys
2010-08-28 04:12:34 0 d-----w- c:\program files\KeyScrambler
2010-08-28 04:09:45 0 d-----w- c:\program files\common files\Wise Installation Wizard
2010-08-28 03:40:14 0 d-----w- c:\programdata\McAfee
2010-08-28 03:36:10 0 d-----w- c:\programdata\Blizzard
2010-08-28 00:29:02 0 d-----w- c:\program files\common files\Blizzard Entertainment
2010-08-28 00:21:16 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-08-28 00:18:47 16 ----a-w- c:\windows\system32\coh.cache
2010-08-27 23:57:41 0 d-----w- c:\programdata\Yahoo! Companion
2010-08-27 23:57:03 2421760 ----a-w- c:\windows\system32\wucltux.dll
2010-08-27 23:56:20 87552 ----a-w- c:\windows\system32\wudriver.dll
2010-08-27 23:55:50 33792 ----a-w- c:\windows\system32\wuapp.exe
2010-08-27 23:55:50 171608 ----a-w- c:\windows\system32\wuwebv.dll
2010-08-27 23:53:40 27335 ----a-w- c:\users\shawn\appdata\roaming\nvModes.dat
2010-08-27 23:50:01 0 --sha-r- c:\windows\system32\drivers\103C_HP_cNB_Pavilion dv6500 Notebook PC_Y5335KV_0U_QCNF7445K61_E445841-003_4A_I30CF_SQuanta_V85.24_F.2A_T080222_WV3-0_L409_M2495_J160_7AMD_8F81_91.80_#100827_N10DE054C_(GS662UA#ABA)_XMOBILE_CN10_Z_2Rev 1.MRK
2010-08-27 23:49:34 44 ----a-w- c:\windows\system\hpsysdrv.dat
2010-08-27 23:37:28 0 d-sh--we c:\programdata\Documents
2010-08-27 23:37:28 0 d-sh--we C:\Documents and Settings

==================== Find3M ====================

2010-09-02 02:24:33 51200 ----a-w- c:\windows\inf\infpub.dat
2010-09-02 02:19:27 86016 ----a-w- c:\windows\inf\infstor.dat
2010-09-02 02:19:27 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-09-02 02:09:24 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-09-02 01:57:08 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2010-09-01 10:19:53 174 --sha-w- c:\program files\desktop.ini
2010-09-01 09:49:04 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-09-01 09:49:01 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-08-28 11:00:59 2599936 ----a-w- c:\windows\system32\NlsData0001.dll
2010-06-26 06:05:49 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02:15 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02:15 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25:02 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 8:38:13.08 ===============

Also, see attachments. I appreciate the help :pray:

~Shawn
 

Attachments

·
TSF Security Manager, Emeritus
Joined
·
42,836 Posts
Hello ixireaperixi,

I see you ran ComboFix a couple of days before posting this. Are you receiving help at another forum?
 
1 - 3 of 3 Posts
Status
Not open for further replies.
Top