[A] Help please!

Inactive
By Zurles
Aug 11, 2012
Topic Status:
Not open for further replies.
  1. Followed all instructions, logs as request!



    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-08-11 19:05:14
    Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\00000060 ST332062 rev.3.AA
    Running: gh1nj5kv.exe; Driver: C:\Users\Dean\AppData\Local\Temp\kxldapog.sys


    ---- Devices - GMER 1.0.15 ----

    Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 852201F8
    Device \Driver\atapi \Device\Ide\IdePort0 852201F8
    Device \Driver\atapi \Device\Ide\IdePort1 852201F8
    Device \Driver\atapi \Device\Ide\IdePort2 852201F8
    Device \Driver\msahci \Device\Ide\PciIde1Channel0 852221F8
    Device \Driver\asm6bken \Device\Scsi\asm6bken1Port8Path0Target0Lun0 86CA91F8
    Device \Driver\asm6bken \Device\Scsi\asm6bken1 86CA91F8
    Device \FileSystem\Ntfs \Ntfs 852241F8

    ---- EOF - GMER 1.0.15 ----

    Malwarebytes Anti-Malware (Trial) 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.08.08.04

    Windows Vista Service Pack 1 x86 NTFS
    Internet Explorer 8.0.6001.18928
    Dean :: DEAN-PC [administrator]

    Protection: Enabled

    2012-08-08 11:58:27
    mbam-log-2012-08-08 (11-58-27).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 247799
    Time elapsed: 4 minute(s), 41 second(s)

    Memory Processes Detected: 1
    C:\Windows\Cursors\lsass.exe (Trojan.Dropper) -> 1572 -> Delete on reboot.

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 42
    HKCR\CLSID\{4445414E-4445-4445-4445-4445414E2D50} (Trojan.Dropper) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{4445414E-4445-4445-4445-4445414E2D50} (Trojan.Dropper) -> Quarantined and deleted successfully.
    HKCR\CLSID\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCR\TypeLib\{44444444-4444-4444-4444-440044044435} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCR\Interface\{55555555-5555-5555-5555-550055045535} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.BHO.1 (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011041135} (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCR\CLSID\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCR\TypeLib\{44444444-4444-4444-4444-440044344491} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCR\Interface\{55555555-5555-5555-5555-550055345591} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0003491.BHO.1 (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011341191} (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{514A5C49-0C7D-42C3-A71B-38864A269B7A} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0003491.BHO (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.BHO (PUP.Codec.PR) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.FBApi (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.FBApi.1 (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.Sandbox (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0000435.Sandbox.1 (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0003491.FBApi (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0003491.FBApi.1 (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0003491.Sandbox (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\CrossriderApp0003491.Sandbox.1 (PUP.CrossFire.Gen) -> Quarantined and deleted successfully.
    HKCR\AppID\activex.DLL (Adware.180Solutions) -> Delete on reboot.
    HKCU\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKCU\Software\Cr_Installer\3491 (Adware.GamePlayLab) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\FUNMOODS\FUNMOODS (PUP.Funmoods) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\215 APPS (PUP.CrossFire.SA) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Detected: 9
    HKCU\Control Panel\Desktop|OriginalWallpaper (Hijack.Wallpaper) -> Data: C:\Windows\system32\phctcoj0e90l.bmp -> Quarantined and deleted successfully.
    HKCU\Control Panel\Desktop|ConvertedWallpaper (Hijack.Wallpaper) -> Data: C:\Windows\system32\phctcoj0e90l.bmp -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\OLE|DRam prosessor (Trojan.Agent) -> Data: gibwaoqk.exe -> Quarantined and deleted successfully.
    HKCU\Software\Funmoods\funmoods|tlbrSrchUrl (PUP.Funmoods) -> Data: http://start.funmoods.com/results.php?f=3&a=bf4&q= -> Quarantined and deleted successfully.
    HKCU\Software\InstalledBrowserExtensions\215 Apps|3491 (PUP.CrossFire.SA) -> Data: Vid-Saver -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings|bf (Trojan.Agent) -> Data: 嶝髪퉽沔䍢๳଀켇笗ꮯリ⚝﹣赥鐱⥙毺飹讝媒坳ﶙԯ⦅ꤷ䨢秜௣⇾ꏟ쑫岺楑੢⌀鋛䨪놖濣痍﹝驪錰⬘寢긽ꧣ軴힅 -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings|bk (Trojan.Agent) -> Data: ¥V…úK„Õ/}*.X*k‹©’A"÷³ànÓt—–Õ7Êg¡
    ËJf -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings|iu (Trojan.Agent) -> Data: 3077 -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings|mu (Trojan.Agent) -> Data: {®Gáz„? -> Quarantined and deleted successfully.

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 7
    C:\Windows\Cursors\lsass.exe (Trojan.Dropper) -> Delete on reboot.
    C:\Program Files\Codec-V\Codec-V.dll (PUP.Codec.PR) -> Quarantined and deleted successfully.
    C:\Program Files\Vid-Saver\Vid-Saver.dll (PUP.GamePlayLab) -> Quarantined and deleted successfully.
    C:\Users\Dean\Downloads\Setup.exe (PUP.Bundle.Installer.OI) -> Quarantined and deleted successfully.
    C:\Users\Dean\Downloads\Codec-V.exe (Affiliate.Downloader) -> Quarantined and deleted successfully.
    C:\Windows\Help\DVCLAL (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Windows\Help\PACKAGEINFO (Malware.Trace) -> Quarantined and deleted successfully.

    (end)
    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_31
    Run by Dean at 19:07:56 on 2012-08-11
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2046.967 [GMT 1:00]
    .
    SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\TEMP\mrt754E.tmp\stdrt.exe
    C:\Program Files\Razer\Abyssus\razerhid.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Razer\Abyssus\razerofa.exe
    C:\Users\Dean\AppData\Local\Google\Update\1.3.21.115\GoogleCrashHandler.exe
    C:\Windows\system32\svchost.exe -k apphost
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe
    C:\Program Files\PostgreSQL\8.4\bin\pg_ctl.exe
    C:\Program Files\Ralink\Common\RalinkRegistryWriter.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
    C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
    C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
    C:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
    C:\Windows\system32\svchost.exe -k iissvcs
    C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
    C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
    C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
    C:\Program Files\PostgreSQL\8.4\bin\postgres.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    C:\Windows\System32\svchost.exe -k wdisvc
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Users\Dean\AppData\Local\Google\Chrome\Application\chrome.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = https://isearch.avg.com/?cid={602ED...fb3797180&lang=en&ds=gm011&pr=sa&d=2012-06-26 11:13:19&v=11.1.1.7&sap=hp
    uInternet Settings,ProxyOverride = *.local
    mSearchAssistant =
    uURLSearchHooks: Veoh Web Player Toolbar: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - c:\program files\veoh_web_player\prxtbVeo2.dll
    mURLSearchHooks: H - No File
    mURLSearchHooks: Veoh Web Player Toolbar: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - c:\program files\veoh_web_player\prxtbVeo2.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    BHO: Veoh Web Player Toolbar: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - c:\program files\veoh_web_player\prxtbVeo2.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    BHO: Yontoo: {fd72061e-9fde-484d-a58a-0bab4151cad8} - c:\program files\yontoo\YontooIEClient.dll
    TB: Veoh Web Player Toolbar: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - c:\program files\veoh_web_player\prxtbVeo2.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
    TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
    uRun: [Steam] "c:\program files\steam\steam.exe" -silent
    uRun: [Google Update] "c:\users\dean\appdata\local\google\update\GoogleUpdate.exe" /c
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    mRun: [Abyssus] c:\program files\razer\abyssus\razerhid.exe
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    dRunOnce: [AutoLaunch] c:\program files\lavasoft\ad-aware\AutoLaunch.exe monthly
    StartupFolder: c:\users\dean\appdata\roaming\microsoft\windows\start menu\programs\startup\CurseClientStartup.ccip
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Trusted Zone: plu.cn\3
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{3366FFC0-7663-4AC5-9FB2-29D09949FC0F} : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{BD3E9A98-4DDE-431B-9918-A814EB040FEF} : DhcpNameServer = 192.168.1.1
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
    LSA: Authentication Packages = msv1_0 c:\windows\system32\fcccayxY
    Hosts: 127.0.0.1www.spywareinfo.com
    Hosts: 255.255.255.255 easyanticheat.se # misleading site
    Hosts: 255.255.255.255 www.easyanticheat.se # misleading site
    Hosts: 255.255.255.255 easyanticheat.com # misleading site
    Hosts: 255.255.255.255 www.easyanticheat.com # misleading site
    .
    Note: multiple HOSTS entries found. Please refer to Attach.txt
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\dean\appdata\roaming\mozilla\firefox\profiles\imwplybk.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=793c20b6-80ae-4bc3-b136-6f08d5d26c78&lcid=2057&ref=homepage
    FF - prefs.js: keyword.URL - hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=
    FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=793C20B6-80AE-4BC3-B136-6F08D5D26C78
    FF - prefs.js: browser.search.selectedEngine - SearchTheWeb
    FF - prefs.js: browser.startup.homepage -
    FF - prefs.js: browser.search.selectedEngine -
    FF - plugin: c:\program files\common files\gretech\npgomtvx_nie.dll
    FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
    FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
    FF - plugin: c:\program files\dyyno\dyyno player\npvlc.dll
    FF - plugin: c:\program files\java\jre6\bin\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre6\bin\npjpi160_31.dll
    FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npclntax_HotbarSA.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
    FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
    FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
    FF - plugin: c:\program files\veetle\player\npvlc.dll
    FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
    FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\programdata\id software\quakelive\npquakezero.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\users\dean\appdata\local\google\update\1.3.21.111\npGoogleUpdate3.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms0808050_sua_900\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms0810164_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms0905250_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms0907083_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms0907280_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms0912302_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms1001140_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms1002010_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms1002170_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms1008042_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms1010120_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\local\octoshape\octoshape streaming services\octoprogram-l03-nms1101262_sua_000\npoctoshape.dll
    FF - plugin: c:\users\dean\appdata\roaming\mozilla\plugins\npoctoshape.dll
    FF - plugin: c:\windows\system32\tvuax\npTVUAx.dll
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(extensions.funmoods.autoRvrt, false
    FF - user.js: extensions.funmoods_i.hmpg - true
    FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=bf4
    FF - user.js: extensions.funmoods_i.dfltSrch - true
    FF - user.js: extensions.funmoods_i.srchPrvdr - Search
    FF - user.js: extensions.funmoods_i.dnsErr - true
    FF - user.js: extensions.funmoods_i.newTab - true
    FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=bf4
    FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=bf4&q=
    FF - user.js: extensions.funmoods_i.id - a894eecf000000000000001a9282357f
    FF - user.js: extensions.funmoods_i.instlDay - 15406
    FF - user.js: extensions.funmoods_i.vrsn - 1.5.17.8
    FF - user.js: extensions.funmoods_i.vrsni - 1.5.17.8
    FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.17.812:16:00
    FF - user.js: extensions.funmoods_i.prtnrId - funmoods
    FF - user.js: extensions.funmoods_i.prdct - funmoods
    FF - user.js: extensions.funmoods_i.aflt - bf4
    FF - user.js: extensions.funmoods_i.smplGrp - none
    FF - user.js: extensions.funmoods_i.tlbrId - base
    FF - user.js: extensions.funmoods_i.instlRef -
    FF - user.js: extensions.funmoods_i.dfltLng -
    FF - user.js: extensions.funmoods_i.excTlbr - false
    FF - user.js: extensions.funmoods_i.admin - false
    FF - user.js: extentions.y2layers.installId - 4dee6cb6-a544-4543-b426-f89cb6793250
    FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader,ezLooker,pagerage,buzzdock,toprelatedtopics,twittube
    .
    FF - user.js: extensions.autoDisableScopes - 14
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-27 64160]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-8-8 655944]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-7-11 1262400]
    R2 postgresql-8.4;postgresql-8.4 - PostgreSQL Server 8.4;C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N "postgresql-8.4" -D "C:/Program Files/PostgreSQL/8.4/data" -w --> C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 [?]
    R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RalinkRegistryWriter.exe [2011-2-22 69632]
    R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-7-5 3048136]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-5-15 382272]
    R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-6-14 2666880]
    R3 Abyssus03;Razer Abyssus USB Filter Driver;c:\windows\system32\drivers\Abyssus.sys [2012-1-24 9216]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-8-8 22344]
    R3 nvoclock;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\drivers\nvoclock.sys [2009-9-15 38248]
    R3 vHidDev;Razer Gaming Device;c:\windows\system32\drivers\vHidDev.sys [2012-1-24 5760]
    S2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\system32\lnsecsl.exe [2012-6-15 910564]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-3 160944]
    S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-7-18 250056]
    S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-12-8 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
    S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2011-2-22 641024]
    S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064]
    S3 Salmosa03;Razer Salmosa USB Filter Driver;c:\windows\system32\drivers\Salmosa.sys [2008-10-29 9344]
    S3 VundoFixSvc;VundoFix Service;VundoFixSVC.exe --> VundoFixSVC.exe [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1036104]
    S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]
    .
    =============== Created Last 30 ================
    .
    2012-08-11 17:57:08100864----a-w-C:\kxldapog.sys
    2012-08-08 10:57:36--------d-----w-c:\users\dean\appdata\roaming\Malwarebytes
    2012-08-08 10:57:28--------d-----w-c:\programdata\Malwarebytes
    2012-08-08 10:57:2722344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-08-08 10:57:27--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-08-08 10:56:27--------d-----w-c:\program files\Ad-Aware Antivirus
    2012-08-08 10:55:20--------d-----w-c:\users\dean\appdata\roaming\Ad-Aware Antivirus
    2012-07-18 11:28:01426184----a-w-c:\windows\system32\FlashPlayerApp.exe
    .
    ==================== Find3M ====================
    .
    2012-08-02 19:49:2670344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-06-15 03:50:48910564----a-w-c:\windows\system32\lnsecsl.exe
    2012-05-15 10:26:00883008----a-w-c:\windows\system32\nvgenco32.dll
    2012-05-15 10:26:008105280----a-w-c:\windows\system32\nvwgf2um.dll
    2012-05-15 10:26:0061248----a-w-c:\windows\system32\OpenCL.dll
    2012-05-15 10:26:005982528----a-w-c:\windows\system32\nvcuda.dll
    2012-05-15 10:26:002524992----a-w-c:\windows\system32\nvcuvid.dll
    2012-05-15 10:26:002445120----a-w-c:\windows\system32\nvcuvenc.dll
    2012-05-15 10:26:002368832----a-w-c:\windows\system32\nvapi.dll
    2012-05-15 10:26:0019607872----a-w-c:\windows\system32\nvoglv32.dll
    2012-05-15 10:26:0017551680----a-w-c:\windows\system32\nvcompiler.dll
    2012-05-15 10:26:0015322432----a-w-c:\windows\system32\nvd3dum.dll
    2012-05-15 10:26:0011354944----a-w-c:\windows\system32\drivers\nvlddmkm.sys
    2012-05-15 10:26:001000768----a-w-c:\windows\system32\nvdispco32.dll
    2012-05-15 09:28:502561344----a-w-c:\windows\system32\nvsvcr.dll
    2012-05-15 09:28:49645440----a-w-c:\windows\system32\nvvsvc.exe
    2012-05-15 09:28:4962272----a-w-c:\windows\system32\nvshext.dll
    2012-05-15 09:28:49108352----a-w-c:\windows\system32\nvmctray.dll
    2012-05-15 09:28:483931456----a-w-c:\windows\system32\nvcpl.dll
    2012-05-15 09:27:282759488----a-w-c:\windows\system32\nvsvc.dll
    2012-05-15 01:21:50423744----a-w-c:\windows\system32\nvStreaming.exe
    2008-10-29 06:29:41399386--sh--r-c:\windows\system32\gibwaoqk.exe
    2008-10-29 06:29:41399386--sh--r-c:\windows\system32\quierwtw.exe
    2008-10-29 06:29:41399386--sh--r-c:\windows\system32\ulzhortg.exe
    2008-10-29 06:29:41399386--sh--r-c:\windows\system32\vechijoj.exe
    2008-10-29 06:29:41399386--sh--r-c:\windows\system32\ymafemxq.exe
    .
    ============= FINISH: 19:08:43.98 ===============
  2. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
    .

    ======================================

    I still need Attach.txt part of DDS.

    You're not saying what your computer problems are.
  3. Zurles

    Zurles TechSpot Enthusiast Topic Starter Posts: 123

    I read something saying not to attach it unless asked to, sorry.

    Problems are everything runs really slow, much more popups when browsing, built-in adverts in facebook/youtube that aren't meant to be there, programs hang a lot.

    Attached Files:

  4. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    Please observe forum rules.
    All logs have to be pasted not attached.
  5. Zurles

    Zurles TechSpot Enthusiast Topic Starter Posts: 123

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 2008-07-05 15:38:20
    System Uptime: 2012-08-11 19:02:25 (0 hours ago)
    .
    Motherboard: ASUSTeK Computer INC. | | P5N-E SLI
    Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz | Socket 775 | 2400/266mhz
    .
    ==== Disk Partitions =========================
    .
    A: is Removable
    C: is FIXED (NTFS) - 298 GiB total, 81.251 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    F: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Hosts File Hijack ======================
    .
    Hosts: 127.0.0.1www.spywareinfo.com
    Hosts: 255.255.255.255 easyanticheat.se # misleading site
    Hosts: 255.255.255.255 www.easyanticheat.se # misleading site
    Hosts: 255.255.255.255 easyanticheat.com # misleading site
    Hosts: 255.255.255.255 www.easyanticheat.com # misleading site
    Hosts: 255.255.255.255 easyanticheat.org # misleading site
    Hosts: 255.255.255.255 www.easyanticheat.org # misleading site
    .
    ==== Installed Programs ======================
    .
    .
    1ClickDownloader
    Acrobat.com
    Ad-Aware
    Adobe AIR
    Adobe Bridge 1.0
    Adobe Common File Installer
    Adobe Flash Player 11 ActiveX
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Reader 9.4.1
    Adobe Stock Photos 1.0
    AIM 7
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Arasan 10.4
    ASIO4ALL
    ASUSUpdate
    µTorrent
    Audacity 1.2.6
    BattlePing
    Bonjour
    CCleaner
    Codec-V
    Counter-Strike: Source
    Defraggler
    DivX Converter
    DivX Plus DirectShow Filters
    DivX Setup
    DivX Version Checker
    Download Updater (AOL LLC)
    DTS+AC3 Filter
    DyynoPlayer 0.8.6f
    EPSON Scan
    File Shredder 2.0
    FL Studio 10.5
    FrostWire 5.3.4
    Full Tilt Poker
    Garena
    GOM Player
    GOMTV Plug-in
    GOMTV Streamer
    Google Chrome
    Graboid Video 1.73
    Hamachi 1.0.2.0
    Heroes of Newerth
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    ICCup Launcher
    IL Download Manager
    IL Shared Libraries
    IsoBuster 2.5
    iTunes
    Java Auto Updater
    Java DB 10.5.3.0
    Java(TM) 6 Update 31
    Java(TM) 6 Update 7
    Java(TM) SE Development Kit 6 Update 20
    Junk Mail filter update
    Last.fm 1.5.4.24567
    League of Legends
    Magic ISO Maker v5.5 (build 0276)
    MagicDisc 2.7.106
    Malwarebytes Anti-Malware version 1.62.0.1300
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Games for Windows - LIVE
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Enterprise 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Groove MUI (English) 2007
    Microsoft Office Groove Setup Metadata MUI (English) 2007
    Microsoft Office InfoPath MUI (English) 2007
    Microsoft Office Live Add-in 1.3
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office Outlook Connector
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft XNA Framework Redistributable 3.1
    Microsoft XNA Framework Redistributable 4.0
    mIRC
    Mozilla Firefox (3.6.22)
    MPEG2 Codec(libmpeg2/mad)
    MSVCRT
    Mumble 1.2.3
    NVIDIA 3D Vision Controller Driver 301.42
    NVIDIA 3D Vision Driver 301.42
    NVIDIA Control Panel 301.42
    NVIDIA Drivers
    NVIDIA Graphics Driver 301.42
    NVIDIA Install Application
    NVIDIA Performance
    NVIDIA PhysX
    NVIDIA PhysX System Software 9.12.0213
    NVIDIA Stereoscopic 3D Driver
    NVIDIA System Monitor
    NVIDIA System Update
    NVIDIA Update 1.8.15
    NVIDIA Update Components
    Octoshape add-in for Adobe Flash Player
    Octoshape Streaming Services
    Planescape Torment
    Pokemon World Online version 1.83
    Poker Tracker Version 2.17.03d
    PokerStars
    PokerStove version 1.24
    PokerStrategy Equilator
    PokerStrategy.com Equilator
    PokerTracker 3 (remove only)
    PostgreSQL 8.4
    Premiumplay Codec-C
    PunkBuster Services
    Quake Live Internet Explorer Plugin
    Quake Live Mozilla Plugin
    QuickTime
    Ralink RT2870 Wireless LAN Card
    Razer Abyssus
    Razer Habu Config
    Razer Salmosa
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    Realtek AC'97 Audio
    Realtek High Definition Audio Driver
    RealUpgrade 1.1
    RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
    Rosetta Stone Version 3
    Security Update for 2007 Microsoft Office System (KB951550)
    Security Update for 2007 Microsoft Office System (KB951944)
    Skype Click to Call
    Skype™ 5.10
    SopCast 3.2.9
    Speccy
    Spelling Dictionaries Support For Adobe Reader 9
    Spybot - Search & Destroy
    Starcraft
    StarCraft II
    Steam
    Synthesia (remove only)
    System Requirements Lab
    System Requirements Lab CYRI
    TableNinja
    TeamSpeak 3 Client
    TeamViewer 7
    Terraria
    Update for 2007 Microsoft Office System (KB967642)
    Update for Outlook 2007 Junk Email Filter (kb983486)
    VC80CRTRedist - 8.0.50727.6195
    Veetle TV 0.9.18
    Ventrilo Client
    Veoh Web Player Toolbar
    Vid-Saver
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 1.0.1
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live Mail
    Windows Live Messenger
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Toolbar
    Windows Live Upload Tool
    Windows Live Writer
    Windows Media Player Firefox Plugin
    WinPcap 4.0.2
    Xvid 1.2.1 final uninstall
    Yontoo 1.10.02
    .
    ==== End Of File ===========================
  6. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    I don't see any AV program running.
    Install ONE of these:
    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
    - free Microsoft Security Essentials: http://windows.microsoft.com/en-GB/windows/products/security-essentials
    - free Comodo Antivirus: http://www.comodo.com/home/internet-security/antivirus.php
    Update, run full scan, report on any findings.

    Next...

    Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    http://download.bleepingcomputer.com/grinler/beta/rkill.exe
    http://download.bleepingcomputer.com/grinler/beta/iExplore.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    If normal mode still doesn't work, run the tool from safe mode.

    When the scan is done Notepad will open with rKill log.
    Post it in your next reply.

    NOTE. rKill.txt log will also be present on your desktop.

    =================================

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
  7. Zurles

    Zurles TechSpot Enthusiast Topic Starter Posts: 123

    Avast scan found 5 cases of a spyware-gen in system 32 with "high severity,
    and a JS multiplug-b[adw] in a google chrome folder.

    Rkill:
    Rkill 2.1.0 by Lawrence Abrams (Grinler)
    http://www.bleepingcomputer.com/
    Copyright 2008-2012 BleepingComputer.com
    More Information about Rkill can be found at this link:
    http://www.bleepingcomputer.com/forums/topic308364.html

    Program started at: 08/12/2012 01:44:58 AM in x86 mode.
    Windows Version: Windows Vista

    Checking for Windows services to stop.

    * No malware services found to stop.

    Checking for processes to terminate.

    * No malware processes found to kill.

    Checking Registry for malware related settings.

    * No issues found in the Registry.

    Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
    * HKLM\Software\Classes\.com "@" has been changed to ComFile!
    * HKLM\Software\Classes\.com "@" was reset to comfile!


    Performing miscellaneous checks.

    * No issues found.

    Searching for Missing Digital Signatures:

    * No issues found.

    Restarting Explorer.exe in order to apply changes.

    Program finished at: 08/12/2012 01:45:30 AM
    Execution time: 0 hours(s), 0 minute(s), and 31 seconds(s)
    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-08-12 01:45:48
    -----------------------------
    01:45:48.701 OS Version: Windows 6.0.6001 Service Pack 1
    01:45:48.701 Number of processors: 2 586 0xF06
    01:45:48.703 ComputerName: DEAN-PC UserName: Dean
    01:45:55.734 Initialize success
    01:45:56.354 AVAST engine defs: 12081101
    01:46:04.617 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000060
    01:46:04.617 Disk 0 Vendor: ST332062 3.AA Size: 305245MB BusType: 6
    01:46:04.632 Disk 0 MBR read successfully
    01:46:04.632 Disk 0 MBR scan
    01:46:04.632 Disk 0 Windows VISTA default MBR code
    01:46:04.664 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 305243 MB offset 2048
    01:46:04.664 Disk 0 scanning sectors +625139712
    01:46:04.726 Disk 0 scanning C:\Windows\system32\drivers
    01:46:12.947 Service scanning
    01:46:23.352 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
    01:46:27.970 Modules scanning
    01:46:32.463 Disk 0 trace - called modules:
    01:46:32.478 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x852231f8]<<
    01:46:32.478 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85cd7560]
    01:46:32.494 3 CLASSPNP.SYS[82c8a745] -> nt!IofCallDriver -> [0x852898d0]
    01:46:32.494 5 acpi.sys[807b06a0] -> nt!IofCallDriver -> \Device\00000060[0x85289b00]
    01:46:32.510 \Driver\nvstor32[0x85280db0] -> IRP_MJ_CREATE -> 0x852231f8
    01:46:34.132 AVAST engine scan C:\Windows
    01:46:37.673 AVAST engine scan C:\Windows\system32
    01:48:31.939 AVAST engine scan C:\Windows\system32\drivers
    01:48:44.211 AVAST engine scan C:\Users\Dean
    02:11:47.798 AVAST engine scan C:\ProgramData
    03:05:35.801 Scan finished successfully
    03:06:02.867 Disk 0 MBR has been saved successfully to "C:\Users\Dean\Desktop\MBR.dat"
    03:06:02.883 The log file has been saved successfully to "C:\Users\Dean\Desktop\aswMBR.txt"
  8. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    http://download.bleepingcomputer.com/grinler/beta/rkill.exe
    http://download.bleepingcomputer.com/grinler/beta/iExplore.exe

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    Please post BOTH logs, rKillt.xt and Combofix.txt.
  9. Zurles

    Zurles TechSpot Enthusiast Topic Starter Posts: 123

    Rkill 2.1.0 by Lawrence Abrams (Grinler)
    http://www.bleepingcomputer.com/
    Copyright 2008-2012 BleepingComputer.com
    More Information about Rkill can be found at this link:
    http://www.bleepingcomputer.com/forums/topic308364.html

    Program started at: 08/12/2012 03:13:51 PM in x86 mode.
    Windows Version: Windows Vista

    Checking for Windows services to stop.

    * No malware services found to stop.

    Checking for processes to terminate.

    * No malware processes found to kill.

    Checking Registry for malware related settings.

    * No issues found in the Registry.

    Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

    Performing miscellaneous checks.

    * No issues found.

    Searching for Missing Digital Signatures:

    * No issues found.

    Restarting Explorer.exe in order to apply changes.

    Program finished at: 08/12/2012 03:14:29 PM
    Execution time: 0 hours(s), 0 minute(s), and 38 seconds(s)
    ComboFix 12-08-10.02 - Dean 2012-08-12 14:37:17.2.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2046.727 [GMT 1:00]
    Running from: c:\users\Dean\Desktop\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\dddd
    c:\program files\dddd\dsda.exe
    c:\program files\dddd\hijackthis.log
    c:\users\Dean\AppData\Roaming\Microsoft\Windows\Recent\ahttpwww.youtube.comwatchv=2T5NUB1vyu4a.pif
    c:\users\Dean\AppData\Roaming\Microsoft\Windows\Recent\NDSEmulator.com.url
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome.manifest
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\background.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\browser.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\crossrider.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\crossriderapi.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\dialog.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\lib\faye-browser-min.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\manage-apps-style.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\manage-apps.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\messaging.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\options.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\options.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\push.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\search_dialog.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\chrome\content\update.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\defaults\preferences\prefs.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\install.rdf
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\locale\en-US\translations.dtd
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\button1.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\button2.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\button3.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\button4.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\button5.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\crossrider_statusbar.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\icon128.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\icon16.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\icon24.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\icon48.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\panelarrow-up.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\popup.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\popup.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\popup_binding.xml
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\skin.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp3491@crossrider.com\skin\update.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome.manifest
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\background.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\browser.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\crossrider.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\crossriderapi.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\dialog.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\facebox.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\facebox.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\b.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\bl.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\br.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\closelabel.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\loading.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\tl.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\facebox\Images\tr.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\faye-browser-min.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\lib\jquery-1.4.2.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\manage-apps-style.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\manage-apps.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\messaging.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\options.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\options.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\push.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\search_dialog.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\socialapi.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\update.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\utilityapi.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\chrome\content\workers_chain.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\defaults\preferences\prefs.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\install.rdf
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\locale\en-US\translations.dtd
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\button1.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\button2.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\button3.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\button4.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\button5.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\crossrider_statusbar.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\icon128.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\icon16.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\icon24.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\icon48.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\panelarrow-up.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\popup.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\popup.html
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\popup_binding.xml
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\skin.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\crossriderapp435@crossrider.com\skin\update.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\chrome.manifest
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\funmoods.css
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\funmoods.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\arwDwn.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ae.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\bg.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ch.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cn.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\cz.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\de.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\eg.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\en.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\es.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\fr.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\gr.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\he.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\il.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\it.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ja.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\jp.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\nl.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\no.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pl.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\pt.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ro.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ru.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sa.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\se.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\sv.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\tr.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\ua.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\flgs\us.png
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\help_16.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\home.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\privecy_16_hot.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\imgs\tellafriend.gif
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\loader.xul
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\mtstart.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\content\tmplt.js
    c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\extensions\ffxtlbr@funmoods.com\install.rdf
    c:\windows\struct~.ini
    c:\windows\system32\404Fix.exe
    c:\windows\system32\dumphive.exe
    c:\windows\system32\IEDFix.C.exe
    c:\windows\system32\IEDFix.exe
    c:\windows\system32\nsis_loader.dll
    c:\windows\system32\phxawvms.ini
    c:\windows\system32\Process.exe
    c:\windows\system32\SrchSTS.exe
    c:\windows\system32\tmp.reg
    c:\windows\system32\VCCLSID.exe
    c:\windows\system32\WS2Fix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_Adobe Licensing Console
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-07-12 to 2012-08-12 )))))))))))))))))))))))))))))))
    .
    .
    2012-08-12 13:52 . 2012-08-12 13:52--------d-----w-c:\users\UpdatusUser\AppData\Local\temp
    2012-08-12 13:52 . 2012-08-12 13:52--------d-----w-c:\users\postgres\AppData\Local\temp
    2012-08-12 13:52 . 2012-08-12 13:52--------d-----w-c:\users\postgres.Dean-PC\AppData\Local\temp
    2012-08-12 13:52 . 2012-08-12 13:52--------d-----w-c:\users\Default\AppData\Local\temp
    2012-08-11 23:49 . 2012-07-03 16:21353688----a-w-c:\windows\system32\drivers\aswSP.sys
    2012-08-11 23:49 . 2012-07-03 16:2121256----a-w-c:\windows\system32\drivers\aswFsBlk.sys
    2012-08-11 23:49 . 2012-07-03 16:2154232----a-w-c:\windows\system32\drivers\aswTdi.sys
    2012-08-11 23:49 . 2012-07-03 16:2135928----a-w-c:\windows\system32\drivers\aswRdr.sys
    2012-08-11 23:49 . 2012-07-03 16:21721000----a-w-c:\windows\system32\drivers\aswSnx.sys
    2012-08-11 23:49 . 2012-07-03 16:2157656----a-w-c:\windows\system32\drivers\aswMonFlt.sys
    2012-08-11 23:48 . 2012-07-03 16:2141224----a-w-c:\windows\avastSS.scr
    2012-08-11 23:48 . 2012-07-03 16:21227648----a-w-c:\windows\system32\aswBoot.exe
    2012-08-11 23:48 . 2012-08-11 23:48--------d-----w-c:\programdata\AVAST Software
    2012-08-11 23:48 . 2012-08-11 23:48--------d-----w-c:\program files\AVAST Software
    2012-08-11 17:57 . 2012-08-11 17:57100864----a-w-C:\kxldapog.sys
    2012-08-08 10:57 . 2012-08-08 10:57--------d-----w-c:\users\Dean\AppData\Roaming\Malwarebytes
    2012-08-08 10:57 . 2012-08-08 10:57--------d-----w-c:\programdata\Malwarebytes
    2012-08-08 10:57 . 2012-08-08 10:57--------d-----w-c:\program files\Malwarebytes' Anti-Malware
    2012-08-08 10:57 . 2012-07-03 12:4622344----a-w-c:\windows\system32\drivers\mbam.sys
    2012-08-08 10:56 . 2012-08-08 10:56--------d-----w-c:\program files\Ad-Aware Antivirus
    2012-08-08 10:55 . 2012-08-08 10:55--------d-----w-c:\users\Dean\AppData\Roaming\Ad-Aware Antivirus
    2012-07-18 11:28 . 2012-08-02 19:49426184----a-w-c:\windows\system32\FlashPlayerApp.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-08-02 19:49 . 2012-05-02 00:0670344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
    2012-06-15 03:50 . 2012-06-15 03:50910564----a-w-c:\windows\system32\lnsecsl.exe
    2012-05-15 10:26 . 2012-07-11 12:168105280----a-w-c:\windows\system32\nvwgf2um.dll
    2012-05-15 10:26 . 2012-07-11 12:1619607872----a-w-c:\windows\system32\nvoglv32.dll
    2012-05-15 10:26 . 2012-07-11 12:1611354944----a-w-c:\windows\system32\drivers\nvlddmkm.sys
    2012-05-15 10:26 . 2012-07-11 12:165982528----a-w-c:\windows\system32\nvcuda.dll
    2012-05-15 10:26 . 2012-07-11 12:162524992----a-w-c:\windows\system32\nvcuvid.dll
    2012-05-15 10:26 . 2012-07-11 12:162445120----a-w-c:\windows\system32\nvcuvenc.dll
    2012-05-15 10:26 . 2012-07-11 12:1617551680----a-w-c:\windows\system32\nvcompiler.dll
    2012-05-15 10:26 . 2011-12-12 21:24883008----a-w-c:\windows\system32\nvgenco32.dll
    2012-05-15 10:26 . 2011-12-12 21:2461248----a-w-c:\windows\system32\OpenCL.dll
    2012-05-15 10:26 . 2011-12-12 21:241000768----a-w-c:\windows\system32\nvdispco32.dll
    2012-05-15 10:26 . 2011-01-06 19:4415322432----a-w-c:\windows\system32\nvd3dum.dll
    2012-05-15 10:26 . 2010-08-02 10:222368832----a-w-c:\windows\system32\nvapi.dll
    2012-05-15 09:28 . 2010-10-16 12:422561344----a-w-c:\windows\system32\nvsvcr.dll
    2012-05-15 09:28 . 2010-10-16 12:42645440----a-w-c:\windows\system32\nvvsvc.exe
    2012-05-15 09:28 . 2010-10-16 12:42108352----a-w-c:\windows\system32\nvmctray.dll
    2012-05-15 09:28 . 2010-07-09 15:2062272----a-w-c:\windows\system32\nvshext.dll
    2012-05-15 09:28 . 2010-10-16 12:423931456----a-w-c:\windows\system32\nvcpl.dll
    2012-05-15 09:27 . 2010-10-16 12:422759488----a-w-c:\windows\system32\nvsvc.dll
    2012-05-15 01:21 . 2012-05-15 01:21423744----a-w-c:\windows\system32\nvStreaming.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{cd90bf73-20f6-44ef-993d-bb920303bd2e}"= "c:\program files\Veoh_Web_Player\prxtbVeo2.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
    2011-01-17 14:54175912----a-w-c:\program files\ConduitEngine\prxConduitEngine.dll
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]
    2011-01-17 14:54175912----a-w-c:\program files\Veoh_Web_Player\prxtbVeo2.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{cd90bf73-20f6-44ef-993d-bb920303bd2e}"= "c:\program files\Veoh_Web_Player\prxtbVeo2.dll" [2011-01-17 175912]
    "{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]
    .
    [HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{CD90BF73-20F6-44EF-993D-BB920303BD2E}"= "c:\program files\Veoh_Web_Player\prxtbVeo2.dll" [2011-01-17 175912]
    .
    [HKEY_CLASSES_ROOT\clsid\{cd90bf73-20f6-44ef-993d-bb920303bd2e}]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2012-07-03 16:21121528----a-w-c:\program files\AVAST Software\Avast\ashShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Steam"="c:\program files\Steam\steam.exe" [2012-08-04 1353080]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Abyssus"="c:\program files\Razer\Abyssus\razerhid.exe" [2010-05-10 223744]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "AutoLaunch"="c:\program files\Lavasoft\Ad-Aware\AutoLaunch.exe" [2011-06-13 669936]
    .
    c:\users\Dean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    CurseClientStartup.ccip [2011-6-5 0]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux4"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
    backup=c:\windows\pss\Ralink Wireless Utility.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^Users^Dean^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    path=c:\users\Dean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
    backup=c:\windows\pss\Adobe Gamma.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2012-01-03 07:37843712----a-w-c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-09-23 04:4735760----a-w-c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
    2009-04-23 13:51691656----a-w-c:\program files\DAEMON Tools Lite\daemon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2010-02-19 18:20135664----atw-c:\users\Dean\AppData\Local\Google\Update\GoogleUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2012-03-27 04:09421736----a-w-c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
    2009-11-06 13:13133736----a-w-c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    2012-05-15 09:28108352----a-w-c:\windows\System32\nvmctray.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
    2008-05-22 13:59156944----a-w-c:\users\Dean\AppData\Local\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2012-04-18 19:56421888----a-w-c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
    2009-08-22 18:2524576----a-w-c:\program files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTunerWrapper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salmosa]
    2008-08-21 15:28139264----a-w-c:\program files\Razer\Salmosa\razerhid.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    2012-07-03 12:2317417392----a-r-c:\program files\Skype\Phone\Skype.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2012-01-18 14:02254696----a-w-c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    2012-04-01 04:43296056----a-w-c:\program files\Real\RealPlayer\Update\realsched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]
    2010-07-06 14:012634048----a-w-c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "FirewallOverride"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1332196778-695390960-1088873658-1000]
    "EnableNotificationsRef"=dword:00000001
    .
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
    S3 Abyssus03;Razer Abyssus USB Filter Driver;c:\windows\system32\Drivers\Abyssus.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-08-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 15:57]
    .
    2012-08-12 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-18 19:49]
    .
    2012-08-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1332196778-695390960-1088873658-1000Core.job
    - c:\users\Dean\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-19 18:20]
    .
    2012-08-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1332196778-695390960-1088873658-1000UA.job
    - c:\users\Dean\AppData\Local\Google\Update\GoogleUpdate.exe [2010-02-19 18:20]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://isearch.avg.com/?cid={602ED...fb3797180&lang=en&ds=gm011&pr=sa&d=2012-06-26 11:13&v=11.1.1.7&sap=hp
    uInternet Settings,ProxyOverride = *.local
    Trusted Zone: plu.cn\3
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Dean\AppData\Roaming\Mozilla\Firefox\Profiles\imwplybk.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=793c20b6-80ae-4bc3-b136-6f08d5d26c78&lcid=2057&ref=homepage
    FF - prefs.js: keyword.URL - hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=
    FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=793C20B6-80AE-4BC3-B136-6F08D5D26C78
    FF - prefs.js: browser.search.selectedEngine - SearchTheWeb
    FF - prefs.js: browser.startup.homepage -
    FF - prefs.js: browser.search.selectedEngine -
    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(extensions.funmoods.autoRvrt, false
    FF - user.js: extensions.funmoods_i.hmpg - true
    FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=bf4
    FF - user.js: extensions.funmoods_i.dfltSrch - true
    FF - user.js: extensions.funmoods_i.srchPrvdr - Search
    FF - user.js: extensions.funmoods_i.dnsErr - true
    FF - user.js: extensions.funmoods_i.newTab - true
    FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=bf4
    FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=bf4&q=
    FF - user.js: extensions.funmoods_i.id - a894eecf000000000000001a9282357f
    FF - user.js: extensions.funmoods_i.instlDay - 15406
    FF - user.js: extensions.funmoods_i.vrsn - 1.5.17.8
    FF - user.js: extensions.funmoods_i.vrsni - 1.5.17.8
    FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.17.812:16
    FF - user.js: extensions.funmoods_i.prtnrId - funmoods
    FF - user.js: extensions.funmoods_i.prdct - funmoods
    FF - user.js: extensions.funmoods_i.aflt - bf4
    FF - user.js: extensions.funmoods_i.smplGrp - none
    FF - user.js: extensions.funmoods_i.tlbrId - base
    FF - user.js: extensions.funmoods_i.instlRef -
    FF - user.js: extensions.funmoods_i.dfltLng -
    FF - user.js: extensions.funmoods_i.excTlbr - false
    FF - user.js: extensions.funmoods_i.admin - false
    FF - user.js: extentions.y2layers.installId - 4dee6cb6-a544-4543-b426-f89cb6793250
    FF - user.js: extentions.y2layers.defaultEnableAppsList - bestvideodownloader,ezLooker,pagerage,buzzdock,toprelatedtopics,twittube
    FF - user.js: extensions.autoDisableScopes - 14
    .
    - - - - ORPHANS REMOVED - - - -
    .
    AddRemove-Codec-V - c:\program files\Codec-V\Uninstall.exe
    .
    .
    .
    **************************************************************************
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files:
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresql-8.4]
    "ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GarenaPEngine]
    "ImagePath"="\??\c:\users\Dean\AppData\Local\Temp\LMR3465.tmp"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\postgresql-8.4]
    "ImagePath"="C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files/PostgreSQL/8.4/data\" -w"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1332196778-695390960-1088873658-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:37,49,dd,00,0e,64,a3,1b,a3,e2,a0,97,72,11,64,c7,36,6e,fa,69,01,5c,36,
    47,85,fd,09,a6,60,41,dc,69,b6,ab,1a,19,22,58,df,05,2c,08,41,26,4a,66,55,36,\
    "??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
    .
    [HKEY_USERS\S-1-5-21-1332196778-695390960-1088873658-1000\Software\SecuROM\License information*]
    "datasecu"=hex:c0,96,10,4c,02,bc,60,6f,ac,ec,6b,1d,72,c8,b7,ce,f1,0d,55,c9,5b,
    68,04,68,79,03,4f,fe,e3,92,56,fb,60,15,2e,9e,15,44,92,d0,b5,a6,fc,c3,62,a5,\
    "rkeysecu"=hex:29,ea,18,6d,3d,12,b3,a1,d4,f8,45,5e,88,59,ea,5c
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvvsvc.exe
    c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
    c:\windows\system32\nvvsvc.exe
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files\NVIDIA Corporation\Display\nvtray.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
    c:\windows\system32\PnkBstrA.exe
    c:\program files\PostgreSQL\8.4\bin\pg_ctl.exe
    c:\program files\Ralink\Common\RalinkRegistryWriter.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Razer\Abyssus\razertra.exe
    c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe
    c:\program files\PostgreSQL\8.4\bin\postgres.exe
    c:\program files\Razer\Abyssus\razerofa.exe
    c:\program files\PostgreSQL\8.4\bin\postgres.exe
    c:\program files\TeamViewer\Version7\TeamViewer_Service.exe
    c:\program files\NVIDIA Corporation\System Update\UpdateCenterService.exe
    c:\program files\PostgreSQL\8.4\bin\postgres.exe
    c:\program files\PostgreSQL\8.4\bin\postgres.exe
    c:\program files\PostgreSQL\8.4\bin\postgres.exe
    c:\program files\PostgreSQL\8.4\bin\postgres.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
    c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
    .
    **************************************************************************
    .
    Completion time: 2012-08-12 15:02:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-08-12 14:01
    .
    Pre-Run: 86,802,604,032 bytes free
    Post-Run: 86,605,664,256 bytes free
    .
    - - End Of File - - F121A6FCDD04E3C4ED9D2467EC095509
  10. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    Looks good :)

    Any current issues?

    =============================

    Download Malwarebytes' Anti-Malware (MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.
    NOTE. If you already have MBAM installed, update it before running the scan.

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform quick scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    Be sure to restart the computer IF MBAM asks you to do so.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    =============================

    Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  11. Zurles

    Zurles TechSpot Enthusiast Topic Starter Posts: 123

    Everything seems better now, ads have gone don't notice any more problems really, thanks!

    OTL saying win32 error cyclic redundancy check



    Malwarebytes Anti-Malware (Trial) 1.62.0.1300
    www.malwarebytes.org

    Database version: v2012.08.12.04

    Windows Vista Service Pack 1 x86 NTFS
    Internet Explorer 8.0.6001.18928
    Dean :: DEAN-PC [administrator]

    Protection: Enabled

    2012-08-12 17:51:56
    mbam-log-2012-08-12 (17-51-56).txt

    Scan type: Full scan (C:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 506169
    Time elapsed: 2 hour(s), 4 minute(s), 29 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 1
    C:\Program Files\ICCup\Launcher\iccwc3.icc (PUP.GameTool) -> Quarantined and deleted successfully.

    (I don't think that's actually spyware, but I don't need it anyway)

    (end)
     
  12. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    Delete your OTL file download fresh one and try again.
  13. Zurles

    Zurles TechSpot Enthusiast Topic Starter Posts: 123

    can't make it work, win32 error, code 23 data error (cyclic redundancy check)

    restarted and re downladed both both links always gives that error
  14. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
  15. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    Still with me?
  16. Broni

    Broni Malware Annihilator Posts: 46,164   +251

    This topic is marked as abandoned and closed due to inactivity.
    This member will NOT be eligible to receive any more help in malware removal forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.