TechSpot

Keep getting redirected from all major search engines

By stvneason
Mar 12, 2011
  1. Somehow I have picked up some adware/malware and have run the 8 steps for removal. Attached you will find the reports from DDS, GMER, and Malwarebytes. Please note that neither McAfee nor Malwarebytes have detected any infections. Also, GMER did NOT find any problems, therefore there wasn't a log created. Please help me. I cannot click on a link from any search engine without getting redirected to some site trying to advertise or sell me something.

    Here is the first DDS report:

    .
    DDS (Ver_11-03-05.01) - NTFS_AMD64
    Run by Eason Family at 23:10:11.77 on Fri 03/11/2011
    Internet Explorer: 8.0.7600.16385
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3835.2780 [GMT -6:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Launch Manager\dsiwmis.exe
    C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
    C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
    C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
    C:\Windows\system32\rundll32.exe
    C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
    c:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Acer\Acer Updater\UpdaterService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files (x86)\uTorrent\uTorrent.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
    C:\Program Files (x86)\NTI\NTI Digital Flix 2.5\MediaDetector.exe
    C:\Program Files (x86)\Skype\Phone\Skype.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\mcafee.com\agent\mcagent.exe
    C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
    C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
    C:\Program Files (x86)\Launch Manager\LManager.exe
    C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
    C:\Program Files (x86)\Launch Manager\LMworker.exe
    C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\Eason Family\Desktop\DDS\dds.scr
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://acer.msn.com
    uDefault_Page_URL = hxxp://acer.msn.com
    mDefault_Page_URL = hxxp://acer.msn.com
    mStart Page = hxxp://acer.msn.com
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
    uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
    mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
    mWinlogon: Userinit=userinit.exe,
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110224140645.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
    BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
    BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
    BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~2\mcafee\sitead~1\mcieplg.dll
    TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
    TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll
    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
    uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
    uRun: [BlazeServoTool] "C:\Program Files (x86)\NTI\NTI Digital Flix 2.5\MediaDetector.exe"
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
    uRun: [Google Update] "C:\Users\Eason Family\AppData\Local\Google\Update\GoogleUpdate.exe" /c
    uRun: [VQWSLNAOC] rundll32 "C:\Users\Eason Family\AppData\Roaming\C_20284T.dll",ZNRIF
    uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe"
    mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
    mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
    mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
    mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
    mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun: [Intuit SyncManager] c:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
    Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll
    Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL
    BHO-X64: McAfee Phishing Filter - No File
    BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110224140645.dll
    BHO-X64: scriptproxy - No File
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll
    TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll
    TB-X64: {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
    TB-X64: {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
    TB-X64: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    mRun-x64: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
    mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    mRun-x64: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-1-5 529128]
    R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2010-1-5 283360]
    R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\System32\drivers\mfenlfk.sys [2010-1-5 75032]
    R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\System32\drivers\mwlPSDFilter.sys [2009-6-2 22576]
    R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\System32\drivers\mwlPSDNserv.sys [2009-6-2 20016]
    R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\System32\drivers\mwlPSDVDisk.sys [2009-6-2 60464]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-11-16 203264]
    R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]
    R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-11-16 321104]
    R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-12-27 868896]
    R2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [2011-2-24 355440]
    R2 McMPFSvc;McAfee Personal Firewall Service;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [2011-2-24 355440]
    R2 McNaiAnn;McAfee VirusScan Announcer;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [2011-2-24 355440]
    R2 McProxy;McAfee Proxy Service;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [2011-2-24 355440]
    R2 McShield;McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2010-11-16 200056]
    R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2010-11-16 245352]
    R2 mfevtp;McAfee Validation Trust Protection Service;C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe [2010-11-16 149032]
    R2 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-5-26 305520]
    R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
    R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-6-28 255744]
    R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-4-24 483688]
    R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-11-16 243232]
    R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-11-16 7877120]
    R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-11-16 285696]
    R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2010-11-16 116752]
    R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2010-1-5 62800]
    R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-11-16 384040]
    R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2010-1-5 190136]
    R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2010-1-5 441328]
    R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2010-4-24 721768]
    R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2010-4-24 269672]
    R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2010-4-24 25960]
    R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2010-4-24 22376]
    R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-4-24 209768]
    R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2010-12-27 38528]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
    S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2010-1-5 94864]
    S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-11-16 246376]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-2-25 1255736]
    S4 McOobeSv;McAfee OOBE Service;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [2011-2-24 355440]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2011-03-12 01:30:15 -------- d-----w- C:\Program Files (x86)\ESET
    2011-03-11 22:19:31 -------- d-----w- C:\Program Files\Common Files\Intuit
    2011-03-11 22:15:26 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Intuit
    2011-03-11 22:15:10 4194304 ----a-w- C:\Windows\SysWow64\cdintf400.dll
    2011-03-11 22:13:08 -------- d-----w- C:\Program Files (x86)\Intuit
    2011-03-11 22:13:08 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
    2011-03-11 22:13:08 -------- d-----w- C:\PROGRA~3\Nuance
    2011-03-11 22:13:08 -------- d-----w- C:\PROGRA~3\Intuit
    2011-03-11 22:12:49 -------- d-----w- C:\PROGRA~3\SQL Anywhere 11
    2011-03-11 22:12:49 -------- d-----w- C:\PROGRA~3\COMMON FILES
    2011-03-11 22:12:38 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
    2011-03-11 22:10:28 -------- d-----w- C:\Windows\Intuit
    2011-03-11 18:54:01 -------- d-----w- C:\Program Files (x86)\Ask.com
    2011-03-10 05:00:56 -------- d-----w- C:\Program Files (x86)\World of Warcraft
    2011-03-10 05:00:56 -------- d-----w- C:\Program Files (x86)\Common Files\Blizzard Entertainment
    2011-03-10 04:59:59 -------- d-----w- C:\PROGRA~3\Blizzard Entertainment
    2011-03-09 20:05:32 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\Malwarebytes
    2011-03-09 20:05:22 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-03-09 20:05:22 -------- d-----w- C:\PROGRA~3\Malwarebytes
    2011-03-09 20:05:19 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-03-09 20:05:18 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-03-09 06:31:57 155648 --sha-r- C:\Users\EASONF~1\AppData\Roaming\C_20284T.dll
    2011-03-08 18:28:11 -------- d-----w- C:\Program Files (x86)\Makayama Interactive
    2011-03-06 07:20:17 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Google
    2011-03-06 07:19:38 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Apps
    2011-03-06 07:19:37 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Deployment
    2011-03-05 22:44:41 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\Scholastic
    2011-03-05 22:33:16 -------- d-----w- C:\Program Files (x86)\WildGames
    2011-03-05 21:55:09 -------- d-----w- C:\Program Files (x86)\WildTangent Games
    2011-03-05 07:07:28 737072 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-4\Microsoft.MediaCenter.Sports.UI.dll
    2011-03-04 17:44:10 -------- d-----w- C:\PROGRA~3\vsosdk
    2011-03-04 10:03:55 4277016 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-4\markup.dll
    2011-02-28 00:41:30 539968 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
    2011-02-25 18:03:01 -------- d-----w- C:\Windows\SysWow64\Wat
    2011-02-25 18:03:01 -------- d-----w- C:\Windows\System32\Wat
    2011-02-25 18:01:25 -------- d-----w- C:\PROGRA~3\VirtualizedApplications
    2011-02-25 17:51:34 65602 ----a-w- C:\Windows\SysWow64\cook3260.dll
    2011-02-25 17:51:34 626688 ----a-w- C:\Windows\SysWow64\vp7vfw.dll
    2011-02-25 17:51:34 217127 ----a-w- C:\Windows\SysWow64\drv43260.dll
    2011-02-25 17:51:34 208935 ----a-w- C:\Windows\SysWow64\drv33260.dll
    2011-02-25 17:51:34 176165 ----a-w- C:\Windows\SysWow64\drv23260.dll
    2011-02-25 17:51:34 102439 ----a-w- C:\Windows\SysWow64\sipr3260.dll
    2011-02-25 17:51:33 1184984 ----a-w- C:\Windows\SysWow64\wvc1dmod.dll
    2011-02-25 17:51:32 -------- d-----w- C:\Program Files (x86)\VSO
    2011-02-25 17:35:44 -------- d-----r- C:\Program Files (x86)\Skype
    2011-02-25 15:51:00 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\SoftGrid Client
    2011-02-25 15:51:00 -------- d-----w- C:\Users\EASONF~1\AppData\Local\SoftGrid Client
    2011-02-25 15:50:03 -------- d-----w- C:\Program Files (x86)\Microsoft Application Virtualization Client
    2011-02-25 15:49:48 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\TP
    2011-02-25 13:53:09 112000 ----a-w- C:\Windows\System32\consent.exe
    2011-02-24 21:42:28 42776 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
    2011-02-24 21:40:22 -------- d-----w- C:\PROGRA~3\BlazeVideo
    2011-02-24 21:04:15 14 ----a-w- C:\Windows\SysWow64\systeminfo.dll
    2011-02-24 20:55:45 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Downloaded Installations
    2011-02-24 20:54:26 -------- d-----w- C:\Program Files (x86)\Common Files\muvee Technologies
    2011-02-24 20:41:52 737072 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
    2011-02-24 20:29:49 42776 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
    2011-02-24 20:29:44 539968 ----a-w- C:\PROGRA~3\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2011-02-24 19:15:55 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Cyberlink
    2011-02-24 06:30:09 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
    2011-02-24 06:30:09 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
    2011-02-24 06:27:31 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
    2011-02-24 06:27:31 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
    2011-02-24 06:27:31 48960 ----a-w- C:\Windows\System32\netfxperf.dll
    2011-02-24 06:27:31 444752 ----a-w- C:\Windows\System32\mscoree.dll
    2011-02-24 06:27:31 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
    2011-02-24 06:27:31 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
    2011-02-24 06:27:31 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
    2011-02-24 06:27:31 1942856 ----a-w- C:\Windows\System32\dfshim.dll
    2011-02-24 06:27:31 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
    2011-02-24 06:27:31 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
    2011-02-23 21:08:52 -------- d-----w- C:\Program Files (x86)\Conduit
    2011-02-23 21:08:50 -------- d-----w- C:\Program Files (x86)\ConduitEngine
    2011-02-23 21:08:48 -------- d-----w- C:\Program Files (x86)\uTorrentBar
    2011-02-23 21:08:46 -------- d-----w- C:\extensions
    2011-02-23 21:08:25 -------- d-----w- C:\Program Files (x86)\uTorrent
    2011-02-23 21:07:16 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\uTorrent
    2011-02-23 20:56:25 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Research In Motion
    2011-02-23 20:56:24 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\Research In Motion
    2011-02-23 20:53:59 7680 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll
    2011-02-23 20:52:56 214016 ----a-w- C:\Windows\System32\winsrv.dll
    2011-02-23 20:47:51 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
    2011-02-23 07:00:33 -------- d-----w- C:\Users\EASONF~1\AppData\Roaming\FloodLightGames
    2011-02-23 07:00:33 -------- d-----w- C:\PROGRA~3\FloodLightGames
    2011-02-23 04:19:41 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Diagnostics
    2011-02-23 04:18:05 -------- d-----w- C:\PROGRA~3\boost_interprocess
    2011-02-23 04:04:36 -------- d-----w- C:\Users\EASONF~1\AppData\Local\EgisTec IPS
    2011-02-23 04:03:57 -------- d-----w- C:\Users\EASONF~1\AppData\Local\VirtualStore
    2011-02-23 04:03:16 -------- d-----w- C:\Program Files (x86)\OEM
    2011-02-23 04:03:05 -------- d-----w- C:\PROGRA~3\OEM_E471269A730D
    2011-02-23 04:02:52 -------- d-----w- C:\Program Files (x86)\Times Reader
    2011-02-23 04:02:11 -------- d-----w- C:\Users\EASONF~1\AppData\Local\Adobe
    .
    ==================== Find3M ====================
    .
    2011-02-19 06:37:44 1135104 ----a-w- C:\Windows\System32\FntCache.dll
    2011-02-19 06:37:10 1540608 ----a-w- C:\Windows\System32\DWrite.dll
    2011-02-19 06:36:49 902656 ----a-w- C:\Windows\System32\d2d1.dll
    2011-02-19 05:32:48 1074176 ----a-w- C:\Windows\SysWow64\DWrite.dll
    2011-02-19 05:32:35 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
    2011-01-26 06:53:10 982912 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
    2011-01-26 06:53:10 265088 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys
    2011-01-26 06:31:20 144384 ----a-w- C:\Windows\System32\cdd.dll
    2011-01-07 08:07:24 662528 ----a-w- C:\Windows\System32\XpsPrint.dll
    2011-01-07 08:07:24 475648 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
    2011-01-07 08:06:50 46080 ----a-w- C:\Windows\System32\atmlib.dll
    2011-01-07 07:31:10 442880 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
    2011-01-07 07:31:10 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
    2011-01-07 07:27:11 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
    2011-01-07 05:49:20 366080 ----a-w- C:\Windows\System32\atmfd.dll
    2011-01-07 05:33:11 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll
    2011-01-05 06:20:30 612352 ----a-w- C:\Windows\System32\vbscript.dll
    2011-01-05 05:37:33 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2011-01-05 04:00:16 3127808 ----a-w- C:\Windows\System32\win32k.sys
    2010-12-27 11:02:27 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
    2010-12-27 11:02:26 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll
    2010-12-27 11:02:26 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll
    2010-12-27 10:52:12 0 ----a-w- C:\Windows\ativpsrm.bin
    2010-12-27 10:51:10 3 ----a-w- C:\Windows\System32\PLD_Framework.cmd
    2010-12-23 06:07:50 1118720 ----a-w- C:\Windows\System32\sbe.dll
    2010-12-23 06:07:49 961024 ----a-w- C:\Windows\System32\CPFilters.dll
    2010-12-23 06:07:49 723968 ----a-w- C:\Windows\System32\EncDec.dll
    2010-12-23 06:02:33 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
    2010-12-23 05:28:29 850432 ----a-w- C:\Windows\SysWow64\sbe.dll
    2010-12-23 05:28:28 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
    2010-12-23 05:28:28 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
    2010-12-23 05:24:02 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
    2010-12-21 06:16:27 97280 ----a-w- C:\Windows\System32\wscsvc.dll
    2010-12-21 06:16:27 62976 ----a-w- C:\Windows\System32\wscapi.dll
    2010-12-21 06:16:14 442880 ----a-w- C:\Windows\System32\winhttp.dll
    2010-12-21 06:16:14 1197056 ----a-w- C:\Windows\System32\wininet.dll
    2010-12-21 06:16:09 258048 ----a-w- C:\Windows\System32\WebClnt.dll
    2010-12-21 06:15:55 264192 ----a-w- C:\Windows\System32\upnp.dll
    2010-12-21 06:15:31 15360 ----a-w- C:\Windows\System32\slwga.dll
    2010-12-21 06:13:03 2003968 ----a-w- C:\Windows\System32\msxml6.dll
    2010-12-21 06:13:03 1880576 ----a-w- C:\Windows\System32\msxml3.dll
    2010-12-21 06:10:22 100864 ----a-w- C:\Windows\System32\davclnt.dll
    2010-12-21 05:38:24 51200 ----a-w- C:\Windows\SysWow64\wscapi.dll
    2010-12-21 05:38:22 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2010-12-21 05:38:22 350720 ----a-w- C:\Windows\SysWow64\winhttp.dll
    2010-12-21 05:38:21 204800 ----a-w- C:\Windows\SysWow64\WebClnt.dll
    2010-12-21 05:38:19 204288 ----a-w- C:\Windows\SysWow64\upnp.dll
    2010-12-21 05:38:16 14336 ----a-w- C:\Windows\SysWow64\slwga.dll
    2010-12-21 05:36:17 1389568 ----a-w- C:\Windows\SysWow64\msxml6.dll
    2010-12-21 05:36:16 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll
    2010-12-21 05:34:12 80384 ----a-w- C:\Windows\SysWow64\davclnt.dll
    2010-12-18 06:12:28 3138048 ----a-w- C:\Windows\System32\mstscax.dll
    2010-12-18 06:11:41 57856 ----a-w- C:\Windows\System32\licmgr10.dll
    2010-12-18 06:11:34 714752 ----a-w- C:\Windows\System32\kerberos.dll
    2010-12-18 06:08:15 1097216 ----a-w- C:\Windows\System32\mstsc.exe
    2010-12-18 05:30:20 2690560 ----a-w- C:\Windows\SysWow64\mstscax.dll
    2010-12-18 05:29:40 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
    2010-12-18 05:29:31 541184 ----a-w- C:\Windows\SysWow64\kerberos.dll
    2010-12-18 05:26:55 1034240 ----a-w- C:\Windows\SysWow64\mstsc.exe
    2010-12-18 04:55:03 482816 ----a-w- C:\Windows\System32\html.iec
    2010-12-18 04:20:55 386048 ----a-w- C:\Windows\SysWow64\html.iec
    2010-12-18 04:13:40 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2010-12-18 03:47:59 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    .
    ============= FINISH: 23:10:43.41 ===============


    Here is the second DDS report:

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 2/22/2011 10:00:55 PM
    System Uptime: 3/11/2011 10:31:48 PM (1 hours ago)
    .
    Motherboard: Acer | | JE51_DN
    Processor: AMD Athlon(tm) II P340 Dual-Core Processor | Socket S1G4 | 2200/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 219 GiB total, 144.67 GiB free.
    D: is CDROM (UDF)
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP4: 2/25/2011 12:01:09 PM - Windows Update
    RP5: 2/25/2011 2:49:35 PM - Windows Update
    RP6: 2/26/2011 2:38:08 AM - Windows Update
    RP7: 2/26/2011 6:29:57 PM - Windows Update
    RP8: 2/26/2011 11:55:44 PM - Windows Update
    RP9: 2/27/2011 9:54:44 PM - Windows Update
    RP10: 3/5/2011 3:00:14 AM - Windows Update
    RP11: 3/9/2011 2:59:50 PM - Windows Update
    .
    ==== Installed Programs ======================
    .
    µTorrent
    18 Wheels of Steel - American Long Haul
    Acer Backup Manager
    Acer Crystal Eye Webcam
    Acer ePower Management
    Acer eRecovery Management
    Acer Games
    Acer Registration
    Acer ScreenSaver
    Acer Updater
    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.1 MUI
    Agatha Christie - Death on the Nile
    Ask Toolbar
    Backup Manager Basic
    Bejeweled 2 Deluxe
    Bing Bar
    Bing Bar Platform
    Bing Rewards Client Installer
    BlackBerry Desktop Software 6.0.1
    Blackhawk Striker 2
    Build-a-lot 2
    Catalyst Control Center - Branding
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Chuzzle Deluxe
    Conduit Engine
    ConvertXtoDVD 4.1.7.343
    CyberLink PowerDVD 9
    D3DX10
    Diner Dash 2 Restaurant Rescue
    Dora's Carnival Adventure
    eBay Worldwide
    ESET Online Scanner v3
    eSobi v2
    FATE
    Google Chrome
    I SPY Treasure Hunt
    Identity Card
    Internet TV for Windows Media Center
    Jewel Quest - Heritage
    Jewel Quest Solitaire 2
    John Deere Drive Green
    Junk Mail filter update
    Launch Manager
    Malwarebytes' Anti-Malware
    McAfee Internet Security Suite
    Mesh Runtime
    Microsoft Default Manager
    Microsoft Office 2010
    Microsoft Office Click-to-Run 2010
    Microsoft Office Starter 2010 - English
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    MSVCRT
    MSVCRT_amd64
    MSXML 4.0 SP2 Parser and SDK
    MyWinLocker
    MyWinLocker Suite
    NOOK for PC
    Norton Online Backup
    NTI Digital Flix 2.5
    NTI Media Maker 8
    NTI Media Maker 9
    Penguins!
    Plants vs. Zombies
    Polar Bowler
    Polar Golfer
    QuickBooks
    QuickBooks Premier Edition 2010
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Shredder
    Skype™ 4.1
    Times Reader
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update Installer for WildTangent Games App
    uTorrentBar Toolbar
    Virtual Villagers 4 - The Tree of Life
    Welcome Center
    WildTangent Games App (Acer Games)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Media Center Add-in for Flash
    World of Warcraft
    Zuma's Revenge
    .
    ==== Event Viewer Messages From Past Week ========
    .
    3/8/2011 5:23:54 PM, Error: Microsoft-Windows-SharedAccess_NAT [34001] - The ICS_IPV6 failed to configure IPv6 stack.
    3/8/2011 5:22:22 PM, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
    3/7/2011 5:25:27 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
    3/11/2011 10:29:01 PM, Error: Service Control Manager [7034] - The Dritek WMI Service service terminated unexpectedly. It has done this 1 time(s).
    ==== End Of File ===========================

    And finally, here is the report from Malwarebytes:

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6029

    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    3/11/2011 10:39:14 PM
    mbam-log-2011-03-11 (22-39-14).txt

    Scan type: Quick scan
    Objects scanned: 160432
    Time elapsed: 2 minute(s), 43 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    As stated before, I ran the GMER as instructed and it did not yield any results for me to save/post. Please help!!
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Welcome to TechSpot! I'll help with the redirects. I see quite a few entries that are putting you at risk.

    Please uninstall any entries for Ask,com or Ask Toolbar.
    Please disable-or better-uninsatll all entries for uTorrent and the uTorrent Toolbar.
    =======================
    Try running GMER either of these ways:
    1. Disable Devices
    2. Run the scan in Safe Mode.
    A log should be provided.
    ==========================
    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Click on "Copy to Clipboard"> (you won't see the 'clipboard')
    10. Click anywhere in the post where you want the logs to go, the do Ctrl V. The log will be sent from the clipboard and pasted in the post.
    11. Re-enable your Antivirus software.
      NOTE: If you forget to copy to the clipboard you can find the log here:
      C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
    ==================================
    Download Combofix to your desktop from one of these locations:
    Link 1
    Link 2
    • Double click combofix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Query- Recovery Console image
      [​IMG]
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

    Leave all logs when through.
     
  3. stvneason

    stvneason TS Rookie Topic Starter

    The utorrent has been disabled. I am aware of the damages it causes, however, I just cannot explain enough to the other half (the wife) to OPT OUT of downloading the trackers that go along with them. Here are the logs that you requested.:

    GMER:

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2011-03-17 19:17:59
    Windows 6.1.7600
    Running: lcv4xek4.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations ????vf??????????.1??????????? ?????????????????????0?????????????????????????h??????????????? ?????????????????????0????????:???????????? ?????????????????????0?????????????????????????????????????6??????????????????????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????n??????????????????????????????????????????? ?????????????????????0??????????????????????????????????????6?????????????? ?????????????????????0????????????????????volsnap.inf?????????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????????y???y??6.1.7600.16385?y?y???????????.??????????????????? ?????????????????????0????????????????????? ?????????????????????0?????????????????????????????o?????????????s?3???????????????0??????????????????? ?????????????????????0????????????????????????????????????????????????????????????????????? ?????????????????????0????????????????????????????????????? ???????h?????????????????

    ---- Files - GMER 1.0.15 ----

    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y0CXA00M\143746[1].txt 4096 bytes
    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\31IYPOH8\expand_nor[1] 2864 bytes
    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\31IYPOH8\collapse_nor[1] 2869 bytes
    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\31IYPOH8\topic58138[1].html 81282 bytes
    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5EANEBBM\help_16[1] 3527 bytes
    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EO60KVKV\close_nor[1] 0 bytes
    File C:\Users\Eason Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X9RR6Z38\top[1] 0 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@crosspixel.demdex[2].txt 262 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@crowdscience[2].txt 93 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@demdex[2].txt 188 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@www.techspot[2].txt 992 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@xgraph[2].txt 403 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@scorecardresearch[1].txt 112 bytes
    File C:\Users\Eason Family\AppData\Roaming\Microsoft\Windows\Cookies\Low\eason_family@techspot[2].txt 445 bytes

    ---- EOF - GMER 1.0.15 ----


    ESET:

    ESETSmartInstaller@High as CAB hook log:
    OnlineScanner64.ocx - registred OK
    OnlineScanner.ocx - registred OK


    ComboFix:

    ComboFix 11-03-16.06 - Eason Family 03/17/2011 20:07:03.1.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3835.2689 [GMT -5:00]
    Running from: c:\users\Eason Family\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    C:\Install.exe
    c:\users\Eason Family\AppData\Local\Temp\7CAD.tmp
    c:\users\Eason Family\AppData\Roaming\C_20284T.dll
    c:\users\EASONF~1\AppData\Local\Temp\7CAD.tmp
    c:\windows\SysWow64\systeminfo.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-02-18 to 2011-03-18 )))))))))))))))))))))))))))))))
    .
    .
    2011-03-18 01:19 . 2011-03-18 01:19 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-03-18 01:03 . 2011-03-18 01:05 -------- d-----w- C:\32788R22FWJFW
    2011-03-13 21:18 . 2011-03-15 04:54 -------- d-----w- c:\programdata\DVD Shrink
    2011-03-13 21:18 . 2011-03-13 21:18 -------- d-----w- c:\program files (x86)\DVD Shrink
    2011-03-12 01:30 . 2011-03-12 01:30 -------- d-----w- c:\program files (x86)\ESET
    2011-03-11 22:19 . 2011-03-11 22:19 -------- d-----w- c:\program files\Common Files\Intuit
    2011-03-11 22:15 . 2009-06-22 15:14 4194304 ----a-w- c:\windows\SysWow64\cdintf400.dll
    2011-03-11 22:13 . 2011-03-12 04:32 -------- d-----w- c:\programdata\Intuit
    2011-03-11 22:13 . 2011-03-11 22:14 -------- d-----w- c:\program files (x86)\Common Files\Intuit
    2011-03-11 22:13 . 2011-03-11 22:13 -------- d-----w- c:\programdata\Nuance
    2011-03-11 22:13 . 2011-03-11 22:13 -------- d-----w- c:\program files (x86)\Intuit
    2011-03-11 22:12 . 2011-03-11 22:12 -------- d-----w- c:\programdata\SQL Anywhere 11
    2011-03-11 22:12 . 2011-03-11 22:12 -------- d-----w- c:\programdata\COMMON FILES
    2011-03-11 22:12 . 2011-03-11 22:12 -------- d-----w- c:\program files (x86)\MSXML 4.0
    2011-03-11 22:10 . 2011-03-11 22:10 -------- d-----w- c:\windows\Intuit
    2011-03-10 05:00 . 2011-03-10 05:48 -------- d-----w- c:\program files (x86)\World of Warcraft
    2011-03-10 05:00 . 2011-03-10 05:04 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
    2011-03-10 04:59 . 2011-03-10 05:49 -------- d-----w- c:\programdata\Blizzard Entertainment
    2011-03-09 20:05 . 2011-03-09 20:05 -------- d-----w- c:\programdata\Malwarebytes
    2011-03-09 20:05 . 2010-12-21 00:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
    2011-03-09 20:05 . 2010-12-21 00:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-03-09 20:05 . 2011-03-09 20:05 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2011-03-08 18:28 . 2011-03-08 18:28 -------- d-----w- c:\program files (x86)\Makayama Interactive
    2011-03-05 22:33 . 2011-03-05 22:33 -------- d-----w- c:\program files (x86)\WildGames
    2011-03-05 21:55 . 2011-03-05 21:55 -------- d-----w- c:\program files (x86)\WildTangent Games
    2011-03-05 07:07 . 2011-03-05 07:07 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-4\Microsoft.MediaCenter.Sports.UI.dll
    2011-03-04 17:44 . 2011-03-04 17:44 -------- d-----w- c:\programdata\vsosdk
    2011-03-04 16:48 . 2011-03-04 16:48 -------- d-----r- C:\MSOCache
    2011-03-04 10:03 . 2011-03-04 10:03 4277016 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-4\markup.dll
    2011-02-28 00:41 . 2011-02-28 00:41 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
    2011-02-27 00:32 . 2011-02-27 00:32 -------- d-----w- c:\program files (x86)\Microsoft.NET
    2011-02-25 18:03 . 2011-02-25 18:03 -------- d-----w- c:\windows\SysWow64\Wat
    2011-02-25 18:03 . 2011-02-25 18:03 -------- d-----w- c:\windows\system32\Wat
    2011-02-25 18:01 . 2011-02-25 20:57 -------- d-----w- c:\programdata\VirtualizedApplications
    2011-02-25 17:51 . 2009-09-02 18:44 65602 ----a-w- c:\windows\SysWow64\cook3260.dll
    2011-02-25 17:51 . 2009-09-02 18:44 626688 ----a-w- c:\windows\SysWow64\vp7vfw.dll
    2011-02-25 17:51 . 2009-09-02 18:44 217127 ----a-w- c:\windows\SysWow64\drv43260.dll
    2011-02-25 17:51 . 2009-09-02 18:44 208935 ----a-w- c:\windows\SysWow64\drv33260.dll
    2011-02-25 17:51 . 2009-09-02 18:44 176165 ----a-w- c:\windows\SysWow64\drv23260.dll
    2011-02-25 17:51 . 2009-09-02 18:44 102439 ----a-w- c:\windows\SysWow64\sipr3260.dll
    2011-02-25 17:51 . 2009-09-02 18:44 1184984 ----a-w- c:\windows\SysWow64\wvc1dmod.dll
    2011-02-25 17:51 . 2011-02-25 17:51 -------- d-----w- c:\program files (x86)\VSO
    2011-02-25 17:35 . 2011-02-25 17:35 -------- d-----r- c:\program files (x86)\Skype
    2011-02-25 17:35 . 2011-02-25 17:35 -------- d-----w- c:\programdata\Skype
    2011-02-25 15:50 . 2011-02-27 05:56 -------- d-----w- c:\program files (x86)\Microsoft Application Virtualization Client
    2011-02-25 13:53 . 2010-10-16 05:23 112000 ----a-w- c:\windows\system32\consent.exe
    2011-02-24 21:42 . 2011-03-04 10:03 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
    2011-02-24 21:40 . 2011-02-24 21:40 -------- d-----w- c:\programdata\BlazeVideo
    2011-02-24 20:54 . 2011-02-24 20:54 -------- d-----w- c:\program files (x86)\Common Files\muvee Technologies
    2011-02-24 20:41 . 2011-02-24 20:41 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
    2011-02-24 20:29 . 2011-02-28 00:41 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
    2011-02-24 20:29 . 2011-03-04 10:03 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2011-02-24 19:17 . 2011-02-24 19:17 -------- d-----w- c:\users\Public\CyberLink
    2011-02-24 19:15 . 2011-02-24 19:15 -------- d-----w- c:\programdata\CyberLink
    2011-02-24 06:30 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll
    2011-02-24 06:30 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll
    2011-02-24 06:27 . 2009-11-25 18:47 99176 ----a-w- c:\windows\SysWow64\PresentationHostProxy.dll
    2011-02-24 06:27 . 2009-11-25 18:47 49472 ----a-w- c:\windows\SysWow64\netfxperf.dll
    2011-02-24 06:27 . 2009-11-25 18:47 48960 ----a-w- c:\windows\system32\netfxperf.dll
    2011-02-24 06:27 . 2009-11-25 18:47 297808 ----a-w- c:\windows\SysWow64\mscoree.dll
    2011-02-24 06:27 . 2009-11-25 18:47 295264 ----a-w- c:\windows\SysWow64\PresentationHost.exe
    2011-02-24 06:27 . 2009-11-25 18:47 1130824 ----a-w- c:\windows\SysWow64\dfshim.dll
    2011-02-24 06:27 . 2009-11-25 18:47 109912 ----a-w- c:\windows\system32\PresentationHostProxy.dll
    2011-02-24 06:27 . 2009-11-25 18:47 444752 ----a-w- c:\windows\system32\mscoree.dll
    2011-02-24 06:27 . 2009-11-25 18:47 320352 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-02-24 06:27 . 2009-11-25 18:47 1942856 ----a-w- c:\windows\system32\dfshim.dll
    2011-02-23 21:08 . 2011-02-23 21:08 -------- d-----w- c:\program files (x86)\Conduit
    2011-02-23 21:08 . 2011-02-23 21:08 -------- d-----w- C:\extensions
    2011-02-23 21:08 . 2011-02-23 21:08 -------- d-----w- c:\program files (x86)\uTorrent
    2011-02-23 20:53 . 2010-10-19 08:47 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
    2011-02-23 20:52 . 2010-12-21 06:16 214016 ----a-w- c:\windows\system32\winsrv.dll
    2011-02-23 20:47 . 2010-07-13 05:37 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys
    2011-02-23 07:00 . 2011-02-23 07:00 -------- d-----w- c:\programdata\FloodLightGames
    2011-02-23 04:18 . 2011-03-14 05:15 -------- d-----w- c:\programdata\boost_interprocess
    2011-02-23 04:03 . 2011-02-23 04:03 -------- d-----w- c:\program files (x86)\OEM
    2011-02-23 04:03 . 2011-02-23 04:03 -------- d-----w- c:\programdata\OEM_E471269A730D
    2011-02-23 04:02 . 2011-02-23 04:02 -------- d-----w- c:\program files (x86)\Times Reader
    2011-02-23 04:00 . 2011-02-23 04:04 -------- d-----w- c:\users\Eason Family
    2011-02-23 04:00 . 2011-02-23 04:00 -------- d-----w- C:\Recovery
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-27 11:02 . 2010-12-27 11:02 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
    2010-12-27 11:02 . 2010-12-27 11:02 505128 ----a-w- c:\windows\SysWow64\msvcp71.dll
    2010-12-27 11:02 . 2010-12-27 11:02 353576 ----a-w- c:\windows\SysWow64\msvcr71.dll
    2010-12-27 10:51 . 2010-12-27 10:51 3 ----a-w- c:\windows\system32\PLD_Framework.cmd
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2010-05-27 03:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-02-23 396152]
    "BlazeServoTool"="c:\program files (x86)\NTI\NTI Digital Flix 2.5\MediaDetector.exe" [2007-12-01 282624]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2009-10-09 25623336]
    "Google Update"="c:\users\Eason Family\AppData\Local\Google\Update\GoogleUpdate.exe" [2011-03-06 136176]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-01-17 1484856]
    "SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
    "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
    "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
    "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
    "BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-28 98304]
    "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]
    "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
    "Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-11-26 1087752]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-12-16 1153824]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux1"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    R2 0076371300405309mcinstcleanup;McAfee Application Installer Cleanup (0076371300405309);c:\windows\TEMP\007637~1.EXE [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
    R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2010-03-10 355440]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
    S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
    S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
    S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
    S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
    S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
    S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]
    S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]
    S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 355440]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 355440]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [2010-03-10 355440]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-10-14 245352]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-10-14 149032]
    S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]
    S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
    S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]
    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-04-24 483688]
    S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-29 243232]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
    S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-24 209768]
    S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2525124660-355074007-1878042952-1000Core.job
    - c:\users\Eason Family\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 07:20]
    .
    2011-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2525124660-355074007-1878042952-1000UA.job
    - c:\users\Eason Family\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-06 07:20]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2010-05-27 03:42 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-21 11444840]
    "mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]
    "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://acer.msn.com
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = hxxp://acer.msn.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll
    .
    - - - - ORPHANS REMOVED - - - -
    .
    URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
    Toolbar-Locked - (no file)
    Wow6432Node-HKCU-Run-VQWSLNAOC - c:\users\Eason Family\AppData\Roaming\C_20284T.dll
    Wow6432Node-HKCU-Run-DW6 - c:\program files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe
    Toolbar-Locked - (no file)
    WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
    WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-03-17 20:43:51
    ComboFix-quarantined-files.txt 2011-03-18 01:43
    .
    Pre-Run: 143,028,957,184 bytes free
    Post-Run: 142,788,259,840 bytes free
    .
    - - End Of File - - 95E18E35651E44DE61E6ED6EE2437E74


    Sorry it took so long, have been very busy lately.

    Thanks
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    GMER sure hollered at use! Let's see if there's a rootkit running:
    • Download the file TDSSKiller.zip and save to the desktop.
      (If you are unable to download the file for some reason, then TDSS may be blocking it. You would then need to download it first to a clean computer and then transfer it to the infected one using an external drive or USB flash drive.)
    • Right-click the tdsskiller.zip file> Select Extract All into a folder on the infected (or potentially infected) PC.
    • Double click on TDSSKiller.exe. to run the scan
    • When the scan is over, the utility outputs a list of detected objects with description.
      The utility automatically selects an action (Cure or Delete) for malicious objects.
      The utility prompts the user to select an action to apply to suspicious objects (Skip, by default).
    • Select the action Quarantine to quarantine detected objects.
      The default quarantine folder is in the system disk root folder, e.g.: C:\TDSSKiller_Quarantine\23.07.2010_15.31.43
    • After clicking Next, the utility applies selected actions and outputs the result.
    • A reboot is required after disinfection.
    ====================================
    I have a few thing to remove with script in Combofix, but will old off until I see this scan. Okay?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...