[RESOLVED] Explorer.exe running at %50

Printable View

Show 40 post(s) from this thread on one page

October 12th, 2010, 06:23 PM
704_Skate

[RESOLVED] Explorer.exe running at %50

OK so, I have probably x'd out of making this thread 3 times already, due to the fact I "though"I resolved it myself. hehe, I'll stop trying now(:

Anyways, something is keeping my system running at %50. Did a full Mbam scan (updated before I started) and it came up with a virus. I removed it, restarted... computer looked fine. Up until I started my browser or another program, maybe? Anyways, problem still persist. Keeps explorer.exe running at %50, and heating up my computer along the way. :(

Here's an SS of the virus.

http://i53.tinypic.com/344qyya.jpg

From what I remember, I think I was suppose to be downloading DIVx, and not xVID. Agh, stupid me.

Anyways, I found it was actually a program that I could uninstall. But I'm not that gullible, I know it won't just take the virus off like that. I uninstalled it.. funny enough, it stopped. Explorer was back to normal... so time for a reboot.

Rebooted.. problem persist. As you can tell, I was thinking this was DIVx not xVID. So I'm guessing it runs when I open Firefox...

All in all, I've removed the fake program, and deleted one virus. Ran a full mbam scan, and half of a super ainti-spyware scan, and a avast to no avail.
October 12th, 2010, 08:34 PM
Broni

Please, read here: http://discussions.virtualdr.com/sho...d.php?t=167915, and post required logs.
October 13th, 2010, 08:48 AM
704_Skate

Logs:

mbam;

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4800

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

10/12/2010 9:51:44 PM
mbam-log-2010-10-12 (21-51-44).txt

Scan type: Quick scan
Objects scanned: 166037
Time elapsed: 10 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
October 13th, 2010, 08:49 AM
704_Skate

gmer:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-10-13 08:45:30
Windows 6.0.6002 Service Pack 2
Running: m9kx36bk.exe; Driver: C:\Users\User\AppData\Local\Temp\pxldrpow.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x8D47FBAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0x8D47F9D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0x8D47FB0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntkrnlpa.exe!ZwLoadDriver 81B9FDF0 7 Bytes JMP 8D47FB10 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 81C0B28F 5 Bytes JMP 8D47B5D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ObInsertObject 81C64038 5 Bytes JMP 8D47CFFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!NtCreateSection 81C658C3 7 Bytes JMP 8D47F9D6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 81CC5892 7 Bytes JMP 8D47FBB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1584] kernel32.dll!SetUnhandledExceptionFilter 767EA84F 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\services.exe[644] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00060002
IAT C:\Windows\system32\services.exe[644] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 00060000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x42 0x18 0x5A 0x48 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x42 0x18 0x5A 0x48 ...

---- EOF - GMER 1.0.15 ----
October 13th, 2010, 08:50 AM
704_Skate

DDS;

DDS (Ver_10-10-10.03) - NTFSx86
Run by User at 8:45:53.34 on Wed 10/13/2010
Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_18
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.643 [GMT -4:00]

AV: avast! antivirus 4.8.1368 [VPS 100219-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: avast! antivirus 4.8.1368 [VPS 100219-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\PixArt\Pac207\Monitor.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ModLEDKey.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\uTorrent\uTorrent.exe
c:\windows\system32\inetsrv\w3wp.exe
C:\Users\User\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uLocal Page = c:\program files\hewlett-packard\hp quick launch buttons\Blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
mLocal Page = c:\program files\hewlett-packard\hp quick launch buttons\Blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 216.22.2.218:80
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [hpWirelessAssistant] "c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe"
mRun: [WAWifiMessage] "c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PAC207_Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [CHotkey] mHotkey.exe
mRun: [ledpointer] CNYHKey.exe
mRun: [LchDrv] LchDrvKey.exe
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
mASetup: {621FCD24-4498-4324-A81E-07D331376EDF} - c:\program files\pixiepack codec pack\InstallerHelper.exe

================= FIREFOX ===================

FF - ProfilePath - c:\users\user\appdata\roaming\mozilla\firefox\profiles\bv5h7rsw.speed\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\nexonus\ngm\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-10-12 165584]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-10-12 17744]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-10-12 50768]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-19 40384]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-19 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-19 40384]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-2-19 21504]
S3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-12-18 18912]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2009-5-27 29262680]
S3 PAC207;PC Camer@;c:\windows\system32\drivers\PFC027.SYS [2008-2-13 618112]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 WMSvc;Web Management Service;c:\windows\system32\inetsrv\WMSvc.exe [2010-2-19 11264]
S4 gupdate;Google Update Service (gupdate); [x]

=============== Created Last 30 ================

2010-10-08 15:59:21 -------- d-----w- c:\program files\KeyTweak
2010-10-07 19:29:02 40960 ----a-r- c:\users\user\appdata\roaming\microsoft\installer\{9559f7ca-5e34-4237-a2d9-d856464ad727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-10-07 19:29:02 40960 ----a-r- c:\users\user\appdata\roaming\microsoft\installer\{9559f7ca-5e34-4237-a2d9-d856464ad727}\ARPPRODUCTICON.exe
2010-10-07 19:28:56 -------- d-----w- c:\program files\Project64 1.6
2010-10-06 20:27:05 5576704 ----a-w- c:\windows\CNYHKey.exe
2010-10-06 20:27:05 53248 ----a-w- c:\windows\ModLEDKey.exe
2010-10-06 20:27:05 49152 ----a-w- c:\windows\CNYUSB.dll
2010-10-06 20:27:05 36864 ----a-w- c:\windows\LchDrvKey.exe
2010-10-03 23:34:50 -------- d-----w- c:\program files\Xvid
2010-09-19 13:43:37 38848 ----a-w- c:\windows\avastSS.scr
2010-09-19 13:42:34 -------- d-----w- c:\progra~2\Alwil Software
2010-09-16 14:33:55 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-16 14:32:59 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-16 14:32:59 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-09-16 14:32:35 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-16 14:32:34 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-16 14:20:45 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-16 14:20:33 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-16 14:20:32 1616384 ----a-w- c:\program files\windows mail\msoe.dll

==================== Find3M ====================

2010-08-10 09:15:58 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 09:15:58 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-07-27 22:44:10 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 22:44:10 107808 ----a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 8:46:47.90 ===============
October 13th, 2010, 08:50 AM
704_Skate

DDS Attach;

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-10.03)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 10/5/2007 7:07:17 PM
System Uptime: 10/13/2010 7:53:37 AM (1 hours ago)

Motherboard: Hewlett-Packard | | 30D9
Processor: Intel(R) Pentium(R) Dual CPU T2310 @ 1.46GHz | CPU | 1467/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 104 GiB total, 18.856 GiB free.
D: is FIXED (NTFS) - 8 GiB total, 1.496 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1208: 10/10/2010 12:24:56 PM - Scheduled Checkpoint
RP1209: 10/11/2010 9:36:29 AM - Scheduled Checkpoint
RP1210: 10/12/2010 7:33:24 PM - Scheduled Checkpoint

==== Installed Programs ======================

µTorrent
7-Zip 4.57
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 8 Professional
Adobe Acrobat 8.1.5 - CPSID_49013
Adobe Acrobat 8.1.5 Professional
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe After Effects CS3 Third Party Content
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Contribute CS3
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Photoshop Lightroom 2
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 8.1.5
Adobe Setup
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server {ko_KR}
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
AHV content for Acrobat and Flash
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
avast! Free Antivirus
Avery Wizard 3.1
AviSynth 2.5
Bonjour
Capture NX 2
CCleaner
Conexant HD Audio
ConvertHelper 2.2
Cycore FX 1.0.1 for After Effects
DivX Plus Web Player
EPSON Stylus NX400 Series Printer Uninstall
ESU for Microsoft Vista
ffdshow [rev 2033] [2008-07-05]
File Uploader
GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
Google Update Helper
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.2
HP Easy Setup - Frontend
HP Help and Support
HP Quick Launch Buttons 6.20 G2
HP Total Care Advisor
HP Update
HP User Guides 0078
HP Wireless Assistant
HPNetworkAssistant
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
iPhoneBrowser
iTunes
Java Auto Updater
Java(TM) 6 Update 18
KB408682
KeyTweak - Keyboard Remapper (remove only)
LightScribe 1.6.43.1
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Expression Web
Microsoft Expression Web MUI (English)
Microsoft Expression Web Service Pack 1 (SP1)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office SharePoint Designer 2007 Service Pack 2 (SP2)
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SONY_MEDIAMGR2)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Miro
Mobile Mouse Server
Mozilla Firefox (3.6.10)
MSCU for Microsoft Vista
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MyDefrag v4.2.7
NetWaiting
Nikon Message Center
Nikon Transfer
Opanda IExif 2.3
PDF Settings
Photomatix Pro version 2.5
Picture Control Utility
PixiePack Codec Pack
Project64 1.6
QuickTime
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
Realtek USB 2.0 Card Reader
Registry First Aid
Rhapsody Player Engine
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Safari
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
SpeedFan (remove only)
Spelling Dictionaries Support For Adobe Reader 8
SUPERAntiSpyware Free Edition
SupportSoft Assisted Service
Touch Pad Driver
Trapcode Form
Trapcode Particular v2
U3Launcher
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Access 2007 Help (KB957241)
Update for Microsoft Office InfoPath 2007 Help (KB957243)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office Publisher 2007 Help (KB957249)
Update for Microsoft Office Word 2007 (KB974561)
Update for Microsoft Script Editor Help (KB957253)
Update for Outlook 2007 Junk Email Filter (kb981433)
USB 2.4G Wireless Keyboard Driver
VC80CRTRedist - 8.0.50727.4053
Videora iPod touch Converter 5.03
Windows Installer Clean Up
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Player Firefox Plugin
WinSCP 4.2.8

==== Event Viewer Messages From Past Week ========

10/9/2010 7:36:25 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
10/8/2010 11:11:33 AM, Error: EventLog [6008] - The previous system shutdown at 11:08:45 AM on 10/8/2010 was unexpected.
10/6/2010 7:59:05 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the LightScribeService Direct Disc Labeling Service service to connect.
10/13/2010 7:54:54 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: mvfvu sptd uvhskrj
10/13/2010 7:54:54 AM, Error: Service Control Manager [7001] - The Internet Connection Sharing (ICS) service depends on the Remote Access Connection Manager service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
10/13/2010 7:53:38 AM, Error: sptd [4] - Driver detected an internal error in its data structures for .
10/11/2010 8:48:20 AM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.

==== End Of File ===========================
October 13th, 2010, 08:09 PM
Broni
Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
October 13th, 2010, 09:05 PM
704_Skate

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Presario C700 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 157):
0x81A4A000 \SystemRoot\system32\ntkrnlpa.exe
0x81A17000 \SystemRoot\system32\hal.dll
0x80407000 \SystemRoot\system32\kdcom.dll
0x8040E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8047E000 \SystemRoot\system32\PSHED.dll
0x8048F000 \SystemRoot\system32\BOOTVID.dll
0x80497000 \SystemRoot\system32\CLFS.SYS
0x804D8000 \SystemRoot\system32\CI.dll
0x80606000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80682000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8068F000 \SystemRoot\system32\drivers\acpi.sys
0x806D5000 \SystemRoot\system32\drivers\WMILIB.SYS
0x805B8000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x807DE000 \SystemRoot\system32\drivers\msisadrv.sys
0x87A01000 \SystemRoot\system32\drivers\pci.sys
0x87A28000 \SystemRoot\System32\drivers\partmgr.sys
0x87A37000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x87A3A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x87A44000 \SystemRoot\system32\drivers\volmgr.sys
0x87A53000 \SystemRoot\System32\drivers\volmgrx.sys
0x87A9D000 \SystemRoot\system32\DRIVERS\pciide.sys
0x87AA4000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x87AB2000 \SystemRoot\System32\drivers\mountmgr.sys
0x87AC2000 \SystemRoot\system32\drivers\iaStor.sys
0x87B89000 \SystemRoot\system32\drivers\atapi.sys
0x87B91000 \SystemRoot\system32\drivers\ataport.SYS
0x87BAF000 \SystemRoot\system32\drivers\fltmgr.sys
0x87BE1000 \SystemRoot\system32\drivers\fileinfo.sys
0x87BF1000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x87C0F000 \SystemRoot\System32\Drivers\ksecdd.sys
0x87C80000 \SystemRoot\system32\drivers\ndis.sys
0x87D8B000 \SystemRoot\system32\drivers\msrpc.sys
0x87DB6000 \SystemRoot\system32\drivers\NETIO.SYS
0x87E02000 \SystemRoot\System32\drivers\tcpip.sys
0x87EEC000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8800E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8811E000 \SystemRoot\system32\drivers\volsnap.sys
0x88157000 \SystemRoot\System32\Drivers\spldr.sys
0x8815F000 \SystemRoot\system32\speedfan.sys
0x88161000 \SystemRoot\System32\Drivers\mup.sys
0x88170000 \SystemRoot\system32\giveio.sys
0x88171000 \SystemRoot\System32\drivers\ecache.sys
0x88198000 \SystemRoot\system32\drivers\disk.sys
0x881A9000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x881CA000 \SystemRoot\system32\drivers\crcdisk.sys
0x881E0000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x881EB000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x87FCE000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x881F4000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x881F8000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x87FDD000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x88000000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x87FED000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C606000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8CC53000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8CCF4000 \SystemRoot\System32\drivers\watchdog.sys
0x8CD00000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x806DE000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8CD8D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8CD98000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8CDD6000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8CDE5000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0x80764000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x87DF1000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x80777000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x87C00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x807A0000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8CE02000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8CE31000 \SystemRoot\system32\DRIVERS\storport.sys
0x8CE72000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8CE7D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8CE94000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8CE9F000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8CEC2000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8CED1000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8CEE5000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8CEFA000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8CF0A000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8CF0C000 \SystemRoot\system32\DRIVERS\ks.sys
0x8CF36000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8CF40000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8CF4D000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8CF56000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8CF8B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8CF9C000 \SystemRoot\system32\drivers\CHDRT32.sys
0x8CFCF000 \SystemRoot\system32\drivers\portcls.sys
0x807B8000 \SystemRoot\system32\drivers\drmk.sys
0x8D206000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8D243000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8D346000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x807E6000 \SystemRoot\system32\drivers\modem.sys
0x805DE000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8D3FB000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CDF6000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x87FF6000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x807F3000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x88007000 \SystemRoot\System32\Drivers\Null.SYS
0x805F5000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D80A000 \SystemRoot\System32\drivers\vga.sys
0x8D816000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D837000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D83F000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D847000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D852000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D860000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D869000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D87F000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x8D889000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D8BB000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D8CF000 \SystemRoot\system32\drivers\afd.sys
0x8D917000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x8D91C000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D932000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D940000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8D942000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D955000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x8D97A000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x8D980000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D9BC000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D9C6000 \SystemRoot\System32\Drivers\dfsc.sys
0x8DC07000 \SystemRoot\System32\Drivers\aswSP.SYS
0x8DC2E000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8DC3B000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x95600000 \SystemRoot\System32\win32k.sys
0x8DD02000 \SystemRoot\System32\drivers\Dxapi.sys
0x8DD0C000 \SystemRoot\system32\DRIVERS\monitor.sys
0x95820000 \SystemRoot\System32\TSDDD.dll
0x95840000 \SystemRoot\System32\cdd.dll
0x95850000 \SystemRoot\System32\ATMFD.DLL
0x8DD1B000 \SystemRoot\system32\drivers\luafv.sys
0x8DD36000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0x8DD6D000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0x8DD78000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8DD88000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8DDB2000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8DDBC000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x87F07000 \SystemRoot\system32\drivers\spsys.sys
0xAF00B000 \SystemRoot\system32\drivers\HTTP.sys
0xAF078000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAF095000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAF0AE000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAF0C3000 \SystemRoot\system32\drivers\mrxdav.sys
0xAF0E4000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAF103000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAF13C000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAF154000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAF17B000 \SystemRoot\System32\DRIVERS\srv.sys
0xAF1C9000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB2208000 \SystemRoot\system32\drivers\peauth.sys
0xB22E6000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB22F0000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB22FC000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xB2304000 \SystemRoot\system32\drivers\tdtcp.sys
0xB230F000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xB231B000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xB234E000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x777A0000 \WINDOWS\System32\ntdll.dll

Processes (total 59):
0 System Idle Process
4 System
412 C:\WINDOWS\System32\smss.exe
484 csrss.exe
528 C:\WINDOWS\System32\wininit.exe
540 csrss.exe
604 C:\WINDOWS\System32\services.exe
612 C:\WINDOWS\System32\lsass.exe
620 C:\WINDOWS\System32\lsm.exe
676 C:\WINDOWS\System32\winlogon.exe
816 C:\WINDOWS\System32\svchost.exe
888 C:\WINDOWS\System32\svchost.exe
924 C:\WINDOWS\System32\svchost.exe
1024 C:\WINDOWS\System32\svchost.exe
1056 C:\WINDOWS\System32\svchost.exe
1072 C:\WINDOWS\System32\svchost.exe
1196 C:\WINDOWS\System32\audiodg.exe
1224 C:\WINDOWS\System32\svchost.exe
1240 C:\WINDOWS\System32\SLsvc.exe
1320 C:\WINDOWS\System32\svchost.exe
1392 C:\WINDOWS\System32\svchost.exe
1592 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1696 C:\WINDOWS\explorer.exe
124 C:\WINDOWS\System32\spoolsv.exe
264 C:\WINDOWS\System32\taskeng.exe
288 C:\WINDOWS\System32\svchost.exe
428 C:\WINDOWS\System32\taskeng.exe
524 C:\WINDOWS\ModLEDKey.exe
1668 C:\Program Files\Apoint2K\Apoint.exe
1716 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
1752 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
1744 C:\WINDOWS\System32\igfxtray.exe
1776 C:\Program Files\Apoint2K\ApMsgFwd.exe
1788 C:\WINDOWS\System32\igfxpers.exe
1628 C:\WINDOWS\PixArt\Pac207\Monitor.exe
1648 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
968 C:\WINDOWS\System32\igfxsrvc.exe
1712 C:\WINDOWS\CNYHKey.exe
2216 C:\WINDOWS\System32\svchost.exe
2228 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2244 C:\Program Files\Bonjour\mDNSResponder.exe
2280 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2468 C:\Program Files\Apoint2K\ApntEx.exe
2608 C:\WINDOWS\System32\svchost.exe
2624 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
2640 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2664 C:\WINDOWS\System32\svchost.exe
2740 C:\WINDOWS\System32\svchost.exe
2764 C:\WINDOWS\System32\svchost.exe
2956 C:\WINDOWS\System32\drivers\XAudio.exe
3008 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
3088 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3400 WmiPrvSE.exe
3636 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
2896 C:\WINDOWS\System32\taskmgr.exe
3532 C:\Program Files\Mozilla Firefox\firefox.exe
3332 C:\Program Files\Mozilla Firefox\plugin-container.exe
3812 C:\Users\User\Desktop\MBRCheck.exe
1376 C:\WINDOWS\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000019`e26b9800 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541612J9SA00, Rev: SBDOC7BP

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
October 13th, 2010, 09:08 PM
704_Skate

Oh, didn't see Combo Fix, will do it right now..
October 13th, 2010, 09:16 PM
Broni

OK :)
October 13th, 2010, 09:41 PM
704_Skate

Anddd Combix.

ComboFix 10-10-12.03 - User 10/13/2010 21:20:52.7.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.1104 [GMT -4:00]
Running from: c:\users\User\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100219-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1368 [VPS 100219-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\User\FAVORI~1\bookmarks.html
c:\users\User\Favorites\bookmarks.html

.
((((((((((((((((((((((((( Files Created from 2010-09-14 to 2010-10-14 )))))))))))))))))))))))))))))))
.

2010-10-14 01:32 . 2010-10-14 01:33 -------- d-----w- c:\users\User\AppData\Local\temp
2010-10-14 01:32 . 2010-10-14 01:32 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-10-14 01:32 . 2010-10-14 01:32 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-10-14 01:32 . 2010-10-14 01:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-08 15:59 . 2010-10-08 15:59 -------- d-----w- c:\program files\KeyTweak
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2010-10-07 19:28 . 2010-10-07 19:31 -------- d-----w- c:\program files\Project64 1.6
2010-10-06 20:27 . 2009-03-05 15:35 49152 ----a-w- c:\windows\CNYUSB.dll
2010-10-06 20:27 . 2009-03-03 23:27 5576704 ----a-w- c:\windows\CNYHKey.exe
2010-10-06 20:27 . 2007-03-28 21:55 36864 ----a-w- c:\windows\LchDrvKey.exe
2010-10-06 20:27 . 2007-01-08 18:51 53248 ----a-w- c:\windows\ModLEDKey.exe
2010-10-04 20:26 . 2010-10-04 20:20 3670016 ----a-w- c:\users\Mcx2\ntuser.tmp
2010-10-04 20:26 . 2010-10-04 20:20 3932160 ----a-w- c:\users\Mcx1\ntuser.tmp
2010-10-04 20:26 . 2010-10-03 23:49 262144 ----a-w- c:\windows\system32\config\systemprofile\ntuser.tmp
2010-10-03 23:34 . 2010-10-12 21:44 -------- d-----w- c:\program files\Xvid
2010-09-19 13:43 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-19 13:42 . 2010-09-19 13:42 -------- d-----w- c:\programdata\Alwil Software
2010-09-16 14:33 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-16 14:32 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-09-16 14:32 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-16 14:32 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-16 14:32 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-16 14:20 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-16 14:20 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-16 14:20 . 2010-01-29 15:40 1616384 ----a-w- c:\program files\Windows Mail\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 19:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"ledpointer"="CNYHKey.exe" [2009-03-03 5576704]
"LchDrv"="LchDrvKey.exe" [2007-03-28 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
backup=c:\windows\pss\Nikon Monitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClickPotatoLiteSA

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 02:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 16:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-01-02 22:06 166424 ----a-w- c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 18:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-05 00:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-01 12:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2009-05-29 21:58 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-06-11 15:57 184320 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-03-29 00:45 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 09:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r***ent]
2009-10-21 17:58 916304 ----a-w- c:\program files\RFA\r***ent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2007-03-23 21:23 86016 ----a-w- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 04:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 20:21 246504 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-03-23 18:07 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 04:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 mvfvu;mvfvu;c:\windows\System32\drivers\jujfyfj.sys [x]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-30 717296]
R0 uvhskrj;uvhskrj;c:\windows\System32\drivers\tech.sys [x]
R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-07-01 18912]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\9240.tmp [x]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
R3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
R3 WMSvc;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264]
R4 gupdate;Google Update Service (gupdate); [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 15:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-17 c:\windows\Tasks\HPCeeScheduleForUser.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-07-02 21:23]
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
mLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 216.22.2.218:80
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bv5h7rsw.SPEED\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-CHotkey - mHotkey.exe

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\9240.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-10-13 21:38:29
ComboFix-quarantined-files.txt 2010-10-14 01:38

Pre-Run: 31,919,661,056 bytes free
Post-Run: 31,484,055,552 bytes free

- - End Of File - - 3B496AA92AD95AB064037B9A633C04C7
October 13th, 2010, 09:46 PM
Broni
Let's deal first with apparently infected MBR.

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)
- Place a blank CD in your CD drive.
- Double click on NTBR_CD.exe file and a folder of the same name will appear.
- Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
- Follow the prompts to burn the CD.
- Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
- If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
- Insert the newly created CD into your infected PC and reboot your computer.
- Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
- Read the warning and then continue as prompted.
- You first need to select your keyboard layout - press Enter for English.
- Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
- On the following screen enter 5 to select Install Standard MBR code.
- Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
- When asked to confirm please do so.
- Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
- Eject the disc and then press ctrl+alt+del to reboot the PC.
Once rebooted, run MBRCheck again and post its log.
October 13th, 2010, 10:13 PM
704_Skate

(:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Presario C700 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 157):
0x81A02000 \SystemRoot\system32\ntkrnlpa.exe
0x81DBB000 \SystemRoot\system32\hal.dll
0x80402000 \SystemRoot\system32\kdcom.dll
0x80409000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80479000 \SystemRoot\system32\PSHED.dll
0x8048A000 \SystemRoot\system32\BOOTVID.dll
0x80492000 \SystemRoot\system32\CLFS.SYS
0x804D3000 \SystemRoot\system32\CI.dll
0x80607000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80683000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80690000 \SystemRoot\system32\drivers\acpi.sys
0x806D6000 \SystemRoot\system32\drivers\WMILIB.SYS
0x805B3000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x807DF000 \SystemRoot\system32\drivers\msisadrv.sys
0x805D9000 \SystemRoot\system32\drivers\pci.sys
0x807E7000 \SystemRoot\System32\drivers\partmgr.sys
0x807F6000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x87A05000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x87A0F000 \SystemRoot\system32\drivers\volmgr.sys
0x87A1E000 \SystemRoot\System32\drivers\volmgrx.sys
0x87A68000 \SystemRoot\system32\DRIVERS\pciide.sys
0x87A6F000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x87A7D000 \SystemRoot\System32\drivers\mountmgr.sys
0x87A8D000 \SystemRoot\system32\drivers\iaStor.sys
0x87B54000 \SystemRoot\system32\drivers\atapi.sys
0x87B5C000 \SystemRoot\system32\drivers\ataport.SYS
0x87B7A000 \SystemRoot\system32\drivers\fltmgr.sys
0x87BAC000 \SystemRoot\system32\drivers\fileinfo.sys
0x87BBC000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x87C04000 \SystemRoot\System32\Drivers\ksecdd.sys
0x87C75000 \SystemRoot\system32\drivers\ndis.sys
0x87D80000 \SystemRoot\system32\drivers\msrpc.sys
0x87DAB000 \SystemRoot\system32\drivers\NETIO.SYS
0x87E0C000 \SystemRoot\System32\drivers\tcpip.sys
0x87EF6000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88002000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88112000 \SystemRoot\system32\drivers\volsnap.sys
0x8814B000 \SystemRoot\System32\Drivers\spldr.sys
0x88153000 \SystemRoot\system32\speedfan.sys
0x88155000 \SystemRoot\System32\Drivers\mup.sys
0x88164000 \SystemRoot\system32\giveio.sys
0x88165000 \SystemRoot\System32\drivers\ecache.sys
0x8818C000 \SystemRoot\system32\drivers\disk.sys
0x8819D000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x881BE000 \SystemRoot\system32\drivers\crcdisk.sys
0x881D4000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x881DF000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x881E8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x881F7000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x881FB000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x87FD8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x87FE8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x87FEF000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8C00F000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8C65C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C6FD000 \SystemRoot\System32\drivers\watchdog.sys
0x8C709000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x806DF000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8C796000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C7A1000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C7DF000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C7EE000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0x87DE6000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8C000000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x87BC5000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x87E00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x80765000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8077D000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C802000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C843000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C84E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C865000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8C870000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8C893000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C8A2000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8C8B6000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8C8CB000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C8DB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8C8DD000 \SystemRoot\system32\DRIVERS\ks.sys
0x8C907000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C911000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8C91E000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8C927000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8C95C000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C96D000 \SystemRoot\system32\drivers\CHDRT32.sys
0x8C9A0000 \SystemRoot\system32\drivers\portcls.sys
0x8C9CD000 \SystemRoot\system32\drivers\drmk.sys
0x8CC0B000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8CC48000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8CD4B000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8C9F2000 \SystemRoot\system32\drivers\modem.sys
0x807AC000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8CC00000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CC02000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x87FF8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x87BEE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x87DF9000 \SystemRoot\System32\Drivers\Null.SYS
0x87BF7000 \SystemRoot\System32\Drivers\Beep.SYS
0x807C3000 \SystemRoot\System32\drivers\vga.sys
0x8D001000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D022000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D02A000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D032000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D03D000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D04B000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D054000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D06A000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x8D074000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D0A6000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D0BA000 \SystemRoot\system32\drivers\afd.sys
0x8D102000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x8D107000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D11D000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D12B000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8D12D000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D140000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x8D165000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x8D16B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D1A7000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D1B1000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D1C8000 \SystemRoot\System32\Drivers\aswSP.SYS
0x8D1EF000 \SystemRoot\System32\Drivers\crashdmp.sys
0x87F11000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x944E0000 \SystemRoot\System32\win32k.sys
0x881C7000 \SystemRoot\System32\drivers\Dxapi.sys
0x807CF000 \SystemRoot\system32\DRIVERS\monitor.sys
0x94700000 \SystemRoot\System32\TSDDD.dll
0x94720000 \SystemRoot\System32\cdd.dll
0x94730000 \SystemRoot\System32\ATMFD.DLL
0xA8C0E000 \SystemRoot\system32\drivers\luafv.sys
0xA8C29000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0xA8C60000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xA8C6B000 \SystemRoot\system32\drivers\spsys.sys
0xA8D1B000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA8D2B000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xA8D55000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA8D5F000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA8D72000 \SystemRoot\system32\drivers\HTTP.sys
0xA8DDF000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAEC00000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAEC19000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAEC2E000 \SystemRoot\system32\drivers\mrxdav.sys
0xAEC4F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAEC6E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAECA7000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAECBF000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAECE6000 \SystemRoot\System32\DRIVERS\srv.sys
0xAED34000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB240D000 \SystemRoot\system32\drivers\peauth.sys
0xB24EB000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB24F5000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB2501000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xB2509000 \SystemRoot\system32\drivers\tdtcp.sys
0xB2514000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0xB2520000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xB2553000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x76F80000 \WINDOWS\System32\ntdll.dll

Processes (total 56):
0 System Idle Process
4 System
412 C:\WINDOWS\System32\smss.exe
544 csrss.exe
588 C:\WINDOWS\System32\wininit.exe
600 csrss.exe
644 C:\WINDOWS\System32\services.exe
652 C:\WINDOWS\System32\lsass.exe
660 C:\WINDOWS\System32\lsm.exe
736 C:\WINDOWS\System32\winlogon.exe
848 C:\WINDOWS\System32\svchost.exe
920 C:\WINDOWS\System32\svchost.exe
960 C:\WINDOWS\System32\svchost.exe
1068 C:\WINDOWS\System32\svchost.exe
1108 C:\WINDOWS\System32\svchost.exe
1128 C:\WINDOWS\System32\svchost.exe
1232 C:\WINDOWS\System32\audiodg.exe
1248 C:\WINDOWS\System32\svchost.exe
1268 C:\WINDOWS\System32\SLsvc.exe
1304 C:\WINDOWS\System32\svchost.exe
1436 C:\WINDOWS\System32\svchost.exe
1604 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1748 C:\WINDOWS\explorer.exe
288 C:\WINDOWS\System32\spoolsv.exe
320 C:\WINDOWS\System32\svchost.exe
324 C:\WINDOWS\System32\taskeng.exe
748 C:\Program Files\Apoint2K\Apoint.exe
1024 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
832 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
1348 C:\WINDOWS\System32\igfxtray.exe
1400 C:\WINDOWS\System32\igfxpers.exe
724 C:\WINDOWS\System32\igfxsrvc.exe
1716 C:\WINDOWS\ModLEDKey.exe
1784 C:\Program Files\Apoint2K\ApMsgFwd.exe
844 C:\WINDOWS\PixArt\Pac207\Monitor.exe
1928 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
1216 C:\WINDOWS\CNYHKey.exe
2212 C:\WINDOWS\System32\svchost.exe
2240 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2256 C:\Program Files\Bonjour\mDNSResponder.exe
2300 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2548 C:\Program Files\Apoint2K\ApntEx.exe
2572 C:\WINDOWS\System32\svchost.exe
2588 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
2620 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2660 C:\WINDOWS\System32\svchost.exe
2788 C:\WINDOWS\System32\svchost.exe
2800 C:\WINDOWS\System32\svchost.exe
2832 C:\WINDOWS\System32\drivers\XAudio.exe
2916 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
2984 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3360 WmiPrvSE.exe
3512 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
4076 C:\WINDOWS\System32\taskeng.exe
1312 C:\Users\User\Desktop\MBRCheck.exe
2780 C:\WINDOWS\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000019`e26b9800 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541612J9SA00, Rev: SBDOC7BP

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!
October 13th, 2010, 10:28 PM
Broni
Looks good :)

Uninstall Ask Toolbar, known adware.

1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File:: c:\windows\System32\drivers\jujfyfj.sys c:\windows\System32\drivers\tech.sys DDS:: uInternet Settings,ProxyServer = 216.22.2.218:80 Driver:: mvfvu uvhskrj MEMSWEEP2 Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=-

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
October 14th, 2010, 08:43 AM
704_Skate

ComboFix 10-10-12.03 - User 10/14/2010 8:11.8.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.1125 [GMT -4:00]
Running from: c:\users\User\Desktop\ComboFix.exe
Command switches used :: c:\users\User\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100219-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1368 [VPS 100219-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\System32\drivers\jujfyfj.sys"
"c:\windows\System32\drivers\tech.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MEMSWEEP2
-------\Service_MEMSWEEP2
-------\Service_mvfvu
-------\Service_uvhskrj

((((((((((((((((((((((((( Files Created from 2010-09-14 to 2010-10-14 )))))))))))))))))))))))))))))))
.

2010-10-14 12:25 . 2010-10-14 12:28 -------- d-----w- c:\users\User\AppData\Local\temp
2010-10-14 12:25 . 2010-10-14 12:25 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-10-14 12:25 . 2010-10-14 12:25 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-10-14 12:25 . 2010-10-14 12:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-08 15:59 . 2010-10-08 15:59 -------- d-----w- c:\program files\KeyTweak
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-10-07 19:29 . 2010-10-07 19:29 40960 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2010-10-07 19:28 . 2010-10-07 19:31 -------- d-----w- c:\program files\Project64 1.6
2010-10-06 20:27 . 2009-03-05 15:35 49152 ----a-w- c:\windows\CNYUSB.dll
2010-10-06 20:27 . 2009-03-03 23:27 5576704 ----a-w- c:\windows\CNYHKey.exe
2010-10-06 20:27 . 2007-03-28 21:55 36864 ----a-w- c:\windows\LchDrvKey.exe
2010-10-06 20:27 . 2007-01-08 18:51 53248 ----a-w- c:\windows\ModLEDKey.exe
2010-10-04 20:26 . 2010-10-04 20:20 3670016 ----a-w- c:\users\Mcx2\ntuser.tmp
2010-10-04 20:26 . 2010-10-04 20:20 3932160 ----a-w- c:\users\Mcx1\ntuser.tmp
2010-10-04 20:26 . 2010-10-03 23:49 262144 ----a-w- c:\windows\system32\config\systemprofile\ntuser.tmp
2010-10-03 23:34 . 2010-10-12 21:44 -------- d-----w- c:\program files\Xvid
2010-09-19 13:43 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-19 13:42 . 2010-09-19 13:42 -------- d-----w- c:\programdata\Alwil Software
2010-09-16 14:33 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-09-16 14:32 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-09-16 14:32 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-09-16 14:32 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-09-16 14:32 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-09-16 14:20 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-16 14:20 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-16 14:20 . 2010-01-29 15:40 1616384 ----a-w- c:\program files\Windows Mail\msoe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 19:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"ledpointer"="CNYHKey.exe" [2009-03-03 5576704]
"LchDrv"="LchDrvKey.exe" [2007-03-28 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
backup=c:\windows\pss\Nikon Monitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 02:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 16:44 31072 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-01-02 22:06 166424 ----a-w- c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 18:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-05 00:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-01 12:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 21:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2009-05-29 21:58 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-06-11 15:57 184320 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-03-29 00:45 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-08-10 09:15 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r***ent]
2009-10-21 17:58 916304 ----a-w- c:\program files\RFA\r***ent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2007-03-23 21:23 86016 ----a-w- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 04:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-11 20:21 246504 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-03-23 18:07 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 04:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-11-30 717296]
R3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\system32\drivers\lmvac.sys [2008-07-01 18912]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [x]
R3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]
R3 PAC207;PC Camer@;c:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
R3 WMSvc;Web Management Service;c:\windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264]
R4 gupdate;Google Update Service (gupdate); [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 15:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-17 c:\windows\Tasks\HPCeeScheduleForUser.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-07-02 21:23]
.
.
------- Supplementary Scan -------
.
uLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
mLocal Page = c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Blank.htm
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bv5h7rsw.SPEED\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(2912)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\ModLEDKey.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\conime.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\CNYHKey.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Apoint2K\Apntex.exe
.
**************************************************************************
.
Completion time: 2010-10-14 08:38:22 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-14 12:38
ComboFix2.txt 2010-10-14 01:38

Pre-Run: 30,912,671,744 bytes free
Post-Run: 30,660,624,384 bytes free

- - End Of File - - CDB345DB2565E8639DD6F7C592F35A47

Show 40 post(s) from this thread on one page