BleepingComputer.com: goingonearth google redirect

Hi - i have been infected with the goingonearth virus which is a google redirect virus, and it only affects mozilla. IE and chrome seem to be spared. I cannot seem to shake it. I have tried tons of malaware software and i'm protected with norton antivirus, but none have been able to pick it up. I tried the TDSS rootkit removal software targeted at this virus, but i apparently have a different version of the virus, because this did not eradicate it.

Any help would be appreciated. Thanks.


.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Rob at 13:52:22.94 on Thu 04/21/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.5941.4168 [GMT -4:00]
.
AV: Norton Security Suite *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Security Suite *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton Security Suite *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Windows\splwow64.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Rob\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.dell.com
uDefault_Page_URL = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
mURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\IPSBHO.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\coIEPlg.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
uRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
uRun: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
uRun: [Google Update] "C:\Users\Rob\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10o_Plugin.exe -update plugin
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: PDN64BitBookMarkActivator.BookMark64BitActivator: {887cdc33-0de3-4fd5-a5d3-eccd4b4b396c} - mscoree.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
TB-X64: Post-itr Digital Notes: {735abc4c-9266-4008-9ef6-bc60be8de31f} - mscoree.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB-X64: {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe
mRun-x64: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
mRun-x64: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
mRun-x64: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
mRun-x64: [RunDLLEntry] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\w6slxl33.default\
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Users\Rob\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 stdflt;Disk Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdflt.sys [2011-4-14 18792]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\0403000.005\symds64.sys [2011-4-14 433200]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\0403000.005\symefa64.sys [2011-4-14 221232]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110419.001\BHDrvx64.sys [2011-4-19 1127032]
R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\N360x64\0403000.005\cchpx64.sys [2011-4-14 615040]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110420.001\IDSviA64.sys [2011-4-20 476792]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\0403000.005\ironx64.sys [2011-4-14 150064]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\N360x64\0403000.005\symtdiv.sys [2011-4-14 451120]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-4-14 13336]
R2 InstallFilterService;FF Install Filter Service;C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe [2011-4-14 60928]
R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\ccsvchst.exe [2011-4-14 126392]
R2 rimspci;rimspci;C:\Windows\System32\drivers\rimspe64.sys [2011-4-11 60416]
R2 risdpcie;risdpcie;C:\Windows\System32\drivers\risdpe64.sys [2011-4-11 80896]
R2 rixdpcie;rixdpcie;C:\Windows\System32\drivers\rixdpe64.sys [2011-4-11 55808]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2009-11-2 13784]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-4-14 2320920]
R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Acceler.sys [2011-4-11 23912]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2011-4-14 35104]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-4-11 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2011-4-11 158720]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-4-11 271872]
R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2011-4-11 6952960]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-4-11 239616]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-4-14 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-4-14 79360]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2009-9-21 315664]
S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2011-4-14 79360]
S3 TurboBoost;TurboBoost;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2009-11-2 126352]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-4-18 1255736]
.
=============== Created Last 30 ================
.
2011-04-18 17:10:12 -------- d-----w- C:\Program Files (x86)\ESET
2011-04-18 11:20:49 -------- d-----w- C:\Windows\SysWow64\Wat
2011-04-18 11:20:49 -------- d-----w- C:\Windows\System32\Wat
2011-04-18 01:54:39 -------- d-----w- C:\Users\Rob\AppData\Local\StickyNotes
2011-04-18 01:44:22 -------- d-----w- C:\Program Files (x86)\3M
2011-04-18 01:38:30 -------- d-----w- C:\Users\Rob\AppData\Roaming\GetRightToGo
2011-04-18 00:41:08 92248 ----a-w- C:\Windows\System32\drivers\klmd.sys
2011-04-17 21:33:02 44544 ----a-r- C:\Users\Rob\AppData\Roaming\msxml4a.dll
2011-04-17 21:33:02 1233920 ----a-r- C:\Users\Rob\AppData\Roaming\msxml4.dll
2011-04-17 19:32:14 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2011-04-17 19:32:14 -------- d-----w- C:\PROGRA~3\Spybot - Search & Destroy
2011-04-17 18:44:57 -------- d-----w- C:\Users\Rob\AppData\Local\Google
2011-04-17 18:44:41 -------- d-----w- C:\Users\Rob\AppData\Local\Apps
2011-04-17 18:44:40 -------- d-----w- C:\Users\Rob\AppData\Local\Deployment
2011-04-17 18:28:33 -------- d-----w- C:\PROGRA~3\STOPzilla!
2011-04-17 17:28:59 -------- d-----w- C:\Program Files (x86)\Unlocker
2011-04-17 17:04:28 19528 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys
2011-04-17 17:04:27 -------- d-----w- C:\Program Files\Hitman Pro 3.5
2011-04-17 17:04:16 -------- d-----w- C:\PROGRA~3\Hitman Pro
2011-04-16 19:16:04 -------- d-----w- C:\Users\Rob\AppData\Local\PokerStars.NET
2011-04-16 19:15:58 -------- d-----w- C:\Program Files (x86)\PokerStars.NET
2011-04-15 15:08:53 -------- d-----w- C:\Users\Rob\AppData\Roaming\Malwarebytes
2011-04-15 15:08:49 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-04-15 15:08:48 -------- d-----w- C:\PROGRA~3\Malwarebytes
2011-04-15 15:08:45 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-04-15 15:08:45 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-04-15 06:50:24 49752 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys
2011-04-15 06:50:04 -------- d-----w- C:\Users\Rob\AppData\Local\Sunbelt Software
2011-04-15 06:43:58 -------- dc-h--w- C:\PROGRA~3\{6A395471-4AA3-4072-AE1B-9B69A97AD164}
2011-04-15 06:43:54 -------- d-----w- C:\Program Files (x86)\Lavasoft
2011-04-15 04:38:04 476160 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2011-04-15 04:38:04 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2011-04-14 22:38:51 505392 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\srtsp64.sys
2011-04-14 22:38:51 451120 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\symtdiv.sys
2011-04-14 22:38:51 433200 ----a-r- C:\Windows\System32\drivers\N360x64\0403000.005\symds64.sys
2011-04-14 22:38:51 32304 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\srtspx64.sys
2011-04-14 22:38:51 221232 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\symefa64.sys
2011-04-14 22:38:50 615040 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\cchpx64.sys
2011-04-14 22:38:50 150064 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\ironx64.sys
2011-04-14 22:38:36 -------- d-----w- C:\Windows\System32\drivers\N360x64\0403000.005
2011-04-14 20:58:46 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
2011-04-14 20:58:46 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
2011-04-14 20:56:34 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
2011-04-14 20:56:34 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
2011-04-14 20:56:34 48960 ----a-w- C:\Windows\System32\netfxperf.dll
2011-04-14 20:56:34 444752 ----a-w- C:\Windows\System32\mscoree.dll
2011-04-14 20:56:34 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
2011-04-14 20:56:34 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
2011-04-14 20:56:34 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
2011-04-14 20:56:34 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2011-04-14 20:56:34 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2011-04-14 20:56:34 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
2011-04-14 20:54:47 1395712 ----a-w- C:\Windows\System32\mfc42.dll
2011-04-14 20:13:00 -------- d-----w- C:\Windows\PCHEALTH
2011-04-14 20:09:27 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-04-14 19:22:19 -------- d-----w- C:\Program Files (x86)\RocketDock
2011-04-14 19:16:45 -------- d-----w- C:\Users\Rob\.gem
2011-04-14 18:38:38 -------- d-----w- C:\Users\Rob\AppData\Roaming\Azureus
2011-04-14 18:38:07 -------- d-----w- C:\Program Files (x86)\Vuze
2011-04-14 18:37:53 -------- d-----w- C:\Users\Rob\AppData\Local\Conduit
2011-04-14 18:37:53 -------- d-----w- C:\Program Files (x86)\Vuze_Remote
2011-04-14 18:28:45 -------- d-----w- C:\Users\Rob\AppData\Local\Apple
2011-04-14 18:28:30 -------- d-----w- C:\Program Files\Bonjour
2011-04-14 18:28:30 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-04-14 16:05:20 -------- d-----w- C:\Program Files\Creative
2011-04-14 16:03:56 -------- d-----w- C:\PROGRA~3\Creative Labs
2011-04-14 16:01:14 -------- d-----w- C:\Program Files (x86)\Common Files\Creative Labs Shared
2011-04-14 16:01:07 -------- d-----w- C:\Program Files (x86)\Creative
2011-04-14 16:01:05 225280 ------w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-04-14 16:01:04 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2011-04-14 16:01:04 32768 ------w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-04-14 16:01:04 176128 ------w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-04-14 16:01:00 729088 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2011-04-14 16:01:00 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2011-04-14 16:01:00 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2011-04-14 16:01:00 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-04-14 16:01:00 266240 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2011-04-14 16:01:00 192512 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2011-04-14 16:00:57 188548 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2011-04-14 16:00:56 311428 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2011-04-14 15:52:39 -------- d-----w- C:\PROGRA~3\regid.1986-12.com.adobe
2011-04-14 15:47:45 -------- d-----w- C:\Users\Rob\AppData\Local\Adobe
2011-04-14 15:37:10 -------- d-----w- C:\Users\Rob\AppData\Roaming\Philipp Winterberg
2011-04-14 15:36:54 -------- d-----w- C:\Program Files (x86)\Free RAR Extract Frog
2011-04-14 15:32:41 -------- d-----w- C:\Users\Rob\AppData\Local\CrashDumps
2011-04-14 15:18:13 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
2011-04-14 15:18:05 200704 --sha-r- C:\Windows\SysWow64\dcomcnfgq.dll
2011-04-14 15:09:09 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
2011-04-14 15:08:47 -------- d-----w- C:\Users\Rob\AppData\Local\Microsoft Help
2011-04-14 15:04:14 34152 ----a-r- C:\Windows\System32\drivers\GEARAspiWDM.sys
2011-04-14 15:04:14 126312 ----a-r- C:\Windows\System32\GEARAspi64.dll
2011-04-14 15:04:14 107368 ----a-r- C:\Windows\SysWow64\GEARAspi.dll
2011-04-14 15:04:13 173104 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2011-04-14 15:04:13 -------- d-----w- C:\Program Files\Symantec
2011-04-14 15:04:13 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2011-04-14 15:04:04 -------- d-----w- C:\Windows\System32\drivers\N360x64
2011-04-14 15:04:03 -------- d-----w- C:\Program Files (x86)\Norton Security Suite
2011-04-14 15:03:53 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2011-04-14 15:03:53 -------- d-----w- C:\PROGRA~3\NortonInstaller
2011-04-14 15:00:47 -------- d-----w- C:\PROGRA~3\Norton
2011-04-14 14:58:48 -------- d-----w- C:\Users\Rob\AppData\Local\Mozilla
2011-04-14 14:55:12 8424784 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{0024E619-251F-444F-9109-0726133779A4}\mpengine.dll
2011-04-14 14:55:12 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-04-14 14:53:47 -------- d-----w- C:\Users\Rob\AppData\Local\AOL
2011-04-14 14:53:47 -------- d-----w- C:\Users\Rob\AppData\Local\AIM
2011-04-14 14:53:05 -------- d-----w- C:\PROGRA~3\AIM
2011-04-14 14:53:03 -------- d-----w- C:\Program Files (x86)\Common Files\Software Update Utility
2011-04-14 14:53:03 -------- d-----w- C:\Program Files (x86)\AIM
2011-04-14 14:53:02 -------- d-----w- C:\Program Files (x86)\Common Files\AOL
2011-04-14 14:50:45 -------- d-----w- C:\Users\Rob\ACP
2011-04-14 14:16:29 -------- d-----w- C:\Program Files\IDT
2011-04-14 14:16:28 90624 ----a-w- C:\Windows\System32\AESTCo64.dll
2011-04-14 14:16:28 68608 ----a-w- C:\Windows\System32\AESTAR64.dll
2011-04-14 14:16:28 652288 ----a-w- C:\Windows\System32\ctapo64.dll
2011-04-14 14:16:28 57856 ----a-w- C:\Windows\System32\ctppld64.dll
2011-04-14 14:16:28 511488 ----a-w- C:\Windows\System32\ctapo32.dll
2011-04-14 14:16:28 431104 ----a-w- C:\Windows\System32\AESTEC64.dll
2011-04-14 14:16:28 165888 ----a-w- C:\Windows\System32\AESTAC64.dll
2011-04-14 14:16:27 564224 ----a-w- C:\Windows\System32\idt64mp1.exe
2011-04-14 14:16:27 3593216 ----a-w- C:\Windows\System32\stlang64.dll
2011-04-14 14:16:27 12151808 ----a-w- C:\Windows\System32\idtcpl64.cpl
2011-04-14 14:16:27 -------- d-----w- C:\Windows\System32\SRSLabs
2011-04-14 14:15:47 -------- d-----w- C:\Intel
2011-04-14 12:27:39 -------- d-----w- C:\Program Files\Common Files\Intel
2011-04-14 12:27:39 -------- d-----w- C:\Program Files (x86)\Cisco
2011-04-14 12:26:21 18792 ----a-w- C:\Windows\System32\drivers\stdflt.sys
2011-04-14 12:26:21 -------- d-----w- C:\Program Files (x86)\STMicroelectronics
2011-04-14 12:26:06 -------- d-----w- C:\Program Files\Dell
2011-04-14 12:25:15 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent
2011-04-14 12:24:55 98344 ----a-w- C:\Windows\System32\drivers\btwaudio.sys
2011-04-14 12:24:55 35104 ----a-w- C:\Windows\System32\drivers\btwl2cap.sys
2011-04-14 12:24:55 21160 ----a-w- C:\Windows\System32\drivers\btwrchid.sys
2011-04-14 12:24:55 132648 ----a-w- C:\Windows\System32\drivers\btwavdt.sys
2011-04-14 12:24:48 -------- d-----w- C:\Program Files\WIDCOMM
2011-04-14 12:23:24 521448 ----a-w- C:\Windows\System32\deployJava1.dll
2011-04-14 12:23:16 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-04-14 12:23:07 -------- d-----w- C:\Program Files\Dell Inc
2011-04-14 12:23:05 -------- d-sh--w- C:\Windows\Installer
2011-04-12 19:38:59 -------- d-----w- C:\Music
2011-04-11 14:27:13 -------- d-----w- C:\backup
2011-04-11 14:24:52 -------- d-----w- C:\Program Files\Synaptics
2011-04-11 14:21:56 1975296 ----a-w- C:\Windows\System32\CertEnroll.dll
2011-04-11 14:17:44 787456 ----a-w- C:\Windows\System32\NETw5c64.dll
2011-04-11 14:16:57 540696 ----a-w- C:\Windows\System32\drivers\iaStor.sys
2011-04-11 14:15:36 -------- d-----w- C:\hotfix
2011-04-11 14:15:05 -------- d-----w- C:\Windows\System32\oem
2011-04-11 14:15:04 -------- d-----w- C:\Windows\Panther
2011-04-11 14:15:04 -------- d-----w- C:\Drivers
2011-04-11 14:11:08 -------- d-----w- C:\dell
.
==================== Find3M ====================
.
2011-04-14 16:06:21 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-04-14 16:06:21 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-04-14 16:06:21 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-04-14 16:06:21 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2011-04-11 14:21:56 1320960 ----a-w- C:\Windows\SysWow64\CertEnroll.dll
2011-03-11 06:19:26 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
2011-03-11 05:40:24 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
2011-03-11 05:40:24 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
2011-03-08 06:14:30 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2011-03-08 05:38:13 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2011-03-07 02:08:13 93552 ----a-w- C:\Windows\SysWow64\ElbyCDIO.dll
2011-03-07 00:52:09 134512 ----a-w- C:\Windows\SysWow64\ElbyVCD.dll
2011-03-03 06:17:10 182272 ----a-w- C:\Windows\System32\dnsrslvr.dll
2011-03-03 06:14:38 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe
2011-03-03 05:27:30 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe
2011-03-03 03:58:32 3133440 ----a-w- C:\Windows\System32\win32k.sys
2011-02-24 06:29:15 1197056 ----a-w- C:\Windows\System32\wininet.dll
2011-02-24 06:24:57 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2011-02-24 05:32:44 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-02-24 05:30:16 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2011-02-24 05:05:13 482816 ----a-w- C:\Windows\System32\html.iec
2011-02-24 04:24:04 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-02-24 04:23:48 386048 ----a-w- C:\Windows\SysWow64\html.iec
2011-02-24 03:50:26 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-02-23 05:16:28 461312 ----a-w- C:\Windows\System32\drivers\srv.sys
2011-02-23 05:16:01 401920 ----a-w- C:\Windows\System32\drivers\srv2.sys
2011-02-23 05:15:50 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2011-02-23 05:15:27 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2011-02-23 05:15:14 286720 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-02-23 05:15:13 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2011-02-23 05:15:06 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
2011-02-19 06:36:13 46080 ----a-w- C:\Windows\System32\atmlib.dll
2011-02-19 05:32:08 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2011-02-19 04:13:39 367104 ----a-w- C:\Windows\System32\atmfd.dll
2011-02-19 03:37:02 294912 ----a-w- C:\Windows\SysWow64\atmfd.dll
2011-02-18 06:37:05 612352 ----a-w- C:\Windows\System32\vbscript.dll
2011-02-18 05:36:26 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
2011-02-12 06:14:41 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2011-02-05 12:41:43 556928 ----a-w- C:\Windows\System32\winresume.efi
2011-02-05 12:41:35 640896 ----a-w- C:\Windows\System32\winload.efi
2011-02-05 12:41:24 20352 ----a-w- C:\Windows\System32\kdusb.dll
2011-02-05 12:41:24 19328 ----a-w- C:\Windows\System32\kd1394.dll
2011-02-05 12:41:23 17792 ----a-w- C:\Windows\System32\kdcom.dll
2011-02-05 12:39:21 603976 ----a-w- C:\Windows\System32\winload.exe
2011-02-05 12:39:21 518160 ----a-w- C:\Windows\System32\winresume.exe
2011-01-26 06:53:10 982912 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
2011-01-26 06:53:10 265088 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys
2011-01-26 06:31:20 144384 ----a-w- C:\Windows\System32\cdd.dll
.
============= FINISH: 13:53:06.69 ===============

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• Please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.


In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

• The application window will appear
  
• Click the Disable button to disable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

Download DDS:

Please download DDS by sUBs from one of the links below and save it to your desktop:


Download DDS and save it to your desktop

Link1
Link2
Link3

Please disable any anti-malware program that will block scripts from running before running DDS.


• Double-Click on dds.scr and a command window will appear. This is normal.
  
• Shortly after two logs will appear:
  
  • DDS.txt
    
  • Attach.txt
  
  
• A window will open instructing you save & post the logs
  
• Save the logs to a convenient place such as your desktop
  
• Copy the contents of both logs & post in your next reply

information and logs:

In your next post I need the following


• .logs from DDS
  
• let me know of any problems you may have had

Gringo

No problems. Here is my DDS script.

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Rob at 3:14:52.64 on Sat 04/30/2011
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.5941.3997 [GMT -4:00]
.
AV: Norton Security Suite *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Security Suite *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton Security Suite *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Windows\system32\SearchIndexer.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Rob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Rob\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.dell.com
uDefault_Page_URL = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
mURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\IPSBHO.DLL
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\coIEPlg.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll
uRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
uRun: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
uRun: [Google Update] "C:\Users\Rob\AppData\Local\Google\Update\GoogleUpdate.exe" /c
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: PDN64BitBookMarkActivator.BookMark64BitActivator: {887cdc33-0de3-4fd5-a5d3-eccd4b4b396c} - mscoree.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
TB-X64: Post-itr Digital Notes: {735abc4c-9266-4008-9ef6-bc60be8de31f} - mscoree.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB-X64: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB-X64: {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe
mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe
mRun-x64: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
mRun-x64: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\Accelerometer\FF_Protection.exe
mRun-x64: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
mRun-x64: [RunDLLEntry] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\w6slxl33.default\
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Users\Rob\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 RapportKE64;RapportKE64;C:\Windows\System32\drivers\RapportKE64.sys [2011-4-28 64272]
R0 stdflt;Disk Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdflt.sys [2011-4-14 18792]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\0403000.005\symds64.sys [2011-4-14 433200]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\0403000.005\symefa64.sys [2011-4-14 221232]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20110419.001\BHDrvx64.sys [2011-4-19 1127032]
R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\N360x64\0403000.005\cchpx64.sys [2011-4-14 615040]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20110429.002\IDSviA64.sys [2011-4-30 476792]
R1 RapportEI64;RapportEI64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-4-28 52496]
R1 RapportPG64;RapportPG64;C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-4-28 61200]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\0403000.005\ironx64.sys [2011-4-14 150064]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;C:\Windows\System32\drivers\N360x64\0403000.005\symtdiv.sys [2011-4-14 451120]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-4-14 13336]
R2 InstallFilterService;FF Install Filter Service;C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe [2011-4-14 60928]
R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\4.3.0.5\ccsvchst.exe [2011-4-14 126392]
R2 RapportMgmtService;Rapport Management Service;C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-4-28 870200]
R2 rimspci;rimspci;C:\Windows\System32\drivers\rimspe64.sys [2011-4-11 60416]
R2 risdpcie;risdpcie;C:\Windows\System32\drivers\risdpe64.sys [2011-4-11 80896]
R2 rixdpcie;rixdpcie;C:\Windows\System32\drivers\rixdpe64.sys [2011-4-11 55808]
R2 TurboB;Turbo Boost UI Monitor driver;C:\Windows\System32\drivers\TurboB.sys [2009-11-2 13784]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-4-14 2320920]
R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Acceler.sys [2011-4-11 23912]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2011-4-14 35104]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-4-21 132656]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-4-11 56344]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2011-4-11 158720]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-4-11 271872]
R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2011-4-11 6952960]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-4-11 239616]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-4-14 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-4-14 79360]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2009-9-21 315664]
S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2011-4-14 79360]
S3 TurboBoost;TurboBoost;C:\Program Files\Intel\TurboBoost\TurboBoost.exe [2009-11-2 126352]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-2-18 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-4-18 1255736]
.
=============== Created Last 30 ================
.
2011-04-28 20:00:43 -------- d-----w- C:\Users\Rob\AppData\Local\Trusteer
2011-04-28 19:59:33 64272 ----a-w- C:\Windows\System32\drivers\RapportKE64.sys
2011-04-28 19:59:31 -------- d-----w- C:\Users\Rob\AppData\Roaming\Trusteer
2011-04-28 19:59:29 -------- d-----w- C:\Program Files (x86)\Trusteer
2011-04-28 19:58:50 -------- d-----w- C:\PROGRA~3\Trusteer
2011-04-27 20:25:05 2870272 ----a-w- C:\Windows\explorer.exe
2011-04-27 20:25:05 2614784 ----a-w- C:\Windows\SysWow64\explorer.exe
2011-04-27 20:25:04 662528 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-04-27 20:25:04 442880 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-04-18 17:10:12 -------- d-----w- C:\Program Files (x86)\ESET
2011-04-18 11:20:49 -------- d-----w- C:\Windows\SysWow64\Wat
2011-04-18 11:20:49 -------- d-----w- C:\Windows\System32\Wat
2011-04-18 01:54:39 -------- d-----w- C:\Users\Rob\AppData\Local\StickyNotes
2011-04-18 01:44:22 -------- d-----w- C:\Program Files (x86)\3M
2011-04-18 01:38:30 -------- d-----w- C:\Users\Rob\AppData\Roaming\GetRightToGo
2011-04-17 21:33:02 44544 ----a-r- C:\Users\Rob\AppData\Roaming\msxml4a.dll
2011-04-17 21:33:02 1233920 ----a-r- C:\Users\Rob\AppData\Roaming\msxml4.dll
2011-04-17 19:32:14 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2011-04-17 19:32:14 -------- d-----w- C:\PROGRA~3\Spybot - Search & Destroy
2011-04-17 18:44:57 -------- d-----w- C:\Users\Rob\AppData\Local\Google
2011-04-17 18:44:41 -------- d-----w- C:\Users\Rob\AppData\Local\Apps
2011-04-17 18:44:40 -------- d-----w- C:\Users\Rob\AppData\Local\Deployment
2011-04-17 18:28:33 -------- d-----w- C:\PROGRA~3\STOPzilla!
2011-04-17 17:28:59 -------- d-----w- C:\Program Files (x86)\Unlocker
2011-04-17 17:04:28 19528 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys
2011-04-17 17:04:27 -------- d-----w- C:\Program Files\Hitman Pro 3.5
2011-04-17 17:04:16 -------- d-----w- C:\PROGRA~3\Hitman Pro
2011-04-16 19:16:04 -------- d-----w- C:\Users\Rob\AppData\Local\PokerStars.NET
2011-04-16 19:15:58 -------- d-----w- C:\Program Files (x86)\PokerStars.NET
2011-04-15 15:08:53 -------- d-----w- C:\Users\Rob\AppData\Roaming\Malwarebytes
2011-04-15 15:08:49 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-04-15 15:08:48 -------- d-----w- C:\PROGRA~3\Malwarebytes
2011-04-15 15:08:45 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-04-15 15:08:45 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-04-15 06:50:24 49752 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys
2011-04-15 06:50:04 -------- d-----w- C:\Users\Rob\AppData\Local\Sunbelt Software
2011-04-15 06:43:58 -------- dc-h--w- C:\PROGRA~3\{6A395471-4AA3-4072-AE1B-9B69A97AD164}
2011-04-15 06:43:54 -------- d-----w- C:\Program Files (x86)\Lavasoft
2011-04-15 04:38:04 476160 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2011-04-15 04:38:04 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2011-04-14 22:38:51 505392 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\srtsp64.sys
2011-04-14 22:38:51 451120 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\symtdiv.sys
2011-04-14 22:38:51 433200 ----a-r- C:\Windows\System32\drivers\N360x64\0403000.005\symds64.sys
2011-04-14 22:38:51 32304 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\srtspx64.sys
2011-04-14 22:38:51 221232 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\symefa64.sys
2011-04-14 22:38:50 615040 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\cchpx64.sys
2011-04-14 22:38:50 150064 ----a-w- C:\Windows\System32\drivers\N360x64\0403000.005\ironx64.sys
2011-04-14 22:38:36 -------- d-----w- C:\Windows\System32\drivers\N360x64\0403000.005
2011-04-14 20:58:46 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
2011-04-14 20:58:46 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
2011-04-14 20:56:34 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
2011-04-14 20:56:34 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
2011-04-14 20:56:34 48960 ----a-w- C:\Windows\System32\netfxperf.dll
2011-04-14 20:56:34 444752 ----a-w- C:\Windows\System32\mscoree.dll
2011-04-14 20:56:34 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
2011-04-14 20:56:34 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
2011-04-14 20:56:34 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
2011-04-14 20:56:34 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2011-04-14 20:56:34 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2011-04-14 20:56:34 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
2011-04-14 20:54:47 1395712 ----a-w- C:\Windows\System32\mfc42.dll
2011-04-14 20:13:00 -------- d-----w- C:\Windows\PCHEALTH
2011-04-14 20:09:27 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2011-04-14 19:22:19 -------- d-----w- C:\Program Files (x86)\RocketDock
2011-04-14 19:16:45 -------- d-----w- C:\Users\Rob\.gem
2011-04-14 18:38:38 -------- d-----w- C:\Users\Rob\AppData\Roaming\Azureus
2011-04-14 18:38:07 -------- d-----w- C:\Program Files (x86)\Vuze
2011-04-14 18:37:53 -------- d-----w- C:\Users\Rob\AppData\Local\Conduit
2011-04-14 18:37:53 -------- d-----w- C:\Program Files (x86)\Vuze_Remote
2011-04-14 18:28:45 -------- d-----w- C:\Users\Rob\AppData\Local\Apple
2011-04-14 18:28:30 -------- d-----w- C:\Program Files\Bonjour
2011-04-14 18:28:30 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-04-14 16:05:20 -------- d-----w- C:\Program Files\Creative
2011-04-14 16:03:56 -------- d-----w- C:\PROGRA~3\Creative Labs
2011-04-14 16:01:14 -------- d-----w- C:\Program Files (x86)\Common Files\Creative Labs Shared
2011-04-14 16:01:07 -------- d-----w- C:\Program Files (x86)\Creative
2011-04-14 16:01:05 225280 ------w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
2011-04-14 16:01:04 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2011-04-14 16:01:04 32768 ------w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-04-14 16:01:04 176128 ------w- C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-04-14 16:01:00 729088 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iKernel.dll
2011-04-14 16:01:00 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\ctor.dll
2011-04-14 16:01:00 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\DotNetInstaller.exe
2011-04-14 16:01:00 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-04-14 16:01:00 266240 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iscript.dll
2011-04-14 16:01:00 192512 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iuser.dll
2011-04-14 16:00:57 188548 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\iGdi.dll
2011-04-14 16:00:56 311428 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\setup.dll
2011-04-14 15:52:39 -------- d-----w- C:\PROGRA~3\regid.1986-12.com.adobe
2011-04-14 15:47:45 -------- d-----w- C:\Users\Rob\AppData\Local\Adobe
2011-04-14 15:37:10 -------- d-----w- C:\Users\Rob\AppData\Roaming\Philipp Winterberg
2011-04-14 15:36:54 -------- d-----w- C:\Program Files (x86)\Free RAR Extract Frog
2011-04-14 15:32:41 -------- d-----w- C:\Users\Rob\AppData\Local\CrashDumps
2011-04-14 15:18:13 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
2011-04-14 15:18:05 200704 --sha-r- C:\Windows\SysWow64\dcomcnfgq.dll
2011-04-14 15:09:09 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
2011-04-14 15:08:47 -------- d-----w- C:\Users\Rob\AppData\Local\Microsoft Help
2011-04-14 15:04:14 34152 ----a-r- C:\Windows\System32\drivers\GEARAspiWDM.sys
2011-04-14 15:04:14 126312 ----a-r- C:\Windows\System32\GEARAspi64.dll
2011-04-14 15:04:14 107368 ----a-r- C:\Windows\SysWow64\GEARAspi.dll
2011-04-14 15:04:13 173104 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2011-04-14 15:04:13 -------- d-----w- C:\Program Files\Symantec
2011-04-14 15:04:13 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2011-04-14 15:04:04 -------- d-----w- C:\Windows\System32\drivers\N360x64
2011-04-14 15:04:03 -------- d-----w- C:\Program Files (x86)\Norton Security Suite
2011-04-14 15:03:53 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2011-04-14 15:03:53 -------- d-----w- C:\PROGRA~3\NortonInstaller
2011-04-14 15:00:47 -------- d-----w- C:\PROGRA~3\Norton
2011-04-14 14:58:48 -------- d-----w- C:\Users\Rob\AppData\Local\Mozilla
2011-04-14 14:55:12 8424784 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{0024E619-251F-444F-9109-0726133779A4}\mpengine.dll
2011-04-14 14:55:12 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-04-14 14:53:47 -------- d-----w- C:\Users\Rob\AppData\Local\AOL
2011-04-14 14:53:47 -------- d-----w- C:\Users\Rob\AppData\Local\AIM
2011-04-14 14:53:05 -------- d-----w- C:\PROGRA~3\AIM
2011-04-14 14:53:03 -------- d-----w- C:\Program Files (x86)\Common Files\Software Update Utility
2011-04-14 14:53:03 -------- d-----w- C:\Program Files (x86)\AIM
2011-04-14 14:53:02 -------- d-----w- C:\Program Files (x86)\Common Files\AOL
2011-04-14 14:50:45 -------- d-----w- C:\Users\Rob\ACP
2011-04-14 14:16:29 -------- d-----w- C:\Program Files\IDT
2011-04-14 14:16:28 90624 ----a-w- C:\Windows\System32\AESTCo64.dll
2011-04-14 14:16:28 68608 ----a-w- C:\Windows\System32\AESTAR64.dll
2011-04-14 14:16:28 652288 ----a-w- C:\Windows\System32\ctapo64.dll
2011-04-14 14:16:28 57856 ----a-w- C:\Windows\System32\ctppld64.dll
2011-04-14 14:16:28 511488 ----a-w- C:\Windows\System32\ctapo32.dll
2011-04-14 14:16:28 431104 ----a-w- C:\Windows\System32\AESTEC64.dll
2011-04-14 14:16:28 165888 ----a-w- C:\Windows\System32\AESTAC64.dll
2011-04-14 14:16:27 564224 ----a-w- C:\Windows\System32\idt64mp1.exe
2011-04-14 14:16:27 3593216 ----a-w- C:\Windows\System32\stlang64.dll
2011-04-14 14:16:27 12151808 ----a-w- C:\Windows\System32\idtcpl64.cpl
2011-04-14 14:16:27 -------- d-----w- C:\Windows\System32\SRSLabs
2011-04-14 14:15:47 -------- d-----w- C:\Intel
2011-04-14 12:27:39 -------- d-----w- C:\Program Files\Common Files\Intel
2011-04-14 12:27:39 -------- d-----w- C:\Program Files (x86)\Cisco
2011-04-14 12:26:21 18792 ----a-w- C:\Windows\System32\drivers\stdflt.sys
2011-04-14 12:26:21 -------- d-----w- C:\Program Files (x86)\STMicroelectronics
2011-04-14 12:26:06 -------- d-----w- C:\Program Files\Dell
2011-04-14 12:25:15 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent
2011-04-14 12:24:55 98344 ----a-w- C:\Windows\System32\drivers\btwaudio.sys
2011-04-14 12:24:55 35104 ----a-w- C:\Windows\System32\drivers\btwl2cap.sys
2011-04-14 12:24:55 21160 ----a-w- C:\Windows\System32\drivers\btwrchid.sys
2011-04-14 12:24:55 132648 ----a-w- C:\Windows\System32\drivers\btwavdt.sys
2011-04-14 12:24:48 -------- d-----w- C:\Program Files\WIDCOMM
2011-04-14 12:23:24 521448 ----a-w- C:\Windows\System32\deployJava1.dll
2011-04-14 12:23:16 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-04-14 12:23:07 -------- d-----w- C:\Program Files\Dell Inc
2011-04-14 12:23:05 -------- d-sh--w- C:\Windows\Installer
2011-04-12 19:38:59 -------- d-----w- C:\Music
2011-04-11 14:27:13 -------- d-----w- C:\backup
2011-04-11 14:24:52 -------- d-----w- C:\Program Files\Synaptics
2011-04-11 14:21:56 1975296 ----a-w- C:\Windows\System32\CertEnroll.dll
2011-04-11 14:17:44 787456 ----a-w- C:\Windows\System32\NETw5c64.dll
2011-04-11 14:16:57 540696 ----a-w- C:\Windows\System32\drivers\iaStor.sys
2011-04-11 14:15:36 -------- d-----w- C:\hotfix
2011-04-11 14:15:05 -------- d-----w- C:\Windows\System32\oem
2011-04-11 14:15:04 -------- d-----w- C:\Windows\Panther
2011-04-11 14:15:04 -------- d-----w- C:\Drivers
2011-04-11 14:11:08 -------- d-----w- C:\dell
.
==================== Find3M ====================
.
2011-04-14 16:06:21 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-04-14 16:06:21 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-04-14 16:06:21 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-04-14 16:06:21 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2011-04-11 14:21:56 1320960 ----a-w- C:\Windows\SysWow64\CertEnroll.dll
2011-03-11 06:23:13 187264 ----a-w- C:\Windows\System32\drivers\storport.sys
2011-03-11 06:23:06 166272 ----a-w- C:\Windows\System32\drivers\nvstor.sys
2011-03-11 06:23:06 1657216 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2011-03-11 06:23:06 148352 ----a-w- C:\Windows\System32\drivers\nvraid.sys
2011-03-11 06:23:00 410496 ----a-w- C:\Windows\System32\drivers\iaStorV.sys
2011-03-11 06:22:41 107904 ----a-w- C:\Windows\System32\drivers\amdsata.sys
2011-03-11 06:22:40 27008 ----a-w- C:\Windows\System32\drivers\amdxata.sys
2011-03-11 06:19:26 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
2011-03-11 06:18:20 2566144 ----a-w- C:\Windows\System32\esent.dll
2011-03-11 06:15:54 96768 ----a-w- C:\Windows\System32\fsutil.exe
2011-03-11 05:40:24 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
2011-03-11 05:40:24 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
2011-03-11 05:39:35 1686016 ----a-w- C:\Windows\SysWow64\esent.dll
2011-03-11 05:37:34 74240 ----a-w- C:\Windows\SysWow64\fsutil.exe
2011-03-08 06:14:30 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2011-03-08 05:38:13 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2011-03-07 02:08:13 93552 ----a-w- C:\Windows\SysWow64\ElbyCDIO.dll
2011-03-07 00:52:09 134512 ----a-w- C:\Windows\SysWow64\ElbyVCD.dll
2011-03-04 06:17:25 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2011-03-04 06:17:24 347648 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2011-03-03 06:17:10 182272 ----a-w- C:\Windows\System32\dnsrslvr.dll
2011-03-03 06:14:38 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe
2011-03-03 05:27:30 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe
2011-03-03 03:58:32 3133440 ----a-w- C:\Windows\System32\win32k.sys
2011-02-24 06:29:15 1197056 ----a-w- C:\Windows\System32\wininet.dll
2011-02-24 06:24:57 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2011-02-24 05:32:44 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-02-24 05:30:16 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2011-02-24 05:05:13 482816 ----a-w- C:\Windows\System32\html.iec
2011-02-24 04:24:04 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-02-24 04:23:48 386048 ----a-w- C:\Windows\SysWow64\html.iec
2011-02-24 03:50:26 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-02-23 05:16:28 461312 ----a-w- C:\Windows\System32\drivers\srv.sys
2011-02-23 05:16:01 401920 ----a-w- C:\Windows\System32\drivers\srv2.sys
2011-02-23 05:15:50 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2011-02-23 05:15:27 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2011-02-23 05:15:14 286720 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-02-23 05:15:13 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2011-02-23 05:15:06 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
2011-02-19 06:36:13 46080 ----a-w- C:\Windows\System32\atmlib.dll
2011-02-19 05:32:08 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2011-02-19 04:13:39 367104 ----a-w- C:\Windows\System32\atmfd.dll
2011-02-19 03:37:02 294912 ----a-w- C:\Windows\SysWow64\atmfd.dll
2011-02-18 20:36:58 51712 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys
2011-02-18 20:36:58 4184352 ----a-w- C:\Windows\System32\usbaaplrc.dll
2011-02-18 06:37:05 612352 ----a-w- C:\Windows\System32\vbscript.dll
2011-02-18 06:33:50 31232 ----a-w- C:\Windows\System32\prevhost.exe
2011-02-18 05:36:26 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
2011-02-18 05:33:29 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2011-02-12 06:14:41 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2011-02-05 12:41:43 556928 ----a-w- C:\Windows\System32\winresume.efi
2011-02-05 12:41:35 640896 ----a-w- C:\Windows\System32\winload.efi
2011-02-05 12:41:24 20352 ----a-w- C:\Windows\System32\kdusb.dll
2011-02-05 12:41:24 19328 ----a-w- C:\Windows\System32\kd1394.dll
2011-02-05 12:41:23 17792 ----a-w- C:\Windows\System32\kdcom.dll
2011-02-05 12:39:21 603976 ----a-w- C:\Windows\System32\winload.exe
2011-02-05 12:39:21 518160 ----a-w- C:\Windows\System32\winresume.exe
.
============= FINISH: 3:15:45.60 ===============

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following


• Log from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Since i posted this, i have not used mozilla. I just tried out google on mozilla, and didn't encounter the problem. I tried many times and never got redirected. I don't know if Norton picked it up or what, but i don't seem to have a problem right now.

If i encounter the problem again in the future i will re-post.

Thanks.

ok thanks for letting me know


gringo

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.