BleepingComputer.com: Google redirect + potential Botnet hijacking

Every checkbox from GMER except Services, Registry and File where greyed out.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_26
Run by Iggy at 22:30:34 on 2011-09-01
Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1033.18.6143.4486 [GMT 2:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\system32\msiexec.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\vds.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
C:\PROGRA~2\CheckPoint\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uInternet Settings,ProxyOverride = <local>;*.local
uURLSearchHooks: ZoneAlarm Extreme Security Toolbar: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll
mURLSearchHooks: ZoneAlarm Extreme Security Toolbar: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll
mWinlogon: Shell=explorer.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: ZoneAlarm Extreme Security Toolbar: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll
TB: ZoneAlarm Extreme Security Toolbar: {a94e8dc9-07aa-45a7-8af2-a0375473a5cd} - C:\Program Files (x86)\ZoneAlarm_Extreme_Security\prxtbZone.dll
TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngin.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll
{555d4d79-4bd2-4094-a395-cfc534424a05}
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Google Update] "C:\Users\Iggy\AppData\Local\Google\Update\GoogleUpdate.exe" /c
mRun: [<NO NAME>]
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
LSP: mswsock.dll
Trusted Zone: line6.net
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 212.27.40.241 212.27.40.240
TCP: Interfaces\{96C4C3F4-1CA1-4645-88B6-D8A37BF947D0} : DhcpNameServer = 192.168.42.129
TCP: Interfaces\{C806D92F-2A71-4137-8134-106149B7EF0E} : DhcpNameServer = 212.27.40.241 212.27.40.240
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}
{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{9FDDE16B-836F-4806-AB1F-1455CBEFF289}
{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}
{bf00e119-21a3-4fd1-b178-3b8537e75c92}
{d2ce3e00-f94a-4740-988e-03dc2f38c34f}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{8dcb7100-df86-4384-8842-8fa844297b3f}
{a94e8dc9-07aa-45a7-8af2-a0375473a5cd}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [(par défaut)]
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Iggy\AppData\Roaming\Mozilla\Firefox\Profiles\1mily1sn.default\
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll
FF - plugin: C:\Users\Iggy\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: C:\Users\Iggy\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 cdrblock;cdrblock;C:\Windows\system32\DRIVERS\cdrblock.sys --> C:\Windows\system32\DRIVERS\cdrblock.sys [?]
R1 kl2;kl2;C:\Windows\system32\DRIVERS\kl2.sys --> C:\Windows\system32\DRIVERS\kl2.sys [?]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-14 20992]
R2 cpuz135;cpuz135;\??\C:\Windows\system32\drivers\cpuz135_x64.sys --> C:\Windows\system32\drivers\cpuz135_x64.sys [?]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2010-12-6 2101640]
R2 ISWKL;ZoneAlarm ForceField ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2011-7-25 33672]
R2 IswSvc;ZoneAlarm ForceField IswSvc;C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe [2011-7-25 827520]
R3 COMMONFX.SYS;COMMONFX.SYS;C:\Windows\system32\drivers\COMMONFX.SYS --> C:\Windows\system32\drivers\COMMONFX.SYS [?]
R3 icsak;icsak;C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys [2011-7-25 45448]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Service Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-29 136176]
S3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\androidusb.sys --> C:\Windows\system32\Drivers\androidusb.sys [?]
S3 COMMONFX;COMMONFX;C:\Windows\system32\drivers\COMMONFX.SYS --> C:\Windows\system32\drivers\COMMONFX.SYS [?]
S3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CTAUDFX.SYS;CTAUDFX.SYS;C:\Windows\system32\drivers\CTAUDFX.SYS --> C:\Windows\system32\drivers\CTAUDFX.SYS [?]
S3 CTAUDFX;CTAUDFX;C:\Windows\system32\drivers\CTAUDFX.SYS --> C:\Windows\system32\drivers\CTAUDFX.SYS [?]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;C:\Windows\system32\drivers\CTEAPSFX.SYS --> C:\Windows\system32\drivers\CTEAPSFX.SYS [?]
S3 CTEAPSFX;CTEAPSFX;C:\Windows\system32\drivers\CTEAPSFX.SYS --> C:\Windows\system32\drivers\CTEAPSFX.SYS [?]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS;C:\Windows\system32\drivers\CTEDSPFX.SYS --> C:\Windows\system32\drivers\CTEDSPFX.SYS [?]
S3 CTEDSPFX;CTEDSPFX;C:\Windows\system32\drivers\CTEDSPFX.SYS --> C:\Windows\system32\drivers\CTEDSPFX.SYS [?]
S3 CTEDSPIO.SYS;CTEDSPIO.SYS;C:\Windows\system32\drivers\CTEDSPIO.SYS --> C:\Windows\system32\drivers\CTEDSPIO.SYS [?]
S3 CTEDSPIO;CTEDSPIO;C:\Windows\system32\drivers\CTEDSPIO.SYS --> C:\Windows\system32\drivers\CTEDSPIO.SYS [?]
S3 CTEDSPSY.SYS;CTEDSPSY.SYS;C:\Windows\system32\drivers\CTEDSPSY.SYS --> C:\Windows\system32\drivers\CTEDSPSY.SYS [?]
S3 CTEDSPSY;CTEDSPSY;C:\Windows\system32\drivers\CTEDSPSY.SYS --> C:\Windows\system32\drivers\CTEDSPSY.SYS [?]
S3 CTERFXFX.SYS;CTERFXFX.SYS;C:\Windows\system32\drivers\CTERFXFX.SYS --> C:\Windows\system32\drivers\CTERFXFX.SYS [?]
S3 CTERFXFX;CTERFXFX;C:\Windows\system32\drivers\CTERFXFX.SYS --> C:\Windows\system32\drivers\CTERFXFX.SYS [?]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 CTSBLFX.SYS;CTSBLFX.SYS;C:\Windows\system32\drivers\CTSBLFX.SYS --> C:\Windows\system32\drivers\CTSBLFX.SYS [?]
S3 CTSBLFX;CTSBLFX;C:\Windows\system32\drivers\CTSBLFX.SYS --> C:\Windows\system32\drivers\CTSBLFX.SYS [?]
S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2010-11-15 14216]
S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2010-11-15 8456]
S3 fssfltr;FssFltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 GenericMount;Generic Mount Driver;C:\Windows\system32\DRIVERS\GenericMount.sys --> C:\Windows\system32\DRIVERS\GenericMount.sys [?]
S3 gupdatem;Service Google Update (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-29 136176]
S3 L6PODLV;PODxt Live Service;C:\Windows\system32\Drivers\L6PODLV64.sys --> C:\Windows\system32\Drivers\L6PODLV64.sys [?]
S3 L6PODX3;L6 POD X3 Service;C:\Windows\system32\Drivers\L6PODX364.sys --> C:\Windows\system32\Drivers\L6PODX364.sys [?]
S3 L6PODX3Pro;POD X3 Pro Service;C:\Windows\system32\Drivers\L6PODX3Pro64.sys --> C:\Windows\system32\Drivers\L6PODX3Pro64.sys [?]
S3 PPJoyBus;Parallel Port Joystick Bus Enumerator;C:\Windows\system32\DRIVERS\PPJoyBus64.sys --> C:\Windows\system32\DRIVERS\PPJoyBus64.sys [?]
S3 PPortJoystick;Parallel Port Joystick Device Driver;C:\Windows\system32\DRIVERS\PPortJoy64.sys --> C:\Windows\system32\DRIVERS\PPortJoy64.sys [?]
S3 qcusbser;ACER USB Device for Legacy Serial Communication;C:\Windows\system32\DRIVERS\qcusbser.sys --> C:\Windows\system32\DRIVERS\qcusbser.sys [?]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-09-01 14:48:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{7A38FF28-51E1-48C1-8785-257279F57C23}
2011-09-01 14:48:07 -------- d-----w- C:\Users\Iggy\AppData\Local\{61AE1259-CCF4-4F6C-86B8-3D2BD95B946A}
2011-09-01 13:19:43 -------- d-----w- C:\ProgramData\Kaspersky SDK
2011-09-01 13:19:02 -------- d-----w- C:\Users\Iggy\AppData\Roaming\Wireshark
2011-09-01 13:18:32 -------- d-----w- C:\Users\Iggy\AppData\Roaming\MailFrontier
2011-09-01 13:17:20 -------- d-----w- C:\Program Files (x86)\WinPcap
2011-09-01 13:16:51 -------- d-----w- C:\Program Files\Wireshark
2011-09-01 13:14:36 -------- d-----w- C:\Users\Iggy\AppData\Roaming\CheckPoint
2011-09-01 13:14:28 -------- d-----w- C:\Program Files (x86)\Conduit
2011-09-01 13:14:27 0 ----a-w- C:\Windows\SysWow64\ConduitEngine.tmp
2011-09-01 13:14:27 -------- d-----w- C:\Program Files (x86)\ConduitEngine
2011-09-01 13:14:26 -------- d-----w- C:\Users\Iggy\AppData\Local\Conduit
2011-09-01 13:14:25 -------- d-----w- C:\Program Files (x86)\ZoneAlarm_Extreme_Security
2011-09-01 13:13:55 -------- d-----w- C:\Program Files\CheckPoint
2011-09-01 13:13:29 -------- d-----w- C:\ProgramData\CheckPoint
2011-09-01 13:13:21 374664 ----a-w- C:\Windows\System32\drivers\netio.sys
2011-09-01 12:59:16 -------- d-----w- C:\Program Files (x86)\CheckPoint
2011-09-01 12:18:09 476904 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-09-01 12:18:09 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-09-01 02:47:16 -------- d-----w- C:\Users\Iggy\AppData\Local\{446329EF-D92F-40B8-9031-789AF2D7627D}
2011-08-31 14:46:35 -------- d-----w- C:\Users\Iggy\AppData\Local\{1DA8C788-11CE-46A7-B152-B86218BE96D8}
2011-08-31 02:46:08 -------- d-----w- C:\Users\Iggy\AppData\Local\{F1BE1123-DCD7-41B0-9F29-0460C2435319}
2011-08-30 14:45:43 -------- d-----w- C:\Users\Iggy\AppData\Local\{A4A964A0-FDF2-47BB-96DB-EAFC6DDB14FD}
2011-08-30 02:45:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{46CF1734-6B6F-458F-AC26-F97A65CEC922}
2011-08-30 02:45:06 -------- d-----w- C:\Users\Iggy\AppData\Local\{1A0F57AD-24E3-4157-9A37-E3C756D5B3E7}
2011-08-29 14:44:40 -------- d-----w- C:\Users\Iggy\AppData\Local\{CC4283C4-FCDD-4C11-9A37-11B2EB2CAD4E}
2011-08-29 14:44:27 -------- d-----w- C:\Users\Iggy\AppData\Local\{53A8D8ED-8E04-44D8-B9D1-CF7488054A59}
2011-08-29 02:44:13 -------- d-----w- C:\Users\Iggy\AppData\Local\{01E61D62-C4F1-4830-99FC-80A4D38E2826}
2011-08-29 02:44:02 -------- d-----w- C:\Users\Iggy\AppData\Local\{FF3663E9-6BB1-41AF-821E-43C2A86AA2C5}
2011-08-28 14:43:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{8FC39479-C92F-4213-B9E8-E39365EEA7AD}
2011-08-28 14:43:06 -------- d-----w- C:\Users\Iggy\AppData\Local\{6785B665-E160-477E-A0DF-BE5C268E7017}
2011-08-28 14:16:39 -------- d-----we C:\Windows\system64
2011-08-28 02:23:01 -------- d-----w- C:\Users\Iggy\AppData\Local\{F5DC416B-E088-43C0-A28D-9A0DB28C396D}
2011-08-28 02:22:48 -------- d-----w- C:\Users\Iggy\AppData\Local\{8F320AC5-DC14-4333-B5A8-D152C67E045A}
2011-08-27 14:22:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{A61943C7-CD34-49EA-9F41-DC36FDDE3095}
2011-08-27 14:22:09 -------- d-----w- C:\Users\Iggy\AppData\Local\{19AF655D-CD2C-458D-BF72-E1A30DA412AB}
2011-08-27 02:21:55 -------- d-----w- C:\Users\Iggy\AppData\Local\{0581A323-45D9-46B3-A441-2421F8B26A15}
2011-08-27 02:21:43 -------- d-----w- C:\Users\Iggy\AppData\Local\{781997A6-BD5D-4D4A-A2E7-B2FA2EA2C2BE}
2011-08-26 14:21:30 -------- d-----w- C:\Users\Iggy\AppData\Local\{B5C29BED-9C08-4AA2-8E6D-D7991F854A52}
2011-08-26 14:21:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{3A9F71CE-E8D4-4F10-9C65-473B1930C487}
2011-08-26 02:21:04 -------- d-----w- C:\Users\Iggy\AppData\Local\{6BA90C12-B07F-4794-98C8-BC880AF310FB}
2011-08-26 02:20:52 -------- d-----w- C:\Users\Iggy\AppData\Local\{0DE885EA-C447-44DB-94B7-251AE204E8E6}
2011-08-25 14:20:14 -------- d-----w- C:\Users\Iggy\AppData\Local\{31A809F1-CA06-4D27-8951-362FDFABE933}
2011-08-25 14:19:59 -------- d-----w- C:\Users\Iggy\AppData\Local\{51323413-1B57-4710-970A-197E0B1A258E}
2011-08-24 22:44:59 -------- d-----w- C:\Users\Iggy\AppData\Local\{AB0DB6A9-4268-496B-9210-9C2D3EA196AB}
2011-08-24 22:44:44 -------- d-----w- C:\Users\Iggy\AppData\Local\{4CF24F3D-9C15-44B8-841A-C8D410649FCC}
2011-08-24 10:44:30 -------- d-----w- C:\Users\Iggy\AppData\Local\{04021EB5-1F1B-4D1D-B007-667B9AD5CFFB}
2011-08-24 10:44:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{0FB7A374-6A58-4F41-8FEB-A92A78E641B0}
2011-08-23 22:44:04 -------- d-----w- C:\Users\Iggy\AppData\Local\{B9973D24-1019-46D1-80BF-46F9A43D03FF}
2011-08-23 22:43:52 -------- d-----w- C:\Users\Iggy\AppData\Local\{1244AA45-E647-459E-8778-BF02037233FF}
2011-08-23 10:43:29 -------- d-----w- C:\Users\Iggy\AppData\Local\{059B54C1-8591-4A6B-8136-6C9201F9A242}
2011-08-23 10:43:12 -------- d-----w- C:\Users\Iggy\AppData\Local\{21F34A6E-42F0-45C8-8C86-70A9739230F8}
2011-08-22 22:42:57 -------- d-----w- C:\Users\Iggy\AppData\Local\{4CB5EEAF-C84A-4146-90C8-407F62C2E618}
2011-08-22 22:42:44 -------- d-----w- C:\Users\Iggy\AppData\Local\{13A1666E-E7D4-4DF5-89F2-0230B7771C3C}
2011-08-22 10:42:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{0C7274AD-FC7C-46E4-8530-4B1141586ABD}
2011-08-22 10:42:03 -------- d-----w- C:\Users\Iggy\AppData\Local\{2FDAA044-54E8-4A73-B664-9504EA93F119}
2011-08-21 22:40:34 -------- d-----w- C:\Users\Iggy\AppData\Local\{1AEAA774-BF53-4F1F-92C9-99982BDB97E0}
2011-08-21 22:39:39 -------- d-----w- C:\Users\Iggy\AppData\Local\{9F80F57B-F0D5-40F5-86C1-E8D22E5E3A93}
2011-08-21 10:38:29 -------- d-----w- C:\Users\Iggy\AppData\Local\{A593BD72-F037-478E-BC6D-2412BB0ACD65}
2011-08-20 22:37:52 -------- d-----w- C:\Users\Iggy\AppData\Local\{7FC75B98-1791-49CC-8178-50A81102BE18}
2011-08-20 10:37:12 -------- d-----w- C:\Users\Iggy\AppData\Local\{1DD54A45-15BC-4716-889A-9A7361E7BA47}
2011-08-20 10:36:48 -------- d-----w- C:\Users\Iggy\AppData\Local\{CF897D90-2EB9-4909-94E5-204512B40D0F}
2011-08-20 00:43:26 -------- d-----w- C:\ProgramData\RedGiant
2011-08-19 22:36:13 -------- d-----w- C:\Users\Iggy\AppData\Local\{1C6C8E73-7F2A-4D26-9A9D-8F6CB6743E58}
2011-08-19 10:35:26 -------- d-----w- C:\Users\Iggy\AppData\Local\{9CE625E5-BF83-408D-B721-B0E394D3E793}
2011-08-18 22:34:45 -------- d-----w- C:\Users\Iggy\AppData\Local\{02E35527-A855-4B9D-9B59-4CB8683E4AFB}
2011-08-18 22:34:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{E4ED9623-2691-4100-8CF5-2F5D575AE73B}
2011-08-18 10:33:50 -------- d-----w- C:\Users\Iggy\AppData\Local\{B22C7A35-4792-4E0E-A578-27E9FFD91B4A}
2011-08-18 10:33:26 -------- d-----w- C:\Users\Iggy\AppData\Local\{620A424F-83D7-4E20-8DB5-929C72013B03}
2011-08-17 22:33:11 -------- d-----w- C:\Users\Iggy\AppData\Local\{C76B3D3E-479A-4892-9014-E6517F69CCC6}
2011-08-17 22:32:57 -------- d-----w- C:\Users\Iggy\AppData\Local\{014B954B-5CF7-47A4-88AE-7B4C4BC8FC22}
2011-08-17 21:49:29 -------- d-----r- C:\Program Files (x86)\Skype
2011-08-17 10:32:26 -------- d-----w- C:\Users\Iggy\AppData\Local\{16D7FFE6-D370-4EAD-B954-A132699DA033}
2011-08-17 10:32:10 -------- d-----w- C:\Users\Iggy\AppData\Local\{AEBB35E4-273A-4C3C-82E0-6C703E5ED63B}
2011-08-16 22:03:50 -------- d-----w- C:\Users\Iggy\AppData\Local\{5174417D-A0B8-49B9-B885-59511A17CAB2}
2011-08-16 22:03:32 -------- d-----w- C:\Users\Iggy\AppData\Local\{C2E5CFF5-8B18-45D3-A7E2-92DCF46C385B}
2011-08-16 10:03:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{11FFCBD9-7083-4EBC-AEEB-D88770166FBA}
2011-08-16 10:03:05 -------- d-----w- C:\Users\Iggy\AppData\Local\{37142CD2-216B-4FEA-8C7F-99648CCF02B9}
2011-08-15 23:35:36 -------- d-----w- C:\Users\Iggy\AppData\Roaming\avidemux
2011-08-15 23:35:24 -------- d-----w- C:\Program Files\Avidemux 2.5
2011-08-15 18:58:43 -------- d-----w- C:\Users\Iggy\AppData\Local\{467D55A5-284C-4024-85FF-1B798AD7D378}
2011-08-15 18:58:26 -------- d-----w- C:\Users\Iggy\AppData\Local\{D590AE25-82A4-4BEB-88A8-98178D84F9D6}
2011-08-15 06:58:12 -------- d-----w- C:\Users\Iggy\AppData\Local\{E7F3A4BF-EBF3-454B-86B1-00627A16996F}
2011-08-15 06:58:00 -------- d-----w- C:\Users\Iggy\AppData\Local\{01804400-4018-4EAF-9928-121C44287609}
2011-08-14 18:57:45 -------- d-----w- C:\Users\Iggy\AppData\Local\{FCB47605-C75D-42C1-BAE4-741A8EFF7437}
2011-08-14 18:57:33 -------- d-----w- C:\Users\Iggy\AppData\Local\{EB0DC007-0E38-47EC-BA3D-56483CDD9C6F}
2011-08-14 10:51:41 -------- d-----w- C:\Program Files (x86)\JDownloader
2011-08-14 06:57:20 -------- d-----w- C:\Users\Iggy\AppData\Local\{708F5E54-D7FB-4B3F-B0F2-6B36FA1ECBDE}
2011-08-14 06:57:08 -------- d-----w- C:\Users\Iggy\AppData\Local\{303FFFD2-7316-4B28-A810-E34CDABFF45C}
2011-08-13 18:56:36 -------- d-----w- C:\Users\Iggy\AppData\Local\{5B7826D1-D775-4653-8BA7-431A7200021E}
2011-08-13 18:56:22 -------- d-----w- C:\Users\Iggy\AppData\Local\{B59458D8-C98C-4D24-AA37-2EB936273C60}
2011-08-07 09:37:41 -------- d-----w- C:\Users\Iggy\AppData\Local\{97047CCE-7908-4BCE-8778-DF5C09E1F9C8}
2011-08-07 09:37:29 -------- d-----w- C:\Users\Iggy\AppData\Local\{91119C71-B761-4ABC-9E7B-9C6F8CB281C1}
2011-08-07 09:30:39 -------- d-----w- C:\Windows\fr
2011-08-07 09:27:08 2983424 ----a-w- C:\Windows\SysWow64\UIRibbon.dll
2011-08-07 09:27:08 1164800 ----a-w- C:\Windows\SysWow64\UIRibbonRes.dll
2011-08-07 09:27:08 1164800 ----a-w- C:\Windows\System32\UIRibbonRes.dll
2011-08-07 09:27:07 3860992 ----a-w- C:\Windows\System32\UIRibbon.dll
2011-08-07 09:26:35 257024 ----a-w- C:\Windows\System32\mfreadwrite.dll
2011-08-07 09:26:35 206848 ----a-w- C:\Windows\System32\mfps.dll
2011-08-07 09:26:35 196608 ----a-w- C:\Windows\SysWow64\mfreadwrite.dll
2011-08-07 09:26:34 4068864 ----a-w- C:\Windows\System32\mf.dll
2011-08-07 09:26:34 3181568 ----a-w- C:\Windows\SysWow64\mf.dll
2011-08-07 09:26:34 1888256 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2011-08-07 09:26:34 1619456 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2011-08-07 09:25:39 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\f8e13e981cc54e303\MeshBetaRemover.exe
2011-08-03 21:14:41 -------- d-----w- C:\Program Files (x86)\Digieffects
2011-08-03 19:16:31 -------- d-----w- C:\Users\Iggy\.nuke
2011-08-03 19:12:46 -------- d-----w- C:\Users\Iggy\AppData\Local\cache
2011-08-03 19:10:25 -------- d-----w- C:\Program Files (x86)\The Foundry
2011-08-03 19:10:25 -------- d-----w- C:\Program Files (x86)\Nuke6.2v1
2011-08-03 12:28:05 10438568 ----a-r- C:\Users\Iggy\AppData\Roaming\Microsoft\Installer\{8DC485D5-AB09-489F-8D8B-7A229F595F33}\PhotoSceneEditor.exe
2011-08-03 12:28:05 -------- d-----w- C:\Users\Iggy\AppData\Roaming\Autodesk
2011-08-03 12:28:04 -------- d-----w- C:\Program Files (x86)\Autodesk
.
==================== Find3M ====================
.
2011-08-30 22:39:33 176 ----a-w- C:\Windows\SysWow64\msvcsv60.dll
2011-07-24 20:58:15 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-06 17:52:42 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-06 17:52:42 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-06-29 06:46:50 4752896 ----a-w- C:\Windows\System32\PhotoLooksRenderer_x64.dll
2011-06-29 06:46:50 4070912 ----a-w- C:\Windows\SysWow64\PhotoLooksRenderer.dll
2011-06-29 06:42:02 4130816 ----a-w- C:\Windows\SysWow64\LS3Renderer.dll
2011-06-29 06:31:34 4841472 ----a-w- C:\Windows\System32\LS3Renderer_x64.dll
2011-06-29 05:58:06 4173824 ----a-w- C:\Windows\System32\CosmoRenderer_x64.dll
2011-06-29 05:45:42 4761088 ----a-w- C:\Windows\System32\ColoristaRenderer_x64.dll
2011-06-25 10:15:42 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-06-25 10:15:42 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-06-25 10:15:42 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-06-25 10:15:42 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2006-05-03 09:06:54 163328 --sh--r- C:\Windows\SysWOW64\flvDX.dll
2007-02-21 10:47:16 31232 --sh--r- C:\Windows\SysWOW64\msfDX.dll
2008-03-16 12:30:52 216064 --sh--r- C:\Windows\SysWOW64\nbDX.dll
.
============= FINISH: 22:32:35,04 ===============

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/417055 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

Hello again!

Topic has been reopened per members request

This post has been edited by rigel: 20 September 2011 - 08:52 AM

Thanks for reopening. So here an update of what happened in the meantime:

-After rebooting I got a "C0000135 %HS is missing" error BSOD happening just before the login screen display (happened in every mode, safe, prompt command...), the error is usually caused by an AVG faulty update apparently but I have no AVG so I dug down a bit and found this article which fixed the BSOD.

Basically right now I'm running on a fresh W7 x64 install on one hard drive and the faulty one on a second so it's easier for me to see what's wrong and what's not. Now, it's impossible for me to connect to whichever network, no internet, no IPs whether via ethernet/wifi on my broadband connection or via mobile phone tethering, of course all this doesn't occurs on the fresh install. Yesterday I ran a Kaspersky virus search on the computer from the clean install, you can get the results in the kaspersky.png attached picture. I redid a dds.scr right now (gmer on x64 doesn't run properly) so you can get the updated situation :

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_26
Run by Iggy at 15:55:55 on 2011-09-20
Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1033.18.6143.4555 [GMT 2:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Windows\system32\taskhost.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\vds.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Users\Iggy\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uInternet Settings,ProxyOverride = <local>;*.local
uURLSearchHooks: H - No File
mWinlogon: Shell=explorer.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
TB: {A94E8DC9-07AA-45A7-8AF2-A0375473A5CD} - No File
{555d4d79-4bd2-4094-a395-cfc534424a05}
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Google Update] "C:\Users\Iggy\AppData\Local\Google\Update\GoogleUpdate.exe" /c
mRun: [<NO NAME>]
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [ZoneAlarm Installer] "C:\Program Files (x86)\CheckPoint\Install\Launcher.exe" "C:\Program Files (x86)\CheckPoint\Install\Install.exe" /r download /w
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
Trusted Zone: line6.net
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 212.27.40.241 212.27.40.240
TCP: Interfaces\{96C4C3F4-1CA1-4645-88B6-D8A37BF947D0} : DhcpNameServer = 192.168.42.129
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{9FDDE16B-836F-4806-AB1F-1455CBEFF289}
{bf00e119-21a3-4fd1-b178-3b8537e75c92}
{d2ce3e00-f94a-4740-988e-03dc2f38c34f}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{8dcb7100-df86-4384-8842-8fa844297b3f}
TB-X64: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
TB-X64: {A94E8DC9-07AA-45A7-8AF2-A0375473A5CD} - No File
EB-X64: {555D4D79-4BD2-4094-A395-CFC534424A05} - No File
mRun-x64: [(par défaut)]
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [ZoneAlarm Installer] "C:\Program Files (x86)\CheckPoint\Install\Launcher.exe" "C:\Program Files (x86)\CheckPoint\Install\Install.exe" /r download /w
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Iggy\AppData\Roaming\Mozilla\Firefox\Profiles\1mily1sn.default\
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2156.0\npwinext.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Iggy\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: C:\Users\Iggy\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 cdrblock;cdrblock;C:\Windows\system32\DRIVERS\cdrblock.sys --> C:\Windows\system32\DRIVERS\cdrblock.sys [?]
R2 cpuz135;cpuz135;\??\C:\Windows\system32\drivers\cpuz135_x64.sys --> C:\Windows\system32\drivers\cpuz135_x64.sys [?]
R3 COMMONFX.SYS;COMMONFX.SYS;C:\Windows\system32\drivers\COMMONFX.SYS --> C:\Windows\system32\drivers\COMMONFX.SYS [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Service Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-29 136176]
S3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\androidusb.sys --> C:\Windows\system32\Drivers\androidusb.sys [?]
S3 COMMONFX;COMMONFX;C:\Windows\system32\drivers\COMMONFX.SYS --> C:\Windows\system32\drivers\COMMONFX.SYS [?]
S3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CTAUDFX.SYS;CTAUDFX.SYS;C:\Windows\system32\drivers\CTAUDFX.SYS --> C:\Windows\system32\drivers\CTAUDFX.SYS [?]
S3 CTAUDFX;CTAUDFX;C:\Windows\system32\drivers\CTAUDFX.SYS --> C:\Windows\system32\drivers\CTAUDFX.SYS [?]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;C:\Windows\system32\drivers\CTEAPSFX.SYS --> C:\Windows\system32\drivers\CTEAPSFX.SYS [?]
S3 CTEAPSFX;CTEAPSFX;C:\Windows\system32\drivers\CTEAPSFX.SYS --> C:\Windows\system32\drivers\CTEAPSFX.SYS [?]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS;C:\Windows\system32\drivers\CTEDSPFX.SYS --> C:\Windows\system32\drivers\CTEDSPFX.SYS [?]
S3 CTEDSPFX;CTEDSPFX;C:\Windows\system32\drivers\CTEDSPFX.SYS --> C:\Windows\system32\drivers\CTEDSPFX.SYS [?]
S3 CTEDSPIO.SYS;CTEDSPIO.SYS;C:\Windows\system32\drivers\CTEDSPIO.SYS --> C:\Windows\system32\drivers\CTEDSPIO.SYS [?]
S3 CTEDSPIO;CTEDSPIO;C:\Windows\system32\drivers\CTEDSPIO.SYS --> C:\Windows\system32\drivers\CTEDSPIO.SYS [?]
S3 CTEDSPSY.SYS;CTEDSPSY.SYS;C:\Windows\system32\drivers\CTEDSPSY.SYS --> C:\Windows\system32\drivers\CTEDSPSY.SYS [?]
S3 CTEDSPSY;CTEDSPSY;C:\Windows\system32\drivers\CTEDSPSY.SYS --> C:\Windows\system32\drivers\CTEDSPSY.SYS [?]
S3 CTERFXFX.SYS;CTERFXFX.SYS;C:\Windows\system32\drivers\CTERFXFX.SYS --> C:\Windows\system32\drivers\CTERFXFX.SYS [?]
S3 CTERFXFX;CTERFXFX;C:\Windows\system32\drivers\CTERFXFX.SYS --> C:\Windows\system32\drivers\CTERFXFX.SYS [?]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 CTSBLFX.SYS;CTSBLFX.SYS;C:\Windows\system32\drivers\CTSBLFX.SYS --> C:\Windows\system32\drivers\CTSBLFX.SYS [?]
S3 CTSBLFX;CTSBLFX;C:\Windows\system32\drivers\CTSBLFX.SYS --> C:\Windows\system32\drivers\CTSBLFX.SYS [?]
S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2010-11-15 14216]
S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2010-11-15 8456]
S3 fssfltr;FssFltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 GenericMount;Generic Mount Driver;C:\Windows\system32\DRIVERS\GenericMount.sys --> C:\Windows\system32\DRIVERS\GenericMount.sys [?]
S3 gupdatem;Service Google Update (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-29 136176]
S3 L6PODLV;PODxt Live Service;C:\Windows\system32\Drivers\L6PODLV64.sys --> C:\Windows\system32\Drivers\L6PODLV64.sys [?]
S3 L6PODX3;L6 POD X3 Service;C:\Windows\system32\Drivers\L6PODX364.sys --> C:\Windows\system32\Drivers\L6PODX364.sys [?]
S3 L6PODX3Pro;POD X3 Pro Service;C:\Windows\system32\Drivers\L6PODX3Pro64.sys --> C:\Windows\system32\Drivers\L6PODX3Pro64.sys [?]
S3 PPJoyBus;Parallel Port Joystick Bus Enumerator;C:\Windows\system32\DRIVERS\PPJoyBus64.sys --> C:\Windows\system32\DRIVERS\PPJoyBus64.sys [?]
S3 PPortJoystick;Parallel Port Joystick Device Driver;C:\Windows\system32\DRIVERS\PPortJoy64.sys --> C:\Windows\system32\DRIVERS\PPortJoy64.sys [?]
S3 qcusbser;ACER Android USB Device for Legacy Serial Communication;C:\Windows\system32\DRIVERS\qcusbser.sys --> C:\Windows\system32\DRIVERS\qcusbser.sys [?]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-09-20 13:46:11 -------- d-----w- C:\Users\Iggy\AppData\Local\{A7FB3E17-CFA6-41FC-B36A-39D17B82F3CB}
2011-09-20 01:09:08 -------- d-----w- C:\Users\Iggy\AppData\Local\{141D1AA8-712B-41EE-9C28-15DCFA453CA8}
2011-09-20 01:03:10 -------- d-----w- C:\Program Files (x86)\CheckPoint
2011-09-20 00:59:38 -------- d-----w- C:\Users\Iggy\AppData\Local\{23658EE0-DE1A-4DDE-BE3B-00BE97537218}
2011-09-20 00:48:53 -------- d-----w- C:\Users\Iggy\AppData\Local\{D3A28DAE-5C8D-46A6-87CE-562A0C5EB3D4}
2011-09-20 00:43:17 -------- d-----w- C:\Program Files (x86)\zonealarm_extreme_security
2011-09-20 00:11:50 -------- d-----w- C:\Users\Iggy\AppData\Local\{527C6D0D-E0C0-4E9D-92A7-C6ABEB94BEE7}
2011-09-19 17:25:04 389632 ----a-w- C:\Windows\System32\winlogon.exe
2011-09-19 17:25:04 242176 ----a-w- C:\Windows\System32\vmicsvc.exe
2011-09-19 17:25:04 212864 ----a-w- C:\Windows\System32\MpSigStub.exe
2011-09-19 17:23:09 -------- d-----w- C:\Windows\System32\weird_exes
2011-09-19 17:18:29 71168 ----a-w- C:\Windows\bfsvc.exe
2011-09-19 17:18:29 2870272 ----a-w- C:\Windows\explorer.exe
2011-09-19 16:04:51 -------- d-----w- C:\Windows\weird_exes
2011-09-19 07:06:27 -------- d-sh--w- C:\Boot
2011-09-19 06:52:30 268435456 --sha-w- C:\WinPEpge.sys
2011-09-19 06:52:27 -------- d-----w- C:\$WINDOWS.~BT
2011-09-02 12:39:46 287304 ----a-w- C:\Windows\System32\drivers\TrufosAlt.sys.bak
2011-09-02 02:49:11 -------- d-----w- C:\Users\Iggy\AppData\Local\{801079CA-60D2-441B-8FAB-50DAAA5BB7D7}
2011-09-02 02:48:55 -------- d-----w- C:\Users\Iggy\AppData\Local\{39CF538C-2B8B-4904-8B11-112B78F83AB2}
2011-09-02 00:35:17 35712 ----a-w- C:\Windows\SysWow64\drivers\BlackBox.sys
2011-09-01 14:48:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{7A38FF28-51E1-48C1-8785-257279F57C23}
2011-09-01 14:48:07 -------- d-----w- C:\Users\Iggy\AppData\Local\{61AE1259-CCF4-4F6C-86B8-3D2BD95B946A}
2011-09-01 13:19:02 -------- d-----w- C:\Users\Iggy\AppData\Roaming\Wireshark
2011-09-01 13:18:32 -------- d-----w- C:\Users\Iggy\AppData\Roaming\MailFrontier
2011-09-01 13:16:51 -------- d-----w- C:\Program Files\TG2
2011-09-01 13:14:36 -------- d-----w- C:\Users\Iggy\AppData\Roaming\CheckPoint
2011-09-01 13:14:28 -------- d-----w- C:\Program Files (x86)\Conduitssss
2011-09-01 13:14:27 0 ----a-w- C:\Windows\SysWow64\ConduitEngine.tmp
2011-09-01 13:14:27 -------- d-----w- C:\Program Files (x86)\ConduitEnginessss
2011-09-01 13:14:26 -------- d-----w- C:\Users\Iggy\AppData\Local\Conduit
2011-09-01 13:13:29 -------- d-----w- C:\ProgramData\CheckPointssss
2011-09-01 13:13:21 374664 ----a-w- C:\Windows\System32\drivers\netio.sys
2011-09-01 12:59:16 -------- d-----w- C:\Program Files (x86)\CheckPointsss
2011-09-01 12:18:09 476904 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-09-01 12:18:09 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-09-01 02:47:16 -------- d-----w- C:\Users\Iggy\AppData\Local\{446329EF-D92F-40B8-9031-789AF2D7627D}
2011-08-31 14:46:35 -------- d-----w- C:\Users\Iggy\AppData\Local\{1DA8C788-11CE-46A7-B152-B86218BE96D8}
2011-08-31 02:46:08 -------- d-----w- C:\Users\Iggy\AppData\Local\{F1BE1123-DCD7-41B0-9F29-0460C2435319}
2011-08-30 14:45:43 -------- d-----w- C:\Users\Iggy\AppData\Local\{A4A964A0-FDF2-47BB-96DB-EAFC6DDB14FD}
2011-08-30 02:45:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{46CF1734-6B6F-458F-AC26-F97A65CEC922}
2011-08-30 02:45:06 -------- d-----w- C:\Users\Iggy\AppData\Local\{1A0F57AD-24E3-4157-9A37-E3C756D5B3E7}
2011-08-29 14:44:40 -------- d-----w- C:\Users\Iggy\AppData\Local\{CC4283C4-FCDD-4C11-9A37-11B2EB2CAD4E}
2011-08-29 14:44:27 -------- d-----w- C:\Users\Iggy\AppData\Local\{53A8D8ED-8E04-44D8-B9D1-CF7488054A59}
2011-08-29 02:44:13 -------- d-----w- C:\Users\Iggy\AppData\Local\{01E61D62-C4F1-4830-99FC-80A4D38E2826}
2011-08-29 02:44:02 -------- d-----w- C:\Users\Iggy\AppData\Local\{FF3663E9-6BB1-41AF-821E-43C2A86AA2C5}
2011-08-28 14:43:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{8FC39479-C92F-4213-B9E8-E39365EEA7AD}
2011-08-28 14:43:06 -------- d-----w- C:\Users\Iggy\AppData\Local\{6785B665-E160-477E-A0DF-BE5C268E7017}
2011-08-28 14:16:39 -------- d-----we C:\Windows\system64
2011-08-28 02:23:01 -------- d-----w- C:\Users\Iggy\AppData\Local\{F5DC416B-E088-43C0-A28D-9A0DB28C396D}
2011-08-28 02:22:48 -------- d-----w- C:\Users\Iggy\AppData\Local\{8F320AC5-DC14-4333-B5A8-D152C67E045A}
2011-08-27 14:22:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{A61943C7-CD34-49EA-9F41-DC36FDDE3095}
2011-08-27 14:22:09 -------- d-----w- C:\Users\Iggy\AppData\Local\{19AF655D-CD2C-458D-BF72-E1A30DA412AB}
2011-08-27 02:21:55 -------- d-----w- C:\Users\Iggy\AppData\Local\{0581A323-45D9-46B3-A441-2421F8B26A15}
2011-08-27 02:21:43 -------- d-----w- C:\Users\Iggy\AppData\Local\{781997A6-BD5D-4D4A-A2E7-B2FA2EA2C2BE}
2011-08-26 14:21:30 -------- d-----w- C:\Users\Iggy\AppData\Local\{B5C29BED-9C08-4AA2-8E6D-D7991F854A52}
2011-08-26 14:21:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{3A9F71CE-E8D4-4F10-9C65-473B1930C487}
2011-08-26 02:21:04 -------- d-----w- C:\Users\Iggy\AppData\Local\{6BA90C12-B07F-4794-98C8-BC880AF310FB}
2011-08-26 02:20:52 -------- d-----w- C:\Users\Iggy\AppData\Local\{0DE885EA-C447-44DB-94B7-251AE204E8E6}
2011-08-25 14:20:14 -------- d-----w- C:\Users\Iggy\AppData\Local\{31A809F1-CA06-4D27-8951-362FDFABE933}
2011-08-25 14:19:59 -------- d-----w- C:\Users\Iggy\AppData\Local\{51323413-1B57-4710-970A-197E0B1A258E}
2011-08-24 22:44:59 -------- d-----w- C:\Users\Iggy\AppData\Local\{AB0DB6A9-4268-496B-9210-9C2D3EA196AB}
2011-08-24 22:44:44 -------- d-----w- C:\Users\Iggy\AppData\Local\{4CF24F3D-9C15-44B8-841A-C8D410649FCC}
2011-08-24 10:44:30 -------- d-----w- C:\Users\Iggy\AppData\Local\{04021EB5-1F1B-4D1D-B007-667B9AD5CFFB}
2011-08-24 10:44:18 -------- d-----w- C:\Users\Iggy\AppData\Local\{0FB7A374-6A58-4F41-8FEB-A92A78E641B0}
2011-08-23 22:44:04 -------- d-----w- C:\Users\Iggy\AppData\Local\{B9973D24-1019-46D1-80BF-46F9A43D03FF}
2011-08-23 22:43:52 -------- d-----w- C:\Users\Iggy\AppData\Local\{1244AA45-E647-459E-8778-BF02037233FF}
2011-08-23 10:43:29 -------- d-----w- C:\Users\Iggy\AppData\Local\{059B54C1-8591-4A6B-8136-6C9201F9A242}
2011-08-23 10:43:12 -------- d-----w- C:\Users\Iggy\AppData\Local\{21F34A6E-42F0-45C8-8C86-70A9739230F8}
2011-08-22 22:42:57 -------- d-----w- C:\Users\Iggy\AppData\Local\{4CB5EEAF-C84A-4146-90C8-407F62C2E618}
2011-08-22 22:42:44 -------- d-----w- C:\Users\Iggy\AppData\Local\{13A1666E-E7D4-4DF5-89F2-0230B7771C3C}
2011-08-22 10:42:21 -------- d-----w- C:\Users\Iggy\AppData\Local\{0C7274AD-FC7C-46E4-8530-4B1141586ABD}
2011-08-22 10:42:03 -------- d-----w- C:\Users\Iggy\AppData\Local\{2FDAA044-54E8-4A73-B664-9504EA93F119}
2011-08-21 22:40:34 -------- d-----w- C:\Users\Iggy\AppData\Local\{1AEAA774-BF53-4F1F-92C9-99982BDB97E0}
2011-08-21 22:39:39 -------- d-----w- C:\Users\Iggy\AppData\Local\{9F80F57B-F0D5-40F5-86C1-E8D22E5E3A93}
.
==================== Find3M ====================
.
2011-08-30 22:39:33 176 ----a-w- C:\Windows\SysWow64\msvcsv60.dll
2011-07-24 20:58:15 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-29 06:46:50 4752896 ----a-w- C:\Windows\System32\PhotoLooksRenderer_x64.dll
2011-06-29 06:46:50 4070912 ----a-w- C:\Windows\SysWow64\PhotoLooksRenderer.dll
2011-06-29 06:42:02 4130816 ----a-w- C:\Windows\SysWow64\LS3Renderer.dll
2011-06-29 06:31:34 4841472 ----a-w- C:\Windows\System32\LS3Renderer_x64.dll
2011-06-29 05:58:06 4173824 ----a-w- C:\Windows\System32\CosmoRenderer_x64.dll
2011-06-29 05:45:42 4761088 ----a-w- C:\Windows\System32\ColoristaRenderer_x64.dll
2011-06-25 10:15:42 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-06-25 10:15:42 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-06-25 10:15:42 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-06-25 10:15:42 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2006-05-03 09:06:54 163328 --sh--r- C:\Windows\SysWOW64\flvDX.dll
2007-02-21 10:47:16 31232 --sh--r- C:\Windows\SysWOW64\msfDX.dll
2008-03-16 12:30:52 216064 --sh--r- C:\Windows\SysWOW64\nbDX.dll
.
============= FINISH: 15:56:16,43 ===============

Sorry, forgot to attach the attach.txt file

Greetings Eggehh and Welcome to the Forums,

I've taken a look at your logs and have a few suggestions before we begin. Please uninstall the "Ask" tool bar (Conduit Engine), which probably came with the ZoneAlarm package...and both of these file sharing applications:
Megaupload
uTorrent

Lastly, tell us if you use these:
LogMeIn
Unified Remote
...and if so, for what purpose? If not, please uninstall them too. When you post back, let us know that you have accomplished the above and that you are ready to continue. Thanks!

I uninstalled both of these (they are solely used for huge raw video data sharing concerning my work). The Ask toolbar came indeed with ZoneAlarm, it's deleted.

I use LogmeIn for remote usage (kind of easy to use vpn) of my computer when I need to, for example, share one of the above files to get them from another place.
Unified Remote is the computer-side application of an Android application allowing me to use my phone as a remote for music and a trackpad via wifi.

This post has been edited by Eggehh: 20 September 2011 - 09:38 AM

OK thanks...and I assume you've created strong passwords with use of the remote access programs.

It is extremely important that you DO NOT close this program until or unless you are directed to do so. Once the program is closed, it will automatically uninstall itself taking with it anything that was removed and the related report.

Please download the AVP removal tool to the desktop and double-click the executable to install it. Select your language preference, accept the agreement and click the Start button. You should see something like this:

...click the settings button...it's the small "Gear" icon just to the right of the large yellow button. Make sure the following boxes are checked:
System memory
Hidden startup objects
Disk boot sectors
Computer

...Next, click the Actions link and click the bullet item labeled "Select action". Disinfect and Delete if disinfection fails should already be checked by default...then return to the Automatic Scan tab and click the Start scanning button.

If you happen to receive a pop up during the scan which reads "File C:\whatever...is password protected, you can safely ignore them. The program will find it's own password protected files and report these during the scan. If there is a genuine malicious file that is password protected, we will deal with it manually later.

The scan will begin and you will see a progress bar and scanned objects counter. When the scan completes, the progress bar will disappear. Click the "Reports" tab icon to the far right, just under the large yellow button. Click on the "Automatic scan report" link, then click the save button. Save the report to your desktop as Scan 1. The report will be saved as a text file. Please post the contents of that report in your next reply.

Doing this right now. I'm gonna have to post back the thing from my phone to have to keep the software on so it may take a bit of time to get it right.

That's fine...no hurry. As I think back on the size of that disk, I should modify my instructions just a bit. As to the text log file, it may very well be rather large. Just scan down to the ending. You should notice that most entries will say "OK" except for the very end. Those last few lines should detail anything that was removed. Please copy that information and post it back instead of the entire log. Might be too big to upload or attach. Thanks!

Ok, Kaspersky is done. I'm very sorry but I can't copy the txt content back from the phone however. The only suspicious file it detected was the z4root Android .apk application, probably because it actually behaves as a rootkit for linux. Been checking the password protected files and all of them came from personnal rar archives. Thanks a lot.

Did you want to wait then, until you get back home...as you must still be experiencing redirects I'm certain. Have you tested this?

I cannot test these as I have no access to Internet from that Windows installation since I recovered from the BSOD. This is why I'm using my phone while being on the infected install.

Right now the problem is that there is no trace of any infections coming up from the two AV scans I did yesterday and today and the network part of Windows seems to be completely broken, preventing me from actually verifying if I have the redirections and the FTP transfert jamming.

My guess on it is that some previous scan I did (prior the the BSOD incident) managed to delete the faulty network driver that caused these problems but there is no other properly functionning network driver now.

Okay I just fixed the problem, thanks for your help.

Basically I replaced my netio.sys file from the clean install, same goes for the ethernet card driver, uninstalled all the network adaptors, reinstalled them and here we are. No more redirections, FTP transferts are now working again and no more suspect upload packets, thanks again for the time spent.

Good to know you got it sorted now.