Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Random Redirects


  • This topic is locked This topic is locked
6 replies to this topic

#1 AgentFade2Black

AgentFade2Black

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:42 AM

Posted 16 March 2011 - 02:53 PM

It's a random thing; occasionally when I click a link, my browser (Chrome) sends me back a couple pages. This just started recently.


.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Sean Doonan at 15:49:38.77 on Wed 03/16/2011
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4095.2159 [GMT -4:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\MsgTranAgt64.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\Livestation\Livestation.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Windows\SysWOW64\PnkBstrA.exe
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sean Doonan\Downloads\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2304157
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
mURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
mWinlogon: Userinit=C:\Windows\SysWOW64\userinit.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
BHO: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Livestation] C:\Program Files (x86)\Livestation\Livestation.exe -startup
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
mRun: [McAfeeUpdaterUI] "C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
mRun: [P2Go_Menu] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
mRun: [ShStatEXE] "C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: C:\Users\Sean Doonan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
Trusted Zone: intuit.com\ttlc
Trusted Zone: pcpitstop.com\www
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {700EF03F-A472-4D26-8ACB-300F4D04FD96} - hxxp://www.lojackforlaptops.com/ctmweb/testoc.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll
BHO-X64: scriptproxy - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - No File
mRun-x64: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\SEANDO~1\AppData\Roaming\Mozilla\Firefox\Profiles\iydsdza2.default\
FF - prefs.js: browser.startup.homepage - hxxps://universe.chacha.com/
FF - plugin: C:\PROGRA~2\MEADCO~1\npmeadax.dll
FF - plugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Sean Doonan\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Users\Sean Doonan\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll
FF - plugin: C:\Users\Sean Doonan\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: Gmail Notifier: {44d0a1b4-9c90-4f86-ac92-8680b5d6549e} - %profile%\extensions\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: ChaCha Guide App Toolbar: chachaguidebar@chacha.com - %profile%\extensions\chachaguidebar@chacha.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\System32\drivers\Lbd.sys [2010-12-14 69152]
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-3-7 466944]
R0 SmartDefragDriver;SmartDefragDriver;C:\Windows\System32\drivers\SmartDefragDriver.sys [2010-12-13 17720]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2009-3-17 14904]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2010-12-3 1405384]
R2 McAfeeEngineService;McAfee Engine Service;C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe [2009-4-29 19720]
R2 McAfeeFramework;McAfee Framework Service;C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [2009-6-25 104000]
R2 McShield;McAfee McShield;C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe [2009-4-29 176872]
R2 McTaskManager;McAfee Task Manager;C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe [2009-4-29 62800]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2010-3-7 78992]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-1-7 378984]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe [2009-8-16 24652]
R3 itecir;ITECIR Infrared Receiver;C:\Windows\System32\drivers\itecir.sys [2010-7-13 69736]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2010-12-3 17152]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2010-3-7 120096]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETwNs64.sys [2010-8-29 7821312]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2011-3-10 155752]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-3-11 425064]
R3 VSTWinDriver6;VSTWinDriver6;C:\Windows\System32\drivers\VSTwindrvr6.sys [2008-7-4 252928]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 mpich2_smpd;MPICH2 Process Manager, Argonne National Lab;C:\Users\Sean Doonan\FAH\smpd.exe --> C:\Users\Sean Doonan\FAH\smpd.exe [?]
S3 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-9-18 297472]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-22 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2010-3-7 76696]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2009-9-15 6952960]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-25 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-2-18 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-3-7 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-03-15 07:10:40 7947600 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{26B6398C-A7B1-4EEC-8CF1-525E7C35542B}\mpengine.dll
2011-03-14 15:36:17 -------- d-----w- C:\Program Files\iPod
2011-03-14 15:36:16 -------- d-----w- C:\Program Files\iTunes
2011-03-12 02:42:50 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
2011-03-12 02:42:50 425064 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
2011-03-11 03:07:57 70760 ----a-w- C:\Windows\System32\nvapo64v.dll
2011-03-10 15:31:48 -------- d-----w- C:\Program Files (x86)\SystemRequirementsLab
2011-03-10 15:30:38 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-03-10 15:30:38 472808 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-03-07 16:48:01 -------- d-----w- C:\Program Files\Bonjour
2011-03-07 16:48:01 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-03-02 17:12:15 248320 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpfpp70v.dll
2011-03-02 17:11:32 -------- d-----w- C:\Program Files (x86)\Common Files\HP
2011-03-02 17:11:24 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2011-03-02 17:10:56 136704 ----a-w- C:\Windows\System32\hpf3l70v.dll
2011-03-02 17:10:13 -------- d-----w- C:\Program Files (x86)\HP
2011-03-02 17:08:45 -------- d-----w- C:\Program Files\HP
2011-03-02 17:08:07 642360 ----a-w- C:\Windows\System32\hpzids40.dll
2011-03-02 17:08:06 880640 ----a-w- C:\Windows\System32\hposwia_p02c.dll
2011-03-02 17:08:06 551424 ----a-w- C:\Windows\System32\hppldcoi.dll
2011-03-02 17:08:06 515072 ----a-w- C:\Windows\System32\hposc_p02a.dll
2011-03-02 17:08:06 1403904 ----a-w- C:\Windows\System32\hpost_p02c.dll
2011-02-25 13:13:41 -------- d-----w- C:\Windows\Panther
2011-02-25 06:04:01 -------- d-----w- C:\Windows\System32\SPReview
2011-02-25 06:03:45 -------- d-----w- C:\Windows\System32\EventProviders
2011-02-25 05:59:19 48976 ----a-w- C:\Windows\System32\netfxperf.dll
2011-02-25 05:59:19 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2011-02-25 05:59:10 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2011-02-25 05:59:07 5563776 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-02-25 05:59:06 59392 ----a-w- C:\Windows\System32\drivers\TsUsbFlt.sys
2011-02-25 05:59:06 12288 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2011-02-25 05:59:05 3715584 ----a-w- C:\Windows\System32\mstscax.dll
2011-02-25 05:59:05 1838080 ----a-w- C:\Windows\System32\d3d10warp.dll
2011-02-25 05:59:05 14967808 ----a-w- C:\Program Files\DVD Maker\OmdBase.dll
2011-02-25 05:59:02 3215872 ----a-w- C:\Windows\SysWow64\mstscax.dll
2011-02-25 05:59:00 1171456 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
2011-02-25 05:57:59 630272 ----a-w- C:\Windows\System32\evr.dll
2011-02-25 05:56:59 508928 ----a-w- C:\Windows\System32\DeviceCenter.dll
2011-02-25 05:55:59 72192 ----a-w- C:\Windows\System32\napdsnap.dll
2011-02-25 05:54:42 323072 ----a-w- C:\Windows\SysWow64\drvstore.dll
2011-02-25 05:54:41 257024 ----a-w- C:\Windows\SysWow64\dpx.dll
2011-02-25 05:54:28 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll
2011-02-25 05:54:28 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll
2011-02-25 05:50:00 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2011-02-25 05:50:00 524288 ----a-w- C:\Windows\System32\wmicmiplugin.dll
2011-02-25 05:50:00 1225216 ----a-w- C:\Windows\System32\wbem\wbemcore.dll
2011-02-25 05:49:36 933376 ----a-w- C:\Windows\System32\SmiEngine.dll
2011-02-25 05:49:22 199168 ----a-w- C:\Windows\System32\PkgMgr.exe
2011-02-25 05:48:09 422912 ----a-w- C:\Windows\System32\drvstore.dll
2011-02-25 05:48:09 399872 ----a-w- C:\Windows\System32\dpx.dll
2011-02-24 14:38:27 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
2011-02-24 14:38:26 321024 ----a-w- C:\Windows\System32\d3d10_1core.dll
2011-02-24 14:38:26 219136 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
2011-02-24 14:38:26 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-02-24 14:38:23 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-02-24 14:38:23 1465344 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-02-24 14:38:22 475648 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2011-02-24 14:38:21 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2011-02-22 22:27:47 -------- d-----w- C:\Users\SEANDO~1\AppData\Local\The Lord of the Rings Online
2011-02-22 22:26:16 1974616 ----a-w- C:\Windows\SysWow64\D3DCompiler_42.dll
2011-02-22 22:25:50 -------- d-----w- C:\Users\SEANDO~1\AppData\Local\ApplicationHistory
2011-02-22 22:04:28 1892184 ----a-w- C:\Windows\SysWow64\D3DX9_42.dll
2011-02-22 22:04:27 3495784 ----a-w- C:\Windows\SysWow64\d3dx9_33.dll
2011-02-18 21:36:58 51712 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys
2011-02-18 21:36:58 4184352 ----a-w- C:\Windows\System32\usbaaplrc.dll
2011-02-15 19:39:45 49536 ----a-w- C:\Windows\SysWow64\drivers\tiehdusb.sys
2011-02-15 19:39:45 11520 ----a-w- C:\Windows\SysWow64\drivers\wdmstub.sys
2011-02-15 19:39:45 -------- d-----w- C:\Program Files (x86)\Common Files\TI Shared
2011-02-15 19:39:30 17424 ----a-w- C:\Windows\SysWow64\drivers\ezusb.sys
2011-02-15 19:39:18 -------- d-----w- C:\Program Files (x86)\Common Files\Vernier Software
2011-02-15 19:37:33 -------- d-----w- C:\Program Files (x86)\Vernier Software
.
==================== Find3M ====================
.
2011-02-25 06:13:12 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-02-25 06:13:12 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-02-19 12:05:15 1139200 ----a-w- C:\Windows\System32\FntCache.dll
2011-02-19 12:04:37 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2011-02-19 12:04:17 902656 ----a-w- C:\Windows\System32\d2d1.dll
2011-02-19 06:30:51 1076736 ----a-w- C:\Windows\SysWow64\DWrite.dll
2011-02-19 06:30:50 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
2011-02-02 22:11:20 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-02-02 22:02:16 419840 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-02-02 22:02:16 413696 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-02-02 22:02:16 133632 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-02-02 22:02:16 110592 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2011-01-27 02:35:26 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
2011-01-08 01:50:14 795752 ----a-w- C:\Windows\System32\easyUpdatusAPIU64.dll
2011-01-08 01:50:08 6143080 ----a-w- C:\Windows\System32\nvcpl.dll
2011-01-08 01:49:50 3156072 ----a-w- C:\Windows\System32\nvsvc64.dll
2011-01-08 01:49:28 117864 ----a-w- C:\Windows\System32\nvmctray.dll
2011-01-08 01:49:26 313448 ----a-w- C:\Windows\System32\nvhotkey.dll
2011-01-08 01:49:26 2558568 ----a-w- C:\Windows\System32\nvsvcr.dll
2011-01-08 01:49:26 1005160 ----a-w- C:\Windows\System32\nvvsvc.exe
2011-01-07 12:14:11 46080 ----a-w- C:\Windows\System32\atmlib.dll
2011-01-07 09:51:01 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-01-07 09:20:44 366592 ----a-w- C:\Windows\System32\atmfd.dll
2011-01-07 07:45:57 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2011-01-07 06:01:22 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-01-07 05:43:36 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll
2011-01-05 10:34:00 612864 ----a-w- C:\Windows\System32\vbscript.dll
2011-01-05 06:56:24 3129344 ----a-w- C:\Windows\System32\win32k.sys
2011-01-05 05:55:55 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
2010-12-23 10:42:53 1118720 ----a-w- C:\Windows\System32\sbe.dll
2010-12-23 10:42:51 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2010-12-23 10:42:51 723968 ----a-w- C:\Windows\System32\EncDec.dll
2010-12-23 10:36:02 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
2010-12-23 05:54:18 850944 ----a-w- C:\Windows\SysWow64\sbe.dll
2010-12-23 05:54:17 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2010-12-23 05:54:17 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2010-12-23 05:50:23 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
2010-12-17 11:42:18 214016 ----a-w- C:\Windows\System32\winsrv.dll
2010-12-17 11:40:10 715776 ----a-w- C:\Windows\System32\kerberos.dll
2010-12-17 07:07:55 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll
.
============= FINISH: 15:51:12.68 ===============

BC AdBot (Login to Remove)

 


#2 Casey_boy

Casey_boy

    Bleeping physicist


  • Malware Response Team
  • 7,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:01:42 PM

Posted 21 March 2011 - 08:08 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Please take note:

  • If you have since resolved the original problem you were having, we would appreciate you letting us know.
  • If you are unable to create a log because your computer cannot start up successfully please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • If you are unable to perform the steps we have recommended please try one more time and if unsuccessful alert us of such and we will design an alternate means of obtaining the necessary information.
  • If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • Upon completing the steps below another staff member will review your topic an do their best to resolve your issues.
  • If you have already posted a DDS log, please do so again, as your situation may have changed.
  • Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


Thanks and again sorry for the delay.

Casey

If I have been helping you and I do not reply within 48hours, feel free to send me a PM.


* My Website * Am I Infected? * Malware Removal Help * If you'd like to say thanks *


#3 AgentFade2Black

AgentFade2Black
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:42 AM

Posted 21 March 2011 - 10:37 AM

I'm running Windows 7 64-bit, so no dice on the rootkit remover.


.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Sean Doonan at 11:33:53.19 on Mon 03/21/2011
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4095.2282 [GMT -4:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\MsgTranAgt64.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Livestation\Livestation.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mfeann.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
C:\Program Files (x86)\McAfee\VirusScan Enterprise\shstat.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\System32\svchost.exe -k secsvcs
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Sean Doonan\Downloads\dds (1).scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2304157
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
mURLSearchHooks: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
mWinlogon: Userinit=C:\Windows\SysWOW64\userinit.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
BHO: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: XfireXO Toolbar: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\tbXfir.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Livestation] C:\Program Files (x86)\Livestation\Livestation.exe -startup
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
mRun: [McAfeeUpdaterUI] "C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
mRun: [P2Go_Menu] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
mRun: [ShStatEXE] "C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: C:\Users\Sean Doonan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open with WordPerfect - c:\Program Files (x86)\Corel\WordPerfect Office X5\Programs\WPLauncher.hta
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
Trusted Zone: intuit.com\ttlc
Trusted Zone: pcpitstop.com\www
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {700EF03F-A472-4D26-8ACB-300F4D04FD96} - hxxp://www.lojackforlaptops.com/ctmweb/testoc.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll
BHO-X64: scriptproxy - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB-X64: {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - No File
mRun-x64: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\SEANDO~1\AppData\Roaming\Mozilla\Firefox\Profiles\iydsdza2.default\
FF - prefs.js: browser.startup.homepage - hxxps://universe.chacha.com/
FF - plugin: C:\PROGRA~2\MEADCO~1\npmeadax.dll
FF - plugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Sean Doonan\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Users\Sean Doonan\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll
FF - plugin: C:\Users\Sean Doonan\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: Gmail Notifier: {44d0a1b4-9c90-4f86-ac92-8680b5d6549e} - %profile%\extensions\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
FF - Ext: vShare Plugin: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: ChaCha Guide App Toolbar: chachaguidebar@chacha.com - %profile%\extensions\chachaguidebar@chacha.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\System32\drivers\Lbd.sys [2010-12-14 69152]
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-3-7 466944]
R0 SmartDefragDriver;SmartDefragDriver;C:\Windows\System32\drivers\SmartDefragDriver.sys [2010-12-13 17720]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-13 27136]
R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2009-3-17 14904]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2010-12-3 1405384]
R2 McAfeeEngineService;McAfee Engine Service;C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe [2009-4-29 19720]
R2 McAfeeFramework;McAfee Framework Service;C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [2009-6-25 104000]
R2 McShield;McAfee McShield;C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe [2009-4-29 176872]
R2 McTaskManager;McAfee Task Manager;C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe [2009-4-29 62800]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2010-3-7 78992]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-1-7 378984]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe [2009-8-16 24652]
R3 itecir;ITECIR Infrared Receiver;C:\Windows\System32\drivers\itecir.sys [2010-7-13 69736]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2010-12-3 17152]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2010-3-7 120096]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETwNs64.sys [2010-8-29 7821312]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2011-3-10 155752]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-3-11 425064]
R3 VSTWinDriver6;VSTWinDriver6;C:\Windows\System32\drivers\VSTwindrvr6.sys [2008-7-4 252928]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 mpich2_smpd;MPICH2 Process Manager, Argonne National Lab;C:\Users\Sean Doonan\FAH\smpd.exe --> C:\Users\Sean Doonan\FAH\smpd.exe [?]
S3 Amazon Download Agent;Amazon Download Agent;C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-9-18 297472]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2010-10-22 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2010-3-7 76696]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2009-9-15 6952960]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-25 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-2-18 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-3-7 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-03-18 11:53:55 7947600 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{F7AFF2C1-0948-4E4D-A12C-64B722CD4A13}\mpengine.dll
2011-03-14 15:36:17 -------- d-----w- C:\Program Files\iPod
2011-03-14 15:36:16 -------- d-----w- C:\Program Files\iTunes
2011-03-12 02:42:50 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
2011-03-12 02:42:50 425064 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
2011-03-11 03:07:57 70760 ----a-w- C:\Windows\System32\nvapo64v.dll
2011-03-10 15:31:48 -------- d-----w- C:\Program Files (x86)\SystemRequirementsLab
2011-03-10 15:30:38 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-03-10 15:30:38 472808 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-03-07 16:48:01 -------- d-----w- C:\Program Files\Bonjour
2011-03-07 16:48:01 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-03-02 17:12:15 248320 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpfpp70v.dll
2011-03-02 17:11:32 -------- d-----w- C:\Program Files (x86)\Common Files\HP
2011-03-02 17:11:24 -------- d-----w- C:\Program Files (x86)\Common Files\Hewlett-Packard
2011-03-02 17:10:56 136704 ----a-w- C:\Windows\System32\hpf3l70v.dll
2011-03-02 17:10:13 -------- d-----w- C:\Program Files (x86)\HP
2011-03-02 17:08:45 -------- d-----w- C:\Program Files\HP
2011-03-02 17:08:07 642360 ----a-w- C:\Windows\System32\hpzids40.dll
2011-03-02 17:08:06 880640 ----a-w- C:\Windows\System32\hposwia_p02c.dll
2011-03-02 17:08:06 551424 ----a-w- C:\Windows\System32\hppldcoi.dll
2011-03-02 17:08:06 515072 ----a-w- C:\Windows\System32\hposc_p02a.dll
2011-03-02 17:08:06 1403904 ----a-w- C:\Windows\System32\hpost_p02c.dll
2011-02-25 13:13:41 -------- d-----w- C:\Windows\Panther
2011-02-25 06:04:01 -------- d-----w- C:\Windows\System32\SPReview
2011-02-25 06:03:45 -------- d-----w- C:\Windows\System32\EventProviders
2011-02-25 05:59:19 48976 ----a-w- C:\Windows\System32\netfxperf.dll
2011-02-25 05:59:19 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2011-02-25 05:59:10 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2011-02-25 05:59:07 5563776 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-02-25 05:59:06 59392 ----a-w- C:\Windows\System32\drivers\TsUsbFlt.sys
2011-02-25 05:59:06 12288 ----a-w- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
2011-02-25 05:59:05 3715584 ----a-w- C:\Windows\System32\mstscax.dll
2011-02-25 05:59:05 1838080 ----a-w- C:\Windows\System32\d3d10warp.dll
2011-02-25 05:59:05 14967808 ----a-w- C:\Program Files\DVD Maker\OmdBase.dll
2011-02-25 05:59:02 3215872 ----a-w- C:\Windows\SysWow64\mstscax.dll
2011-02-25 05:59:00 1171456 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
2011-02-25 05:57:59 630272 ----a-w- C:\Windows\System32\evr.dll
2011-02-25 05:56:59 508928 ----a-w- C:\Windows\System32\DeviceCenter.dll
2011-02-25 05:55:59 72192 ----a-w- C:\Windows\System32\napdsnap.dll
2011-02-25 05:54:42 323072 ----a-w- C:\Windows\SysWow64\drvstore.dll
2011-02-25 05:54:41 257024 ----a-w- C:\Windows\SysWow64\dpx.dll
2011-02-25 05:54:28 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll
2011-02-25 05:54:28 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll
2011-02-25 05:50:00 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2011-02-25 05:50:00 524288 ----a-w- C:\Windows\System32\wmicmiplugin.dll
2011-02-25 05:50:00 1225216 ----a-w- C:\Windows\System32\wbem\wbemcore.dll
2011-02-25 05:49:36 933376 ----a-w- C:\Windows\System32\SmiEngine.dll
2011-02-25 05:49:22 199168 ----a-w- C:\Windows\System32\PkgMgr.exe
2011-02-25 05:48:09 422912 ----a-w- C:\Windows\System32\drvstore.dll
2011-02-25 05:48:09 399872 ----a-w- C:\Windows\System32\dpx.dll
2011-02-24 14:38:27 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
2011-02-24 14:38:26 321024 ----a-w- C:\Windows\System32\d3d10_1core.dll
2011-02-24 14:38:26 219136 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
2011-02-24 14:38:26 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-02-24 14:38:23 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-02-24 14:38:23 1465344 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-02-24 14:38:22 475648 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2011-02-24 14:38:21 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2011-02-22 22:27:47 -------- d-----w- C:\Users\SEANDO~1\AppData\Local\The Lord of the Rings Online
2011-02-22 22:26:16 1974616 ----a-w- C:\Windows\SysWow64\D3DCompiler_42.dll
2011-02-22 22:25:50 -------- d-----w- C:\Users\SEANDO~1\AppData\Local\ApplicationHistory
2011-02-22 22:04:28 1892184 ----a-w- C:\Windows\SysWow64\D3DX9_42.dll
2011-02-22 22:04:27 3495784 ----a-w- C:\Windows\SysWow64\d3dx9_33.dll
.
==================== Find3M ====================
.
2011-02-25 06:13:12 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-02-25 06:13:12 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-02-19 12:05:15 1139200 ----a-w- C:\Windows\System32\FntCache.dll
2011-02-19 12:04:37 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2011-02-19 12:04:17 902656 ----a-w- C:\Windows\System32\d2d1.dll
2011-02-19 06:30:51 1076736 ----a-w- C:\Windows\SysWow64\DWrite.dll
2011-02-19 06:30:50 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
2011-02-18 21:36:58 51712 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys
2011-02-18 21:36:58 4184352 ----a-w- C:\Windows\System32\usbaaplrc.dll
2011-02-02 22:11:20 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-02-02 22:02:16 419840 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-02-02 22:02:16 413696 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-02-02 22:02:16 133632 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-02-02 22:02:16 110592 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2011-01-27 02:35:26 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
2011-01-08 01:50:14 795752 ----a-w- C:\Windows\System32\easyUpdatusAPIU64.dll
2011-01-08 01:50:08 6143080 ----a-w- C:\Windows\System32\nvcpl.dll
2011-01-08 01:49:50 3156072 ----a-w- C:\Windows\System32\nvsvc64.dll
2011-01-08 01:49:28 117864 ----a-w- C:\Windows\System32\nvmctray.dll
2011-01-08 01:49:26 313448 ----a-w- C:\Windows\System32\nvhotkey.dll
2011-01-08 01:49:26 2558568 ----a-w- C:\Windows\System32\nvsvcr.dll
2011-01-08 01:49:26 1005160 ----a-w- C:\Windows\System32\nvvsvc.exe
2011-01-07 12:14:11 46080 ----a-w- C:\Windows\System32\atmlib.dll
2011-01-07 09:51:01 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2011-01-07 09:20:44 366592 ----a-w- C:\Windows\System32\atmfd.dll
2011-01-07 07:45:57 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2011-01-07 06:01:22 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-01-07 05:43:36 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll
2011-01-05 10:34:00 612864 ----a-w- C:\Windows\System32\vbscript.dll
2011-01-05 06:56:24 3129344 ----a-w- C:\Windows\System32\win32k.sys
2011-01-05 05:55:55 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
2010-12-23 10:42:53 1118720 ----a-w- C:\Windows\System32\sbe.dll
2010-12-23 10:42:51 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2010-12-23 10:42:51 723968 ----a-w- C:\Windows\System32\EncDec.dll
2010-12-23 10:36:02 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
2010-12-23 05:54:18 850944 ----a-w- C:\Windows\SysWow64\sbe.dll
2010-12-23 05:54:17 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2010-12-23 05:54:17 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2010-12-23 05:50:23 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
.
============= FINISH: 11:35:23.89 ===============

Attached Files



#4 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:42 PM

Posted 23 March 2011 - 01:56 AM

Hi,

Does the redirecting occur with other browsers than Chrome too?


Please download MBRCheck to your desktop.

1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log in your reply.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#5 AgentFade2Black

AgentFade2Black
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:42 AM

Posted 23 March 2011 - 07:07 AM

I only use Chrome, so I haven't checked this in other browsers.

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: ASUSTeK Computer Inc.
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: ASUSTeK Computer Inc.
System Product Name: N80Vb
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 169):
0x03062000 \SystemRoot\system32\ntoskrnl.exe
0x03019000 \SystemRoot\system32\hal.dll
0x00BB9000 \SystemRoot\system32\kdcom.dll
0x00C90000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CDF000 \SystemRoot\system32\PSHED.dll
0x00CF3000 \SystemRoot\system32\CLFS.SYS
0x00E1D000 \SystemRoot\system32\CI.dll
0x00EDD000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F81000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F90000 \SystemRoot\system32\drivers\ACPI.sys
0x00FE7000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00FF0000 \SystemRoot\system32\drivers\msisadrv.sys
0x00D51000 \SystemRoot\system32\drivers\pci.sys
0x00E00000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00D84000 \SystemRoot\System32\drivers\partmgr.sys
0x00D99000 \SystemRoot\system32\drivers\volmgr.sys
0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E0D000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00C5C000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00C68000 \SystemRoot\System32\drivers\mountmgr.sys
0x0102F000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x0114B000 \SystemRoot\system32\drivers\amdxata.sys
0x01156000 \SystemRoot\system32\drivers\fltmgr.sys
0x011A2000 \SystemRoot\system32\drivers\fileinfo.sys
0x011B6000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x01214000 \SystemRoot\System32\Drivers\Ntfs.sys
0x014D4000 \SystemRoot\System32\Drivers\msrpc.sys
0x01532000 \SystemRoot\System32\Drivers\ksecdd.sys
0x0154D000 \SystemRoot\System32\Drivers\cng.sys
0x015BF000 \SystemRoot\System32\drivers\pcw.sys
0x015D0000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x016EE000 \SystemRoot\system32\drivers\ndis.sys
0x01600000 \SystemRoot\system32\drivers\NETIO.SYS
0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x018F3000 \SystemRoot\System32\drivers\tcpip.sys
0x01AF7000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01B41000 \SystemRoot\system32\drivers\volsnap.sys
0x01B8D000 \SystemRoot\System32\Drivers\spldr.sys
0x01B95000 \SystemRoot\System32\Drivers\SmartDefragDriver.sys
0x01B9C000 \SystemRoot\System32\drivers\rdyboost.sys
0x01BD6000 \SystemRoot\System32\Drivers\mup.sys
0x01800000 \SystemRoot\system32\drivers\mfehidk.sys
0x01870000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01879000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x018B3000 \SystemRoot\system32\DRIVERS\disk.sys
0x0168B000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x018C9000 \SystemRoot\system32\drivers\cdrom.sys
0x01BE8000 \SystemRoot\System32\Drivers\Null.SYS
0x01BF1000 \SystemRoot\System32\Drivers\Beep.SYS
0x016BB000 \SystemRoot\System32\drivers\vga.sys
0x016C9000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x017E1000 \SystemRoot\System32\drivers\watchdog.sys
0x017F1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x015DA000 \SystemRoot\system32\drivers\rdpencdd.sys
0x015E3000 \SystemRoot\system32\drivers\rdprefmp.sys
0x015EC000 \SystemRoot\System32\Drivers\Msfs.SYS
0x01400000 \SystemRoot\System32\Drivers\Npfs.SYS
0x01411000 \SystemRoot\system32\drivers\mfetdik.sys
0x01424000 \SystemRoot\system32\drivers\TDI.SYS
0x01431000 \SystemRoot\system32\DRIVERS\tdx.sys
0x01453000 \SystemRoot\System32\DRIVERS\netbt.sys
0x02ECD000 \SystemRoot\system32\drivers\afd.sys
0x02F56000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x02F5F000 \SystemRoot\system32\DRIVERS\pacer.sys
0x02F85000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x02F9B000 \SystemRoot\system32\DRIVERS\netbios.sys
0x02FAA000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x02E00000 \SystemRoot\System32\drivers\truecrypt.sys
0x02E41000 \SystemRoot\system32\drivers\termdd.sys
0x02E55000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02EA6000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02EB2000 \SystemRoot\system32\drivers\mssmbios.sys
0x02EBD000 \SystemRoot\System32\drivers\discache.sys
0x02FC5000 \SystemRoot\System32\Drivers\dfsc.sys
0x02FE3000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x01498000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x0F254000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x0FEAF000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x0FEB1000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x0FFA5000 \SystemRoot\System32\drivers\dxgmms1.sys
0x0FFEB000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x04022000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x04078000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x04089000 \SystemRoot\system32\drivers\HDAudBus.sys
0x04A68000 \SystemRoot\system32\DRIVERS\NETwNs64.sys
0x051EA000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x040AD000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x04A00000 \SystemRoot\system32\drivers\1394ohci.sys
0x04A3E000 \SystemRoot\system32\drivers\sdbus.sys
0x04117000 \SystemRoot\system32\DRIVERS\rimmpx64.sys
0x0412D000 \SystemRoot\system32\DRIVERS\rimspx64.sys
0x04144000 \SystemRoot\system32\DRIVERS\rixdpx64.sys
0x0419B000 \SystemRoot\system32\drivers\i8042prt.sys
0x04A5E000 \SystemRoot\system32\DRIVERS\kbfiltr.sys
0x041B9000 \SystemRoot\system32\drivers\kbdclass.sys
0x044B6000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x0450B000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x0450D000 \SystemRoot\system32\drivers\mouclass.sys
0x0451C000 \SystemRoot\system32\DRIVERS\itecir.sys
0x0457E000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x0458B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x04590000 \SystemRoot\system32\DRIVERS\ATK64AMD.sys
0x04598000 \SystemRoot\system32\drivers\CompositeBus.sys
0x045A8000 \SystemRoot\System32\Drivers\RootMdm.sys
0x045B0000 \SystemRoot\system32\drivers\modem.sys
0x045BF000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x045D5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04400000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x0440C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x0443B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04456000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04477000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x04491000 \SystemRoot\system32\DRIVERS\RimSerial_AMD64.sys
0x04499000 \SystemRoot\system32\drivers\swenum.sys
0x0F200000 \SystemRoot\system32\drivers\ks.sys
0x0449B000 \SystemRoot\system32\DRIVERS\circlass.sys
0x041C8000 \SystemRoot\system32\drivers\umbus.sys
0x013B7000 \SystemRoot\system32\drivers\VSTwindrvr6.sys
0x03EDF000 \SystemRoot\system32\drivers\usbhub.sys
0x03F39000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x03F4E000 \SystemRoot\system32\drivers\HdAudio.sys
0x03FAA000 \SystemRoot\system32\drivers\portcls.sys
0x03E00000 \SystemRoot\system32\drivers\drmk.sys
0x03E22000 \SystemRoot\system32\drivers\ksthunk.sys
0x03E28000 \SystemRoot\system32\drivers\nvhda64v.sys
0x03E51000 \SystemRoot\system32\DRIVERS\hidir.sys
0x03E62000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x03E7B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x03E84000 \SystemRoot\system32\drivers\kbdhid.sys
0x03E92000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x03E9F000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x03EAB000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x000A0000 \SystemRoot\System32\win32k.sys
0x03EC8000 \SystemRoot\System32\drivers\Dxapi.sys
0x03FE7000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0x041DA000 \SystemRoot\system32\drivers\hidusb.sys
0x041E8000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x04000000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x04014000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00510000 \SystemRoot\System32\TSDDD.dll
0x00630000 \SystemRoot\System32\cdd.dll
0x014AE000 \SystemRoot\system32\drivers\luafv.sys
0x011CB000 \SystemRoot\system32\drivers\WudfPf.sys
0x01000000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x07232000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x07285000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x07298000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x072B0000 \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys
0x072B7000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x072C1000 \SystemRoot\system32\drivers\HTTP.sys
0x0738A000 \SystemRoot\system32\DRIVERS\bowser.sys
0x073A8000 \SystemRoot\System32\drivers\mpsdrv.sys
0x073C0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x00DAE000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x07200000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x09A43000 \SystemRoot\system32\drivers\peauth.sys
0x09AE9000 \SystemRoot\System32\Drivers\secdrv.SYS
0x09AF4000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x09B25000 \SystemRoot\System32\drivers\tcpipreg.sys
0x09B37000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0A413000 \SystemRoot\System32\DRIVERS\srv.sys
0x0A4AC000 \SystemRoot\system32\drivers\mfeapfk.sys
0x0A4C3000 \SystemRoot\system32\drivers\mfeavfk.sys
0x0A4DF000 \SystemRoot\System32\Drivers\fastfat.SYS
0x0A586000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x0A591000 \??\C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys
0x77A40000 \Windows\System32\ntdll.dll
0x47C40000 \Windows\System32\smss.exe
0xFFD60000 \Windows\System32\apisetschema.dll

Processes (total 104):
0 System Idle Process
4 System
320 C:\Windows\System32\smss.exe
460 csrss.exe
520 C:\Windows\System32\wininit.exe
536 csrss.exe
568 C:\Windows\System32\services.exe
592 C:\Windows\System32\lsass.exe
600 C:\Windows\System32\lsm.exe
704 C:\Windows\System32\svchost.exe
764 C:\Windows\System32\nvvsvc.exe
792 C:\Windows\System32\svchost.exe
860 C:\Windows\System32\svchost.exe
892 C:\Windows\System32\svchost.exe
920 C:\Windows\System32\svchost.exe
1012 C:\Windows\System32\audiodg.exe
1020 C:\Windows\System32\winlogon.exe
456 C:\Windows\System32\svchost.exe
644 C:\Windows\System32\svchost.exe
1084 C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
1144 C:\Program Files\ATKGFNEX\GFNEXSrv.exe
1168 C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
1308 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1328 C:\Windows\System32\spoolsv.exe
1340 C:\Windows\System32\nvvsvc.exe
1380 C:\Windows\System32\svchost.exe
1396 C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
1568 C:\Windows\SysWOW64\svchost.exe
1596 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1732 C:\Windows\System32\taskeng.exe
1828 C:\Windows\System32\dwm.exe
1860 C:\Windows\System32\taskhost.exe
1944 C:\Windows\explorer.exe
1980 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1988 C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
1996 C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
2004 C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
1456 C:\Windows\System32\svchost.exe
1720 C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\engineserver.exe
1904 C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
1748 C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
2084 C:\Program Files (x86)\ASUS\ATK Hotkey\MsgTranAgt64.exe
2096 C:\Program Files\Wireless Console 2\wcourier.exe
2116 C:\Program Files\P4G\BatteryLife.exe
2156 C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
2164 C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
2284 C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
2296 C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
2308 C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
2332 C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
2368 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2428 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
2452 C:\Windows\System32\mfevtps.exe
2588 C:\Windows\System32\svchost.exe
2652 C:\Program Files\Windows Sidebar\sidebar.exe
2676 C:\Program Files (x86)\Skype\Phone\Skype.exe
2756 C:\Windows\System32\svchost.exe
2776 C:\Windows\SysWOW64\PnkBstrA.exe
2844 C:\Program Files (x86)\Livestation\Livestation.exe
2920 C:\Program Files\Logitech\SetPoint\SetPoint.exe
2960 C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
3008 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
1656 C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
2256 C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
1348 C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
1204 shstat.exe
2820 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
2908 C:\Program Files (x86)\iTunes\iTunesHelper.exe
2932 C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
2864 C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe
3260 C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
3388 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
3420 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
3460 C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe
3520 mfeann.exe
3528 C:\Windows\System32\conhost.exe
3576 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
3808 unsecapp.exe
3984 naPrdMgr.exe
4052 WmiPrvSE.exe
4744 C:\Program Files (x86)\Browny02\BrYNSvc.exe
4928 C:\Windows\System32\SearchIndexer.exe
4992 C:\Program Files\iPod\bin\iPodService.exe
5052 C:\Windows\System32\svchost.exe
4688 C:\Windows\System32\svchost.exe
4824 C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
4012 C:\Windows\System32\svchost.exe
716 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
3048 C:\Windows\System32\taskhost.exe
3204 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
2868 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
4072 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
1128 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
3888 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
3956 C:\Windows\SysWOW64\rundll32.exe
3856 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
1296 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
3164 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
4008 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
1280 C:\Users\Sean Doonan\AppData\Local\Google\Chrome\Application\chrome.exe
3500 C:\Windows\System32\SearchProtocolHost.exe
4960 C:\Windows\System32\SearchFilterHost.exe
2600 C:\Users\Sean Doonan\Downloads\MBRCheck.exe
664 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`ee1af400 (NTFS)

PhysicalDrive0 Model Number: ST9250827AS, Rev: 3.AAA

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

#6 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:42 PM

Posted 23 March 2011 - 10:49 AM

Hi,

Please check with all browsers you have installed. Makes it easier to narrow problem down a bit.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.


#7 Blade81

Blade81

    Bleepin' Rocker


  • Malware Response Team
  • 6,465 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:04:42 PM

Posted 03 April 2011 - 09:33 AM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Microsoft Windows Insider MVP 2016-2017

Microsoft MVP Consumer Security 2008-2015
UNITE member since 2006
unite_blue.png

Provided malware removal related instructions are meant to be used in the correspondent user's case only. If you have similar symptoms create own topic instead of following instructions given to some other, please.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users