gwenda Posted December 21, 2011 ID:507242 Share Posted December 21, 2011 Hi,I'm having problems with the redirect virus. I had this problem a month ago and seemed to be able to get rid of it. This time, I am having trouble getting rid of it. I'll lay out the things I've done so far. I've also attached the 2 log files (attach.txt. and DDS.txt) as requested by the Forum instructions. I don't know if any of my antivirus/antimalware apps have scriptblockers; I know I was supposed to disable that; I googled all my apps to see if they were associated with scriptblockers and didn't think that any of them were (I might be wrong). Anyway, here goes a list of what I've done:First, what I already had installed were: Mcafee, Windows Defender, PrevX paid version, Malwarebytes free version, Lavasoft Adaware free version.First sign of trouble: google sites redirecting to "getanswers.com". then, yahoo search doing something similar. Next, can't run Windows Defender because "A problem caused this program's service to stop....The specified service does not exist as an installed service (Error Code: 0x80070424). I tried running it in SafeMode but I can't even find WIndows Defender then! First, I run my various programs, doesn't find much. Then I install UnHackme and run that; also doesn't find much. I then uninstall Lavasoft Adaware so that it stops interfereing with UnHackMe. Also, at some point RegRunReanimator (part of UnHackMe) can't do its initial system scan, it freezes at 36%; I was able to run that in safe mode, but it didn't find any viruses/malware in safe mode.Next I load and run the following softwares: Threatfire, tdsskiller, HitmanPro free version, Emisoft free version, SuperAntiSpyare free version. The only one that finds some bad Trojans is Emisoft (log attached).The other thing I've done is deleted temporary folder contents and temporary internet files for IE, Firefox, and Java. I also attempted to uninstall and reinstall Firefox, but firefox won't load, the icon is a generic file icon, and when I double click it says "cannot be accessed...may not have the appropriate permissions". In addition, I deleted all the "cache" contents including folders for both Firefox and Java (I went directly into the folders to do that (I am not sure if this has screwed up Firefox and Java, neither of which I can load; however, another piece of info is that Emisoft asked me if I wanted to quarantine and block the actions of a java executable file and I said yes--this could have disabled Java.)Finally, I did check my hosts IP file; everything looked normal. I'm wondering if there is something else manual I can try, but I know registry changes are dangerous so would need guidance.That is everything! Hope that was coherent, and look forward to some help. Thank you very much. -Gwenda.DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORKInternet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_21Run by Gwen at 16:35:45 on 2011-12-20Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8191.6718 [GMT -8:00].AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Program Files\SUPERAntiSpyware\SASCORE64.EXEC:\Windows\system32\mfevtps.exeC:\Program Files\Common Files\McAfee\SystemCore\mfefire.exeC:\Windows\Explorer.EXEC:\Windows\system32\ctfmon.exeC:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeC:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%smWinlogon: Userinit=userinit.exe,BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dllBHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dllBHO: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dllBHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLLBHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111203151418.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllBHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLLBHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllTB: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dllTB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllTB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileuRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimizeduRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRunuRun: [ooVoo.exe] C:\Program Files (x86)\ooVoo\oovoo.exe /minimizeduRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hiddenuRun: [Google Update] "C:\Users\Gwen\AppData\Local\Google\Update\GoogleUpdate.exe" /cuRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exemRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osbootmRun: [ThreatFire] C:\Program Files (x86)\ThreatFire\TFTray.exemRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumemRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeymRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOWmRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCentermRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /mmRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServicesmRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"StartupFolder: C:\Users\Gwen\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exemPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dllIE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllTrusted Zone: intuit.com\ttlcDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cabTCP: DhcpNameServer = 192.168.1.254TCP: Interfaces\{35CA0952-8361-4FC8-B8A2-A2E7FEC2B73E} : DhcpNameServer = 192.168.1.254Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dllFilter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLLHandler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dllHandler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dllHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllSEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLLmASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllBHO-X64: AcroIEHelperStub - No FileBHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dllBHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dllBHO-X64: Increase performance and video formats for your HTML5 <video> - No FileBHO-X64: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dllBHO-X64: ooVoo Toolbar - No FileBHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No FileBHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLLBHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111203151418.dllBHO-X64: scriptproxy - No FileBHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dllBHO-X64: SkypeIEPluginBHO - No FileBHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllBHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLLBHO-X64: URLRedirectionBHO - No FileBHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllTB-X64: ooVoo Toolbar: {59c6f12b-f004-43e5-9997-08f2123119b6} - C:\Program Files (x86)\oovootoolbar\oovootoolbarX.dllTB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllTB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FilemRun-x64: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osbootmRun-x64: [ThreatFire] C:\Program Files (x86)\ThreatFire\TFTray.exemRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottimemRun-x64: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"mRun-x64: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumemRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeymRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttraymRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOWmRun-x64: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCentermRun-x64: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2mRun-x64: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /mmRun-x64: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServicesmRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL.================= FIREFOX ===================.FF - ProfilePath - .============= SERVICES / DRIVERS ===============.R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]R0 pxscan;pxscan;C:\Windows\system32\drivers\pxscan.sys --> C:\Windows\system32\drivers\pxscan.sys [?]R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-7-18 140672]R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2011-12-3 208536]R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]R3 pxkbf;pxkbf;C:\Windows\system32\drivers\pxkbf.sys --> C:\Windows\system32\drivers\pxkbf.sys [?]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]S0 TfFsMon;TfFsMon;C:\Windows\system32\drivers\TfFsMon.sys --> C:\Windows\system32\drivers\TfFsMon.sys [?]S0 TfSysMon;TfSysMon;C:\Windows\system32\drivers\TfSysMon.sys --> C:\Windows\system32\drivers\TfSysMon.sys [?]S1 A2DDA;A2 Direct Disk Access Support Driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2011-12-12 23208]S1 a2injectiondriver;a2injectiondriver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2011-12-12 41728]S1 a2util;a-squared Malware-IDS utility driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [2011-12-12 14720]S1 pxrts;pxrts;C:\Windows\system32\drivers\pxrts.sys --> C:\Windows\system32\drivers\pxrts.sys [?]S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2010/03/10 13:47:23];C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl [2010-3-10 146928]S2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-12-12 3102856]S2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]S2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-12-13 92160]S2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]S2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]S2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 CSIScanner;CSIScanner;C:\Program Files\Prevx\prevx.exe [2011-9-10 6746280]S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]S2 gupdate1ca336debd74f66;Google Update Service (gupdate1ca336debd74f66);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-9-11 133104]S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-13 366152]S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-12-3 249936]S2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-12-3 249936]S2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-12-3 249936]S2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-12-3 249936]S2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2011-12-3 199272]S2 ThreatFire;ThreatFire;C:\Program Files (x86)\ThreatFire\TFService.exe service --> C:\Program Files (x86)\ThreatFire\TFService.exe service [?]S3 a2acc;a2acc;C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys [2011-12-12 63880]S3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]S3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]S3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\system32\DRIVERS\CtClsFlt.sys --> C:\Windows\system32\DRIVERS\CtClsFlt.sys [?]S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-9-11 133104]S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]S3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880]S3 OA002Afx;Provides a software interface to control audio effects of OA002 camera.;\??\C:\Windows\system32\Drivers\OA002Afx.sys --> C:\Windows\system32\Drivers\OA002Afx.sys [?]S3 OA002Ufd;Creative Camera OA002 Upper Filter Driver;C:\Windows\system32\DRIVERS\OA002Ufd.sys --> C:\Windows\system32\DRIVERS\OA002Ufd.sys [?]S3 OA002Vid;Creative Camera OA002 Function Driver;C:\Windows\system32\DRIVERS\OA002Vid.sys --> C:\Windows\system32\DRIVERS\OA002Vid.sys [?]S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]S3 TfNetMon;TfNetMon;\??\C:\Windows\system32\drivers\TfNetMon.sys --> C:\Windows\system32\drivers\TfNetMon.sys [?]S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?].=============== Created Last 30 ================.2011-12-19 01:02:42 924632 ----a-w- C:\Program Files (x86)\Mozilla Firefox\firefox.exe2011-12-18 21:22:54 -------- d-----w- C:\Users\Gwen\AppData\Local\ElevatedDiagnostics2011-12-12 09:06:13 -------- d-----w- C:\Users\Gwen\AppData\Roaming\SUPERAntiSpyware.com2011-12-12 09:06:00 -------- d-----w- C:\ProgramData\!SASCORE2011-12-12 09:05:54 -------- d-----w- C:\Program Files\SUPERAntiSpyware2011-12-12 09:05:53 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com2011-12-12 06:45:58 -------- d-----w- C:\Program Files (x86)\Emsisoft Anti-Malware2011-12-09 01:03:52 12872 ----a-w- C:\Windows\System32\bootdelete.exe2011-12-08 20:26:50 -------- d-----w- C:\Windows\pss2011-12-08 19:48:57 24416 ----a-w- C:\Windows\SysWow64\drivers\regguard.sys2011-12-08 19:41:41 39192 ----a-w- C:\Windows\SysWow64\Partizan.exe2011-12-08 19:41:41 35816 ----a-w- C:\Windows\SysWow64\drivers\Partizan.sys2011-12-07 18:43:28 74824 ----a-w- C:\Windows\System32\drivers\TfSysMon.sys2011-12-07 18:43:28 65072 ----a-w- C:\Windows\System32\drivers\TfFsMon.sys2011-12-07 18:43:28 41888 ----a-w- C:\Windows\System32\drivers\TfNetMon.sys2011-12-07 18:43:18 -------- d-----w- C:\ProgramData\PC Tools2011-12-07 18:43:18 -------- d-----w- C:\Program Files (x86)\ThreatFire2011-12-05 23:16:43 11776 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll2011-12-05 23:16:21 -------- d-----w- C:\Program Files (x86)\Common Files\xing shared2011-12-05 23:16:03 150696 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll2011-12-05 23:15:49 108544 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll2011-12-05 23:15:35 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll2011-12-05 23:15:35 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll2011-12-03 23:07:13 161168 ----a-w- C:\Windows\System32\mfevtps.exe2011-12-02 14:53:13 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{B967DFEA-D5F1-4815-BCB0-0C8552AEF387}\mpengine.dll2011-11-30 09:52:47 -------- d-----w- C:\Program Files (x86)\MSXML 4.02011-11-29 01:09:18 -------- d-----w- C:\Users\Gwen\AppData\Local\MicroVision Applications2011-11-29 01:00:57 -------- d-----w- C:\ProgramData\LightScribe2011-11-29 00:13:09 -------- d-----w- C:\Program Files (x86)\Nero2011-11-29 00:12:50 -------- d-----w- C:\ProgramData\Nero2011-11-28 01:45:36 -------- d-----w- C:\Users\Gwen\AppData\Local\Microsoft Games.==================== Find3M ====================.2011-12-20 20:53:08 25160 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys2011-12-14 04:45:53 62976 ----a-w- C:\Windows\SysWow64\PxSecure.dll2011-12-14 04:45:52 65736 ----a-w- C:\Windows\System32\drivers\pxrts.sys2011-12-14 04:45:52 36384 ----a-w- C:\Windows\System32\drivers\pxscan.sys2011-12-14 04:45:52 24024 ----a-w- C:\Windows\System32\drivers\pxkbf.sys2011-12-08 19:34:38 2 --shatr- C:\Windows\winstart.bat2011-12-03 06:12:52 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2011-10-20 23:26:22 94208 ----a-w- C:\Windows\SysWow64\dpl100.dll2011-10-15 21:16:16 75808 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys2011-10-15 21:16:16 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys2011-10-15 21:16:16 647080 ----a-w- C:\Windows\System32\drivers\mfehidk.sys2011-10-15 21:16:16 481768 ----a-w- C:\Windows\System32\drivers\mfefirek.sys2011-10-15 21:16:16 284648 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys2011-10-15 21:16:16 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys2011-10-15 21:16:16 160280 ----a-w- C:\Windows\System32\drivers\mfeapfk.sys2011-10-15 21:16:16 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys2011-10-15 21:16:16 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys2011-10-01 03:25:37 1638912 ----a-w- C:\Windows\System32\mshtml.tlb2011-10-01 02:42:56 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb2011-09-29 16:29:28 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys2011-09-29 04:03:32 3144704 ----a-w- C:\Windows\System32\win32k.sys.============= FINISH: 16:36:23.92 ===============Attach1.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 27, 2012 ID:521063 Share Posted January 27, 2012 Hello ,Would you advise if you have resolved your issues or if you have sought help elsewhere?If not resolved and you are not already seeking help elsewhere, I'd like for you to rerun a new DDS and Copy & Paste the DDS.txt into a new reply.Anyone other than original-poster who has similar issues, do not reply here. Start your own topic. Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 31, 2012 ID:522159 Share Posted January 31, 2012 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts