isearch.whitesmoke.com

JaredMiles · February 3, 2012

Hello. I was using Google chrome as my default web browser and a couple of days ago I loaded up chrome and instead of getting Google I got isearch.whitesmoke.com/?isid=9860/. I have gone in and deleted in as my default search browser, but it keeps installing itself back on there. I have done virus scans, quick and full using Microsoft Security Essentials and same with malwarebytes. All of them don't find anything and was wondering if you could do anything to get rid of it?

Any help will be appreciated

Cheers

Jared

Larusso · February 3, 2012

:welcome:

Hy

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Download DDS and save it to your desktop from here or here

Double click dds to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
[*]Save both reports to your desktop and post them in your next reply

Please post in your next reply

DDS.txt

attach.txt

JaredMiles · February 3, 2012

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421

Run by Jared at 13:47:07 on 2012-02-03

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.5815.3891 [GMT 0:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Launch Manager\dsiwmis.exe

C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Acer\Acer Updater\UpdaterService.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Elantech\ETDCtrl.exe

C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Elantech\ETDCtrlHelper.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Windows\system32\igfxext.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe

C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Launch Manager\LManager.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

C:\Program Files (x86)\Launch Manager\LMworker.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\WUDFHost.exe

C:\Program Files (x86)\iTunes\iTunes.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe

C:\Windows\system32\conhost.exe

C:\Users\Jared\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://isearch.whitesmoke.com/?isid=9860

uDefault_Page_URL = hxxp://acer.msn.com

uSearch Page = hxxp://isearch.whitesmoke.com/?q={searchTerms}&babsrc=home&s=web&as=0&isid=9860

uSearch Bar = hxxp://isearch.whitesmoke.com/?q={searchTerms}&babsrc=home&s=web&as=0&isid=9860

mDefault_Page_URL = hxxp://acer.msn.com

mStart Page = hxxp://acer.msn.com

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://isearch.whitesmoke.com/?q={searchTerms}&babsrc=home&s=web&as=0&isid=9860

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: WinZip Courier BHO: {a8fb70fa-0fdf-4601-9dc4-bfa1b357204f} - C:\PROGRA~2\WINZIP~1\wzwmcie.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

uRun: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d

mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [backupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files%20(x86)/Farm%20Frenzy%202/Images/stg_drm.ocx

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files%20(x86)/Farm%20Frenzy%202/Images/armhelper.ocx

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{3DE1FAC4-B916-448F-A747-E5A362D2FC66} : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{69B69274-1755-4F24-A17D-EA5633B929CF} : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{69B69274-1755-4F24-A17D-EA5633B929CF}\244584F6D65684572623D2456475A5 : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{69B69274-1755-4F24-A17D-EA5633B929CF}\244584F6D65684572623D264347323 : DhcpNameServer = 192.168.1.254

TCP: Interfaces\{69B69274-1755-4F24-A17D-EA5633B929CF}\35B4951323334333 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{69B69274-1755-4F24-A17D-EA5633B929CF}\465667F6C6F6 : DhcpNameServer = 194.168.4.100 194.168.8.100

TCP: Interfaces\{69B69274-1755-4F24-A17D-EA5633B929CF}\7414E44434 : DhcpNameServer = 192.168.1.254

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO-X64: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO-X64: WinZip Courier BHO: {A8FB70FA-0FDF-4601-9DC4-BFA1B357204F} - C:\PROGRA~2\WINZIP~1\wzwmcie.dll

BHO-X64: WinZip Courier BHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: SweetIM Toolbar Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

BHO-X64: SWEETIE - No File

TB-X64: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d

mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [backupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k

mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [sweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe

mRunOnce-x64: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 MpKsl483d2bb6;MpKsl483d2bb6;C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5668E933-D761-4E5F-B963-A7BC9A88783A}\MpKsl483d2bb6.sys [2012-2-3 35664]

R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]

R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]

R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-8-30 321104]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2010-12-27 868896]

R2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-8-30 13336]

R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-6-28 255744]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-9-14 508264]

R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-8-30 2320920]

R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-8-30 243232]

R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys --> C:\Windows\system32\DRIVERS\ETD.sys [?]

R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys --> C:\Windows\system32\DRIVERS\Impcd.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]

R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]

R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]

R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-9-14 219496]

R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 MWLService;MyWinLocker Service;C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-5-27 305520]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-02-03 02:20:02 35664 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5668E933-D761-4E5F-B963-A7BC9A88783A}\MpKsl483d2bb6.sys

2012-02-02 23:35:22 -------- d-----w- C:\ProgramData\Arcade Lab

2012-02-02 20:42:12 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5668E933-D761-4E5F-B963-A7BC9A88783A}\offreg.dll

2012-02-02 18:39:09 8602168 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5668E933-D761-4E5F-B963-A7BC9A88783A}\mpengine.dll

2012-02-01 00:07:03 -------- d-----w- C:\Users\Jared\AppData\Local\Chromium

2012-02-01 00:05:51 -------- d-----w- C:\Users\Jared\AppData\Local\SKIDROW

2012-01-31 23:13:56 -------- d-----w- C:\Users\Jared\AppData\Roaming\Sports Interactive

2012-01-31 23:13:56 -------- d-----w- C:\Users\Jared\AppData\Local\Sports Interactive

2012-01-31 23:07:55 -------- d-----w- C:\Program Files (x86)\SEGA

2012-01-31 02:22:33 -------- d-----w- C:\Program Files (x86)\Common Files\Steam

2012-01-31 02:22:31 -------- d-----w- C:\Program Files (x86)\Steam

2012-01-31 02:06:29 526392 ----a-w- C:\Windows\System32\drivers\sptd.sys

2012-01-31 02:05:59 -------- d-----w- C:\Program Files (x86)\DAEMON Tools Pro

2012-01-31 02:05:11 -------- d-----w- C:\Users\Jared\AppData\Roaming\DAEMON Tools Pro

2012-01-31 02:05:11 -------- d-----w- C:\ProgramData\DAEMON Tools Pro

2012-01-28 23:33:38 64000 ----a-w- C:\Windows\SysWow64\steam_api.dll

2012-01-28 23:29:49 4178264 ----a-w- C:\Windows\SysWow64\d3dx9_41.dll

2012-01-28 23:24:43 -------- d-----w- C:\Users\Jared\AppData\Roaming\WinZip

2012-01-28 23:20:38 -------- d-----w- C:\Users\Jared\AppData\Local\WinZip

2012-01-28 23:19:36 -------- d-----w- C:\ProgramData\WinZipEC

2012-01-28 23:19:34 -------- d-----w- C:\Program Files (x86)\WinZip Courier

2012-01-28 23:19:33 -------- d-----w- C:\Windows\CD95F661A5C411AFB2CCABCD21A325B8.TMP

2012-01-28 22:53:40 -------- d-----w- C:\Users\Jared\Tracing

2012-01-28 22:53:32 -------- d-----w- C:\ProgramData\SweetIM

2012-01-28 22:53:32 -------- d-----w- C:\Program Files (x86)\SweetIM

2012-01-27 15:59:30 84992 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNBPP4.DLL

2012-01-19 12:40:44 -------- d-----w- C:\Users\Jared\AppData\Local\Microsoft Help

2012-01-14 16:53:04 -------- d-----w- C:\Users\Jared\AppData\Roaming\WinFF

2012-01-14 16:53:01 -------- d-----w- C:\Program Files (x86)\WinFF

2012-01-11 13:34:56 1572864 ----a-w- C:\Windows\System32\quartz.dll

2012-01-11 13:34:55 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll

2012-01-11 13:34:55 366592 ----a-w- C:\Windows\System32\qdvd.dll

2012-01-11 13:34:55 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll

2012-01-11 13:34:33 1731920 ----a-w- C:\Windows\System32\ntdll.dll

2012-01-11 13:34:33 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll

2012-01-11 13:29:47 77312 ----a-w- C:\Windows\System32\packager.dll

2012-01-11 13:29:47 67072 ----a-w- C:\Windows\SysWow64\packager.dll

2012-01-09 22:44:28 -------- d-----w- C:\Users\Jared\AppData\Local\Cyberlink

2012-01-08 16:42:45 974848 ----a-w- C:\Windows\SysWow64\mfc70.dll

2012-01-08 16:42:44 487424 ----a-w- C:\Windows\SysWow64\msvcp70.dll

2012-01-08 15:53:53 -------- d-----w- C:\Users\Jared\AppData\Roaming\tiger-k

2012-01-08 15:53:53 -------- d-----w- C:\Users\Jared\AppData\Roaming\Leawo

2012-01-08 15:53:36 175616 ----a-w- C:\Windows\SysWow64\unrar.dll

2012-01-08 15:53:23 606208 ----a-w- C:\Windows\SysWow64\xvidcore.dll

2012-01-08 15:53:23 139264 ----a-w- C:\Windows\SysWow64\xvid.ax

2012-01-08 15:49:07 -------- d-----w- C:\Users\Jared\AppData\Roaming\AVS4YOU

2012-01-08 15:47:17 1700352 ----a-w- C:\Windows\SysWow64\GdiPlus.dll

2012-01-08 15:47:17 -------- d-----w- C:\ProgramData\AVS4YOU

2012-01-08 15:47:17 -------- d-----w- C:\Program Files (x86)\Common Files\AVSMedia

2012-01-08 15:47:17 -------- d-----w- C:\Program Files (x86)\AVS4YOU

2012-01-08 15:35:57 -------- d-----w- C:\Users\Jared\AppData\Roaming\Malwarebytes

2012-01-08 15:35:47 -------- d-----w- C:\ProgramData\Malwarebytes

2012-01-08 15:35:46 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-01-08 15:35:46 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2012-01-08 12:09:13 -------- d-sh--w- C:\Windows\SysWow64\AI_RecycleBin

2012-01-08 09:47:32 -------- d-----w- C:\Users\Jared\AppData\Roaming\Applian FLV and Media Player

2012-01-08 09:40:09 -------- d-----w- C:\Program Files (x86)\Applian Technologies

2012-01-08 09:39:24 -------- d-----w- C:\Users\Jared\AppData\Local\Linkury

2012-01-08 09:39:24 -------- d-----w- C:\ProgramData\Linkury

2012-01-08 09:39:24 -------- d-----w- C:\Program Files (x86)\Linkury

2012-01-08 09:39:16 -------- d-----w- C:\ProgramData\Computer Updater

2012-01-08 09:39:08 -------- d-----w- C:\Program Files (x86)\Free Offers from Freeze.com

2012-01-08 09:38:52 9216 ----a-r- C:\Users\Jared\AppData\Roaming\Microsoft\Installer\{7426428E-71D4-452C-BA13-B14E5EB52859}\Icon7426428E16.exe

2012-01-05 18:43:09 -------- d-----w- C:\ProgramData\VirtualizedApplications

2012-01-05 16:31:24 -------- d-----w- C:\Users\Jared\AppData\Roaming\SoftGrid Client

2012-01-05 16:31:24 -------- d-----w- C:\Users\Jared\AppData\Local\SoftGrid Client

2012-01-05 16:30:32 -------- d-----w- C:\Program Files (x86)\Microsoft Application Virtualization Client

2012-01-05 16:30:21 -------- d-----w- C:\Users\Jared\AppData\Roaming\TP

.

==================== Find3M ====================

.

2012-01-31 12:44:20 279656 ------w- C:\Windows\System32\MpSigStub.exe

2011-12-28 17:57:44 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2011-12-27 02:56:09 175616 ----a-w- C:\Windows\System32\msclmd.dll

2011-12-27 02:56:09 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll

2011-11-24 04:52:09 3145216 ----a-w- C:\Windows\System32\win32k.sys

2011-11-17 06:49:14 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2011-11-17 06:49:14 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2011-11-17 06:44:43 459232 ----a-w- C:\Windows\System32\drivers\cng.sys

2011-11-17 06:35:28 395776 ----a-w- C:\Windows\System32\webio.dll

2011-11-17 06:35:26 29184 ----a-w- C:\Windows\System32\sspisrv.dll

2011-11-17 06:35:26 136192 ----a-w- C:\Windows\System32\sspicli.dll

2011-11-17 06:35:25 340992 ----a-w- C:\Windows\System32\schannel.dll

2011-11-17 06:35:25 28160 ----a-w- C:\Windows\System32\secur32.dll

2011-11-17 06:35:19 1447936 ----a-w- C:\Windows\System32\lsasrv.dll

2011-11-17 06:33:55 31232 ----a-w- C:\Windows\System32\lsass.exe

2011-11-17 05:35:02 314880 ----a-w- C:\Windows\SysWow64\webio.dll

2011-11-17 05:34:52 224768 ----a-w- C:\Windows\SysWow64\schannel.dll

2011-11-17 05:34:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2011-11-17 05:28:48 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2011-11-15 03:38:16 69632 ----a-w- C:\Windows\SysWow64\CUUpdateComponent.ocx

2011-11-15 03:38:16 425984 ----a-w- C:\Windows\SysWow64\ComputerUpdaterLM.ocx

2011-11-15 03:38:16 131072 ----a-w- C:\Windows\SysWow64\SafeAppRichList.ocx

.

============= FINISH: 13:47:37.14 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 26/12/2011 22:44:28

System Uptime: 02/02/2012 18:27:37 (19 hours ago)

.

Motherboard: Acer | | Aspire 5742Z

Processor: Intel® Pentium® CPU P6200 @ 2.13GHz | CPU | 917/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 583 GiB total, 391.258 GiB free.

D: is CDROM ()

E: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP30: 28/01/2012 23:17:46 - Installed WinZip 16.0

RP31: 29/01/2012 00:02:19 - Windows Update

RP32: 29/01/2012 22:05:38 - Removed Windows Live ID Sign-in Assistant

RP34: 31/01/2012 02:06:10 - SPTD setup V1.78

RP35: 31/01/2012 02:22:16 - Installed Steam

RP36: 02/02/2012 18:38:39 - Windows Update

RP37: 02/02/2012 20:27:05 - Configured eSobi v2

.

==== Installed Programs ======================

.

Acer Backup Manager

Acer Crystal Eye webcam

Acer ePower Management

Acer eRecovery Management

Acer GameZone Console

Acer Registration

Acer ScreenSaver

Acer Updater

Acrobat.com

Adobe AIR

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9.1 MUI

Age of Empires Online

Airport Mania First Flight

Amazonia

Apple Application Support

Apple Software Update

Applian FLV and Media Player 3.1.1.12

Backup Manager Basic

CyberLink PowerDVD 9

DAEMON Tools Pro

Dream Day First Home

eBay Worldwide

Football Manager 2012

Galapago

Google Chrome

Heroes of Hellas

Identity Card

ImgBurn

Intel® Control Center

Intel® Graphics Media Accelerator Driver

Intel® Management Engine Components

Intel® Rapid Storage Technology

Java Auto Updater

Java 6 Update 30

Junk Mail filter update

Launch Manager

Malwarebytes Anti-Malware version 1.60.1.1000

Merriam Websters Spell Jam

Microsoft Choice Guard

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

MSVCRT

MyWinLocker

MyWinLocker Suite

NTI Media Maker 9

Poker Pop

Realtek High Definition Audio Driver

Realtek USB 2.0 Card Reader

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Shredder

Skype™ 5.5

Spin & Win

Steam

SweetIM for Messenger 3.6

SweetIM Toolbar for Internet Explorer 4.2

Unity

Unity Web Player

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Welcome Center

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Movie Maker

Windows Live Photo Gallery

Windows Live Sync

Windows Live Upload Tool

Windows Live Writer

WinFF 1.4.0

WinZip Courier

.

==== Event Viewer Messages From Past Week ========

.

31/01/2012 02:08:49, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

30/01/2012 22:13:50, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

29/01/2012 15:17:26, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

28/01/2012 23:52:22, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.

28/01/2012 23:51:52, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

28/01/2012 23:51:52, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.

28/01/2012 23:51:51, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

28/01/2012 22:41:30, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.119.772.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8001.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

28/01/2012 18:19:58, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

27/01/2012 19:52:37, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

27/01/2012 15:54:07, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

27/01/2012 13:30:49, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

02/02/2012 18:28:09, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

01/02/2012 19:22:14, Error: bowser [8003] - The master browser has received a server announcement from the computer TOSHIBA that believes that it is the master browser for the domain on transport NetBT_Tcpip_{69B69274-1755-4F24-A17D-EA5633B929CF}. The master browser is stopping or an election is being forced.

.

==== End Of File ===========================

Larusso · February 3, 2012

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

*Note - if after running ComboFix you see a message similar to 'registry key marked for deletion..' rebooting the machine will resolve that.

Please post in your next reply

Combofix.txt

JaredMiles · February 3, 2012

ComboFix 12-02-03.02 - Jared 03/02/2012 17:04:31.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.5815.4002 [GMT 0:00]

Running from: c:\users\Jared\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\FullRemove.exe

c:\users\Public\Documents\NTILiveUpdateV9.dll

c:\users\Public\Documents\NTIMMV9Acer.dll

c:\users\Public\Documents\NTIMMV9REGET.dll

.

((((((((((((((((((((((((( Files Created from 2012-01-03 to 2012-02-03 )))))))))))))))))))))))))))))))

.

2012-02-03 17:08 . 2012-02-03 17:08 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-02-02 23:35 . 2012-02-02 23:35 -------- d-----w- c:\programdata\Arcade Lab

2012-02-02 22:45 . 2012-02-02 22:45 -------- d-----w- c:\users\Jared\AppData\Roaming\PlayFirst

2012-02-02 18:39 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5668E933-D761-4E5F-B963-A7BC9A88783A}\mpengine.dll

2012-02-01 00:07 . 2012-02-01 00:07 -------- d-----w- c:\users\Jared\AppData\Local\Chromium

2012-02-01 00:05 . 2012-02-01 00:05 -------- d-----w- c:\users\Jared\AppData\Local\SKIDROW

2012-01-31 23:13 . 2012-02-03 02:56 -------- d-----w- c:\users\Jared\AppData\Roaming\Sports Interactive

2012-01-31 23:13 . 2012-01-31 23:13 -------- d-----w- c:\users\Jared\AppData\Local\Sports Interactive

2012-01-31 23:07 . 2012-01-31 23:07 -------- d-----w- c:\program files (x86)\SEGA

2012-01-31 02:22 . 2012-01-31 02:22 -------- d-----w- c:\program files (x86)\Common Files\Steam

2012-01-31 02:22 . 2012-02-03 17:10 -------- d-----w- c:\program files (x86)\Steam

2012-01-31 02:06 . 2012-01-31 02:06 526392 ----a-w- c:\windows\system32\drivers\sptd.sys

2012-01-31 02:05 . 2012-01-31 02:06 -------- d-----w- c:\program files (x86)\DAEMON Tools Pro

2012-01-31 02:05 . 2012-02-02 18:33 -------- d-----w- c:\users\Jared\AppData\Roaming\DAEMON Tools Pro

2012-01-31 02:05 . 2012-01-31 02:05 -------- d-----w- c:\programdata\DAEMON Tools Pro

2012-01-28 23:33 . 2011-09-27 04:58 64000 ----a-w- c:\windows\SysWow64\steam_api.dll

2012-01-28 23:29 . 2011-09-27 04:24 4178264 ----a-w- c:\windows\SysWow64\d3dx9_41.dll

2012-01-28 23:24 . 2012-01-28 23:24 -------- d-----w- c:\users\Jared\AppData\Roaming\WinZip

2012-01-28 23:20 . 2012-01-28 23:20 -------- d-----w- c:\users\Jared\AppData\Local\WinZip

2012-01-28 23:19 . 2012-01-28 23:19 -------- d-----w- c:\program files (x86)\WinZip Courier

2012-01-28 23:19 . 2012-01-28 23:19 -------- d-----w- c:\windows\CD95F661A5C411AFB2CCABCD21A325B8.TMP

2012-01-28 23:18 . 2012-01-28 23:19 -------- d-----w- c:\programdata\WinZip

2012-01-28 23:01 . 2012-01-28 23:01 -------- d-----w- c:\users\Jared\AppData\Roaming\ImgBurn

2012-01-28 22:55 . 2012-01-28 22:56 -------- d-----w- c:\program files (x86)\ImgBurn

2012-01-28 22:53 . 2012-02-03 00:15 -------- d-----w- c:\users\Jared\Tracing

2012-01-28 22:53 . 2012-01-28 22:53 -------- d-----w- c:\program files (x86)\SweetIM

2012-01-28 22:53 . 2012-01-28 22:53 -------- d-----w- c:\programdata\SweetIM

2012-01-27 15:59 . 2012-01-27 15:59 -------- d--h--w- c:\programdata\CanonBJ

2012-01-27 15:59 . 2009-07-14 01:40 84992 ----a-w- c:\windows\system32\Spool\prtprocs\x64\CNBPP4.DLL

2012-01-19 12:40 . 2012-01-19 12:40 -------- d-----w- c:\programdata\Microsoft Help

2012-01-19 12:40 . 2012-01-19 12:40 -------- d-----w- c:\users\Jared\AppData\Local\Microsoft Help

2012-01-14 16:53 . 2012-01-26 01:17 -------- d-----w- c:\users\Jared\AppData\Roaming\WinFF

2012-01-14 16:53 . 2012-01-14 16:53 -------- d-----w- c:\program files (x86)\WinFF

2012-01-11 13:34 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll

2012-01-11 13:34 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll

2012-01-11 13:34 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

2012-01-11 13:34 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll

2012-01-11 13:34 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll

2012-01-11 13:34 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll

2012-01-11 13:29 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll

2012-01-11 13:29 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll

2012-01-09 22:44 . 2012-01-13 20:18 -------- d-----w- c:\users\Jared\AppData\Local\Cyberlink

2012-01-09 22:44 . 2012-01-09 22:44 -------- d-----w- c:\users\Public\CyberLink

2012-01-09 22:44 . 2012-01-09 22:44 -------- d-----w- c:\programdata\CyberLink

2012-01-09 22:44 . 2012-01-09 22:44 -------- d-----w- c:\users\Jared\AppData\Roaming\CyberLink

2012-01-08 16:42 . 2007-02-27 18:36 974848 ----a-w- c:\windows\SysWow64\mfc70.dll

2012-01-08 16:42 . 2007-02-27 18:36 487424 ----a-w- c:\windows\SysWow64\msvcp70.dll

2012-01-08 15:53 . 2012-01-08 15:54 -------- d-----w- c:\users\Jared\AppData\Roaming\tiger-k

2012-01-08 15:53 . 2012-01-08 15:53 -------- d-----w- c:\users\Jared\AppData\Roaming\Leawo

2012-01-08 15:53 . 2011-03-02 10:43 175616 ----a-w- c:\windows\SysWow64\unrar.dll

2012-01-08 15:53 . 2008-10-28 10:10 139264 ----a-w- c:\windows\SysWow64\xvid.ax

2012-01-08 15:53 . 2008-10-08 09:45 606208 ----a-w- c:\windows\SysWow64\xvidcore.dll

2012-01-08 15:49 . 2012-01-08 15:49 -------- d-----w- c:\users\Jared\AppData\Roaming\AVS4YOU

2012-01-08 15:47 . 2012-01-11 13:03 -------- d-----w- c:\program files (x86)\Common Files\AVSMedia

2012-01-08 15:47 . 2012-01-11 13:03 -------- d-----w- c:\program files (x86)\AVS4YOU

2012-01-08 15:47 . 2012-01-08 15:49 -------- d-----w- c:\programdata\AVS4YOU

2012-01-08 15:47 . 2011-08-22 16:33 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll

2012-01-08 15:35 . 2012-01-08 15:35 -------- d-----w- c:\users\Jared\AppData\Roaming\Malwarebytes

2012-01-08 15:35 . 2012-01-08 15:35 -------- d-----w- c:\programdata\Malwarebytes

2012-01-08 15:35 . 2012-02-03 00:19 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2012-01-08 15:35 . 2011-12-10 15:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-01-08 12:09 . 2012-01-08 15:26 -------- d-sh--w- c:\windows\SysWow64\AI_RecycleBin

2012-01-08 09:47 . 2012-01-30 00:13 -------- d-----w- c:\users\Jared\AppData\Roaming\Applian FLV and Media Player

2012-01-08 09:40 . 2012-01-08 09:40 -------- d-----w- c:\program files (x86)\Applian Technologies

2012-01-08 09:39 . 2012-02-02 19:25 -------- d-----w- c:\users\Jared\AppData\Local\Linkury

2012-01-08 09:39 . 2012-01-25 12:44 -------- d-----w- c:\programdata\Linkury

2012-01-08 09:39 . 2012-01-25 12:44 -------- d-----w- c:\program files (x86)\Linkury

2012-01-08 09:39 . 2012-01-08 09:44 -------- d-----w- c:\programdata\Computer Updater

2012-01-08 09:39 . 2012-01-08 09:39 -------- d-----w- c:\program files (x86)\Free Offers from Freeze.com

2012-01-08 09:38 . 2012-01-08 09:38 9216 ----a-r- c:\users\Jared\AppData\Roaming\Microsoft\Installer\{7426428E-71D4-452C-BA13-B14E5EB52859}\Icon7426428E16.exe

2012-01-07 18:10 . 2012-01-07 18:10 -------- d-----w- c:\users\Public\OEM

2012-01-05 18:43 . 2012-01-08 01:34 -------- d-----w- c:\programdata\VirtualizedApplications

2012-01-05 16:41 . 2012-01-05 16:41 -------- d-----r- C:\MSOCache

2012-01-05 16:31 . 2012-02-01 19:44 -------- d-----w- c:\users\Jared\AppData\Roaming\SoftGrid Client

2012-01-05 16:31 . 2012-01-05 16:31 -------- d-----w- c:\users\Jared\AppData\Local\SoftGrid Client

2012-01-05 16:30 . 2012-01-06 04:27 -------- d-----w- c:\program files (x86)\Microsoft Application Virtualization Client

2012-01-05 16:30 . 2012-01-05 16:31 -------- d-----w- c:\users\Jared\AppData\Roaming\TP

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-31 12:44 . 2011-12-26 23:21 279656 ------w- c:\windows\system32\MpSigStub.exe

2012-01-06 05:15 . 2011-12-28 17:48 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-12-28 17:57 . 2011-12-28 17:58 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-12-27 04:45 . 2011-12-27 04:45 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F66BA7D9-1CB2-439A-928E-FC9E2AA4B230}\gapaengine.dll

2011-12-27 02:56 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll

2011-12-27 02:56 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll

2011-12-27 01:22 . 2011-12-27 01:22 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-12-27 01:22 . 2011-12-27 01:22 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll

2011-12-27 01:22 . 2011-12-27 01:22 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2011-12-27 01:22 . 2011-12-27 01:22 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe

2011-12-27 01:22 . 2011-12-27 01:22 74752 ----a-w- c:\windows\SysWow64\iesetup.dll

2011-12-27 01:22 . 2011-12-27 01:22 63488 ----a-w- c:\windows\SysWow64\tdc.ocx

2011-12-27 01:22 . 2011-12-27 01:22 49664 ----a-w- c:\windows\system32\imgutil.dll

2011-12-27 01:22 . 2011-12-27 01:22 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2011-12-27 01:22 . 2011-12-27 01:22 420864 ----a-w- c:\windows\SysWow64\vbscript.dll

2011-12-27 01:22 . 2011-12-27 01:22 367104 ----a-w- c:\windows\SysWow64\html.iec

2011-12-27 01:22 . 2011-12-27 01:22 35840 ----a-w- c:\windows\SysWow64\imgutil.dll

2011-12-27 01:22 . 2011-12-27 01:22 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-12-27 01:22 . 2011-12-27 01:22 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-12-27 01:22 . 2011-12-27 01:22 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll

2011-12-27 01:22 . 2011-12-27 01:22 2309120 ----a-w- c:\windows\system32\jscript9.dll

2011-12-27 01:22 . 2011-12-27 01:22 222208 ----a-w- c:\windows\system32\msls31.dll

2011-12-27 01:22 . 2011-12-27 01:22 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-12-27 01:22 . 2011-12-27 01:22 173056 ----a-w- c:\windows\system32\ieUnatt.exe

2011-12-27 01:22 . 2011-12-27 01:22 161792 ----a-w- c:\windows\SysWow64\msls31.dll

2011-12-27 01:22 . 2011-12-27 01:22 152064 ----a-w- c:\windows\SysWow64\wextract.exe

2011-12-27 01:22 . 2011-12-27 01:22 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2011-12-27 01:22 . 2011-12-27 01:22 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2011-12-27 01:22 . 2011-12-27 01:22 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2011-12-27 01:22 . 2011-12-27 01:22 1390080 ----a-w- c:\windows\system32\wininet.dll

2011-12-27 01:22 . 2011-12-27 01:22 12288 ----a-w- c:\windows\system32\mshta.exe

2011-12-27 01:22 . 2011-12-27 01:22 11776 ----a-w- c:\windows\SysWow64\mshta.exe

2011-12-27 01:22 . 2011-12-27 01:22 114176 ----a-w- c:\windows\system32\admparse.dll

2011-12-27 01:22 . 2011-12-27 01:22 1127424 ----a-w- c:\windows\SysWow64\wininet.dll

2011-12-27 01:22 . 2011-12-27 01:22 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2011-12-27 01:22 . 2011-12-27 01:22 101888 ----a-w- c:\windows\SysWow64\admparse.dll

2011-12-27 01:22 . 2011-12-27 01:22 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-12-27 01:22 . 2011-12-27 01:22 85504 ----a-w- c:\windows\system32\iesetup.dll

2011-12-27 01:22 . 2011-12-27 01:22 76800 ----a-w- c:\windows\system32\tdc.ocx

2011-12-27 01:22 . 2011-12-27 01:22 603648 ----a-w- c:\windows\system32\vbscript.dll

2011-12-27 01:22 . 2011-12-27 01:22 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-12-27 01:22 . 2011-12-27 01:22 448512 ----a-w- c:\windows\system32\html.iec

2011-12-27 01:22 . 2011-12-27 01:22 30720 ----a-w- c:\windows\system32\licmgr10.dll

2011-12-27 01:22 . 2011-12-27 01:22 165888 ----a-w- c:\windows\system32\iexpress.exe

2011-12-27 01:22 . 2011-12-27 01:22 160256 ----a-w- c:\windows\system32\wextract.exe

2011-12-27 01:22 . 2011-12-27 01:22 1493504 ----a-w- c:\windows\system32\inetcpl.cpl

2011-12-27 01:22 . 2011-12-27 01:22 135168 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-12-27 01:22 . 2011-12-27 01:22 111616 ----a-w- c:\windows\system32\iesysprep.dll

2011-11-30 02:21 . 2011-12-26 23:21 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6C051B66-E169-4583-953A-912B09F480F6}\mpengine.dll

2011-11-24 04:52 . 2011-12-27 01:35 3145216 ----a-w- c:\windows\system32\win32k.sys

2011-11-15 03:38 . 2011-11-15 03:38 69632 ----a-w- c:\windows\SysWow64\CUUpdateComponent.ocx

2011-11-15 03:38 . 2011-11-15 03:38 425984 ----a-w- c:\windows\SysWow64\ComputerUpdaterLM.ocx

2011-11-15 03:38 . 2011-11-15 03:38 131072 ----a-w- c:\windows\SysWow64\SafeAppRichList.ocx

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]

2011-08-24 18:21 1299248 ----a-r- c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-08-24 1299248]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2010-05-27 02:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]

"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2011-08-17 4527424]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-01-31 1242448]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]

"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]

"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]

"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]

S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]

S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-10 321104]

S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 868896]

S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-04-13 13336]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-06-28 255744]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-03-18 2320920]

S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]

S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c87ec40-4bb0-11e1-a249-806e6f6e6963}]

\shell\AutoRun\command - E:\Setup.exe

.

Contents of the 'Scheduled Tasks' folder

.

2012-02-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2548204430-3489653281-3508443478-1000Core.job

- c:\users\Jared\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-27 00:39]

.

2012-02-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2548204430-3489653281-3508443478-1000UA.job

- c:\users\Jared\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-27 00:39]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]

@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"

[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]

2010-05-27 02:42 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-22 10920552]

"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-21 167704]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-21 392472]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-21 416024]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uStart Page = hxxp://isearch.whitesmoke.com/?isid=9860

uLocal Page = c:\windows\system32\blank.htm

mStart Page = hxxp://acer.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://isearch.whitesmoke.com/?q={searchTerms}&babsrc=home&s=web&as=0&isid=9860

TCP: DhcpNameServer = 192.168.0.1

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10i.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Completion time: 2012-02-03 17:13:40 - machine was rebooted

ComboFix-quarantined-files.txt 2012-02-03 17:13

.

Pre-Run: 420,291,964,928 bytes free

Post-Run: 420,160,962,560 bytes free

.

- - End Of File - - 4D66099523E6ADCD8DEE5864D9916407

Larusso · February 3, 2012

Hy,

Open notepad and copy/paste the text in the Code-box below into it:


DDS::
uSearchAssistant = hxxp://isearch.whitesmoke.com/?q={searchTerms}&babsrc=home&s=web&as=0&isid=9860
ClearJavaCache::

Save this as CFScript.txt, in the same location as ComboFix.exe.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
I notice you have Malwarebytes' Anti-Malware installed on your machine. Please launch the program and select the update tab, then click on the check for updates button.

If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Save it to your desktop.

Note: Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply.

Please post in your next reply

Combofix.txt

MBAM Log

Let me know if whistesmoke still appear

JaredMiles · February 4, 2012

ComboFix 12-02-03.02 - Jared 04/02/2012 11:28:45.2.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.5815.4331 [GMT 0:00]

Running from: c:\users\Jared\Downloads\ComboFix.exe

Command switches used :: c:\users\Jared\Downloads\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2012-01-04 to 2012-02-04 )))))))))))))))))))))))))))))))

.

2012-02-04 11:33 . 2012-02-04 11:33 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-02-04 11:09 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CB9A73A5-CA71-43A8-A7B3-8A6BA9FE9926}\mpengine.dll