Locked up my files...and other stuff

colin0100 · June 30, 2012

Greetings, and I have great confidence. You people are amazing, just reading through the forums.

Anyway, earlier today I ran the two progs and collected the two files....then somehow mucked up the post. I think I am now clear.

Here goes:

28 June. Avira picked up and quaranted 2 things:

EXP/PIDIEF.AIK.1

EXP/JS.PDFKA.KKK

Damage:

I can not see any files created prior to the attack. Files created after the attack and saved to my thumb drive are OK.

Getting Malwarebytes blocking outgoing traffic to bad site.. 206.(wasn't fast enough to get the full URL )

To get into the internet I use the link in the malwarebytes s/w to the Malwarebytes site and move around from there.

I can get the task bar to display.

PC is not stable, and I need to reboot sometimes when it freezes.

Malwarebytes does not update successfully. Files are those downloaded before the attack: 28 June.

Computer is getting progressivly worse I THINK ....anyway, I am! :-(

Action to date:

Malwarebytes full scan

Ran June 2012 of MRT.exe

CHKDSK repair

MS Defender caught 2 : TR/spy.Zbot.76.13 and 76.14 (persitent: just now caught by Avira and removed 30 June 1130pm)

Ran Dell extended H/w test on main drive

LOaded the original Windows disc in Repair mode (gave me XP sp2)

Looking forward to working with you all

Thanks

Colin

dds.txt

attach.txt

Maniac · June 30, 2012

Hello Colin! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

Step 1

Anti-Virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash. If you choose to install more than one Anti-Virus program on your computer, then only one of them should be active in memory at a time. My suggestion is to uninstall Avira Free Antivirus and to keep Microsoft Security Essentials.

Also, please uninstall Ask Toolbar.

Step 2

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 3

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
aswMBR log
a new fresh DDS log file

colin0100 · July 1, 2012

Thanks:

I disables the ASK toolbar.

I have left Avirs on: Security essentials will not turn on: Error 0x800705b4 time out.

Malwarebytes will not update:

Program Error updating (5,0,MBAMF FileIO:write file.

Downloaded aswWBR Version 0.9.9.1665 but it will not run. Tries to get it going with 'run as' and unchecked that 'security' button: still will not run. Task bar doesn't show any activity under the 'applications' tab.

Here are the logs:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.2180

Run by COLIN at 9:50:22 on 2012-07-01

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1311 [GMT 10:00]

.

AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\GEARSec.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\drivers\KodakCCS.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\PCPitstop\PCPitstopScheduleService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Orbitdownloader\orbitdm.exe

C:\Program Files\Orbitdownloader\orbitnet.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\explorer.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com.au/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL =

hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf

8

uDefault_Search_URL = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program

files\orbitdownloader\orbitcth.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program

files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program

files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll

BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} -

c:\program files\ask.com\GenericAskToolbar.dll

BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program

files\epson\epson web-to-page\EPSON Web-To-Page.dll

TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson

web-to-page\EPSON Web-To-Page.dll

TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program

files\orbitdownloader\GrabPro.dll

TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} -

c:\program files\ask.com\GenericAskToolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google

toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay

mRun: [EPSON Stylus Photo R230 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIP.EXE

/P30 "EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"

mRun: [NWEReboot]

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe"

/starttray

mRun: [<NO NAME>]

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\colin\startm~1\programs\startup\adobeg~1.lnk - c:\program

files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\orbit.lnk - c:\program

files\orbitdownloader\orbitdm.exe

mPolicies-system: EnableLUA = 0 (0x0)

IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201

IE: &eBay Search - c:\program files\ebay\ebay toolbar2\eBayTb.dll/RCSearch.html

IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} -

c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB

DPF: {17492023-C23A-453E-A040-C7C580BBF700} -

hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckCont

rol.cab

DPF: {31435657-9980-0010-8000-00AA00389B71} -

hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -

hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} -

hxxps://scan.safety.live.com/resource/download/scanner/en-us/wlscbase3401.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -

hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1340

975846937

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -

hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?114013943

6593

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} -

hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{67C731C6-C643-46BD-8865-2DA9C21374CD} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{8FAD4249-41A8-413E-8C32-51D6B0666FB6} : NameServer = 61.8.0.113,210.23.129.34

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program

files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} -

c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} -

c:\progra~1\wifd1f~1\MpShHook.dll

.

============= SERVICES / DRIVERS ===============

.

R0 PQV2i;PQV2i;c:\windows\system32\drivers\PQV2i.sys [2003-6-4 123957]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2011-10-19 36000]

R1 PQIMount;PQIMount;c:\windows\system32\drivers\PQIMount.sys [2003-6-4 46900]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe

[2011-10-19 86224]

R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe

[2011-10-19 110032]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-10-19 83392]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe

[2010-12-1 654408]

R2 PCPitstop Scheduling;PCPitstop Scheduling;c:\program

files\pcpitstop\PCPitstopScheduleService.exe [2011-11-26 86016]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-11-29 22344]

S0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys

[2012-3-20 171064]

S2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe

[2011-10-19 465360]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN

v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe

[2009-7-23 133104]

S2 SZASSIST;SecretZone Assist Service;"c:\program files\clarus\samsung

secretzone\szassistsvc.exe" --> c:\program files\clarus\samsung secretzone\SZAssistSVC.exe [?]

S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

S3 glauiad;D-Link DSL-302G Modem;c:\windows\system32\drivers\glauiad.sys [2006-1-13 29603]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe

[2009-7-23 133104]

S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\microsoft fix it

center\Matsvc.exe [2011-6-13 267568]

S3 mdf16;mdf16;\??\c:\program files\clarus\samsung secretzone\mdf16.sys --> c:\program

files\clarus\samsung secretzone\mdf16.sys [?]

S3 mvd22;mvd22;\??\c:\program files\clarus\samsung secretzone\mvd22.sys --> c:\program

files\clarus\samsung secretzone\mvd22.sys [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache

4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18

753504]

.

=============== File Associations ===============

.

regfile=regedit.exe "%1" %*

scrfile="%1" %*

.

=============== Created Last 30 ================

.

2012-06-29 12:16:59 18944 -c--a-w- c:\windows\system32\dllcache\simptcp.dll

2012-06-29 12:15:58 65536 -c--a-w- c:\windows\system32\dllcache\EXCH_mailmsg.dll

2012-06-29 12:14:59 57856 -c--a-w- c:\windows\system32\dllcache\esuimgd.dll

2012-06-29 12:13:55 5632 -c--a-w- c:\windows\system32\dllcache\EXCH_adsiisex.dll

2012-06-29 12:09:47 -------- d-s---w- c:\windows\Downloaded Program Files

2012-06-29 12:09:14 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe

2012-06-29 12:09:14 16384 ----a-w- c:\program files\internet explorer\connection

wizard\isignup.exe

2012-06-29 11:48:43 608594 ----a-w- c:\windows\system32\PerfStringBackup.TMP

2012-06-29 11:48:25 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll

2012-06-29 11:48:25 13312 ----a-w- c:\windows\system32\irclass.dll

2012-06-29 11:48:24 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll

2012-06-29 11:48:24 24661 ----a-w- c:\windows\system32\spxcoins.dll

2012-06-29 11:48:09 13753 ----a-r- c:\windows\SET13F.tmp

2012-06-29 11:48:07 1086058 ----a-r- c:\windows\SET133.tmp

2012-06-29 11:48:05 1042903 ----a-r- c:\windows\SET130.tmp

2012-06-29 09:56:37 -------- d-----w- c:\program files\common files\SpeedMaxPc

2012-06-29 09:56:33 -------- d-----w- c:\program files\SpeedMaxPc

2012-06-29 09:56:33 -------- d-----w- c:\documents and settings\all

users\application data\SpeedMaxPc

2012-06-29 03:06:32 -------- d-----w- c:\windows\system32\MpEngineStore

2012-06-28 12:39:28 6762896 ---h--w- c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition

updates\{bf6011fe-02f8-49f5-bc2f-4de76ad67413}\mpengine.dll

2012-06-28 12:35:38 -------- d--h--w- c:\program files\Microsoft Security

Client

2012-06-28 12:28:10 -------- d--h--w- c:\documents and settings\colin\local

settings\application data\FixItCenter

2012-06-26 16:21:10 56200 ---ha-w- c:\documents and settings\all users\application

data\microsoft\windows defender\definition

updates\{ddd32bdf-4f2b-428a-8a02-5ade919ac233}\offreg.dll

2012-06-26 16:17:46 6762896 ---h--w- c:\documents and settings\all users\application

data\microsoft\windows defender\definition

updates\{ddd32bdf-4f2b-428a-8a02-5ade919ac233}\mpengine.dll

2012-06-26 03:59:00 -------- d--h--w- c:\documents and

settings\colin\application data\HandBrake

2012-06-19 09:15:30 17396768 ---ha-w- c:\program files\mpas-fe.exe

.

==================== Find3M ====================

.

2012-06-02 05:19:44 22040 ---ha-w- c:\windows\system32\wucltui.dll.mui

2012-06-02 05:19:38 15384 ---ha-w- c:\windows\system32\wuaucpl.cpl.mui

2012-06-02 05:19:34 15384 ---ha-w- c:\windows\system32\wuapi.dll.mui

2012-06-02 05:19:30 17944 ---ha-w- c:\windows\system32\wuaueng.dll.mui

2012-05-26 06:57:52 73 ---ha-w- c:\windows\system32\ssprs.dll

2012-05-09 03:47:56 83392 ---ha-w- c:\windows\system32\drivers\avgntflt.sys

2012-04-26 07:05:03 87608 ---ha-w- c:\documents and settings\colin\application

data\inst.exe

2012-04-26 07:05:03 47360 ---ha-w- c:\documents and settings\colin\application

data\pcouffin.sys

2012-04-04 05:56:40 22344 ---ha-w- c:\windows\system32\drivers\mbam.sys

2008-12-12 16:07:02 7930904 ---ha-w- c:\program files\dap9.exe

2008-12-09 01:28:00 2167968 ---ha-w- c:\program files\OrbitDownloaderSetup.exe

2008-07-10 09:55:36 383755 ---ha-w- c:\program files\download-VobSub_2.23.exe

2008-06-23 23:31:04 5992404 ---ha-w- c:\program files\Portable GetRight 6.3e.exe

2007-12-05 07:43:01 9347192 ---ha-w- c:\program files\agentenu420-1118.exe

2006-02-27 08:15:14 217329 ---ha-w- c:\program files\gspot221.exe

2006-01-17 06:15:01 20921040 ---ha-w- c:\program files\AdbeRdr705_enu_full.exe

2006-01-17 05:55:18 11477288 ---ha-w- c:\program files\DivXPlay.exe

2005-12-06 02:00:46 74448 ---ha-w- c:\program files\DSETUP.dll

2005-12-06 02:00:46 484560 ---ha-w- c:\program files\DXSETUP.exe

2005-12-06 02:00:46 2247888 ---ha-w- c:\program files\dsetup32.dll

.

============= FINISH: 9:57:35.78 ===============

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.2180

Run by COLIN at 9:50:22 on 2012-07-01

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1311 [GMT 10:00]

.

AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\GEARSec.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\drivers\KodakCCS.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\PCPitstop\PCPitstopScheduleService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Orbitdownloader\orbitdm.exe

C:\Program Files\Orbitdownloader\orbitnet.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\explorer.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com.au/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll

BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll

TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll

TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll

TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay

mRun: [EPSON Stylus Photo R230 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATIAIP.EXE /P30 "EPSON Stylus Photo R230 Series" /O6 "USB002" /M "Stylus Photo R230"

mRun: [NWEReboot]

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [<NO NAME>]

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\colin\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\orbit.lnk - c:\program files\orbitdownloader\orbitdm.exe