Malwarebytes and Win Defender won't open!

joelstitch · May 5, 2010

So my problem is that Malwarebbytes and Windows Defender arent opening. If I change the name of mbam.exe to something else it works, but it's not detecting the malware. Also, everytime I do a search on Google and click on a result it takes me to a random website.

Here is my Hijackthis log file:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 9:44:26 AM, on 5/5/2010

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe

C:\Program Files\Logitech\Gaming Software\LWEMon.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\GreedyTorrent\GTor.exe

C:\Users\Joel\AppData\Roaming\windrvswld\windrvswld.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\VirtuaWin\VirtuaWin.exe

C:\Program Files\VirtuaWin\modules\WinList.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\FlashGet Network\FlashGet 3\Flashget3.exe

C:\Windows\explorer.exe

C:\Users\Joel\AppData\Local\Temp\divBD07.tmp\divCE6B.tmp

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Joel\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2010\IEToolbar.dll

O3 - Toolbar: Foxit Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2010\IEShow.exe"

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKLM\..\Run: [pmnklldrv] rundll32.exe "tusqnn.dll",s

O4 - HKLM\..\Run: [yabyxwsys] rundll32.exe "awuuts.dll",DllRegisterServer

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [GreedyTorrent] "C:\Program Files\GreedyTorrent\GTor.exe" -tray

O4 - HKCU\..\Run: [windrvswld] C:\Users\Joel\AppData\Roaming\windrvswld\windrvswld.exe

O4 - HKCU\..\Run: [360desktop] "C:\Program Files\360desktop\360desktop.exe"

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

O4 - HKCU\..\Run: [gebyvudrv] rundll32.exe "tusqnn.dll",s

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [fcywvsdrv] rundll32.exe "tusqnn.dll",s (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [fcywvsdrv] rundll32.exe "tusqnn.dll",s (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: VirtuaWin.lnk = C:\Program Files\VirtuaWin\VirtuaWin.exe

O8 - Extra context menu item: Add to &Evernote - res://C:\Program Files\Evernote\Evernote3.5\enbar.dll/2000

O8 - Extra context menu item: Download All By FlashGet3 - C:\Users\Joel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm

O8 - Extra context menu item: Download By FlashGet3 - C:\Users\Joel\AppData\Roaming\FlashGetBHO\GetUrl.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll

O9 - Extra 'Tools' menuitem: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll

O15 - Trusted Zone: http://software.kuaiche.com

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe

--

End of file - 7393 bytes

IndiGenus · May 6, 2010

Hello joelstitch and welcome to the forums here at MalwareBytes.

:angry:

We need more information if possible. Please follow the instructions at this link.

Then post the logs from MBAM, DDS, and GMER back to this link. Do not start a new topic.

joelstitch · May 7, 2010

Ok here are the results (on the attached ZIP File).

I hope to get help soon, this virus/trojan is driving me insane!

Attach.zip

IndiGenus · May 7, 2010

We will begin the fix with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

joelstitch · May 7, 2010

Ok here it is.

ComboFix.txt

IndiGenus · May 7, 2010

Hi joelstitch,

I took the liberty of copying and pasting the cf log into the forum as it's easier for me to review that way. Please don't upload logs unless asked or needed if they're too big.

ComboFix 10-05-06.01 - Joel 05/06/2010 20:43:14.1.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1983.1144 [GMT -5:00]

Running from: c:\users\Joel\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\FlashGet Network

c:\program files\FlashGet Network\FlashGet 3\adns.dll

c:\program files\FlashGet Network\FlashGet 3\btcoreu.dll

c:\program files\FlashGet Network\FlashGet 3\BugReport.dll

c:\program files\FlashGet Network\FlashGet 3\BugReport.exe

c:\program files\FlashGet Network\FlashGet 3\cd1.ico

c:\program files\FlashGet Network\FlashGet 3\ckcore.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\14_43260.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\28_83260.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\atrc.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\Codecs.zip

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\cook.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ddnt3260.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\dnet3260.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv1.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drv2.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\drvc.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\hxltcolor.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\raac.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\ralf.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv10.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv20.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv30.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\rv40.dll

c:\program files\FlashGet Network\FlashGet 3\codec\real\Codecs\sipr.dll

c:\program files\FlashGet Network\FlashGet 3\commonlib.dll

c:\program files\FlashGet Network\FlashGet 3\componentskrnl.dll

c:\program files\FlashGet Network\FlashGet 3\config\clients.met

c:\program files\FlashGet Network\FlashGet 3\config\clients.met.bak

c:\program files\FlashGet Network\FlashGet 3\config\cryptkey.dat

c:\program files\FlashGet Network\FlashGet 3\config\emfriends.met

c:\program files\FlashGet Network\FlashGet 3\config\known.met

c:\program files\FlashGet Network\FlashGet 3\config\known2_64.met

c:\program files\FlashGet Network\FlashGet 3\config\preferences.dat

c:\program files\FlashGet Network\FlashGet 3\config\preferences.ini

c:\program files\FlashGet Network\FlashGet 3\config\server.met

c:\program files\FlashGet Network\FlashGet 3\config\server_met.old

c:\program files\FlashGet Network\FlashGet 3\config\upload.met

c:\program files\FlashGet Network\FlashGet 3\corestat.dll

c:\program files\FlashGet Network\FlashGet 3\dbghelp.dll

c:\program files\FlashGet Network\FlashGet 3\fg.ico

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\default.htm

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\FGResDetector.conf

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\banner.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\bullet.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\close.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\closelabel.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\download-icon.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\explorer.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\introTextBg.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\loading.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\nextlabel.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\prevlabel.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod.gif

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\FGResDetector.exe

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\about.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\ftplist_tree_icon.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\option_icon.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_hide.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_show.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\statusbar_bk.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\tasktab_close.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_back.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_bk.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_close.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_forward.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_refresh.png

c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\lang\l.eng.xml

c:\program files\FlashGet Network\FlashGet 3\FGSoftware.exe

c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe

c:\program files\FlashGet Network\FlashGet 3\FlashGet3.xpi

c:\program files\FlashGet Network\FlashGet 3\FlashGetBHO3.dll

c:\program files\FlashGet Network\FlashGet 3\FlashGetHook.dll

c:\program files\FlashGet Network\FlashGet 3\fnsArchive.dll

c:\program files\FlashGet Network\FlashGet 3\fnsDirectuix.dll

c:\program files\FlashGet Network\FlashGet 3\fnsLanguage.dll

c:\program files\FlashGet Network\FlashGet 3\fnslanguage_en.dll

c:\program files\FlashGet Network\FlashGet 3\fnsScheduler.dll

c:\program files\FlashGet Network\FlashGet 3\fnsSecurity.dll

c:\program files\FlashGet Network\FlashGet 3\fnsSkinX.dll

c:\program files\FlashGet Network\FlashGet 3\fnsStatistics.dll

c:\program files\FlashGet Network\FlashGet 3\game.ico

c:\program files\FlashGet Network\FlashGet 3\gb2312-unicode.dic

c:\program files\FlashGet Network\FlashGet 3\gdiplus.dll

c:\program files\FlashGet Network\FlashGet 3\GetAllUrl.htm

c:\program files\FlashGet Network\FlashGet 3\GetUrl.htm

c:\program files\FlashGet Network\FlashGet 3\GoogleToolbarInstaller_download_signed.exe

c:\program files\FlashGet Network\FlashGet 3\libem.dll

c:\program files\FlashGet Network\FlashGet 3\license.txt

c:\program files\FlashGet Network\FlashGet 3\lst_tz.bin

c:\program files\FlashGet Network\FlashGet 3\P2PCfg.ini

c:\program files\FlashGet Network\FlashGet 3\p2pcore.dll

c:\program files\FlashGet Network\FlashGet 3\p2score.dll

c:\program files\FlashGet Network\FlashGet 3\perf.ini

c:\program files\FlashGet Network\FlashGet 3\pncrt.dll

c:\program files\FlashGet Network\FlashGet 3\pstat.dat

c:\program files\FlashGet Network\FlashGet 3\pup.dat

c:\program files\FlashGet Network\FlashGet 3\RdOldDb.dll

c:\program files\FlashGet Network\FlashGet 3\RealMediaSplitter.ax

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\BarSet.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_check.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_normal.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_radio.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\desktoplink.ico

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\login_line.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\menu_icon.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_line.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_page_line.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\skin.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendLogo.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendNoLogo.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_backgrand.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_cancle.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_catgroy.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_group.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_new.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_open.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_option.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_pause.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_recly.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_start.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_left.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_middle.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_right.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\top_logotitle.gif

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\torrent.ico

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\userinfo_head.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\VistaStyleListItems.bmp

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\preview.png

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\skin.xml

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginfailed.wav

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginsucc.wav

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\msgnotify.wav

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\notify.wav

c:\program files\FlashGet Network\FlashGet 3\skin\international\default\topmain.png

c:\program files\FlashGet Network\FlashGet 3\SnapShot.dll

c:\program files\FlashGet Network\FlashGet 3\storage.dll

c:\program files\FlashGet Network\FlashGet 3\SysOptimize.exe

c:\program files\FlashGet Network\FlashGet 3\uninst.exe

c:\program files\FlashGet Network\FlashGet 3\VodCore.dll

c:\program files\FlashGet Network\FlashGet 3\zlib.dll

c:\users\Joel\AppData\Roaming\BITS

c:\users\Joel\AppData\Roaming\BITS\BITS.ini

c:\users\Joel\AppData\Roaming\BITS\DHTTable.dat

c:\users\Joel\AppData\Roaming\BITS\ProxyList.ini

c:\users\Joel\AppData\Roaming\BITS\UPnP.ini

c:\users\Joel\AppData\Roaming\FlashGetBHO

c:\users\Joel\AppData\Roaming\FlashGetBHO\FlashGetBHO3.dll

c:\users\Joel\AppData\Roaming\FlashGetBHO\FlashGetHook.dll

c:\users\Joel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm

c:\users\Joel\AppData\Roaming\FlashGetBHO\GetUrl.htm

c:\users\Joel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VirtuaWin.lnk

c:\windows\system32\FAE93840F8.dll

c:\windows\system32\rqpomm.dll

c:\windows\system32\secustat.dat

c:\windows\system32\tusqnn.dll

.

((((((((((((((((((((((((( Files Created from 2010-04-07 to 2010-05-07 )))))))))))))))))))))))))))))))

.

2010-05-07 01:52 . 2010-05-07 01:56 -------- d-----w- c:\users\Joel\AppData\Local\temp

2010-05-07 01:52 . 2010-05-07 01:52 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-05-06 18:05 . 2010-05-06 21:58 -------- d-----w- c:\users\Joel\AppData\Roaming\FileZilla

2010-05-06 18:05 . 2010-05-06 18:05 -------- d-----w- c:\program files\FileZilla FTP Client

2010-05-06 17:43 . 2010-05-06 17:46 -------- d-----w- c:\users\Joel\AppData\Local\Google

2010-05-06 04:32 . 2010-05-07 01:56 87552 ---ha-w- c:\windows\system32\rqpomm.dll

2010-05-05 14:34 . 2010-05-05 14:34 -------- d-----w- c:\program files\Trend Micro

2010-05-03 01:02 . 2010-05-03 01:02 -------- d-----w- c:\users\Joel\AppData\Roaming\Malwarebytes

2010-05-03 00:04 . 2010-05-06 04:48 -------- d-----w- c:\users\Joel\AppData\Local\ElevatedDiagnostics

2010-05-02 17:25 . 2010-05-02 17:25 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2010-05-02 17:25 . 2010-05-03 01:03 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-05-02 06:06 . 2010-01-07 21:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-05-02 06:06 . 2010-05-02 06:06 -------- d-----w- c:\programdata\Malwarebytes

2010-05-02 06:06 . 2010-01-07 21:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-30 20:19 . 2010-04-30 20:19 -------- d-----w- c:\program files\Music NFO Builder

2010-04-29 17:04 . 2010-05-04 15:49 -------- d-----w- c:\users\Joel\AppData\Roaming\dvdcss

2010-04-29 16:53 . 2010-04-29 16:53 -------- d-----w- c:\program files\Elaborate Bytes

2010-04-29 16:52 . 2010-04-29 16:52 -------- d-----w- c:\programdata\SlySoft

2010-04-29 16:51 . 2010-04-29 16:51 -------- d-----w- c:\program files\SlySoft

2010-04-28 16:11 . 2009-09-26 05:58 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys

2010-04-28 16:10 . 2009-12-11 07:44 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2010-04-28 16:10 . 2009-12-11 07:38 1037312 ----a-w- c:\windows\system32\lsasrv.dll

2010-04-27 02:18 . 2010-04-27 13:36 -------- d-----w- c:\program files\DOOM 3

2010-04-26 20:53 . 2010-05-03 15:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-26 03:27 . 2010-04-26 03:27 -------- d-----w- c:\programdata\Protexis

2010-04-26 03:26 . 2010-04-26 03:26 -------- d-----w- c:\program files\National Instruments

2010-04-26 03:26 . 2010-04-26 03:26 -------- d-----w- c:\program files\nvhsoftware

2010-04-26 02:59 . 2010-04-26 02:59 -------- d-----w- c:\users\Joel\AppData\Roaming\REAPER

2010-04-26 02:53 . 2010-04-26 03:10 -------- d-----w- c:\program files\REAPER

2010-04-26 01:58 . 2010-04-26 01:58 -------- d-----w- c:\program files\CFToolbox

2010-04-25 20:21 . 2010-04-25 20:21 -------- d-----w- c:\users\Joel\AppData\Local\iTunesKeys2

2010-04-25 20:19 . 2010-04-25 20:19 -------- d-----w- c:\program files\iTunesKeys

2010-04-24 22:53 . 2010-05-06 17:28 -------- d-----w- c:\program files\JDownloader

2010-04-24 20:19 . 2010-04-24 20:19 -------- d-----w- c:\program files\Ask.com

2010-04-24 20:19 . 2010-04-24 20:19 -------- d-----w- c:\users\Joel\AppData\Roaming\Foxit

2010-04-24 20:19 . 2010-04-24 20:19 -------- d-----w- c:\program files\Foxit Software

2010-04-24 20:14 . 2010-04-24 20:14 -------- d-----w- c:\program files\MSECache

2010-04-24 19:34 . 2010-04-24 19:34 -------- d-----w- c:\program files\SystemRequirementsLab

2010-04-24 19:34 . 2010-04-24 19:34 -------- d-----w- c:\users\Joel\AppData\Roaming\SystemRequirementsLab

2010-04-24 19:34 . 2010-05-03 02:49 -------- d-----w- c:\windows\Sun

2010-04-24 19:30 . 2010-04-24 19:30 -------- d-----w- c:\program files\Common Files\Steam

2010-04-24 19:30 . 2010-04-27 01:44 -------- d-----w- c:\program files\Steam

2010-04-24 06:04 . 2010-04-24 06:04 -------- d-----w- c:\windows\PCHEALTH

2010-04-24 06:04 . 2010-04-24 06:04 -------- d-----w- c:\program files\Microsoft.NET

2010-04-24 06:00 . 2010-04-24 06:00 -------- d-----w- c:\users\Joel\AppData\Local\Microsoft Help

2010-04-24 06:00 . 2010-04-24 06:07 -------- d-----w- c:\programdata\Microsoft Help

2010-04-24 06:00 . 2010-04-24 06:00 -------- d-----r- C:\MSOCache

2010-04-23 22:44 . 2010-04-23 22:46 -------- d-----w- c:\program files\Picture Resize Genius

2010-04-22 16:39 . 2010-05-03 03:32 -------- d-----w- c:\programdata\Rosetta Stone

2010-04-20 17:49 . 2010-04-20 17:49 -------- d-----w- c:\program files\Rosetta Stone

2010-04-20 16:45 . 2010-04-20 16:45 -------- d-----w- c:\users\Joel\AppData\Roaming\VirtuaWin

2010-04-20 16:45 . 2010-04-20 16:45 -------- d-----w- c:\program files\VirtuaWin

2010-04-20 14:59 . 2010-05-07 01:55 -------- d-----w- c:\windows\system32\wbem\repository

2010-04-20 03:50 . 2010-04-20 03:50 -------- d-----w- c:\users\Joel\AppData\Local\Logitech

2010-04-20 00:16 . 2010-04-20 00:28 -------- d-----w- c:\program files\360desktop

2010-04-20 00:16 . 2010-04-20 00:16 -------- d-----w- c:\users\Joel\AppData\Roaming\360desktop

2010-04-19 19:36 . 2010-04-19 19:36 -------- d-----w- c:\users\Joel\AppData\Roaming\Facebook

2010-04-19 14:32 . 2010-04-19 14:32 91136 ---ha-w- c:\windows\system32\byvwvs.dll

2010-04-18 16:05 . 2010-04-23 16:56 -------- d-----w- c:\users\Joel\AppData\Roaming\TrueCrypt

2010-04-18 15:56 . 2010-04-18 15:56 -------- d-----w- c:\programdata\TrueCrypt

2010-04-18 15:55 . 2010-04-18 15:55 223440 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2010-04-18 15:55 . 2010-04-18 15:55 -------- d-----w- c:\program files\TrueCrypt

2010-04-18 05:06 . 2010-05-07 01:56 95744 ---ha-w- c:\windows\system32\tusqnn.dll

2010-04-18 05:01 . 2010-04-18 05:02 -------- d-----w- c:\program files\TagRename

2010-04-18 05:01 . 2010-04-18 05:01 -------- d-----w- c:\users\Joel\AppData\Roaming\windrvswld

2010-04-18 05:01 . 2010-04-18 05:01 372021 ----a-w- c:\users\Joel\windrvswld.exe

2010-04-18 02:27 . 2010-04-18 02:27 -------- d-----w- c:\windows\system32\Wat

2010-04-17 14:19 . 2010-04-17 16:13 -------- d-----w- c:\users\Joel\AppData\Roaming\DivX

2010-04-17 14:19 . 2010-05-05 14:50 -------- d-----w- c:\program files\Common Files\PX Storage Engine

2010-04-17 14:18 . 2010-04-17 14:18 -------- d-----w- c:\program files\Common Files\DivX Shared

2010-04-17 14:04 . 2010-05-05 14:50 -------- d-----w- c:\program files\DivX

2010-04-17 14:03 . 2010-05-05 15:05 -------- d-----w- c:\programdata\DivX

2010-04-17 00:33 . 2010-04-17 00:33 -------- d-----w- c:\programdata\Adobe Systems

2010-04-17 00:32 . 2010-04-17 16:06 -------- d-----w- c:\users\Joel\AppData\Local\Adobe

2010-04-16 22:22 . 2010-04-16 22:22 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared

2010-04-16 21:28 . 2010-04-16 21:28 -------- d-----w- c:\users\Joel\AppData\Roaming\OpenOffice.org

2010-04-16 21:26 . 2010-04-23 22:50 -------- d-----w- c:\programdata\FLEXnet

2010-04-16 21:14 . 2010-04-24 06:13 -------- d-----w- c:\program files\OpenOffice.org 3

2010-04-16 21:14 . 2010-04-16 21:14 -------- d-----w- c:\program files\Common Files\Java

2010-04-16 21:13 . 2010-04-16 21:13 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-04-16 21:13 . 2010-04-16 21:13 -------- d-----w- c:\program files\Java

2010-04-16 20:50 . 2010-04-16 20:50 -------- d-----w- c:\users\Joel\AppData\Roaming\FastStone

2010-04-16 20:04 . 2010-04-16 20:04 -------- d-----w- c:\program files\PowerISO

2010-04-16 19:48 . 2007-03-22 05:02 37376 ----a-w- c:\windows\system32\drivers\rixdptsk.sys

2010-04-16 19:48 . 2007-02-24 21:42 39936 ----a-w- c:\windows\system32\drivers\rimmptsk.sys

2010-04-16 19:48 . 2007-01-23 23:40 42496 ----a-w- c:\windows\system32\drivers\rimsptsk.sys

2010-04-16 19:48 . 2004-09-04 10:00 90112 ----a-w- c:\windows\system32\snymsico.dll

2010-04-16 19:48 . 2010-04-27 02:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-04-16 19:47 . 2010-04-27 02:18 -------- d-----w- c:\program files\Common Files\InstallShield

2010-04-16 19:37 . 2010-04-29 17:07 -------- d-----w- c:\users\Joel\AppData\Local\Apple Computer

2010-04-16 19:37 . 2010-04-25 19:31 -------- d-----w- c:\users\Joel\AppData\Roaming\Apple Computer

2010-04-16 19:37 . 2010-04-16 19:37 -------- dc----w- c:\windows\system32\DRVSTORE

2010-04-16 19:37 . 2009-05-18 20:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-04-16 19:37 . 2008-04-17 19:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-04-16 19:36 . 2010-04-16 19:36 -------- d-----w- c:\program files\iPod

2010-04-16 19:36 . 2010-04-16 19:37 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-16 19:36 . 2010-04-16 19:37 -------- d-----w- c:\program files\iTunes

2010-04-16 19:34 . 2010-04-16 19:35 -------- d-----w- c:\program files\QuickTime

2010-04-16 19:34 . 2010-04-16 19:36 -------- d-----w- c:\programdata\Apple Computer

2010-04-16 19:34 . 2010-04-16 19:34 -------- d-----w- c:\users\Joel\AppData\Local\Apple

2010-04-16 19:34 . 2010-04-16 19:34 -------- d-----w- c:\program files\Apple Software Update

2010-04-16 19:33 . 2010-04-16 19:33 -------- d-----w- c:\program files\Bonjour

2010-04-16 19:33 . 2010-04-16 19:36 -------- d-----w- c:\program files\Common Files\Apple

2010-04-16 19:33 . 2010-04-16 19:33 -------- d-----w- c:\programdata\Apple

2010-04-16 19:24 . 2010-05-06 22:06 -------- d-----w- c:\users\Joel\AppData\Roaming\vlc

2010-04-16 17:32 . 2010-04-16 17:32 -------- d-----w- c:\program files\GreedyTorrent

2010-04-16 17:18 . 2006-03-17 21:49 368640 ----a-w- c:\windows\system32\TwnLib4.dll

2010-04-16 17:18 . 2006-03-17 18:45 802816 ----a-w- c:\windows\system32\imagXRA7.dll

2010-04-16 17:18 . 2006-03-17 18:45 497296 ----a-w- c:\windows\system32\imagXpr7.dll

2010-04-16 17:18 . 2006-03-17 18:45 258048 ----a-w- c:\windows\system32\imagXR7.dll

2010-04-16 17:18 . 2006-03-17 18:45 1757184 ----a-w- c:\windows\system32\imagX7.dll

2010-04-16 17:18 . 2010-04-16 17:18 -------- d-----w- c:\program files\Nero

2010-04-16 17:18 . 2010-04-16 17:18 -------- d-----w- c:\programdata\Nero

2010-04-16 17:18 . 2010-04-16 17:18 -------- d-----w- c:\program files\Common Files\Nero

2010-04-16 17:14 . 2010-04-16 17:14 -------- d-----w- c:\program files\VideoLAN

2010-04-16 17:09 . 2010-04-16 17:09 0 ----a-w- c:\windows\nsreg.dat

2010-04-16 17:09 . 2010-04-16 17:09 -------- d-----w- c:\users\Joel\AppData\Local\Thunderbird

2010-04-16 17:09 . 2010-04-16 17:09 -------- d-----w- c:\users\Joel\AppData\Roaming\Thunderbird

2010-04-16 17:08 . 2010-05-03 23:53 -------- d-----w- c:\program files\Mozilla Thunderbird

2010-04-16 16:21 . 2010-04-16 16:50 -------- d-----w- c:\programdata\BitDefender

2010-04-16 16:21 . 2010-04-16 16:21 -------- d-----w- c:\users\Joel\AppData\Roaming\BitDefender

2010-04-16 16:21 . 2010-04-16 16:21 -------- d-----w- c:\program files\BitDefender

2010-04-16 16:19 . 2010-04-16 16:49 -------- d-----w- c:\program files\Common Files\BitDefender

2010-04-16 16:13 . 2010-05-02 15:24 -------- d-----w- c:\program files\uTorrent

2010-04-16 16:10 . 2010-05-06 17:43 2356 ----a-w- c:\windows\system32\secushr.dat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-05 15:05 . 2010-04-17 14:19 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-05-05 14:50 . 2010-05-05 14:50 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-05-05 14:50 . 2010-05-05 14:50 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe

2010-05-05 14:50 . 2010-05-05 14:50 57679 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe

2010-05-05 14:50 . 2010-05-05 14:50 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe

2010-05-05 14:49 . 2010-05-05 14:49 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe

2010-05-05 14:49 . 2010-05-05 14:49 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe

2010-05-05 14:49 . 2010-05-05 14:49 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe

2010-05-05 14:49 . 2010-05-05 14:49 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe

2010-05-05 14:49 . 2010-05-05 14:49 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe

2010-05-05 14:35 . 2010-04-17 14:04 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe

2010-05-05 14:35 . 2010-04-17 14:19 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll

2010-05-05 14:35 . 2010-04-17 14:19 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe

2010-05-05 14:34 . 2010-05-05 14:34 388096 ----a-r- c:\users\Joel\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-04-24 19:34 . 2010-04-24 19:34 85504 ----a-w- c:\users\Joel\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll

2010-04-21 17:40 . 2010-04-16 21:28 1 ----a-w- c:\users\Joel\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-04-19 19:36 . 2010-04-19 19:36 50354 ----a-w- c:\users\Joel\AppData\Roaming\Facebook\uninstall.exe

2010-04-18 05:01 . 2010-04-18 05:01 372021 ----a-w- c:\users\Joel\AppData\Roaming\windrvswld\windrvswld.exe

2010-04-17 14:19 . 2010-04-17 14:19 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 57609 ----a-w- c:\programdata\DivX\MFComponents\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 54629 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe

2010-04-17 14:18 . 2010-04-17 14:18 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe

2010-04-16 19:52 . 2010-04-16 19:52 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2010-03-26 08:48 . 2010-03-26 08:48 73000 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe

2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll

2010-03-06 05:30 . 2010-03-06 05:30 847040 ----a-w- c:\users\Joel\AppData\Roaming\Facebook\axfbootloader.dll

2010-03-06 05:30 . 2010-03-06 05:30 5582848 ----a-w- c:\users\Joel\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll

2010-02-27 12:07 . 2010-04-16 03:47 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-27 12:07 . 2010-04-16 03:47 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-23 07:56 . 2010-04-16 03:47 977920 ----a-w- c:\windows\system32\wininet.dll

2010-02-22 21:58 . 2010-02-22 21:58 291352 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys

2010-02-19 19:27 . 2010-02-19 19:27 720384 ----a-w- c:\windows\system32\DivX.dll

2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx0c.dll

2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx07.dll

2010-02-19 19:27 . 2010-02-19 19:27 847872 ----a-w- c:\windows\system32\divx_xx0a.dll

2010-02-19 19:27 . 2010-02-19 19:27 843776 ----a-w- c:\windows\system32\divx_xx16.dll

2010-02-19 19:27 . 2010-02-19 19:27 839680 ----a-w- c:\windows\system32\divx_xx11.dll

2010-02-12 18:46 . 2010-02-12 18:46 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-02-12 18:46 . 2010-02-12 18:46 107808 ----a-w- c:\windows\system32\dns-sd.exe

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-02-04 21:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-02 321328]

"GreedyTorrent"="c:\program files\GreedyTorrent\GTor.exe" [2007-03-08 2526661]

"windrvswld"="c:\users\Joel\AppData\Roaming\windrvswld\windrvswld.exe" [2010-04-18 372021]

"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2009-11-11 3124160]

"gebyvudrv"="tusqnn.dll" [2010-05-07 95744]

"Google Update"="c:\users\Joel\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-05-06 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-06 13605408]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-06 92704]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2009-09-17 153608]

"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-20 71152]

"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2010-03-18 1123360]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

"pmnklldrv"="tusqnn.dll" [2010-05-07 95744]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

"efdaaasys"="rqpomm.dll" [2010-05-07 87552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"fcywvsdrv"="tusqnn.dll" [2010-05-07 95744]

"opmlifsys"="rqpomm.dll" [2010-05-07 87552]

c:\users\Joel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 rqpomm.dll

R3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2009-10-20 183880]

R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-18 1343400]

S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [2010-01-05 79368]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys [2010-02-03 153448]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx REG_MULTI_SZ scan

.

Contents of the 'Scheduled Tasks' folder

2010-05-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-876052268-1848050255-1347733830-1000Core.job

- c:\users\Joel\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-06 17:43]

2010-05-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-876052268-1848050255-1347733830-1000UA.job

- c:\users\Joel\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-06 17:43]

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: Add to &Evernote - c:\program files\Evernote\Evernote3.5\enbar.dll/2000

IE: Download All By FlashGet3 - c:\users\Joel\AppData\Roaming\FlashGetBHO\GetAllUrl.htm

IE: Download By FlashGet3 - c:\users\Joel\AppData\Roaming\FlashGetBHO\GetUrl.htm

IE: {{E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\Evernote\Evernote3.5\enbar.dll

Trusted Zone: kuaiche.com\software

FF - ProfilePath - c:\users\Joel\AppData\Roaming\Mozilla\Firefox\Profiles\3tzksjjy.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-360desktop - c:\program files\360desktop\360desktop.exe

AddRemove-FlashGet 3.3 - c:\program files\FlashGet Network\FlashGet 3\uninst.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\SetID\Internal]

@Denied: (A 2) (LocalSystem)

"DATA"="<settings expireTime=\"0\" productStatus=\"1\" obSize=\"0\" InstallSTD=\"2145870353\" isSubsc=\"0\" version=\"12.0.1\" timeDiff=\"1\" oldDevice=\"\" authStatus_av=\"0\" />"

"Device"="xr3Pxr2+yLnPx87MzrzMy8y7zcs="

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(684)

c:\windows\System32\tusqnn.dll

- - - - - - - > 'Explorer.exe'(3204)

c:\windows\System32\tusqnn.dll

- - - - - - - > 'csrss.exe'(604)

c:\windows\system32\rqpomm.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

c:\program files\BitDefender\BitDefender 2010\vsserv.exe

c:\windows\system32\rundll32.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\BitDefender\BitDefender 2010\seccenter.exe

c:\windows\System32\rundll32.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\sppsvc.exe

c:\windows\system32\taskhost.exe

.

**************************************************************************

.

Completion time: 2010-05-06 21:02:33 - machine was rebooted

ComboFix-quarantined-files.txt 2010-05-07 02:02

Pre-Run: 52,089,454,592 bytes free

Post-Run: 51,977,789,440 bytes free

- - End Of File - - EC0B4E0C5FAE1BB36378E075F4176080

IndiGenus · May 7, 2010

NOTE: To stay clean in the future you should really avoid downloading torrents and fancy "downloaders". With that said I would suggest you uninstall the following from Control Panel.

uTorrent

Greedytorrent

I would also suggest you uninstall the Ask Toolbar as is was probably bundled with some of the garbage you have downloaded recently.

1. Open Notepad

2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.malwarebytes.org/index.php?showtopic=49505&st=0&gopid=246266entry246266

Collect::
c:\windows\system32\byvwvs.dll
c:\windows\system32\tusqnn.dll
c:\users\Joel\windrvswld.exe

File::
c:\windows\system32\rqpomm.dll

Folder::
c:\users\Joel\AppData\Roaming\windrvswld

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"windrvswld"=-
"gebyvudrv"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pmnklldrv"=-
"efdaaasys"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"fcywvsdrv"=-
"opmlifsys"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
New DDS logs..

joelstitch · May 7, 2010

ComboFix 10-05-06.01 - Joel 05/07/2010 9:56.2.2 - x86

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1983.1053 [GMT -5:00]

Running from: c:\users\Joel\Desktop\ComboFix.exe

Command switches used :: c:\users\Joel\Desktop\CFScript.txt

FILE ::

"c:\windows\system32\rqpomm.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Joel\AppData\Roaming\windrvswld

c:\users\Joel\AppData\Roaming\windrvswld\config.ini

c:\users\Joel\AppData\Roaming\windrvswld\windrvswld.exe

c:\users\Joel\windrvswld.exe

c:\windows\system32\byvwvs.dll

c:\windows\system32\rqpomm.dll

c:\windows\system32\tusqnn.dll

.

((((((((((((((((((((((((( Files Created from 2010-04-07 to 2010-05-07 )))))))))))))))))))))))))))))))

.

2010-05-07 15:06 . 2010-05-07 15:10 -------- d-----w- c:\users\Joel\AppData\Local\temp

2010-05-07 15:06 . 2010-05-07 15:06 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-05-07 15:06 . 2010-05-07 15:06 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-05-07 14:54 . 2010-05-07 14:54 -------- d-----w- C:\32788R22FWJFW

2010-05-06 18:05 . 2010-05-07 04:22 -------- d-----w- c:\users\Joel\AppData\Roaming\FileZilla

2010-05-06 18:05 . 2010-05-06 18:05 -------- d-----w- c:\program files\FileZilla FTP Client

2010-05-06 17:43 . 2010-05-06 17:46 -------- d-----w- c:\users\Joel\AppData\Local\Google

2010-05-06 04:32 . 2010-05-07 15:10 87552 ---ha-w- c:\windows\system32\rqpomm.dll