How to remove Rootkit.Bubnix from MY computer?

Brok3 · September 9, 2010

DDS (Ver_10-03-17.01) - NTFSx86

Run by Dylan at 22:09:56.42 on Wed 09/08/2010

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2607 [GMT -4:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\WINDOWS\system32\ZuneBusEnum.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Razer\Lachesis\razerhid.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe

C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe

C:\Program Files\Razer\Lachesis\OSD.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Razer\Lachesis\razertra.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\Razer\Lachesis\razerofa.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\iPod\bin\iPodService.exe

c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\SwiftKit\SwiftKit-RS.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Dylan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.myspace.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = http=127.0.0.1:6522

uInternet Settings,ProxyOverride = <local>

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll

uURLSearchHooks: LoL Strategy Builds Toolbar: {1d09b5e5-973b-47d3-b9da-5579bda6eb62} - c:\program files\lol_strategy_builds\tbLoL_.dll

uURLSearchHooks: Runescape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Runescape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

TB: LoL Strategy Builds Toolbar: {1d09b5e5-973b-47d3-b9da-5579bda6eb62} - c:\program files\lol_strategy_builds\tbLoL_.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll

TB: Runescape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [cdloader] "c:\documents and settings\dylan\application data\mjusbsp\cdloader2.exe" MAGICJACK

uRun: [NCsoft Launcher] c:\program files\ncsoft\launcher\NCLauncher.exe /Minimized

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

uRun: [AdobeBridge]

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [Fxixiyayiyohuy] rundll32.exe "c:\windows\MODVACP.dll",Startup

uRun: [Google Update] "c:\documents and settings\dylan\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"

mRun: [Lachesis] c:\program files\razer\lachesis\razerhid.exe

mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"

mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE

mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"

mRun: [Launch LgDeviceAgent] "c:\program files\logitech\gamepanel software\LgDevAgt.exe"

mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"

mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE

mRun: [Lmezayewiducenaf] rundll32.exe "c:\windows\efaviciduh.dll",Startup

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [notepad]

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler

mRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

dRun: [notepad] rundll32.exe c:\docume~1\networ~1\ntload.dll,_IWMPEvents@0

dRun: [uvpncgek] c:\documents and settings\dylan\local settings\application data\gwyvptmmq\awclnpjshdw.exe

uExplorerRun: [system32]

mExplorerRun: [system32]

StartupFolder: c:\documents and settings\dylan\start menu\programs\startup\CurseClientStartup.ccip

StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\impuls~1.lnk - c:\program files\stardock\impulse\now\ImpulseNow.exe

StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\memeoa~1.lnk - c:\docume~1\dylan\applic~1\microsoft\installer\{6bceb97b-f315-455d-bc2d-565a1a6781e8}\NewShortcut4_51A847D327C24F7797772AF2A4E486ED.exe

StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\memeoa~2.lnk - c:\program files\memeo\autosync\MemeoLauncher.exe

StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE

mPolicies-system: EnableLUA = 0 (0x0)

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

Trusted Zone: mobafire.com

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll

IFEO: image file execution options - svchost.exe

Hosts: 74.125.45.100 4-open-davinci.com

Hosts: 74.125.45.100 securitysoftwarepayments.com

Hosts: 74.125.45.100 privatesecuredpayments.com

Hosts: 74.125.45.100 secure.privatesecuredpayments.com

Hosts: 74.125.45.100 getantivirusplusnow.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

============= SERVICES / DRIVERS ===============

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [2008-12-1 123392]

R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2009-7-16 12032]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-7-14 19720]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\tffsmon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\tfsysmon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

S3 apf001;apf001;c:\program files\softnyx\rakionis\bin\apf001.sys [2010-7-7 10872]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\tfnetmon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]

S3 XDva344;XDva344;\??\c:\windows\system32\xdva344.sys --> c:\windows\system32\XDva344.sys [?]

S4 AutoSyncService;Memeo AutoSync ;c:\program files\memeo\autosync\MemeoService.exe [2007-7-6 31768]

=============== Created Last 30 ================

2010-09-09 01:48:49 176 ----a-w- c:\documents and settings\dylan\defogger_reenable

2010-09-09 00:36:24 54016 ----a-w- c:\windows\system32\drivers\dfwcumgq.sys

2010-09-08 01:44:53 0 d-----w- C:\$WIN_NT$.~BT

2010-09-08 01:44:40 0 d-----w- c:\windows\setupupd

2010-09-06 21:35:19 47104 ---ha-w- c:\windows\system32\bootpart.dll

2010-09-06 21:16:31 0 d-----w- C:\League of Legends

2010-09-01 13:32:58 0 d-----w- c:\program files\Runescape

2010-08-25 17:14:49 2843 ----a-w- c:\windows\amirikijirazoh.dll

2010-08-25 17:04:22 0 d-----w- c:\docume~1\dylan\applic~1\glsbjrvfp

2010-08-22 22:00:28 0 d-----w- c:\program files\MySQL

2010-08-22 22:00:28 0 d-----w- c:\docume~1\alluse~1\applic~1\MySQL

2010-08-21 23:24:31 0 d-sh--w- c:\docume~1\alluse~1\applic~1\MSYAYS

2010-08-21 23:24:05 0 d-sh--w- c:\docume~1\alluse~1\applic~1\5b24f97

2010-08-17 11:11:36 27224 ---ha-w- c:\windows\system32\mlfcache.dat

2010-08-16 21:16:03 0 d-----w- c:\program files\iPod

2010-08-16 21:15:58 0 d-----w- c:\program files\iTunes

2010-08-16 21:15:58 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-08-16 21:14:56 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2010-08-16 21:14:56 3062048 ----a-w- c:\windows\system32\usbaaplrc.dll

2010-08-16 21:14:37 0 d-----w- c:\program files\Bonjour

2010-08-15 13:41:27 0 d-----w- c:\docume~1\alluse~1\applic~1\Update

2010-08-15 05:49:36 0 d-----w- c:\program files\StarCraft II

2010-08-15 04:10:53 0 d-----w- c:\program files\common files\DirectX

2010-08-15 04:08:46 230752 ----a-w- c:\windows\patchw32.dll

2010-08-15 04:08:45 118176 ----a-w- c:\windows\patchw.dll

2010-08-15 03:59:19 0 d-----w- c:\program files\Outspark

2010-08-12 16:42:12 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll

2010-08-12 16:42:12 527192 ----a-w- c:\windows\system32\XAudio2_7.dll

2010-08-12 16:42:12 239960 ----a-w- c:\windows\system32\xactengine3_7.dll

2010-08-12 16:42:11 470880 ----a-w- c:\windows\system32\d3dx10_43.dll

2010-08-12 16:42:11 248672 ----a-w- c:\windows\system32\d3dx11_43.dll

2010-08-12 16:42:11 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll

2010-08-12 16:42:11 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll

2010-08-12 16:42:10 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll

2010-08-12 15:07:19 0 d-----w- c:\program files\Picasa2

2010-08-12 15:06:25 0 d-----w- c:\program files\Western Digital

2010-08-12 15:06:09 0 d-----w- c:\program files\common files\eSellerate

2010-08-12 15:05:31 0 d-----w- c:\program files\Memeo

2010-08-12 15:05:25 0 d-s---w- c:\docume~1\alluse~1\applic~1\Memeo

==================== Find3M ====================

2010-09-09 02:10:43 766464 ----a-w- c:\windows\system32\drivers\qaxhu.sys

2010-09-09 01:40:10 99 ----a-w- c:\documents and settings\dylan\jagex_runescape_preferences2.dat

2010-09-09 01:37:18 41 ----a-w- c:\documents and settings\dylan\jagex__preferences3.dat

2010-09-09 01:37:16 46 ----a-w- c:\documents and settings\dylan\jagex_runescape_preferences.dat

2010-09-08 00:43:49 1384479 ----a-w- c:\windows\system32\msvbvm60.dll

2010-08-10 15:12:43 2848 ----a-w- c:\windows\Gqodexuyodeg.dat

2010-07-18 14:50:58 112 ----a-w- c:\docume~1\alluse~1\applic~1\NR77m5.dat

2010-07-13 17:00:13 2730 ----a-w- c:\windows\otezabulamufoy.dll

2010-07-13 16:27:38 2730 ----a-w- c:\windows\enavamebopevu.dll

2010-07-13 13:33:37 2730 ----a-w- c:\windows\olupoxulodipoki.dll

2010-07-08 03:31:48 12920 ----a-w- c:\windows\system32\apl001.sys

2010-07-08 03:31:48 10872 ----a-w- c:\windows\system32\apf001.sys

2006-04-14 11:17:25 581632 --sha-r- c:\windows\windows\plugin.dat

============= FINISH: 22:18:56.37 ===============

All help is highly appreciated and thank you for taking the time to help me, if you find any other problems with my computer please, feel free to help me fix those as well, i'm new at all of this but i'm a fast learner, thanks everyone.

Brok3 · September 9, 2010

DDS (Ver_10-03-17.01) - NTFSx86
Run by Dylan at 22:09:56.42 on Wed 09/08/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2607 [GMT -4:00]
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Razer\Lachesis\OSD.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Razer\Lachesis\razertra.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SwiftKit\SwiftKit-RS.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Dylan\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.myspace.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:6522
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: LoL Strategy Builds Toolbar: {1d09b5e5-973b-47d3-b9da-5579bda6eb62} - c:\program files\lol_strategy_builds\tbLoL_.dll
uURLSearchHooks: Runescape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Runescape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
TB: LoL Strategy Builds Toolbar: {1d09b5e5-973b-47d3-b9da-5579bda6eb62} - c:\program files\lol_strategy_builds\tbLoL_.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: Runescape Toolbar: {a8864317-e18b-4292-99d9-e6e65ab905d3} - c:\program files\runescape\tbRune.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [cdloader] "c:\documents and settings\dylan\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [NCsoft Launcher] c:\program files\ncsoft\launcher\NCLauncher.exe /Minimized
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe
uRun: [AdobeBridge]
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Fxixiyayiyohuy] rundll32.exe "c:\windows\MODVACP.dll",Startup
uRun: [Google Update] "c:\documents and settings\dylan\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [Lachesis] c:\program files\razer\lachesis\razerhid.exe
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\quickcam\Quickcam.exe" /hide
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [Launch LgDeviceAgent] "c:\program files\logitech\gamepanel software\LgDevAgt.exe"
mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe"
mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
mRun: [Lmezayewiducenaf] rundll32.exe "c:\windows\efaviciduh.dll",Startup
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [notepad]
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [notepad] rundll32.exe c:\docume~1\networ~1\ntload.dll,_IWMPEvents@0
dRun: [uvpncgek] c:\documents and settings\dylan\local settings\application data\gwyvptmmq\awclnpjshdw.exe
uExplorerRun: [system32]
mExplorerRun: [system32]
StartupFolder: c:\documents and settings\dylan\start menu\programs\startup\CurseClientStartup.ccip
StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\impuls~1.lnk - c:\program files\stardock\impulse\now\ImpulseNow.exe
StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\memeoa~1.lnk - c:\docume~1\dylan\applic~1\microsoft\installer\{6bceb97b-f315-455d-bc2d-565a1a6781e8}\NewShortcut4_51A847D327C24F7797772AF2A4E486ED.exe
StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\memeoa~2.lnk - c:\program files\memeo\autosync\MemeoLauncher.exe
StartupFolder: c:\docume~1\dylan\startm~1\programs\startup\stardo~1.lnk - c:\program files\stardock\objectdock\ObjectDock.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
mPolicies-system: EnableLUA = 0 (0x0)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Trusted Zone: mobafire.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\System32\DreamScene.dll
IFEO: image file execution options - svchost.exe
Hosts: 74.125.45.100 4-open-davinci.com
Hosts: 74.125.45.100 securitysoftwarepayments.com
Hosts: 74.125.45.100 privatesecuredpayments.com
Hosts: 74.125.45.100 secure.privatesecuredpayments.com
Hosts: 74.125.45.100 getantivirusplusnow.com
Note: multiple HOSTS entries found. Please refer to Attach.txt
============= SERVICES / DRIVERS ===============
R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [2008-12-1 123392]
R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2009-7-16 12032]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-7-14 19720]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\tffsmon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\tfsysmon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]
S3 apf001;apf001;c:\program files\softnyx\rakionis\bin\apf001.sys [2010-7-7 10872]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\tfnetmon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]
S3 XDva344;XDva344;\??\c:\windows\system32\xdva344.sys --> c:\windows\system32\XDva344.sys [?]
S4 AutoSyncService;Memeo AutoSync ;c:\program files\memeo\autosync\MemeoService.exe [2007-7-6 31768]
=============== Created Last 30 ================
2010-09-09 01:48:49 176 ----a-w- c:\documents and settings\dylan\defogger_reenable
2010-09-09 00:36:24 54016 ----a-w- c:\windows\system32\drivers\dfwcumgq.sys
2010-09-08 01:44:53 0 d-----w- C:\$WIN_NT$.~BT
2010-09-08 01:44:40 0 d-----w- c:\windows\setupupd
2010-09-06 21:35:19 47104 ---ha-w- c:\windows\system32\bootpart.dll
2010-09-06 21:16:31 0 d-----w- C:\League of Legends
2010-09-01 13:32:58 0 d-----w- c:\program files\Runescape
2010-08-25 17:14:49 2843 ----a-w- c:\windows\amirikijirazoh.dll
2010-08-25 17:04:22 0 d-----w- c:\docume~1\dylan\applic~1\glsbjrvfp
2010-08-22 22:00:28 0 d-----w- c:\program files\MySQL
2010-08-22 22:00:28 0 d-----w- c:\docume~1\alluse~1\applic~1\MySQL
2010-08-21 23:24:31 0 d-sh--w- c:\docume~1\alluse~1\applic~1\MSYAYS
2010-08-21 23:24:05 0 d-sh--w- c:\docume~1\alluse~1\applic~1\5b24f97
2010-08-17 11:11:36 27224 ---ha-w- c:\windows\system32\mlfcache.dat
2010-08-16 21:16:03 0 d-----w- c:\program files\iPod
2010-08-16 21:15:58 0 d-----w- c:\program files\iTunes
2010-08-16 21:15:58 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-16 21:14:56 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2010-08-16 21:14:56 3062048 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-08-16 21:14:37 0 d-----w- c:\program files\Bonjour
2010-08-15 13:41:27 0 d-----w- c:\docume~1\alluse~1\applic~1\Update
2010-08-15 05:49:36 0 d-----w- c:\program files\StarCraft II
2010-08-15 04:10:53 0 d-----w- c:\program files\common files\DirectX
2010-08-15 04:08:46 230752 ----a-w- c:\windows\patchw32.dll
2010-08-15 04:08:45 118176 ----a-w- c:\windows\patchw.dll
2010-08-15 03:59:19 0 d-----w- c:\program files\Outspark
2010-08-12 16:42:12 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2010-08-12 16:42:12 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2010-08-12 16:42:12 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2010-08-12 16:42:11 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2010-08-12 16:42:11 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2010-08-12 16:42:11 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2010-08-12 16:42:11 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2010-08-12 16:42:10 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-08-12 15:07:19 0 d-----w- c:\program files\Picasa2
2010-08-12 15:06:25 0 d-----w- c:\program files\Western Digital
2010-08-12 15:06:09 0 d-----w- c:\program files\common files\eSellerate
2010-08-12 15:05:31 0 d-----w- c:\program files\Memeo
2010-08-12 15:05:25 0 d-s---w- c:\docume~1\alluse~1\applic~1\Memeo
==================== Find3M ====================
2010-09-09 02:10:43 766464 ----a-w- c:\windows\system32\drivers\qaxhu.sys
2010-09-09 01:40:10 99 ----a-w- c:\documents and settings\dylan\jagex_runescape_preferences2.dat
2010-09-09 01:37:18 41 ----a-w- c:\documents and settings\dylan\jagex__preferences3.dat
2010-09-09 01:37:16 46 ----a-w- c:\documents and settings\dylan\jagex_runescape_preferences.dat
2010-09-08 00:43:49 1384479 ----a-w- c:\windows\system32\msvbvm60.dll
2010-08-10 15:12:43 2848 ----a-w- c:\windows\Gqodexuyodeg.dat
2010-07-18 14:50:58 112 ----a-w- c:\docume~1\alluse~1\applic~1\NR77m5.dat
2010-07-13 17:00:13 2730 ----a-w- c:\windows\otezabulamufoy.dll
2010-07-13 16:27:38 2730 ----a-w- c:\windows\enavamebopevu.dll
2010-07-13 13:33:37 2730 ----a-w- c:\windows\olupoxulodipoki.dll
2010-07-08 03:31:48 12920 ----a-w- c:\windows\system32\apl001.sys
2010-07-08 03:31:48 10872 ----a-w- c:\windows\system32\apf001.sys
2006-04-14 11:17:25 581632 --sha-r- c:\windows\windows\plugin.dat
============= FINISH: 22:18:56.37 ===============
All help is highly appreciated and thank you for taking the time to help me, if you find any other problems with my computer please, feel free to help me fix those as well, i'm new at all of this but i'm a fast learner, thanks everyone.

Attach.rar

LDTate · September 9, 2010

check some settings on your system:

Enter your Control Panel and double-click on Network Connections
Then right click on your Default Connection
- Usually Local Area Connection for Cable and DSL, or AOL Connection.

[*]Left click on Properties

[*]Double-Click on the Internet Protocol (TCP/IP) item

[*]Select the radio dial that says Obtain DNS Servers Automatically

[*]Press OK twice to get out of the properties screen

Go to Start->Run->Type CMD and click Ok. The MSDOS Window will be displayed. At the command prompt, type the following and press Enter after each line:

IPCONFIG /release

IPCONFIG /renew

Type Exit

Restart the computer.

Next:

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.

Click the Tools menu, and then click Folder Options.

Click the View tab.

Uncheck "Hide file extensions for known file types."

Under the "Hidden files" folder, select "Show hidden files and folders."

Uncheck "Hide protected operating system files."

Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.

When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:

Double-click on the Folder Options icon.

Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.

Click on Show Hidden Files or Folders.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

Brok3 · September 9, 2010

Thank you for the response!

Would you like me to post my "Attach" with copy/paste?

My computer isn't slow to load anything, but about three days ago all internet browsers stopped working and will crash when i open them, Chrome gives me an error that says this: The application failed to initialize properly (0xc0000022). Click on OK to terminate the application.

When i attempt to open FireFox i get this error: The application had a problem and crashed. Details: The application passed an invalid argument.

I did some research and found that i should start my PC in Safe mode and toggle an option on in My Computer>Tools>Folder Options on the security tab, when i attempted to start in Safe mode, it loaded like normal, then just shutdown after loading everything in Bios.

Once again, thank you for your response, all help is extremely appreciated!

Here is my Mbam scan log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4585

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

9/9/2010 7:12:04 PM

mbam-log-2010-09-09 (19-12-04).txt

Scan type: Quick scan

Objects scanned: 150713

Time elapsed: 7 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\Software\WinServers (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\qaxhu.sys (Rootkit.Bubnix) -> Delete on reboot.

LDTate · September 9, 2010

C:\WINDOWS\system32\drivers\qaxhu.sys (Rootkit.Bubnix) -> Delete on reboot.

Did you reboot? If not, do so

Then

Run and post a new DDS scan.

Brok3 · September 9, 2010

DDS (Ver_10-03-17.01) - NTFSx86

Run by Dylan at 19:21:33.79 on Thu 09/09/2010

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2741 [GMT -4:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Razer\Lachesis\razerhid.exe

C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\PowerISO\PWRISOVM.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Zune\ZuneLauncher.exe

C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe

C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe

C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\WinZip\WZQKPICK.EXE