Google Redirect Virus and Win 7 Home Security 2011 Virus

Shrunkin · April 4, 2011

I have been ignoring the Google Redirect virus for the past two and a half months. Not the best solution, but I just could not get rid of it. I didn't think it would be particularly dangerous, but just a week ago my laptop became infected with the Win 7 Home Security virus. I would deal with it (with Rkill and Malwarebytes), it would go away, and everything would seem normal. But then the virus would come back, and I'd have to repeat whole process of cleaning my computer again. This has happened every day for the past week. I'm a student who uses her laptop very often to type up documents and this virus is getting really annoying. Could someone help me get rid of it once and for all? Here are my logs:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6219

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

4/3/2011 6:18:19 PM

mbam-log-2011-04-03 (18-18-19).txt

Scan type: Quick scan

Objects scanned: 38771

Time elapsed: 3 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_11-03-05.01) - NTFS_AMD64

Run by Tammy at 18:48:57.56 on Sun 04/03/2011

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_15

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2939.1689 [GMT -4:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe

C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe

C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe

C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe

C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Windows\SysWOW64\DllHost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\real\realplayer\Update\realsched.exe

C:\Windows\system32\DRIVERS\xaudio64.exe

C:\Program Files (x86)\Xobni\XobniService.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe

C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe

C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe

C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe

C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe

C:\Program Files\Sony\VAIO Care\VCsystray.exe

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\WUDFHost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\iPod\bin\iPodService.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\DllHost.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Users\Tammy\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT

uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr10/*http://www.yahoo.com/ext/search/search.html

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr10/*http://www.yahoo.com

uStart Page = hxxp://www.yahoo.com/

uInternet Settings,ProxyOverride = *.local;<local>

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr10/*http://www.yahoo.com

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll

TB: Veoh Video Compass: {52836eb0-631a-47b1-94a6-61f9d9112dae} - C:\Program Files (x86)\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No File

uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe

uRun: [search Protection] C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe

uRun: [VeohPlugin] "C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"

uRun: [AdobeBridge]

uRun: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

mRun: [iSBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"

mRun: [YSearchProtection] "C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe"

mRun: [smartWiHelper] "C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin

mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [TkBellExe] "c:\program files\real\realplayer\Update\realsched.exe" -osboot

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

uPolicies-explorer: HideSCAHealth = 1 (0x1)

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~3\OFFICE11\REFIEBAR.DLL

LSP: C:\Windows\system32\securenet.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Xobni\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

Notify: VESWinlogon - VESWinlogon.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

TB-X64: {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No File

TB-X64: {CD292324-974F-4224-D074-CACA427AA030} - No File

TB-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

mRun-x64: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

mRun-x64: [skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe

mRun-x64: [igfxTray] C:\Windows\system32\igfxtray.exe

mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe

mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

mRun-x64: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

mRun-x64: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - yahoo.com

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&q=

FF - prefs.js: network.proxy.http_port - 62485

FF - prefs.js: network.proxy.type - 0

FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll

FF - component: C:\Users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCoreGecko19.dll

FF - component: C:\Users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll

FF - component: C:\Users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll

FF - plugin: C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: c:\program files\real\realplayer\Netscape6\nppl3260.dll

FF - plugin: c:\program files\real\realplayer\Netscape6\nprjplug.dll

FF - plugin: c:\program files\real\realplayer\Netscape6\nprpjplug.dll

FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll

FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: C:\Users\Tammy\AppData\Local\Yahoo!\BrowserPlus\2.4.17\Plugins\npybrowserplus_2.4.17.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - C:\Program Files (x86)\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Swag Bucks Community Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - %profile%\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}

FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - Ext: XULRunner: {B90AC0CF-150C-4208-B1DA-0A85C6E5DA21} - C:\Users\Tammy\AppData\Local\{B90AC0CF-150C-4208-B1DA-0A85C6E5DA21}

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true

FF - user.js: network.proxy.type - 0

FF - user.js: network.proxy.http -

user_pref(network.proxy.http_port,);

FF - user.js: network.proxy.no_proxies_on -

.

============= SERVICES / DRIVERS ===============

.

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-5-8 55280]

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2010-10-24 188928]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]

R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2009-5-8 104960]

R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-7-22 642920]

R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-11-4 468264]

R2 XobniService;XobniService;C:\Program Files (x86)\Xobni\XobniService.exe [2009-4-29 46824]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2009-5-8 19968]

R3 CAXHWAZL;CAXHWAZL;C:\Windows\System32\drivers\CAXHWAZL.sys [2009-4-9 300032]

R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\System32\drivers\MpNWMon.sys [2010-10-24 40832]

R3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2010-10-24 72064]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 SecureSrv;SecureSrv;C:\Program Files (x86)\Hide My IP 2007\SecureSrv.exe [2010-4-2 368718]

R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2009-4-9 11392]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate1c9cf8f33e9b278;Google Update Service (gupdate1c9cf8f33e9b278);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-5-7 133104]

S2 Roxio Upnp Server 10;Roxio Upnp Server 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-6-26 362992]

S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-6-26 313840]

S3 SampleCollector;Intel® Sample Collector;C:\Program Files\Sony\VAIO Care\collsvc.exe [2009-11-4 167424]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-2-18 51712]

S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-5-8 110376]

S3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [2010-3-13 1223024]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-4-3 1255736]

.

=============== Created Last 30 ================

.

2011-04-03 19:27:17 8424784 ----a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{21349DD9-46C6-477C-A11A-1E7EECD84578}\mpengine.dll

2011-04-03 04:52:56 601424 ------w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2011-04-03 04:52:53 601424 ------w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\{9FAA61F9-A017-446E-9309-BCB18C4CC56B}\gapaengine.dll

2011-04-03 04:52:51 8424784 ----a-w- C:\PROGRA~3\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-04-03 04:51:01 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2011-04-03 04:50:58 -------- d-----w- C:\Program Files\Microsoft Security Client

2011-04-03 02:13:52 586752 --sha-w- C:\Users\Tammy\AppData\Local\evo.exe

2011-04-02 18:26:19 12872 ----a-w- C:\Windows\System32\bootdelete.exe

2011-04-02 18:13:44 19528 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys

2011-04-02 18:12:55 -------- d-----w- C:\PROGRA~3\Hitman Pro

2011-04-02 15:27:29 586752 --sha-w- C:\Users\Tammy\AppData\Local\bqs.exe

2011-03-28 03:47:50 -------- d-----w- C:\Users\Tammy\AppData\Roaming\Malwarebytes

2011-03-28 03:47:46 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys

2011-03-28 03:47:45 -------- d-----w- C:\PROGRA~3\Malwarebytes

2011-03-28 03:47:41 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-03-28 03:47:41 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-03-12 16:28:40 103864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll

2011-03-12 16:28:40 103864 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll

2011-03-12 13:59:51 -------- d-----w- C:\Program Files\iTunes

.

==================== Find3M ====================

.

2011-02-19 06:37:44 1135104 ----a-w- C:\Windows\System32\FntCache.dll

2011-02-19 06:37:10 1540608 ----a-w- C:\Windows\System32\DWrite.dll

2011-02-19 06:36:49 902656 ----a-w- C:\Windows\System32\d2d1.dll

2011-02-19 05:32:48 1074176 ----a-w- C:\Windows\SysWow64\DWrite.dll

2011-02-19 05:32:35 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll

2011-02-18 21:36:58 51712 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys

2011-02-18 21:36:58 4184352 ----a-w- C:\Windows\System32\usbaaplrc.dll

2011-02-17 21:38:15 466456 ----a-w- C:\Windows\System32\wrap_oal.dll

2011-02-17 21:38:15 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2011-02-17 21:38:15 122904 ----a-w- C:\Windows\System32\OpenAL32.dll

2011-02-17 21:38:14 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2011-01-26 06:53:10 982912 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys

2011-01-26 06:53:10 265088 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys

2011-01-26 06:31:20 144384 ----a-w- C:\Windows\System32\cdd.dll

2011-01-17 21:13:09 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll

2011-01-17 21:13:08 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

2011-01-07 08:07:24 662528 ----a-w- C:\Windows\System32\XpsPrint.dll

2011-01-07 08:07:24 475648 ----a-w- C:\Windows\System32\XpsGdiConverter.dll

2011-01-07 08:06:50 46080 ----a-w- C:\Windows\System32\atmlib.dll

2011-01-07 07:31:10 442880 ----a-w- C:\Windows\SysWow64\XpsPrint.dll

2011-01-07 07:31:10 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll

2011-01-07 07:27:11 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

2011-01-07 05:49:20 366080 ----a-w- C:\Windows\System32\atmfd.dll

2011-01-07 05:33:11 294400 ----a-w- C:\Windows\SysWow64\atmfd.dll

2011-01-05 06:20:30 612352 ----a-w- C:\Windows\System32\vbscript.dll

2011-01-05 05:37:33 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll

2011-01-05 04:00:16 3127808 ----a-w- C:\Windows\System32\win32k.sys

.

============= FINISH: 18:49:35.54 ===============

Attach.zip

Maniac · April 4, 2011

Hello hrunkin! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.
Post all of your log files, don't attach them.

Step 1

Going over your logs I noticed that you have

Shrunkin · April 4, 2011

I uninstalled

Maniac · April 4, 2011

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

-

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Shrunkin · April 4, 2011

I disabled Microsoft Security Essentials, but according to Combofix, I didn't. I ran the scan anyway. Was that dangerous?

This is the log:

ComboFix 11-04-03.03 - Tammy 04/04/2011 16:11:24.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2939.1763 [GMT -4:00]

Running from: c:\users\Tammy\Desktop\Combo-Fix.exe

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\Mozilla Firefox\searchplugins\zwunzi127.xml

c:\program files (x86)\Mozilla Firefox\searchplugins\zwunzi129.xml

c:\program files (x86)\Mozilla Firefox\searchplugins\zwunzi131.xml

c:\program files (x86)\Search Toolbar

c:\program files (x86)\Search Toolbar\icon.ico

c:\program files (x86)\Search Toolbar\SearchToolbarUninstall.exe

c:\program files (x86)\Search Toolbar\SearchToolbarUpdater.exe

c:\users\Tammy\AppData\Local\{B90AC0CF-150C-4208-B1DA-0A85C6E5DA21}

c:\users\Tammy\AppData\Local\{B90AC0CF-150C-4208-B1DA-0A85C6E5DA21}\chrome.manifest

c:\users\Tammy\AppData\Local\{B90AC0CF-150C-4208-B1DA-0A85C6E5DA21}\chrome\content\_cfg.js

c:\users\Tammy\AppData\Local\{B90AC0CF-150C-4208-B1DA-0A85C6E5DA21}\chrome\content\overlay.xul

c:\users\Tammy\AppData\Local\{B90AC0CF-150C-4208-B1DA-0A85C6E5DA21}\install.rdf

c:\users\Tammy\AppData\Local\bqs.exe

c:\users\Tammy\AppData\Local\evo.exe

c:\users\Tammy\AppData\Roaming\Love

c:\users\Tammy\AppData\Roaming\Love\not_tetris\highscoresB.txt

.

((((((((((((((((((((((((( Files Created from 2011-03-04 to 2011-04-04 )))))))))))))))))))))))))))))))

.

2011-04-04 20:24 . 2011-04-04 20:24 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-04-04 20:24 . 2011-04-04 20:24 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-04-03 04:52 . 2011-04-03 04:51 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2011-04-03 04:52 . 2011-04-03 04:51 601424 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9FAA61F9-A017-446E-9309-BCB18C4CC56B}\gapaengine.dll

2011-04-03 04:52 . 2011-03-15 02:17 8424784 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-04-03 04:51 . 2011-04-03 04:51 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2011-04-03 04:50 . 2011-04-03 04:51 -------- d-----w- c:\program files\Microsoft Security Client

2011-04-02 18:26 . 2011-04-03 22:13 12872 ----a-w- c:\windows\system32\bootdelete.exe

2011-04-02 18:13 . 2011-04-04 03:43 19528 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-04-02 18:12 . 2011-04-02 18:34 -------- d-----w- c:\programdata\Hitman Pro

2011-03-28 03:47 . 2011-03-28 03:47 -------- d-----w- c:\users\Tammy\AppData\Roaming\Malwarebytes

2011-03-28 03:47 . 2010-12-20 22:09 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-03-28 03:47 . 2011-03-28 03:47 -------- d-----w- c:\programdata\Malwarebytes

2011-03-28 03:47 . 2011-03-28 03:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-03-28 03:47 . 2010-12-20 22:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-03-12 16:28 . 2011-03-12 16:28 103864 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll

2011-03-12 16:28 . 2011-03-12 16:28 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll

2011-03-12 13:59 . 2011-03-12 14:00 -------- d-----w- c:\program files\iTunes

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-09 09:30 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-02-18 21:36 . 2011-02-18 21:36 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys

2011-02-18 21:36 . 2011-02-18 21:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-02-17 21:38 . 2011-02-17 21:38 466456 ----a-w- c:\windows\system32\wrap_oal.dll

2011-02-17 21:38 . 2011-02-17 21:38 122904 ----a-w- c:\windows\system32\OpenAL32.dll

2011-02-17 21:38 . 2011-02-17 21:38 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2011-02-17 21:38 . 2011-02-17 21:38 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll

2011-01-26 06:53 . 2011-02-08 21:10 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2011-01-26 06:53 . 2011-02-08 21:10 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2011-01-26 06:31 . 2011-02-08 21:10 144384 ----a-w- c:\windows\system32\cdd.dll

2011-01-17 21:13 . 2011-01-17 21:13 770384 ----a-w- c:\windows\SysWow64\msvcr100.dll

2011-01-17 21:13 . 2011-01-17 21:13 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll

2011-01-07 08:07 . 2011-02-23 15:34 662528 ----a-w- c:\windows\system32\XpsPrint.dll

2011-01-07 08:07 . 2011-02-23 15:34 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-01-07 08:06 . 2011-02-08 21:09 46080 ----a-w- c:\windows\system32\atmlib.dll

2011-01-07 07:31 . 2011-02-23 15:34 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll

2011-01-07 07:31 . 2011-02-23 15:34 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll

2011-01-07 07:27 . 2011-02-08 21:09 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2011-01-07 05:49 . 2011-02-08 21:09 366080 ----a-w- c:\windows\system32\atmfd.dll

2011-01-07 05:33 . 2011-02-08 21:09 294400 ----a-w- c:\windows\SysWow64\atmfd.dll

2011-01-05 06:20 . 2011-02-08 21:10 612352 ----a-w- c:\windows\system32\vbscript.dll

2011-01-05 05:37 . 2011-02-08 21:10 428032 ----a-w- c:\windows\SysWow64\vbscript.dll

2011-01-05 04:00 . 2011-02-08 21:10 3127808 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2009-07-14 163328]

"Search Protection"="c:\program files (x86)\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

"VeohPlugin"="c:\program files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-07-06 2634048]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288]

"YSearchProtection"="c:\program files (x86)\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

"SmartWiHelper"="c:\program files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe" [2009-09-02 80384]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-23 402432]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2010-11-25 274608]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-07 421160]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-9-11 984352]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"HideSCAHealth"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2009-07-14 16:15 98304 ------w- c:\windows\System32\VESWinlogon.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate1c9cf8f33e9b278;Google Update Service (gupdate1c9cf8f33e9b278);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-05-08 133104]

R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-06-26 362992]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 282616]

R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-06-26 313840]

R3 SampleCollector;Intel® Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe [2008-09-29 167424]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2009-01-17 110376]

R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe [2010-06-09 1223024]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]

S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-07-22 642920]

S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-06-26 468264]

S2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe [2009-11-13 46824]

S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]

S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x]

S3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]

S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]

S3 SecureSrv;SecureSrv;c:\program files (x86)\Hide My IP 2007\SecureSrv.exe [2007-06-21 368718]

S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - MPFP

.

Contents of the 'Scheduled Tasks' folder

.

2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-05-08 03:43]

.

2011-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-05-08 03:43]

.

2011-04-03 c:\windows\Tasks\ParetoLogic Registration.job

- c:\windows\system32\rundll32.exe [2009-07-13 01:14]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-05-21 1220392]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-01-06 6956576]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-01-06 1833504]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-03-16 165912]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-03-16 387608]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-03-16 365592]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 1436224]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.yahoo.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;<local>

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr10/*http://www.yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\OFFICE11\EXCEL.EXE/3000

LSP: c:\windows\system32\securenet.dll

Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll

FF - ProfilePath - c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - yahoo.com

FF - prefs.js: network.proxy.http_port - 62485

FF - prefs.js: network.proxy.type - 0

FF - Ext: Hide My IP: staff@hide-my-ip.com - c:\program files (x86)\Mozilla Firefox\extensions\staff@hide-my-ip.com

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - c:\program files (x86)\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: BitComet Video Downloader: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB} - %profile%\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}

FF - Ext: Swag Bucks Community Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - %profile%\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}

FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true

FF - user.js: network.proxy.type - 0

FF - user.js: network.proxy.http -

user_pref(network.proxy.http_port,);

FF - user.js: network.proxy.no_proxies_on -

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

SafeBoot-MCODS

WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-UnityWebPlayer - c:\users\Tammy\AppData\Local\Unity\WebPlayer\Uninstall.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]

"ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2011-04-04 16:58:10

ComboFix-quarantined-files.txt 2011-04-04 20:58

.

Pre-Run: 91,131,396,096 bytes free

Post-Run: 90,772,254,720 bytes free

.

- - End Of File - - F27300F5E029660402B3B6FF7E9A9288

Maniac · April 5, 2011

No, it's okay.

Open Notepad and copy and paste the text in the code box below into it:

Driver::
MPFP

FireFox::
FF - ProfilePath - c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}
FF - Ext: Swag Bucks Community Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - %profile%\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Shrunkin · April 5, 2011

This is the log you asked for:

ComboFix 11-04-05.01 - Tammy 04/05/2011 16:43:20.2.2 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.2939.1686 [GMT -4:00]

Running from: c:\users\Tammy\Desktop\Combo-Fix.exe

Command switches used :: c:\users\Tammy\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome.manifest

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\chrome\swag_bucks.jar

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\ConduitAutoCompleteSearch.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\ConduitAutoCompleteSearch.xpt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\ConduitToolbar.idl

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\ConduitToolbar.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\ConduitToolbar.xpt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCore.dll

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCore.xpt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCoreGecko19.dll

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\alertSettingsComponent.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\appContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\engineContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\engineSettings.json

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\fbAlert.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\getAppsContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\postAppsContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\toolbarContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\defaults\unsharedAppsContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\install.rdf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\lib\xpcom.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\META-INF\manifest.mf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\META-INF\zigbert.rsa

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\META-INF\zigbert.sf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\searchplugin\conduit.gif

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\searchplugin\conduit.ico

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\searchplugin\conduit.PNG

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\searchplugin\conduit.src

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\searchplugin\conduit.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\version.txt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\chrome.manifest

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\chrome\conduitengine.jar

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\ConduitAutoCompleteSearch.xpt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\ConduitToolbar.idl

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\ConduitToolbar.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\ConduitToolbar.xpt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\RadioWMPCore.dll

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\RadioWMPCore.xpt

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\alertSettingsComponent.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\appContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\engineContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\engineSettings.json

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\fbAlert.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\getAppsContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\postAppsContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\toolbarContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\defaults\unsharedAppsContextMenu.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\DualPackage\install.rdf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\install.rdf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\lib\xpcom.js

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\META-INF\manifest.mf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\META-INF\zigbert.rsa

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\META-INF\zigbert.sf

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\searchplugin\conduit.gif

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\searchplugin\conduit.ico

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\searchplugin\conduit.PNG

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\searchplugin\conduit.src

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\searchplugin\conduit.xml

c:\users\Tammy\AppData\Roaming\Mozilla\Firefox\Profiles\e8gjnbcg.default\extensions\engine@conduit.com\version.txt

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MPFP

.

((((((((((((((((((((((((( Files Created from 2011-03-05 to 2011-04-05 )))))))))))))))))))))))))))))))

.

2011-04-05 20:49 . 2011-04-05 20:49 -------- d-----w- c:\users\Guest\AppData\Local\temp

2011-04-05 20:49 . 2011-04-05 20:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-04-05 20:49 . 2011-04-05 20:49 -------- d-----w- c:\users\Brian\AppData\Local\temp

2011-04-05 18:19 . 2011-04-03 04:51 601424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3A4C5FB7-8024-4E02-9979-64358BBC69C5}\gapaengine.dll

2011-04-05 18:19 . 2011-03-15 02:17 8424784 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{58661307-01E4-4B94-8779-FB257797BEB2}\mpengine.dll

2011-04-03 04:52 . 2011-04-03 04:51 601424 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll