prophiler Posted June 17, 2011 ID:442339 Share Posted June 17, 2011 Hi and thanks in advance for your help.I'm running Windows 7 64 bit. Just a while ago I was downloading a .exe file. When I ran it, nothing happened and it suddenly disappeared from my desktop. After assuming it was a virus, I ran Macafee and began a quick scan. In the middle of the scan, Macafee shut down and the flag of messages in my task bar appeared, saying that Windows Security Center was turned off. I tried to turn it on, but a message saying "The Windows Security Center service can't be started" appeared. I restarted my computer but everything was the same, no Network Firewall and no Windows Defender.I also tried to do a restore, but the restore service was also disabled. Also every ten minutes an Internet Explorer pop-up appears (even when my default browser is Google Chrome).My HijackThis logs:Logfile of Trend Micro HijackThis v2.0.4Scan saved at 2:31:02 AM, on 18/06/2011Platform: Windows 7 SP1 (WinNT 6.00.3505)MSIE: Internet Explorer v9.00 (9.00.8112.16421)Boot mode: NormalRunning processes:C:\Program Files (x86)\GIGABYTE\ET6\GUI.exeC:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exeC:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exeC:\Program Files (x86)\uTorrent\uTorrent.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\Desktop\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Splashtop Connect SearchHook - {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - C:\Program Files (x86)\Splashtop\Splashtop Connect IE\AddressBarSearch.dllR3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllR3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllF2 - REG:system.ini: UserInit=userinit.exe,O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000000} - c:\windows\syswow64\wpheqswj.dll (file missing)O2 - BHO: Splashtop Connect VisualBookmark - {0E5680D1-BF44-4929-94AF-FD30D784AD1D} - C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STC.dllO2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110527092432.dllO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllO3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllO3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dllO4 - HKLM\..\Run: [SmartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunO4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeyO4 - HKLM\..\Run: [STCAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe"O4 - HKLM\..\Run: [ZyngaGamesAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe"O4 - HKLM\..\RunOnce: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exeO4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startupO4 - HKCU\..\Run: [Google Update] "C:\Users\Josh\AppData\Local\Google\Update\GoogleUpdate.exe" /cO4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphicsO17 - HKLM\System\CCS\Services\Tcpip\..\{EF8ECF94-677F-4124-84E3-005496908A8F}: NameServer = 10.0.0.138O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllO18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dllO23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)O23 - Service: DES2 Service for Energy Saving. (DES2 Service) - Unknown owner - C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exeO23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\The Games\Hi-Rez Studios\HiPatchService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exeO23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exeO23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: Splashtop Connect Service (SCBackService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Connect\BackService.exeO23 - Service: Smart TimeLock Service (Smart TimeLock) - Gigabyte Technology CO., LTD. - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exeO23 - Service: Smart View Service (SmartViewService) - Unknown owner - C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe (file missing)O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exeO23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)O23 - Service: Splashtop Connect IE Software Updater Service (WCUService_STC_IE) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exeO23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)--End of file - 11059 bytesI also did a malwarebytes scan, it found 9 infections and quarantined and deleted all but one. When I did a restart and rescanned with malwarebytes there was nothing found. Then I downloaded Combofix and tried to run it but Macafee kept popping up saying it had found a threat, archimedes!qa. something or other, and at this point every time Combofix was closed and deleted from it's place on the desktop. Any advice on the matter would be greatly appreciated. Link to post Share on other sites More sharing options...
Staff screen317 Posted June 20, 2011 Staff ID:443325 Share Posted June 20, 2011 Hi and welcome to Malwarebytes.Please update MBAM, run a Quick Scan, and post its log.Next, download DDS by sUBs and save it to your Desktop.Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply. Link to post Share on other sites More sharing options...
prophiler Posted June 20, 2011 Author ID:443451 Share Posted June 20, 2011 Hey, thanks for your reply and sorry for my late one. I know you guys don't like people playing around with their computers after asking for help, but my cousin is better with computers than me so he got on and did something, and now none of the symptoms are there and all scans are clean. There was apparently a file called Authoir.dll or something (with that spelling) in my sysWOW64 folder which had hidden itself, and is now gone. One thing I did notice though is that the sound on any internet flash video will not work. It just won't do it. Works fine in WMP, VLC, games and everything just not flash. I've been through many fixes like checking the volume levels on everything, adding the wavemapper files to drivers32 in both System32 and sysWOW64(msacm32.drv etc), reinstalling browsers and Adobe Flash, system restore..... which was a bad idea because i didn't realise that the system restore point was a few minutes after I got the virus in the first place? Apparently just after I installed DirectX....hmmm.....Anyway, if you guys have had any dealings with this in the past I'd appreciate the help bigtime. Link to post Share on other sites More sharing options...
prophiler Posted June 20, 2011 Author ID:443474 Share Posted June 20, 2011 For the sake of doing it, here's the logs you asked for:Malwarebytes' Anti-Malware 1.51.0.1200www.malwarebytes.orgDatabase version: 6902Windows 6.1.7601 Service Pack 1Internet Explorer 9.0.8112.1642120/06/2011 11:58:22 PMmbam-log-2011-06-20 (23-58-22).txtScan type: Quick scanObjects scanned: 163901Time elapsed: 2 minute(s), 8 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected).DDS (Ver_2011-06-12.02) - NTFSAMD64 Internet Explorer: 9.0.8112.16421Run by Josh at 0:20:56 on 2011-06-21Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.4079.2753 [GMT 10:00].AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\system32\atiesrxx.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\atieclxx.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exeC:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeC:\Windows\system32\mfevtps.exeC:\Program Files (x86)\Splashtop\Splashtop Connect\BackService.exeC:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exeC:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exeC:\Windows\system32\rundll32.exeC:\Windows\SysWOW64\rundll32.exeC:\Program Files\Common Files\McAfee\SystemCore\mcshield.exeC:\Program Files\Common Files\McAfee\SystemCore\mfefire.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\GIGABYTE\SMART6\Recovery\RPMDaemon.exeC:\Program Files (x86)\GIGABYTE\ET6\GUI.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Users\Josh\AppData\Local\Google\Update\GoogleUpdate.exeC:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exeC:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Program Files\McAfee.com\Agent\mcagent.exeC:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Windows\system32\wbem\unsecapp.exeC:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Users\Josh\AppData\Local\Google\Chrome\Application\chrome.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\system32\conhost.exeC:\Windows\SysWOW64\cscript.exeC:\Windows\system32\wbem\wmiprvse.exe.============== Pseudo HJT Report ===============.uURLSearchHooks: Splashtop Connect SearchHook: {0f3dc9e0-c459-4a40-bcf8-747bd9322e10} - C:\Program Files (x86)\Splashtop\Splashtop Connect IE\AddressBarSearch.dlluURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dlluURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllmURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllmWinlogon: Userinit=userinit.exe,BHO: : {00000000-0000-0000-0000-000000000000} - c:\windows\syswow64\wpheqswj.dllBHO: Splashtop Connect VisualBookmark: {0e5680d1-bf44-4929-94af-fd30d784ad1d} - C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STC.dllBHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dllBHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110527092432.dllBHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllBHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllBHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllTB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllTB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllTB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dlluRun: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startupuRun: [Google Update] "C:\Users\Josh\AppData\Local\Google\Update\GoogleUpdate.exe" /cmRun: [SmartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"mRun: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -startmRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunmRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeymRun: [STCAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe"mRun: [ZyngaGamesAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe"mRunOnce: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exemRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silentmPolicies-explorer: NoActiveDesktop = 1 (0x1)mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cabDPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTCP: Interfaces\{EF8ECF94-677F-4124-84E3-005496908A8F} : NameServer = 10.0.0.138Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dllHandler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dllHandler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dllBHO-X64: : {00000000-0000-0000-0000-000000000000} - c:\windows\syswow64\wpheqswj.dllBHO-X64: Splashtop Connect VisualBookmark: {0E5680D1-BF44-4929-94AF-FD30D784AD1D} - C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STC.dllBHO-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dllBHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110527092432.dllBHO-X64: scriptproxy - No FileBHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllBHO-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllBHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dllTB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dllTB-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dllTB-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dllmRun-x64: [SmartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"mRun-x64: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -startmRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunmRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeymRun-x64: [STCAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe"mRun-x64: [ZyngaGamesAgent] "C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe"mRunOnce-x64: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exemRunOnce-x64: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent.============= SERVICES / DRIVERS ===============.R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]R1 AppleCharger;AppleCharger;C:\Windows\system32\DRIVERS\AppleCharger.sys --> C:\Windows\system32\DRIVERS\AppleCharger.sys [?]R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]R2 DES2 Service;DES2 Service for Energy Saving.;C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [2011-5-27 68136]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-5-27 249936]R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-5-27 249936]R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-5-27 249936]R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-5-27 249936]R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2011-5-27 197960]R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2011-5-27 208272]R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]R2 SCBackService;Splashtop Connect Service;C:\Program Files (x86)\Splashtop\Splashtop Connect\BackService.exe [2010-11-15 477000]R2 Smart TimeLock;Smart TimeLock Service;C:\Program Files (x86)\GIGABYTE\smart6\timelock\TimeMgmtDaemon.exe [2011-5-27 114688]R2 WCUService_STC_IE;Splashtop Connect IE Software Updater Service;C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe [2011-3-22 497480]R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]R3 GVTDrv64;GVTDrv64;C:\Windows\GVTDrv64.sys [2011-5-27 30528]R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]R3 rt61x64;RT61 Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr6164.sys --> C:\Windows\system32\DRIVERS\netr6164.sys [?]R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;C:\Program Files (x86)\The Games\Hi-Rez Studios\HiPatchService.exe [2011-4-21 23680]S2 SmartViewService;Smart View Service;C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe --> C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe [?]S2 yjukmftz;SFF Storage Protocol for MMCController;C:\Windows\System32\svchost.exe -k netsvcs [2009-7-14 20992]S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]S3 etdrv;etdrv;C:\Windows\etdrv.sys [2011-6-17 25640]S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-5-27 249936].=============== Created Last 30 ================.2011-06-20 10:35:53 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2011-06-17 15:25:20 -------- d-----w- C:\Users\Josh\AppData\Roaming\Malwarebytes2011-06-17 15:25:16 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys2011-06-17 15:25:15 -------- d-----w- C:\ProgramData\Malwarebytes2011-06-17 15:25:12 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys2011-06-17 15:25:11 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2011-06-17 09:24:10 25640 ----a-w- C:\Windows\etdrv.sys2011-06-17 09:17:27 93240 ----a-w- C:\Windows\System32\drivers\scdemu.sys2011-06-17 09:17:27 -------- d-----w- C:\Program Files (x86)\PowerISO2011-06-17 08:58:04 809472 ----a-w- C:\Windows\SysWow64\wpheqswj.dll.bak2011-06-17 08:42:14 -------- d-----w- C:\Users\Josh\AppData\Roaming\DAEMON Tools Pro2011-06-17 08:42:14 -------- d-----w- C:\ProgramData\DAEMON Tools Pro2011-06-15 04:23:08 499200 ----a-w- C:\Windows\System32\drivers\afd.sys2011-06-15 04:23:08 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys2011-06-15 04:23:07 289280 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys2011-06-15 04:23:07 128000 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys2011-06-15 04:23:06 3135488 ----a-w- C:\Windows\System32\win32k.sys2011-06-15 04:23:06 158208 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys2011-06-15 04:23:00 467456 ----a-w- C:\Windows\System32\drivers\srv.sys2011-06-15 04:23:00 410112 ----a-w- C:\Windows\System32\drivers\srv2.sys2011-06-15 04:23:00 168448 ----a-w- C:\Windows\System32\drivers\srvnet.sys2011-06-15 04:22:42 861696 ----a-w- C:\Windows\System32\oleaut32.dll2011-06-15 04:22:41 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll2011-06-15 04:22:40 976896 ----a-w- C:\Windows\System32\inetcomm.dll2011-06-15 04:22:39 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll2011-06-08 02:55:36 84480 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNMPPA7.DLL2011-06-08 02:55:36 28672 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\CNMPDA7.DLL2011-06-08 02:55:24 344064 ----a-w- C:\Windows\System32\CNMLMA7.DLL2011-06-08 02:18:57 -------- d-----w- C:\Users\Josh\AppData\Roaming\PFStaticIP2011-06-08 02:18:36 -------- d-----w- C:\Program Files (x86)\PF2011-06-04 12:24:45 -------- d-----w- C:\Users\Josh\AppData\Roaming\Splashtop2011-05-31 22:46:52 -------- d--h--w- C:\Windows\msdownld.tmp2011-05-31 22:46:51 -------- d-----w- C:\Windows\SysWow64\directx2011-05-31 22:46:42 -------- d-----w- C:\Windows\SysWow64\AGEIA2011-05-31 22:46:30 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard2011-05-29 07:29:07 -------- d-----w- C:\Program Files (x86)\Common Files\Steam2011-05-29 06:40:11 -------- d-----w- C:\Users\Josh\AppData\Local\The Witcher2011-05-29 05:09:59 508264 ----a-w- C:\Windows\System32\d3dx10_36.dll2011-05-29 00:21:31 197120 ----a-w- C:\Windows\System32\d3d10_1.dll2011-05-29 00:21:21 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll2011-05-27 10:35:39 -------- d-----w- C:\Users\Josh\AppData\Local\Diagnostics2011-05-27 07:49:38 -------- d-----w- C:\Windows\Panther2011-05-27 01:58:37 -------- d-----w- C:\Users\Josh\AppData\Roaming\Hi-Rez Studios2011-05-27 01:57:18 -------- d-----w- C:\ProgramData\Hi-Rez Studios2011-05-27 01:39:50 -------- d-----w- C:\Program Files (x86)\Conduit2011-05-27 01:39:48 -------- d-----w- C:\Program Files (x86)\ConduitEngine2011-05-27 01:39:46 -------- d-----w- C:\Program Files (x86)\uTorrentBar2011-05-27 01:39:45 -------- d-----w- C:\extensions2011-05-27 01:38:39 -------- d-----w- C:\Program Files (x86)\uTorrent2011-05-27 01:37:52 -------- d-----w- C:\Users\Josh\AppData\Roaming\uTorrent2011-05-26 23:24:43 -------- d-----w- C:\Program Files (x86)\McAfee.com2011-05-26 23:24:31 9984 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys2011-05-26 23:24:31 -------- d-----w- C:\Program Files (x86)\Common Files\McAfee2011-05-26 15:47:10 -------- d-----w- C:\Windows\SysWow64\Wat2011-05-26 15:47:10 -------- d-----w- C:\Windows\System32\Wat2011-05-26 15:24:59 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe2011-05-26 15:24:59 31232 ----a-w- C:\Windows\System32\prevhost.exe2011-05-26 15:23:37 -------- d-----w- C:\ProgramData\Blizzard Entertainment2011-05-26 15:23:37 -------- d-----w- C:\Program Files (x86)\Common Files\Blizzard Entertainment2011-05-26 15:23:36 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys2011-05-26 15:03:42 -------- d-----w- C:\Program Files (x86)\The Games2011-05-26 14:58:51 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll2011-05-26 14:54:23 -------- d-----w- C:\Users\Josh\AppData\Local\Google2011-05-26 14:50:54 -------- d-----w- C:\ProgramData\Splashtop2011-05-26 14:50:51 -------- d-----w- C:\Program Files (x86)\Splashtop2011-05-26 14:47:46 -------- d-----w- C:\ProgramData\ASUS Driver2011-05-26 14:45:03 -------- d-----w- C:\Users\Josh\AppData\Local\ATI2011-05-26 14:42:47 0 ----a-w- C:\Windows\ativpsrm.bin2011-05-26 14:40:56 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies2011-05-26 14:40:28 -------- d-----w- C:\Program Files\Common Files\ATI Technologies2011-05-26 14:40:23 116752 ----a-w- C:\Windows\System32\drivers\AtihdW76.sys2011-05-26 14:39:49 58880 ----a-w- C:\Windows\System32\coinst.dll2011-05-26 14:39:29 -------- d-----w- C:\Program Files (x86)\ATI Technologies2011-05-26 14:39:05 -------- d-----w- C:\Program Files\ATI Technologies2011-05-26 14:39:02 -------- d-----w- C:\Program Files\ATI2011-05-26 14:30:03 30528 ----a-w- C:\Windows\GVTDrv64.sys2011-05-26 14:29:23 25640 ----a-w- C:\Windows\gdrv.sys2011-05-26 14:25:20 -------- d-----w- C:\Program Files (x86)\AMD2011-05-26 14:23:27 -------- d-----w- C:\ProgramData\DeviceVM2011-05-26 14:19:57 -------- d-----w- C:\Windows\SysWow64\RTCOM2011-05-26 14:18:54 53248 ----a-r- C:\Windows\SysWow64\CSVer.dll2011-05-26 14:18:46 -------- d-----w- C:\Intel2011-05-26 14:18:41 -------- d--h--w- C:\ProgramData\{8533ADFA-85F0-4dc1-946A-2A0BA58E78E3}2011-05-26 14:18:40 -------- d-----w- C:\Users\Josh\AppData\Roaming\DeviceVm2011-05-26 14:18:24 -------- d-sh--w- C:\Windows\Installer2011-05-26 14:15:00 -------- d-----w- C:\Users\Josh\AppData\Local\VirtualStore.==================== Find3M ====================.2011-04-23 01:29:25 2303488 ----a-w- C:\Windows\System32\jscript9.dll2011-04-23 01:19:19 2382848 ----a-w- C:\Windows\System32\mshtml.tlb2011-04-22 23:35:56 1797632 ----a-w- C:\Windows\SysWow64\jscript9.dll2011-04-22 23:25:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb2011-04-22 22:15:29 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys2011-04-19 16:44:50 9319936 ----a-w- C:\Windows\System32\drivers\atikmdag.sys2011-04-19 16:30:18 22900736 ----a-w- C:\Windows\System32\atio6axx.dll2011-04-19 16:09:20 151552 ----a-w- C:\Windows\System32\atiapfxx.exe2011-04-19 16:09:06 676864 ----a-w- C:\Windows\SysWow64\aticfx32.dll2011-04-19 16:07:48 795648 ----a-w- C:\Windows\System32\aticfx64.dll2011-04-19 16:07:04 17693184 ----a-w- C:\Windows\SysWow64\atioglxx.dll2011-04-19 16:05:08 462848 ----a-w- C:\Windows\System32\ATIDEMGX.dll2011-04-19 16:04:56 480256 ----a-w- C:\Windows\System32\atieclxx.exe2011-04-19 16:04:20 203776 ----a-w- C:\Windows\System32\atiesrxx.exe2011-04-19 16:03:06 120320 ----a-w- C:\Windows\System32\atitmm64.dll2011-04-19 16:02:50 423424 ----a-w- C:\Windows\System32\atipdl64.dll2011-04-19 16:02:44 356352 ----a-w- C:\Windows\SysWow64\atipdlxx.dll2011-04-19 16:02:32 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll2011-04-19 16:02:26 16384 ----a-w- C:\Windows\System32\atimuixx.dll2011-04-19 16:02:22 59392 ----a-w- C:\Windows\System32\atiedu64.dll2011-04-19 16:02:18 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll2011-04-19 15:59:22 4161536 ----a-w- C:\Windows\SysWow64\atidxx32.dll2011-04-19 15:49:32 4951552 ----a-w- C:\Windows\System32\atidxx64.dll2011-04-19 15:46:18 51200 ----a-w- C:\Windows\System32\aticalrt64.dll2011-04-19 15:46:16 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll2011-04-19 15:46:06 44544 ----a-w- C:\Windows\System32\aticalcl64.dll2011-04-19 15:46:04 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll2011-04-19 15:45:54 7768064 ----a-w- C:\Windows\System32\aticaldd64.dll2011-04-19 15:42:06 6389760 ----a-w- C:\Windows\SysWow64\aticaldd.dll2011-04-19 15:40:50 1222656 ----a-w- C:\Windows\System32\atiumd6v.dll2011-04-19 15:40:16 1923584 ----a-w- C:\Windows\SysWow64\atiumdmv.dll2011-04-19 15:40:04 3868672 ----a-w- C:\Windows\System32\atiumd6a.dll2011-04-19 15:38:06 4286464 ----a-w- C:\Windows\SysWow64\atiumdag.dll2011-04-19 15:31:14 5440000 ----a-w- C:\Windows\System32\atiumd64.dll2011-04-19 15:30:38 4056576 ----a-w- C:\Windows\SysWow64\atiumdva.dll2011-04-19 15:23:14 366080 ----a-w- C:\Windows\System32\atiadlxx.dll2011-04-19 15:23:08 262144 ----a-w- C:\Windows\SysWow64\atiadlxy.dll2011-04-19 15:22:56 14848 ----a-w- C:\Windows\System32\atig6pxx.dll2011-04-19 15:22:54 12800 ----a-w- C:\Windows\SysWow64\atiglpxx.dll2011-04-19 15:22:54 12800 ----a-w- C:\Windows\System32\atiglpxx.dll2011-04-19 15:22:50 39936 ----a-w- C:\Windows\System32\atig6txx.dll2011-04-19 15:22:42 32768 ----a-w- C:\Windows\SysWow64\atigktxx.dll2011-04-19 15:22:34 306176 ----a-w- C:\Windows\System32\drivers\atikmpag.sys2011-04-19 15:21:46 40960 ----a-w- C:\Windows\System32\atiuxp64.dll2011-04-19 15:21:40 31232 ----a-w- C:\Windows\SysWow64\atiuxpag.dll2011-04-19 15:21:34 38912 ----a-w- C:\Windows\System32\atiu9p64.dll2011-04-19 15:21:26 29184 ----a-w- C:\Windows\SysWow64\atiu9pag.dll2011-04-19 15:20:52 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll2011-04-19 15:13:38 53760 ----a-w- C:\Windows\System32\atimpc64.dll2011-04-19 15:13:38 53760 ----a-w- C:\Windows\System32\amdpcom64.dll2011-04-19 15:13:30 52736 ----a-w- C:\Windows\SysWow64\atimpc32.dll2011-04-19 15:13:30 52736 ----a-w- C:\Windows\SysWow64\amdpcom32.dll2011-04-09 07:02:55 5562240 ----a-w- C:\Windows\System32\ntoskrnl.exe2011-04-09 06:58:56 142336 ----a-w- C:\Windows\System32\poqexec.exe2011-04-09 06:02:25 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe2011-04-09 06:02:25 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe2011-04-09 05:56:38 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe.============= FINISH: 0:21:09.98 ===============and the thing from dds that it tells me to attach, by the looks of it you want the errors?==== Event Viewer Messages From Past Week ========.21/06/2011 12:11:58 AM, Error: Service Control Manager [7034] - The Hi-Rez Studios Authenticate and Update Service service terminated unexpectedly. It has done this 1 time(s).20/06/2011 11:05:45 PM, Error: Service Control Manager [7000] - The SFF Storage Protocol for MMCController service failed to start due to the following error: The executable program that this service is configured to run in does not implement the service.20/06/2011 11:05:35 PM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..18/06/2011 9:59:52 AM, Error: Service Control Manager [7034] - The McAfee Firewall Core Service service terminated unexpectedly. It has done this 1 time(s).18/06/2011 9:59:47 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee VirusScan Announcer service terminated unexpectedly. It has done this 3 time(s).18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee SiteAdvisor Service service terminated unexpectedly. It has done this 2 time(s).18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee Services service terminated unexpectedly. It has done this 3 time(s).18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee Proxy Service service terminated unexpectedly. It has done this 3 time(s).18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 3 time(s).18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee Network Agent service terminated unexpectedly. It has done this 3 time(s).18/06/2011 9:59:44 AM, Error: Service Control Manager [7034] - The McAfee Anti-Spam Service service terminated unexpectedly. It has done this 3 time(s).18/06/2011 9:59:35 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.18/06/2011 9:15:04 AM, Error: Service Control Manager [7031] - The McAfee VirusScan Announcer service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:15:04 AM, Error: Service Control Manager [7031] - The McAfee Services service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:15:04 AM, Error: Service Control Manager [7031] - The McAfee Proxy Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:15:04 AM, Error: Service Control Manager [7031] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:15:04 AM, Error: Service Control Manager [7031] - The McAfee Network Agent service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:15:04 AM, Error: Service Control Manager [7031] - The McAfee Anti-Spam Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:13:24 AM, Error: Service Control Manager [7034] - The McAfee SiteAdvisor Service service terminated unexpectedly. It has done this 1 time(s).18/06/2011 9:13:24 AM, Error: Service Control Manager [7031] - The McAfee VirusScan Announcer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:13:24 AM, Error: Service Control Manager [7031] - The McAfee Services service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:13:24 AM, Error: Service Control Manager [7031] - The McAfee Proxy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:13:24 AM, Error: Service Control Manager [7031] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:13:24 AM, Error: Service Control Manager [7031] - The McAfee Network Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 9:13:24 AM, Error: Service Control Manager [7031] - The McAfee Anti-Spam Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.18/06/2011 10:02:02 AM, Error: Service Control Manager [7034] - The McAfee McShield service terminated unexpectedly. It has done this 6 time(s).18/06/2011 10:01:18 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 5 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.18/06/2011 10:00:18 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 4 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.18/06/2011 10:00:06 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service..==== End Of File =========================== Link to post Share on other sites More sharing options...
Staff screen317 Posted June 23, 2011 Staff ID:444539 Share Posted June 23, 2011 Hi,Please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted August 4, 2011 Staff ID:461908 Share Posted August 4, 2011 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts