Google Redirect, 2 Different Trojans Found?

BearBear619 · October 11, 2011

I have been trying to resolve this issue for the past couple days to no avail. Google redirects and when I scan using Malwarebytes it detects the Sharpro.PGen Trojan. I also scanned using Microsoft Security Essentials and that one showed Tracer.AC Trojan. When I reboot my computer, I get a notification icon that some startup programs have been blocked. I hope this isn't a complete disaster, but of course no matter how many times I scan, delete, reboot, and scan again, I keep having the Google redirect and blocked startup programs problems. I did the required scan and saved the log as ark.zip, but when I try to browse and attach to this post, the file path given leads me to Win32 in my folders and I can't go anywhere else. Help me please... I hope my system isn't completely screwed up! Thanks!

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 7919

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

10/11/2011 11:42:30 PM

mbam-log-2011-10-11 (23-42-30).txt

Scan type: Full scan (C:\|Q:\|)

Objects scanned: 306421

Time elapsed: 1 hour(s), 13 minute(s), 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\programdata\windowsbackupverifier.dll (Trojan.SHarpro.PGen) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsBackupVerifier (Trojan.SHarpro.PGen) -> Value: WindowsBackupVerifier -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\programdata\windowsbackupverifier.dll (Trojan.SHarpro.PGen) -> Delete on reboot.

DDS Log:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by Sara at 0:04:55 on 2011-10-12

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1789.697 [GMT -7:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\SafeConnect\scManager.sys

C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Launch Manager\LManager.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\SafeConnect\scClient.exe

C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.google.com/

uDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=2&o=vb32&d=0209&m=d620

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=2&o=vb32&d=0209&m=d620

mDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=2&o=vb32&d=0209&m=d620

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [WindowsBackupVerifier] rundll32.exe "c:\programdata\WindowsBackupVerifier.dll",DllRegisterServer

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [LManager] c:\progra~1\launch~1\LManager.exe

mRun: [eRecoveryService]

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

dRunOnce: [<NO NAME>]

StartupFolder: c:\users\sara\appdata\roaming\micros~1\windows\startm~1\programs\startup\pmbmed~1.lnk - c:\program files\sony\sony picture utility\pmbcore\SPUVolumeWatcher.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\safeco~1.lnk - c:\program files\safeconnect\scClient.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

TCP: Interfaces\{E548415F-EDEA-4AA1-BE50-77E7EE6F3AE0} : DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs: AVGRSSTX.DLL c:\progra~1\google\google~1\GOEC62~1.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\sara\appdata\roaming\mozilla\firefox\profiles\72wwft7a.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com

FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPcol400.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\sara\appdata\local\yahoo!\browserplus\2.9.2\plugins\npybrowserplus_2.9.2.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Upromise TurboSaver: FFToolbar@upromise - %profile%\extensions\FFToolbar@upromise

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 165648]

R1 MpKsl88e66a68;MpKsl88e66a68;c:\programdata\microsoft\microsoft antimalware\definition updates\{ea2cc2c0-3779-43b2-becf-29f7004eb6ec}\MpKsl88e66a68.sys [2011-10-11 28752]

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384]

R2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2010-10-20 821664]

R2 ETService;Empowering Technology Service;c:\program files\emachines\emachines recovery management\service\ETService.exe [2009-2-24 24576]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-6 50424]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-4 131072]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]

R2 SCManager;SafeConnect Manager;c:\program files\safeconnect\scmanager.sys servicestart --> c:\program files\safeconnect\scManager.sys servicestart [?]

R2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2010-9-14 508264]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-3-25 43392]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024]

R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]

R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2010-9-14 577384]

R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2010-9-14 194408]

R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2010-9-14 21864]

R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2010-9-14 19304]

R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2010-9-14 219496]

R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2008-8-27 22072]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-9 135664]

S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-2-24 30192]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-9 135664]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-10-12 06:43:16 54016 ----a-w- c:\windows\system32\drivers\vesi.sys

2011-10-12 06:41:53 -------- d-----w- c:\program files\ESET

2011-10-12 04:37:01 703824 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{2055793b-b460-4b0a-9cc6-f7c5d1f062d9}\gapaengine.dll

2011-10-12 04:37:01 28752 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ea2cc2c0-3779-43b2-becf-29f7004eb6ec}\MpKsl88e66a68.sys

2011-10-12 04:34:46 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ea2cc2c0-3779-43b2-becf-29f7004eb6ec}\offreg.dll

2011-10-12 04:34:30 7269712 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ea2cc2c0-3779-43b2-becf-29f7004eb6ec}\mpengine.dll

2011-10-11 03:50:31 466944 ----a-w- c:\program files\mozilla firefox\plugins\NPcol400.dll

2011-10-11 03:50:29 -------- d-----w- c:\users\sara\appdata\roaming\Catalina Marketing Corp

2011-10-11 03:50:18 485576 ----a-w- c:\users\sara\appdata\roaming\microsoft\windows\start menu\programs\catalina marketing corp\UninstallCouponActivator.exe

2011-10-07 05:46:51 912344 ----a-w- c:\program files\mozilla firefox\firefox.exe

2011-10-06 04:55:04 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll

2011-10-06 04:55:04 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-06 04:31:54 -------- d-----w- c:\users\sara\appdata\roaming\Malwarebytes

2011-10-06 04:30:18 -------- d-----w- c:\programdata\Malwarebytes

2011-10-06 04:30:13 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-06 04:30:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-06 03:56:45 -------- d-----w- c:\programdata\AVAST Software

2011-10-06 03:56:45 -------- d-----w- c:\program files\AVAST Software

2011-10-06 03:25:37 100864 ------w- c:\programdata\WindowsBackupVerifier.dll

2011-09-27 05:02:00 -------- d-----w- c:\users\sara\appdata\local\Microsoft Corporation

2011-09-27 05:01:14 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor

2011-09-27 04:40:28 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat

2011-09-27 04:24:22 705024 ----a-w- c:\windows\system32\drivers\athr.sys

2011-09-27 04:24:22 705024 ----a-w- c:\windows\system32\athr.sys

2011-09-27 04:24:22 24576 ----a-w- c:\windows\system32\PressCancel.exe

2011-09-27 04:24:22 -------- d-----w- c:\windows\Options

2011-09-27 04:20:08 -------- d-----w- c:\users\sara\appdata\local\WinZip

2011-09-27 04:03:33 61440 ----a-w- c:\windows\system32\athihvui.dll

2011-09-27 04:03:33 397312 ----a-w- c:\windows\system32\athihvs.dll

2011-09-27 04:03:33 -------- d-----w- c:\windows\system32\nn-NO

2011-09-27 04:03:33 -------- d-----w- c:\program files\Atheros

2011-09-27 04:02:45 -------- d-----w- c:\programdata\Atheros

2011-09-27 04:02:30 -------- d-----w- C:\SWSetup

2011-09-21 07:43:24 -------- d-----w- c:\programdata\Cisco Systems

2011-09-14 02:24:21 439632 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{10c2dfe2-dfa2-46fd-a0c0-b64abdadd2f4}\gapaengine.dll

.

==================== Find3M ====================

.

2011-10-07 05:52:05 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-27 04:43:04 161792 ----a-w- c:\windows\system32\msls31.dll

2011-09-27 04:43:04 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-09-27 04:43:03 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-09-27 04:43:03 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-09-27 04:43:03 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-09-27 04:43:02 86528 ----a-w- c:\windows\system32\iesysprep.dll

2011-09-27 04:43:02 63488 ----a-w- c:\windows\system32\tdc.ocx

2011-09-27 04:43:01 367104 ----a-w- c:\windows\system32\html.iec

2011-09-27 04:43:00 74752 ----a-w- c:\windows\system32\iesetup.dll

2011-09-27 04:42:59 23552 ----a-w- c:\windows\system32\licmgr10.dll

2011-09-27 04:42:59 1427456 ----a-w- c:\windows\system32\inetcpl.cpl

2011-09-27 04:42:58 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-09-27 04:42:58 152064 ----a-w- c:\windows\system32\wextract.exe

2011-09-27 04:42:58 150528 ----a-w- c:\windows\system32\iexpress.exe

2011-09-27 04:42:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-27 04:42:57 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2011-09-27 04:42:56 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-09-27 04:42:56 11776 ----a-w- c:\windows\system32\mshta.exe

2011-09-27 04:42:56 101888 ----a-w- c:\windows\system32\admparse.dll

2011-09-27 04:42:55 35840 ----a-w- c:\windows\system32\imgutil.dll

2011-09-27 04:42:54 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

.

============= FINISH: 0:05:53.01 ===============

Attach.zip

screen317 · October 14, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

BearBear619 · October 26, 2011

Sorry for the late reply, I've been away on vacation and just returned. My computer is still having the same issues, so below are the logs requested. Tanks for your help!

ComboFix:

ComboFix 11-10-25.04 - Sara 10/26/2011 23:29:13.1.1 - x86

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1789.802 [GMT -7:00]

Running from: c:\users\Sara\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\WindowsBackupVerifier.dll

c:\windows\system32\regobj.dll

.

((((((((((((((((((((((((( Files Created from 2011-09-27 to 2011-10-27 )))))))))))))))))))))))))))))))

.

2011-10-27 06:40 . 2011-10-27 06:40 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-10-27 05:05 . 2011-10-27 05:10 -------- d-----w- c:\windows\1F34839E48264B64B1B342E5AE8DEC5A.TMP

2011-10-27 02:57 . 2011-10-27 02:57 28752 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12B45A16-3E49-4455-8DD7-CF52FD301001}\MpKslc028b204.sys

2011-10-27 02:56 . 2011-10-27 02:56 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12B45A16-3E49-4455-8DD7-CF52FD301001}\offreg.dll

2011-10-27 02:56 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12B45A16-3E49-4455-8DD7-CF52FD301001}\mpengine.dll

2011-10-12 06:43 . 2011-10-12 06:43 54016 ----a-w- c:\windows\system32\drivers\vesi.sys

2011-10-12 06:41 . 2011-10-12 06:41 -------- d-----w- c:\program files\ESET

2011-10-12 04:37 . 2011-10-12 04:34 703824 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2055793B-B460-4B0A-9CC6-F7C5D1F062D9}\gapaengine.dll

2011-10-11 03:50 . 2011-10-11 03:50 466944 ----a-w- c:\program files\Mozilla Firefox\plugins\NPcol400.dll

2011-10-11 03:50 . 2011-10-11 03:50 -------- d-----w- c:\users\Sara\AppData\Roaming\Catalina Marketing Corp

2011-10-11 03:50 . 2011-10-11 03:50 485576 ----a-w- c:\users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe

2011-10-07 05:51 . 2011-10-07 05:51 -------- d-----w- c:\programdata\McAfee

2011-10-07 05:46 . 2011-10-07 05:47 912344 ----a-w- c:\program files\Mozilla Firefox\firefox.exe

2011-10-06 04:55 . 2011-10-06 04:55 -------- d-----w- c:\program files\Common Files\Java

2011-10-06 04:55 . 2011-05-04 11:52 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

2011-10-06 04:55 . 2011-05-04 11:52 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-06 04:31 . 2011-10-06 04:31 -------- d-----w- c:\users\Sara\AppData\Roaming\Malwarebytes

2011-10-06 04:30 . 2011-10-06 04:30 -------- d-----w- c:\programdata\Malwarebytes

2011-10-06 04:30 . 2011-10-06 04:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-06 04:30 . 2011-09-01 00:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-06 03:56 . 2011-10-11 04:23 -------- d-----w- c:\programdata\AVAST Software

2011-10-06 03:56 . 2011-10-06 03:56 -------- d-----w- c:\program files\AVAST Software

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-07 05:52 . 2011-07-15 02:37 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-27 04:43 . 2011-09-27 04:43 161792 ----a-w- c:\windows\system32\msls31.dll

2011-09-27 04:43 . 2011-09-27 04:43 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-09-27 04:43 . 2011-09-27 04:43 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2011-09-27 04:43 . 2011-09-27 04:43 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2011-09-27 04:43 . 2011-09-27 04:43 48640 ----a-w- c:\windows\system32\mshtmler.dll

2011-09-27 04:43 . 2011-09-27 04:43 86528 ----a-w- c:\windows\system32\iesysprep.dll

2011-09-27 04:43 . 2011-09-27 04:43 63488 ----a-w- c:\windows\system32\tdc.ocx

2011-09-27 04:43 . 2011-09-27 04:43 367104 ----a-w- c:\windows\system32\html.iec

2011-09-27 04:43 . 2011-09-27 04:43 74752 ----a-w- c:\windows\system32\iesetup.dll

2011-09-27 04:42 . 2011-09-27 04:42 23552 ----a-w- c:\windows\system32\licmgr10.dll

2011-09-27 04:42 . 2011-09-27 04:42 1427456 ----a-w- c:\windows\system32\inetcpl.cpl

2011-09-27 04:42 . 2011-09-27 04:42 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-09-27 04:42 . 2011-09-27 04:42 152064 ----a-w- c:\windows\system32\wextract.exe

2011-09-27 04:42 . 2011-09-27 04:42 150528 ----a-w- c:\windows\system32\iexpress.exe

2011-09-27 04:42 . 2011-09-27 04:42 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-27 04:42 . 2011-09-27 04:42 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2011-09-27 04:42 . 2011-09-27 04:42 1797632 ----a-w- c:\windows\system32\jscript9.dll

2011-09-27 04:42 . 2011-09-27 04:42 11776 ----a-w- c:\windows\system32\mshta.exe

2011-09-27 04:42 . 2011-09-27 04:42 101888 ----a-w- c:\windows\system32\admparse.dll

2011-09-27 04:42 . 2011-09-27 04:42 35840 ----a-w- c:\windows\system32\imgutil.dll

2011-09-27 04:42 . 2011-09-27 04:42 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2011-09-12 23:14 . 2010-09-05 01:31 7269712 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-08-12 02:44 . 2011-08-24 10:01 7152464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll

2010-09-01 03:31 . 2009-12-06 16:54 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-19 68856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-02 809480]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-01 30192]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-09-01 1047208]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

.

c:\users\Sara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-6-14 327680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

SafeConnect.lnk - c:\program files\SafeConnect\scClient.exe [2007-11-13 296088]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray]

2008-04-07 05:42 34040 ----a-w- c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Boingo Wi-Fi]

2009-06-11 07:55 1804 ----a-w- c:\program files\Boingo\Boingo Wi-Fi\Boingo.lnk

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-12-14 01:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-30 01:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2008-07-14 13:05 6253088 ----a-w- c:\windows\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]

2008-07-14 13:06 1833504 ----a-w- c:\windows\SkyTel.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2008-01-21 19:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2009-05-19 11:32 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

R1 MpKsl1ea16074;MpKsl1ea16074;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{512A2E4A-A716-4F02-8339-3B32F26B6775}\MpKsl1ea16074.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-09-01 30192]

R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4640000]

R3 WisINT15;WisINT15;c:\windows\System32\OEM\factory\WisINT15.SYS [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S1 MpKsl892b7840;MpKsl892b7840;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A0A9107-C03D-4269-987A-300B74740AE1}\MpKsl892b7840.sys [x]

S1 MpKslae090505;MpKslae090505;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A0A9107-C03D-4269-987A-300B74740AE1}\MpKslae090505.sys [x]

S1 MpKslc028b204;MpKslc028b204;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12B45A16-3E49-4455-8DD7-CF52FD301001}\MpKslc028b204.sys [2011-10-27 28752]

S2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 ETService;Empowering Technology Service;c:\program files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [2008-06-11 24576]

S2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-07 50424]

S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-18 11032]

S2 SCManager;SafeConnect Manager;c:\program files\SafeConnect\scManager.sys servicestart [x]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2008-05-29 22072]

S4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MBAMSWISSARMY

*NewlyCreated* - MPKSL5C216853

*NewlyCreated* - MPKSL88E66A68

*NewlyCreated* - MPKSLC028B204

*NewlyCreated* - PXLDYPOW

*Deregistered* - MpKsl5c216853

*Deregistered* - MpKsl88e66a68

*Deregistered* - pxldypow

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Contents of the 'Scheduled Tasks' folder

.

2011-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 01:05]

.

2011-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 01:05]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=2&o=vb32&d=0209&m=d620

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

TCP: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12

FF - ProfilePath - c:\users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\72wwft7a.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Upromise TurboSaver: FFToolbar@upromise - %profile%\extensions\FFToolbar@upromise

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKCU-Run-WindowsBackupVerifier - c:\programdata\WindowsBackupVerifier.dll

HKLM-Run-eRecoveryService - (no file)

MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-10-26 23:40

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

c:\users\Sara\AppData\Local\Temp\catchme.dll 53248 bytes executable

.

scan completed successfully

hidden files: 1

.

**************************************************************************

.

Completion time: 2011-10-26 23:46:04

ComboFix-quarantined-files.txt 2011-10-27 06:45

.

Pre-Run: 87,980,208,128 bytes free

Post-Run: 88,267,427,840 bytes free

.

- - End Of File - - 9B9FC9A9FB12C0CDDE4935B5FBC97D09

DDS:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26

Run by Sara at 0:01:37 on 2011-10-27

Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1789.550 [GMT -7:00]

.

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\Ati2evxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\SafeConnect\scManager.sys

C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Launch Manager\LManager.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\SafeConnect\scClient.exe

C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\system32\UI0Detect.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\conime.exe

C:\Windows\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=2&o=vb32&d=0209&m=d620

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"