I have a problem...

amann95 · October 27, 2011

ok. I have the same problems as some other guys here and its about malwarebytes blocking some random IPs from Nederland and China. This blocking is about every 10mins or so when im not browsing, but when im entering some random sites its more like every 1 min. Also my computer browser is very slow and sometimes wont start at all, so i think i have malware problems in general. So when u read this(if u do) pls give me some advice. Here are the logs:

DDS :

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_29

Run by Shrooms at 11:57:35 on 2011-10-27

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2004 [GMT 2:00]

.

AV: AVG Internet Security 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: PC Security Guardian *Enabled/Updated* {1FCEF370-070F-4836-879E-2C418C5C7ABF}

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

FW: PC Security Guardian *Enabled*

FW: AVG Firewall *Enabled*

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Razer\Copperhead\razerhid.exe

C:\Program Files\SweetIM\Messenger\SweetIM.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\program files\real\realplayer\update\realsched.exe

C:\Program Files\Razer\DeathAdder\razerhid.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\LOLReplay\LOLRecorder.exe

C:\Program Files\hott notes 4\hottnotes.exe

C:\WINDOWS\System32\svchost.exe -k Akamai

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Razer\Copperhead\razerofa.exe

C:\Program Files\Razer\DeathAdder\razertra.exe

C:\Program Files\Razer\DeathAdder\razerofa.exe

C:\Program Files\Razer\DeathAdder\vdDaemon.exe

C:\Program Files\AVG\AVG2012\avgfws.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Common Files\Corel\Standby\Standby.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.bigseekpro.com/mediaget/{5FF7ECB8-6D08-4C83-996A-01C297A8E99E}

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mStart Page = hxxp://www.bigseekpro.com/mediaget/{5FF7ECB8-6D08-4C83-996A-01C297A8E99E}

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uInternet Settings,ProxyServer = http=127.0.0.1:25507;

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant =

uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll

uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {15531a3f-2691-26a5-5d8a-029c7846098d} - c:\windows\system32\ntmsaapi.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\MMonitor.exe"

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [Google Update] "c:\documents and settings\shrooms\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRun: [Corel Photo Downloader] "c:\program files\common files\corel\corel photodownloader\Corel Photo Downloader.exe" -startup

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"

mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"

mRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\FirstStart.exe" /OM

mRun: [razer] c:\program files\razer\copperhead\razerhid.exe

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [sweetIM] c:\program files\sweetim\messenger\SweetIM.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [standby] "c:\program files\common files\corel\standby\Standby.exe" -START

mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [DeathAdder] c:\program files\razer\deathadder\razerhid.exe

mRun: [QuickTime Task] "c:\program files\k-lite codec pack\quicktime\QTTask.exe" -atboottime

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\shrooms\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\shrooms\startm~1\programs\startup\hottno~1.lnk - c:\program files\hott notes 4\hottnotes.exe

StartupFolder: c:\docume~1\shrooms\startm~1\programs\startup\regist~2.lnk - d:\pop3\pop\support\register\RegistrationReminder.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\lolrec~1.lnk - c:\program files\lolreplay\LOLRecorder.exe

IE: &Search

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

IFEO: image file execution options - svchost.exe

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\shrooms\application data\mozilla\firefox\profiles\mwkxrc77.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT315908&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZRfox000&ptb=jFSzIIdODiWFC3uHHD9mXQ&ind=2010072314&ptnrS=ZRfox000&si=&n=77cf44fa&psa=&st=kwd&searchfor=

FF - component: c:\documents and settings\shrooms\application data\mozilla\firefox\profiles\mwkxrc77.default\extensions\dttoolbar@toolbarnet.com\components\DTToolbarFF.dll

FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll

FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\documents and settings\shrooms\local settings\application data\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin2.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin3.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin4.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin5.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin6.dll

FF - plugin: c:\program files\k-lite codec pack\quicktime\plugins\npqtplugin7.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.50917.0\npctrlui.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]

R0 vax347b;vax347b;c:\windows\system32\drivers\vax347b.sys [2008-7-1 159616]

R0 vax347s;vax347s;c:\windows\system32\drivers\vax347s.sys [2008-7-1 5248]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-11 229840]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2011-10-19 36000]

R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-10-19 86224]

R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2011-10-19 110032]

R2 avgfws;AVG zaštitni zid;c:\program files\avg\avg2012\avgfws.exe [2011-8-19 2399560]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-9-12 5265248]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-10-19 74640]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-5-13 366152]

R2 StarWindService;StarWind iSCSI Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindService.exe [2005-4-2 217600]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2011-5-23 30944]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134608]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-7-11 16720]

R3 danewFltr;NewDeathAdder Mouse;c:\windows\system32\drivers\danew.sys [2011-6-29 11136]

R3 hidkmdf;Filter Driver Service for HID-KMDF Interface layer;c:\windows\system32\drivers\hidkmdf.sys [2011-6-29 6656]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-5-13 22216]

R3 VKbms;Virtual HID Minidriver;c:\windows\system32\drivers\VKbms.sys [2011-6-29 10240]

S0 ps6ah4nb;DiRT Synchronization Driver (ps6ah4nb);c:\windows\system32\drivers\ps6ah4nb.sys --> c:\windows\system32\drivers\ps6ah4nb.sys [?]

S0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc);c:\windows\system32\drivers\ps6ah4nc.sys --> c:\windows\system32\drivers\ps6ah4nc.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 pr2ah4nb;DiRT Drivers Auto Removal (pr2ah4nb);c:\windows\system32\pr2ah4nb.exe svc --> c:\windows\system32\pr2ah4nb.exe svc [?]

S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc);c:\windows\system32\pr2ah4nc.exe svc --> c:\windows\system32\pr2ah4nc.exe svc [?]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2011-5-23 30944]

S3 hid7906;hid7906;c:\windows\system32\drivers\hid7906.sys [2008-1-4 53793]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S3 Razerlow;Razer Copperhead Driver;c:\windows\system32\drivers\Razerlow.sys [2009-6-26 19020]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S3 XDva370;XDva370;\??\c:\windows\system32\xdva370.sys --> c:\windows\system32\XDva370.sys [?]

.

=============== Created Last 30 ================

.

2011-10-26 12:06:46 -------- d-----w- c:\documents and settings\shrooms\application data\AVG2012

2011-10-26 12:05:02 -------- d-----w- c:\windows\system32\drivers\AVG

2011-10-26 12:05:02 -------- d-----w- c:\documents and settings\all users\application data\AVG2012

2011-10-26 12:04:00 -------- d-----w- c:\program files\AVG

2011-10-26 11:52:14 -------- d--h--w- c:\documents and settings\all users\application data\Common Files

2011-10-26 11:51:41 -------- d-----w- c:\documents and settings\all users\application data\MFAData

2011-10-25 20:38:58 -------- d-----w- c:\program files\common files\PC Tools

2011-10-25 20:38:57 -------- d-----w- c:\program files\PC Tools Security

2011-10-25 20:33:58 -------- d-----w- c:\documents and settings\all users\application data\PC Tools

2011-10-24 18:56:03 -------- d-----r- c:\program files\Skype

2011-10-22 12:24:03 -------- d-----w- c:\program files\Rainmeter

2011-10-19 21:37:11 -------- d-----w- c:\documents and settings\shrooms\application data\Avira

2011-10-19 21:36:36 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2011-10-19 21:36:35 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-10-19 21:36:21 -------- d-----w- c:\program files\Avira

2011-10-19 21:36:21 -------- d-----w- c:\documents and settings\all users\application data\Avira

2011-10-11 12:08:06 -------- d-----w- c:\windows\system32\1008

2011-10-01 10:49:24 -------- d-----w- C:\FPC

.

==================== Find3M ====================

.

2011-10-03 03:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-03 00:37:52 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-09-28 11:35:25 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-26 09:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 09:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 09:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2011-09-13 04:30:10 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-06 13:20:51 1858944 ----a-w- c:\windows\system32\win32k.sys

2011-09-05 13:56:22 667136 ----a-w- c:\windows\system32\wininet.dll

2011-09-05 13:56:22 61952 ----a-w- c:\windows\system32\tdc.ocx

2011-09-05 13:56:21 81920 ----a-w- c:\windows\system32\ieencode.dll

2011-09-05 12:35:09 369664 ----a-w- c:\windows\system32\html.iec

2011-08-31 15:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-26 21:49:51 443448 ----a-w- c:\windows\system32\drivers\sptd.sys

2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys

2011-08-09 20:32:40 6060 --sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys

.

============= FINISH: 11:58:30,03 ===============

And here is attach :

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 12.3.2011 16:08:43

System Uptime: 27.10.2011 11:07:33 (0 hours ago)

.

Motherboard: MSI | | MS-7369

Processor: AMD Athlon 64 X2 Dual Core Processor 4400+ | CPU 1 | 2310/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 40 GiB total, 2,397 GiB free.

D: is FIXED (NTFS) - 193 GiB total, 58,224 GiB free.

E: is CDROM ()

F: is CDROM ()

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Hamachi Network Interface

Device ID: ROOT\NET\0000

Manufacturer: LogMeIn, Inc.

Name: Hamachi Network Interface

PNP Device ID: ROOT\NET\0000

Service: hamachi

.

==== System Restore Points ===================

.

RP197: 17.10.2011 12:00:33 - Removed Assassin's Creed II

RP198: 17.10.2011 12:18:42 - Installé Pro Evolution Soccer 2012.

RP199: 21.10.2011 11:42:35 - System Checkpoint

RP200: 21.10.2011 13:00:19 - Pro Evolution Soccer 2012 supprimé.

RP201: 21.10.2011 13:17:34 - Software Distribution Service 3.0

RP202: 21.10.2011 21:19:25 - Removed Assassin's Creed Brotherhood

RP203: 21.10.2011 21:20:49 - Removed Titan Quest

RP204: 21.10.2011 21:21:26 - Removed Titan Quest Immortal Throne

RP205: 21.10.2011 21:35:01 - Installed Pro Evolution Soccer 2012.

RP206: 22.10.2011 0:54:40 - Software Distribution Service 3.0

RP207: 22.10.2011 13:03:36 - Installed Java 6 Update 29

RP208: 23.10.2011 13:28:01 - System Checkpoint

RP209: 24.10.2011 20:54:32 - Removed Skype Click to Call

RP210: 24.10.2011 20:54:52 - Removed Skype™ 5.5

RP211: 26.10.2011 14:03:59 - Instalirano AVG 2012

RP212: 26.10.2011 14:04:38 - Instalirano AVG 2012

.

==== Installed Programs ======================

.

µTorrent

ACDSee

Adobe AIR

Adobe Bridge 1.0

Adobe Common File Installer

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Help Center 2.1

Adobe Photoshop CS2

Adobe Reader X (10.1.1)

Adobe Shockwave Player 11.5

Adobe Stock Photos 1.0

AIMP2

Akamai NetSession Interface

AMD APP SDK Runtime

Apple Application Support

Apple Software Update

Ask Toolbar

ASUS nVIDIA Driver

ATI AVIVO Codecs

ATI Catalyst Control Center

ATI Catalyst Install Manager

ATI Parental Control & Encoder

AVG 2012

Avira Free Antivirus

Bastion

Beowulf TM

BitLocker To Go Reader

Bonjour

Catalyst Control Center

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center HydraVision Full

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-preinstall

ccc-core-static

ccc-utility

CCC Help English

CCleaner

CDCheck (remove only)

Chessmaster Challenge

Chicken Invaders: Revenge of the Yolk (Christmas Edition) v3.20

Compatibility Pack for the 2007 Office system

Contents

Corel PaintShop Photo Pro X3

CorelDRAW Graphics Suite 12

DAEMON Tools Lite

DAEMON Tools Toolbar

DarksidersInstaller

Deus Ex - Human Revolution version 1.0

DeviceIO

DEVIL MAY CRY 4

Fraps (remove only)

Free Pascal 2.4.4

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

Gutterball 2

Hamachi 1.0.1.5

HighMAT Extension to Microsoft Windows XP CD Writing Wizard

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB961118)

hott notes 4

ICA

IPM_PSP_Pro

J2SE Runtime Environment 5.0 Update 8

Java Auto Updater

Java 6 Update 29

Jelen SuperLiga by EDIT TEAM version 2011

K-Lite Mega Codec Pack 1.52

League of Legends

Little Fighter 2.5 - v2.0

LOLReplay

Luxor 2

Luxor 3

Macro Vibration Joystick

Mad Caps

Magic ISO Maker v5.5 (build 0276)

Malwarebytes' Anti-Malware version 1.51.2.1300

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2416447)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Games for Windows - LIVE

Microsoft Games for Windows - LIVE Redistributable

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft Office Live Add-in 1.3

Microsoft Office Outlook Connector

Microsoft Office Professional Edition 2003

Microsoft Office Word Viewer 2003

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Windows Journal Viewer

Microsoft XNA Framework Redistributable 3.1

MLE

Motherboard Monitor 5

Mozilla Firefox 7.0.1 (x86 en-US)

MP3 Player Utilities 1.40

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

MSXML 6 Service Pack 2 (KB973686)

MSXML4 Parser

Nero 6 Ultra Edition

Nero 7 Premium

Norton Security Scan

NVIDIA Drivers

NVIDIA PhysX

OLYMPUS Master 2

OLYMPUS muvee theaterPack

OpenAL

Pando Media Booster

PCI SoftV92 Modem

Plants vs. Zombies

PowerDVD

Prince of Persia T2T

Pro Evolution Soccer 2011 1.0

Pro Evolution Soccer 2012

PSPH10Pro

PSPPContent

PSPPRO_DCRAW

PunkBuster Services

PureHD

QuickTime

Razer Copperhead

Razer DeathAdder Mouse

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

REALTEK GbE & FE Ethernet PCI-E NIC Driver

Realtek High Definition Audio Driver

RealUpgrade 1.1

RegCure

Rockstar Games Social Club

Rubber Ninjas 1.05

S4 League_EU

Saitek Dual Analog Rumble Pad

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft Windows (KB2564958)

Security Update for Step By Step Interactive Training (KB898458)

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2530548)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2544521)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2559049)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2586448)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

Setup

Share

Skype™ 5.3

Snail Mail

Sonic & SEGA All-Stars Racing

SpeedFan (remove only)

Steam

SweetIM for Messenger 3.3

SweetIM Toolbar for Internet Explorer 3.9

TeamSpeak 2 RC2

Total Commander (Remove or Repair)

Ubisoft Game Launcher

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VIO

VLC media player 1.1.4

WARRIORS OROCHI

WebFldrs XP

Windows Media Encoder 9 Series

Windows Media Format 11 runtime

Windows Media Player 10

Windows Media Player Firefox Plugin

Windows Presentation Foundation

Windows XP Service Pack 3

WinRAR archiver

Xbox 360 Controller for Windows

XML Paper Specification Shared Components Pack 1.0

XP Royale Theme

.

==== Event Viewer Messages From Past Week ========

.

26.10.2011 16:15:51, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Security Service service to connect.

26.10.2011 16:15:51, error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

26.10.2011 14:06:01, error: Service Control Manager [7000] - The AVG TDI Driver service failed to start due to the following error: The parameter is incorrect.

24.10.2011 7:51:29, error: Service Control Manager [7023] - The HID Input Service service terminated with the following error: The system cannot find the file specified.

24.10.2011 7:50:16, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 0019DBD16D0B has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

24.10.2011 20:48:41, error: System Error [1003] - Error code 1000008e, parameter1 c0000047, parameter2 804fcf44, parameter3 f78b6774, parameter4 00000000.

24.10.2011 20:45:28, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: gagp30kx ViaIde

24.10.2011 20:45:08, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

24.10.2011 18:03:07, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: The system cannot find the file specified.

.

==== End Of File ===========================

screen317 · October 31, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

amann95 · November 1, 2011

Hi and welcome to Malwarebytes.
Please update MBAM, run a Quick Scan, and post its log.
Next, please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

Here is mbams log :

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8059

Windows 5.1.2600 Service Pack 3

Here are mbam logs :

Internet Explorer 6.0.2900.5512

1.11.2011 9:45:21

mbam-log-2011-11-01 (09-45-20).txt

Scan type: Quick scan

Objects scanned: 194153

Time elapsed: 10 minute(s), 14 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here is combofix :

ComboFix 11-10-30.03 - Shrooms 01.11.2011 9:57:56.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2041 [GMT 1:00]

Running from: C:\Documents and Settings\Shrooms\Desktop\ComboFix.exe

AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

FW: AVG Firewall *Enabled* {8decf618-9569-4340-b34a-d78d28969b66}

* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\All Users\Application Data\ACD Systems\ACDSee\ImageDB.ddf

C:\Documents and Settings\All Users\Application Data\ae8077

C:\Documents and Settings\All Users\Application Data\ae8077\6775.mof

C:\Documents and Settings\All Users\Application Data\ae8077\BackUp\Adobe Gamma.lnk

C:\Documents and Settings\All Users\Application Data\ae8077\BackUp\Adobe Reader Speed Launch.lnk

C:\Documents and Settings\All Users\Application Data\ae8077\BackUp\hott notes 4.lnk

C:\Documents and Settings\All Users\Application Data\ae8077\BackUp\LOLRecorder.lnk

C:\Documents and Settings\All Users\Application Data\ae8077\BackUp\Registration Prince of Persia T2T.LNK

C:\Documents and Settings\All Users\Application Data\ae8077\PSG.ico

C:\Documents and Settings\Shrooms\Application Data\Toolbar4

C:\Documents and Settings\Shrooms\Local Settings\Application Data\.#

C:\Documents and Settings\Shrooms\Recent\ANTIGEN.dll

C:\Documents and Settings\Shrooms\Recent\cb.drv

C:\Documents and Settings\Shrooms\Recent\cb.exe

C:\Documents and Settings\Shrooms\Recent\cb.sys

C:\Documents and Settings\Shrooms\Recent\eb.sys

C:\Documents and Settings\Shrooms\Recent\exec.drv

C:\Documents and Settings\Shrooms\Recent\fan.exe

C:\Documents and Settings\Shrooms\Recent\fan.sys

C:\Documents and Settings\Shrooms\Recent\FW.tmp

C:\Documents and Settings\Shrooms\Recent\Linking Park - In th.m3u

C:\Documents and Settings\Shrooms\Recent\pal.dll

C:\Documents and Settings\Shrooms\Recent\pal.tmp

C:\Documents and Settings\Shrooms\Recent\PE.drv

C:\Documents and Settings\Shrooms\Recent\PE.sys

C:\Documents and Settings\Shrooms\Recent\ppal.tmp

C:\Documents and Settings\Shrooms\Recent\runddl.dll

C:\Documents and Settings\Shrooms\Recent\sld.exe

C:\Documents and Settings\Shrooms\Recent\Thumbs.db

C:\Documents and Settings\Shrooms\Recent\tjd.dll

C:\Documents and Settings\Shrooms\Recent\tjd.drv

C:\Documents and Settings\Shrooms\WINDOWS

C:\WINDOWS\help\tours\htmltour\unlock_playing.htm

C:\WINDOWS\pkunzip.pif

C:\WINDOWS\pkzip.pif

C:\WINDOWS\system\oeminfo.ini

C:\WINDOWS\system32\d3d9caps.dat

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MYWEBSEARCHSERVICE

-------\Legacy_SSHNAS

((((((((((((((((((((((((( Files Created from 2011-10-01 to 2011-11-01 )))))))))))))))))))))))))))))))

2011-10-27 20:03:17 . 2011-10-27 20:03:17 -------- d-----w- C:\$AVG

2011-10-26 12:06:46 . 2011-10-26 12:06:46 -------- d-----w- C:\Documents and Settings\Shrooms\Application Data\AVG2012

2011-10-26 12:05:02 . 2011-11-01 07:13:26 -------- d-----w- C:\WINDOWS\system32\drivers\AVG

2011-10-26 12:05:02 . 2011-10-26 14:20:00 -------- d-----w- C:\Documents and Settings\All Users\Application Data\AVG2012

2011-10-26 12:04:00 . 2011-10-26 12:04:00 -------- d-----w- C:\Program Files\AVG

2011-10-26 11:52:14 . 2011-10-26 11:52:14 -------- d--h--w- C:\Documents and Settings\All Users\Application Data\Common Files

2011-10-26 11:51:41 . 2011-11-01 07:49:04 -------- d-----w- C:\Documents and Settings\All Users\Application Data\MFAData

2011-10-25 20:38:58 . 2011-10-27 09:07:58 -------- d-----w- C:\Program Files\Common Files\PC Tools

2011-10-25 20:38:57 . 2011-10-27 09:07:58 -------- d-----w- C:\Program Files\PC Tools Security

2011-10-25 20:33:58 . 2011-10-26 14:44:52 -------- d-----w- C:\Documents and Settings\All Users\Application Data\PC Tools

2011-10-24 18:56:06 . 2011-10-24 18:56:06 -------- d-----w- C:\Program Files\Common Files\Skype

2011-10-24 18:56:03 . 2011-10-24 18:56:06 -------- d-----r- C:\Program Files\Skype

2011-10-22 12:24:03 . 2011-10-22 13:13:25 -------- d-----w- C:\Program Files\Rainmeter

2011-10-19 21:37:11 . 2011-10-19 21:37:11 -------- d-----w- C:\Documents and Settings\Shrooms\Application Data\Avira

2011-10-19 21:36:36 . 2011-10-11 13:00:32 36000 ----a-w- C:\WINDOWS\system32\drivers\avkmgr.sys

2011-10-19 21:36:35 . 2011-10-11 13:00:32 74640 ----a-w- C:\WINDOWS\system32\drivers\avgntflt.sys

2011-10-19 21:36:35 . 2011-10-11 13:00:32 134344 ----a-w- C:\WINDOWS\system32\drivers\avipbb.sys

2011-10-19 21:36:21 . 2011-10-19 21:36:21 -------- d-----w- C:\Program Files\Avira

2011-10-19 21:36:21 . 2011-10-19 21:36:21 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Avira

2011-10-11 12:08:06 . 2011-10-11 12:08:06 -------- d-----w- C:\WINDOWS\system32\1008

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2011-10-03 03:06:03 . 2010-06-12 20:50:53 472808 ----a-w- C:\WINDOWS\system32\deployJava1.dll

2011-10-03 00:37:52 . 2011-05-13 16:02:47 73728 ----a-w- C:\WINDOWS\system32\javacpl.cpl

2011-09-28 11:35:25 . 2011-05-13 15:59:08 404640 ----a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

2011-09-26 09:41:20 . 2008-07-29 17:59:58 611328 ----a-w- C:\WINDOWS\system32\uiautomationcore.dll

2011-09-26 09:41:20 . 2002-11-22 16:19:26 220160 ----a-w- C:\WINDOWS\system32\oleacc.dll

2011-09-26 09:41:14 . 2002-11-22 16:19:26 20480 ----a-w- C:\WINDOWS\system32\oleaccrc.dll

2011-09-13 04:30:10 . 2011-09-13 04:30:10 32592 ----a-w- C:\WINDOWS\system32\drivers\avgrkx86.sys

2011-09-09 09:12:13 . 2004-08-04 00:56:42 599040 ----a-w- C:\WINDOWS\system32\crypt32.dll

2011-09-06 13:20:51 . 2004-08-03 23:17:42 1858944 ----a-w- C:\WINDOWS\system32\win32k.sys

2011-09-05 13:56:22 . 2004-08-04 00:56:48 667136 ----a-w- C:\WINDOWS\system32\wininet.dll

2011-09-05 13:56:22 . 2004-08-03 22:59:30 61952 ----a-w- C:\WINDOWS\system32\tdc.ocx

2011-09-05 13:56:21 . 2004-08-04 00:56:44 81920 ----a-w- C:\WINDOWS\system32\ieencode.dll

2011-09-05 12:35:09 . 2004-08-03 22:59:58 369664 ----a-w- C:\WINDOWS\system32\html.iec

2011-08-31 15:00:50 . 2011-05-13 12:32:36 22216 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys

2011-08-26 21:49:51 . 2007-10-20 13:20:17 443448 ----a-w- C:\WINDOWS\system32\drivers\sptd.sys

2011-08-17 13:49:54 . 2004-08-03 23:14:16 138496 ----a-w- C:\WINDOWS\system32\drivers\afd.sys

2011-08-09 20:32:40 . 2011-03-15 17:35:44 6060 --sha-w- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys

2011-08-08 04:08:58 . 2011-08-08 04:08:58 40016 ----a-w- C:\WINDOWS\system32\drivers\avgmfx86.sys

2011-10-05 08:19:38 . 2011-05-10 13:00:26 134104 ----a-w- C:\Program Files\mozilla firefox\components\browsercomps.dll

heres new dds :

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_29

Run by Shrooms at 10:22:37 on 2011-11-01

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2073 [GMT 1:00]

.

AV: AVG Internet Security 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

FW: AVG Firewall *Enabled*

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe -k Akamai

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\AVG\AVG2012\avgfws.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Razer\Copperhead\razerhid.exe

C:\WINDOWS\RTHDCPL.EXE

C:\program files\real\realplayer\update\realsched.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Razer\DeathAdder\razerhid.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\LOLReplay\LOLRecorder.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\hott notes 4\hottnotes.exe

C:\Program Files\Razer\Copperhead\razerofa.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Razer\DeathAdder\razertra.exe

C:\Program Files\Razer\DeathAdder\razerofa.exe

C:\Program Files\Razer\DeathAdder\vdDaemon.exe

C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\Program Files\Common Files\Corel\Standby\Standby.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.bigseekpro.com/mediaget/{5FF7ECB8-6D08-4C83-996A-01C297A8E99E}

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.bigseekpro.com/mediaget/{5FF7ECB8-6D08-4C83-996A-01C297A8E99E}

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uInternet Settings,ProxyServer = http=127.0.0.1:25507;

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie