virus?

[worriedaboutmycomputer]

I completed an Avast Scan a few weeks ago and had a virus - three threats were found but I couldn't do anything with them (two had an error message saying the specified file is read only and the other error message said access is denied). I ran malware anti-malware and nothing was found.

I've since run avast on two more occasions - on each occasion some files couldn't be scanned and all of the files ended with a .dll extension. Ad-Aware is finding malicious processes running and is able to quarantine them.

I ran malware anti-malware again - Here is the log for it:

Database version: 7925

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

11/10/2011 6:20:19 PM

mbam-log-2011-10-11 (18-20-19).txt

Scan type: Quick scan

Objects scanned: 181392

Time elapsed: 4 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

I'm wondering what more I can do to get rid of whatever viruses are on my computer?

Thanks!

[LDTate]

Please don't attach the scan results, use Copy/Paste

Logs will be closed if you haven't replied within 3 days

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

• If you use Firefox browser
  Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
    
  • DDS.pif
    

[*]Disable any script blocking protection (How to Disable your Security Programs)

[*]Double click DDS icon to run the tool (may take up to 3 minutes to run)

[*]When done, DDS.txt will open.

[*]After a few moments, attach.txt will open in a second window.

[*]Save both reports to your desktop.

---------------------------------------------------

• Post the contents of the DDS.txt in your next reply
  

[worriedaboutmycomputer]

Thanks. Here it is:

DDS (Ver_2011-06-23.01) - NTFSAMD64

Internet Explorer: 8.0.7600.16385

Run by Kris at 20:40:02 on 2011-11-03

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.3894.1758 [GMT -4:00]

.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

.

============== Running Processes ===============

.

svchost.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

C:\windows\system32\taskhost.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

svchost.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\windows\system32\igfxsrvc.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\windows\system32\taskeng.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\TECO\Teco.exe

C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\windows\system32\igfxext.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe

svchost.exe

svchost.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

svchost.exe

C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

svchost.exe

C:\windows\system32\wuauclt.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\windows\system32\SearchFilterHost.exe

C:\windows\SysWOW64\cmd.exe

C:\windows\system32\conhost.exe

C:\windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uWindow Title = Presented by TOSHIBA Leading Innovation >>>

uDefault_Page_URL = hxxp://www.toshiba.ca/welcome

mDefault_Page_URL = hxxp://www.toshiba.ca/welcome

mStart Page = hxxp://www.toshiba.ca/welcome

mWinlogon: Userinit=userinit.exe

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.30.0\bh\BabylonToolbar.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: SearchCore for Browsers: {9d717f81-9148-4f12-8568-69135f087db0} - C:\PROGRA~2\SEARCH~1\SEARCH~1\BROWSE~1.DLL

BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.30.0\BabylonToolbarTlbr.dll

TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet

uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [sVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

mRun: [HWSetup] "C:\Program Files\TOSHIBA\Utilities\HWSetup.exe" hwSetUP

mRun: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

mRun: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe /hide:60

mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

StartupFolder: C:\Users\Kris\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8} : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8}\16C626562747026616D696C697 : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8}\373656165787 : DhcpNameServer = 10.0.0.1

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8}\3797D60716479636F6021323 : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8}\45F697F6471602821637B60266F62702B6569792 : DhcpNameServer = 192.20.20.138

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8}\46C696E6B6 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{6D9B2D5F-BB5E-44DF-9B59-610D468D8ED8}\C696E6B6379737 : DhcpNameServer = 64.71.255.198

TCP: Interfaces\{93226FC9-4D65-4A15-B2D9-AFB27F6407EF} : DhcpNameServer = 192.168.0.1

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\datamngr.dll C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll

BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

BHO-X64: 0x1 - No File

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Babylon toolbar helper: {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.30.0\bh\BabylonToolbar.dll

BHO-X64: Babylon toolbar helper - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: SearchCore for Browsers: {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\SEARCH~1\BROWSE~1.DLL

BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO-X64: SkypeIEPluginBHO - No File

BHO-X64: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll

BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll

TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll

TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB-X64: Babylon Toolbar: {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.30.0\BabylonToolbarTlbr.dll

TB-X64: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll

mRun-x64: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun-x64: [sVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

mRun-x64: [HWSetup] "C:\Program Files\TOSHIBA\Utilities\HWSetup.exe" hwSetUP

mRun-x64: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe

mRun-x64: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe /hide:60

mRun-x64: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

mRun-x64: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

AppInit_DLLs-X64: C:\PROGRA~2\SEARCH~1\SEARCH~1\datamngr.dll C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;C:\windows\system32\DRIVERS\Lbd.sys --> C:\windows\system32\DRIVERS\Lbd.sys [?]

R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]

R1 aswSnx;aswSnx;C:\windows\system32\drivers\aswSnx.sys --> C:\windows\system32\drivers\aswSnx.sys [?]

R1 aswSP;aswSP;C:\windows\system32\drivers\aswSP.sys --> C:\windows\system32\drivers\aswSP.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]

R2 aswFsBlk;aswFsBlk;C:\windows\system32\drivers\aswFsBlk.sys --> C:\windows\system32\drivers\aswFsBlk.sys [?]

R2 aswMonFlt;aswMonFlt;\??\C:\windows\system32\drivers\aswMonFlt.sys --> C:\windows\system32\drivers\aswMonFlt.sys [?]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-10-11 44768]

R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-28 252784]

R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-2-3 13336]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-8-18 2152152]

R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2009-9-28 251760]

R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys --> C:\windows\system32\DRIVERS\TVALZFL.sys [?]

R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-2-3 2314240]

R3 HECIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]

R3 Impcd;Impcd;C:\windows\system32\DRIVERS\Impcd.sys --> C:\windows\system32\DRIVERS\Impcd.sys [?]

R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]

R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-10-28 17152]

R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys --> C:\windows\system32\DRIVERS\pgeffect.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]

R3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;C:\windows\system32\DRIVERS\rtl8192se.sys --> C:\windows\system32\DRIVERS\rtl8192se.sys [?]

R3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-2-3 51512]

R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-5 137560]

R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-10-30 824176]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-27 135664]

S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]

S3 fssfltr;fssfltr;C:\windows\system32\DRIVERS\fssfltr.sys --> C:\windows\system32\DRIVERS\fssfltr.sys [?]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-27 135664]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-2-3 225280]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2011-11-03 23:34:56 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5D1546E3-9369-4375-9797-94A3EF519143}\offreg.dll

2011-11-03 23:32:49 -------- d-----w- C:\Users\Kris\AppData\Local\{494FBAE5-43C7-473F-B814-CBA731DC5B8E}

2011-11-03 23:32:35 -------- d-----w- C:\Users\Kris\AppData\Local\{FCF735B2-A00D-44C3-9061-6A809BCD1739}

2011-11-02 00:07:12 16432 ----a-w- C:\windows\System32\lsdelete.exe

2011-11-01 23:35:37 8570192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5D1546E3-9369-4375-9797-94A3EF519143}\mpengine.dll

2011-11-01 23:29:02 -------- d-----w- C:\Users\Kris\AppData\Local\{CEB79E7C-8DB9-4309-96B3-D17EA4B02A28}

2011-10-28 21:44:31 -------- d-----w- C:\Users\Kris\AppData\Local\{2F66F8A7-D697-40DD-A722-69BC5DBFEFC9}

2011-10-28 21:43:49 -------- d-----w- C:\Users\Kris\AppData\Local\{C454121E-7480-4B03-8466-924F02DC90D1}

2011-10-27 23:29:38 6144 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll

2011-10-27 23:29:38 6144 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll

2011-10-27 23:23:23 -------- d-----w- C:\Users\Kris\AppData\Local\{E86AAB60-4FF7-4BA7-822C-C5159DE74D22}

2011-10-27 23:22:32 -------- d-----w- C:\Users\Kris\AppData\Local\{A04619A9-41CA-4796-BB3A-AE000DD5F7EF}

2011-10-17 21:48:59 -------- d-----w- C:\Users\Kris\AppData\Local\{FF85CDEE-11AC-480B-BBCD-F3455E685CA4}

2011-10-17 21:48:19 -------- d-----w- C:\Users\Kris\AppData\Local\{AF752C77-E804-4F9E-B941-3748FE1D3A0B}

2011-10-15 20:41:43 -------- d-----w- C:\Users\Kris\AppData\Local\{2CDDE871-58D2-4BDC-B86C-40694DF043BA}

2011-10-15 20:41:03 -------- d-----w- C:\Users\Kris\AppData\Local\{74658A0F-CC89-4A75-8201-EE9F1822023D}

2011-10-15 01:17:41 69376 ----a-w- C:\windows\System32\drivers\Lbd.sys

2011-10-15 00:44:30 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2011-10-15 00:44:30 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

2011-10-13 22:30:35 3134976 ----a-w- C:\windows\System32\win32k.sys

2011-10-13 22:28:59 75776 ----a-w- C:\windows\System32\MSDvbNP.ax

2011-10-13 22:28:59 72704 ----a-w- C:\windows\SysWow64\Mpeg2Data.ax

2011-10-13 22:28:59 59904 ----a-w- C:\windows\SysWow64\MSDvbNP.ax

2011-10-13 22:28:59 204288 ----a-w- C:\windows\SysWow64\MSNP.ax

2011-10-13 22:28:56 571904 ----a-w- C:\windows\SysWow64\oleaut32.dll

2011-10-13 22:28:56 331776 ----a-w- C:\windows\System32\oleacc.dll

2011-10-13 22:28:55 861184 ----a-w- C:\windows\System32\oleaut32.dll

2011-10-13 22:28:55 233472 ----a-w- C:\windows\SysWow64\oleacc.dll

2011-10-13 22:22:37 -------- d-----w- C:\Users\Kris\AppData\Local\{90D9AFC5-5FB5-41E6-83CF-BC06DDDE361B}

2011-10-13 22:21:56 -------- d-----w- C:\Users\Kris\AppData\Local\{9BB2007C-177A-4D38-BEA8-90E8A2FF0EDA}

2011-10-12 23:23:27 -------- d-----w- C:\Users\Kris\AppData\Local\{42C61448-AE8D-4C2B-BDAF-B96E76F1ACD2}

2011-10-12 23:22:44 -------- d-----w- C:\Users\Kris\AppData\Local\{BBBF4777-374A-4A0A-AB89-4FFA7A263FD7}

2011-10-12 21:54:41 -------- d-----w- C:\Users\Kris\AppData\Local\{E56F43C3-6E7B-47FB-9190-30172F4FBCFD}

2011-10-12 21:54:00 -------- d-----w- C:\Users\Kris\AppData\Local\{18AC3BA0-18E9-47D7-AF6C-5FE637A919A2}

.

==================== Find3M ====================

.

2011-10-29 03:34:29 55384 ----a-w- C:\windows\System32\drivers\SBREDrv.sys

2011-10-01 03:21:20 1638912 ----a-w- C:\windows\System32\mshtml.tlb

2011-10-01 02:59:14 1638912 ----a-w- C:\windows\SysWow64\mshtml.tlb

2011-09-06 20:45:29 41184 ----a-w- C:\windows\avastSS.scr

2011-09-06 20:38:18 601944 ----a-w- C:\windows\System32\drivers\aswSnx.sys

2011-09-06 20:36:30 65368 ----a-w- C:\windows\System32\drivers\aswMonFlt.sys

2011-08-31 21:00:50 25416 ----a-w- C:\windows\System32\drivers\mbam.sys

2011-08-20 05:45:20 1197568 ----a-w- C:\windows\System32\wininet.dll

2011-08-20 05:41:16 57856 ----a-w- C:\windows\System32\licmgr10.dll

2011-08-20 04:38:10 981504 ----a-w- C:\windows\SysWow64\wininet.dll

2011-08-20 04:35:20 44544 ----a-w- C:\windows\SysWow64\licmgr10.dll

2011-08-20 04:20:23 482816 ----a-w- C:\windows\System32\html.iec

2011-08-20 03:26:38 386048 ----a-w- C:\windows\SysWow64\html.iec

2011-08-17 05:32:24 613888 ----a-w- C:\windows\System32\psisdecd.dll

2011-08-17 05:27:46 288256 ----a-w- C:\windows\System32\MSNP.ax

2011-08-17 05:27:46 108032 ----a-w- C:\windows\System32\psisrndr.ax

2011-08-17 05:27:46 104960 ----a-w- C:\windows\System32\Mpeg2Data.ax

2011-08-17 04:26:02 465408 ----a-w- C:\windows\SysWow64\psisdecd.dll

2011-08-17 04:22:23 75776 ----a-w- C:\windows\SysWow64\psisrndr.ax

.

============= FINISH: 20:43:33.78 ===============

[LDTate]

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

You're running 2 anti-virus programs.

Uninstall one of them.

After that.

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
• Double click on ComboFix.exe & follow the prompts.
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  Note: If you have XP SP3, use the XP SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

[worriedaboutmycomputer]

Thanks. I had understood - obviously incorrectly - that one was an antivirus program and one was more for spyware. Any recommendations on which one is better?

Does it look as if there are any viruses? My computer was having funny toolbars when I was using firefox. Otherwise, it's a bit slow. Main concern aside from the toolbar being an obvious issue was that my anti virus programs were flagging viruses.

I will work on your instructions and get back to you.

[worriedaboutmycomputer]

Ok, I ran combofix and saw the log as it was running but it shut down at the end to reboot. I can't find a log. Any idea what I've done wrong?

[LDTate]

Can you find it?

C:\ComboFix.txt

[worriedaboutmycomputer]

No, I can't. I must have done something wrong. How do I add it to my desktop? It looked like it finished, then restarted the computer, but I can't find it on my computer.

[LDTate]

Did you download combofix to your desktop? If not, move it to your desktop and run it again

[worriedaboutmycomputer]

I can't find combofix anywhere. So I guess I will have to try the whole thing all over again. Thanks for your help. Btw, is Avast or AdAware better?

[LDTate]

Avast or AdAware better?

I don't use either one so I don't have any opinion.

[worriedaboutmycomputer]

Thanks! I may need a few days to get back to you with my combofix results.

[LDTate]

[worriedaboutmycomputer]

I'm having a hard time downloading the combofix file. Once I download and accept it, I try to open it and then it disappears. Any idea what I'm doing wrong?

[LDTate]

Download Combofix but rename it to Iexplorer.com before saving it to your desktop.

Double click on the Iexplorer.com ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

[worriedaboutmycomputer]

I cannot figure out what I'm doing wrong. I'm able to run combofix (saw that they deleted some temp files and a file folder) but I have not downloaded it correctly to then be able to get the log.

If I click on the link, it doesn't give me an option as to where/how to save it. I usually have an easier time than I'm having with downloading this program. Can you give me a step by step on how to download it so I can then access the log? Thanks.

[worriedaboutmycomputer]

Ok, I've now got it to my desktop but still can't figure out how to keep the log ... any ideas what I'm missing?

[LDTate]

Right Click on the link and select Save As.

[worriedaboutmycomputer]

You're quick! You might have missed my post saying I finally got it saved to the desktop, but I'm still not having a log saved. Any ideas what step I'm missing?

[LDTate]

Ok, I've now got it to my desktop but still can't figure out how to keep the log ... any ideas what I'm missing?

You should see "stages" running and after that it should tell you not to do anything until it finishes.

When it finishes it restarts the computer and after restart, it will finish and post the log using Notepad, on your desktop.

[worriedaboutmycomputer]

Ok, it's doing everything but posting the log on the notepad. I watched all of the stages and the deleting of temp files and a folder, but there was never a log produced. Hmm...

[LDTate]

Look in the C: drive

C:\combofix.txt

or

C:\combofix\combofix.txt

[worriedaboutmycomputer]

Thanks. I'm going to try again later tonight and will hopefully have a log to post then! Thanks for your help.

[LDTate]

OK.

You did download it on your desktop, right?

[worriedaboutmycomputer]

Yes, it's on my desktop. It took me a while to get it there - I wasn't given an option to save when I clicked the link but it's there now. I can't find the log, so I'm going to run it again tonight and hope it works!