Constant IP Blocks from China?

master131 · November 12, 2011

I've been getting popups from Malwarebytes Anti-Malware about outgoing connections to an IP in China. More details can be found here.

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421

Run by Tommy at 20:20:02 on 2011-11-12

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.61.1033.18.3579.1733 [GMT 11:00]

.

AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Program Files\Sandboxie\SbieSvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\fsproflt.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Secunia\PSI\PSIA.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

C:\Program Files\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\CyberLink\TV Enhance\Kernel\TV\TVESched.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe

C:\Program Files\Internet Download Manager\idman.exe

H:\Steam\Steam.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\Common Files\Steam\SteamService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\DllHost.exe

C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RTHDVCPL.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Secunia\PSI\sua.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Nero\Update\NASvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\conhost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com.au/

uInternet Settings,ProxyOverride = *.local

BHO: IDM integration (IDMIEHlprObj Class): {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RoboForm BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\microsoft office\office14\GROOVEEX.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\microsoft office\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll

TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File

uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [iDMan] c:\program files\internet download manager\idman.exe /onboot

uRun: [steam] "h:\steam\steam.exe" -silent

uRun: [Google Update] "c:\users\tommy\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [NUSB3MON] "c:\program files\renesas electronics\usb 3.0 host controller driver\application\nusb3mon.exe"

mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\users\tommy\appdata\roaming\micros~1\windows\startm~1\programs\startup\setpoint.lnk - c:\program files\logitech\setpointp\SetPoint.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html

IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm

IE: Download with IDM - c:\program files\internet download manager\IEExt.htm

IE: Download with Mipony - file://c:\program files\mipony\browser\IEContext.htm

IE: E&xport to Microsoft Excel - c:\progra~1\microsoft office\office14\EXCEL.EXE/3000

IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html

IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html

IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html

IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html

IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html

IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{9C6B2315-CBE4-4201-92D6-EA3A99D5C777} : DhcpNameServer = 192.168.0.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\microsoft office\office14\GROOVEEX.DLL

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

Hosts: 65.254.62.146 www.minecraft.net

Hosts: 65.254.62.146 minecraft.net

Hosts: 65.254.62.146 server.mojang.com

Hosts: 65.254.62.146 session.minecraft.net

============= SERVICES / DRIVERS ===============

.

R0 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2011-8-4 50624]

R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [2011-2-15 43792]

R0 mv91cons;Marvell 91xx Config Device Driver;c:\windows\system32\drivers\mv91cons.sys [2009-10-10 20008]

R0 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys [2010-8-6 257064]

R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [2011-2-13 18544]

R1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\drivers\EpfwLWF.sys [2011-8-4 33656]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-23 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-12 116608]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-10-13 176128]

R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2011-9-22 974944]

R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [2011-2-15 73392]

R2 IDMWFP;IDMWFP;c:\windows\system32\drivers\idmwfp.sys [2011-10-6 89376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-3-6 366152]

R2 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2010-3-25 490280]

R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-11 993848]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-1-11 399416]

R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-8-18 2358656]

R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-8-24 92008]

R2 TVECapSvc;TVEnhance Background Capture Service (TBCS);c:\program files\cyberlink\tv enhance\kernel\tv\TVECapSvc.exe [2010-9-13 464224]

R2 TVESched;TVEnhance Task Scheduler (TTS));c:\program files\cyberlink\tv enhance\kernel\tv\TVESched.exe [2010-9-13 189792]

R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-10-13 8598528]

R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-10-13 257024]

R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-9-15 232512]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-3-6 22216]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2011-2-10 63872]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2011-2-10 141952]

R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-4-18 340072]

R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2011-8-28 130320]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 ANTS Memory Profiler 7 Service;ANTS Memory Profiler 7 Service;c:\program files\red gate\ants memory profiler 7\RedGate.Memory.IISService.exe [2011-8-21 174008]

S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-3-25 101392]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 CEDRIVER60;CEDRIVER60;c:\program files\cheat engine 6.1\dbk32.sys [2011-9-24 72576]

S3 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2011-8-9 163424]

S3 etdrv;etdrv;c:\windows\etdrv.sys [2010-7-7 17488]

S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [2010-6-27 32256]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-4-15 15872]

S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2011-9-29 27192]

S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-11-26 34384]

S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-15 52224]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-4-13 1343400]

S3 wxpSvc;webcamXP Service;c:\program files\wlite\wService.exe [2010-5-3 5027328]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-23 47128]

S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]

.

=============== Created Last 30 ================

.

2011-11-12 09:14:20 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f705e487-1fef-49dd-a604-3132c25b12df}\mpengine.dll

2011-11-12 09:14:20 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{f705e487-1fef-49dd-a604-3132c25b12df}\offreg.dll

2011-11-12 09:13:08 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-11-10 04:50:05 -------- d-----w- c:\users\tommy\appdata\local\Akamai

2011-11-09 05:03:30 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-09 05:03:27 708608 ----a-w- c:\program files\common files\system\wab32.dll

2011-11-09 05:03:26 2341888 ----a-w- c:\windows\system32\win32k.sys

2011-11-09 04:55:33 -------- d-----w- c:\program files\CCleaner

2011-11-05 22:56:57 -------- d-----w- c:\program files\RADVideo

2011-11-05 02:18:05 -------- d-----w- c:\users\tommy\appdata\roaming\f-secure

2011-11-05 02:15:50 -------- d-----w- c:\programdata\F-Secure

2011-11-04 08:43:04 -------- d-----w- c:\windows\system32\directx

2011-11-04 05:09:46 -------- d-----w- c:\programdata\VS

2011-11-03 10:31:08 -------- d-----w- c:\users\tommy\appdata\roaming\Synthesia

2011-11-03 09:43:01 -------- d-----w- c:\program files\Programming Editor

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-11-03 06:37:54 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-11-02 09:01:10 -------- d-----w- c:\program files\common files\TortoiseOverlays

2011-11-02 09:01:09 -------- d-----w- c:\program files\TortoiseSVN

2011-11-01 08:39:19 -------- d-----w- c:\program files\Rock of Ages

2011-11-01 07:06:19 -------- d--h--w- c:\windows\AxInstSV

2011-11-01 02:02:34 -------- d-----w- c:\program files\AMD APP

2011-11-01 01:58:32 -------- d-----w- C:\ATI

2011-10-24 03:29:02 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2011-10-24 03:29:02 69632 ----a-w- c:\windows\system32\QuickTime.qts

2011-10-20 08:58:25 -------- d-----w- c:\program files\common files\Symantec Shared

2011-10-20 08:47:44 -------- d-----w- c:\programdata\Symantec

2011-10-20 08:47:39 -------- d-----w- c:\programdata\Norton

2011-10-20 08:47:37 -------- d-----w- c:\programdata\NortonInstaller

2011-10-18 05:46:45 -------- d-----w- c:\users\tommy\appdata\roaming\JustDecompile

2011-10-17 05:09:01 -------- d-----w- c:\users\tommy\appdata\roaming\WinPatrol

2011-10-17 05:08:55 -------- d-----w- c:\programdata\InstallMate

2011-10-17 05:08:55 -------- d-----w- c:\program files\BillP Studios

2011-10-16 08:04:51 75776 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-16 08:04:51 465408 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-16 08:00:42 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-16 08:00:42 233472 ----a-w- c:\windows\system32\oleacc.dll

2011-10-16 07:55:32 18139008 ----a-w- c:\program files\common files\microsoft shared\office14\MSO.DLL

2011-10-16 05:15:37 -------- d-----w- c:\users\tommy\appdata\local\temp

2011-10-14 09:42:00 -------- d-----w- c:\program files\iTunes

2011-10-14 09:42:00 -------- d-----w- c:\program files\iPod

2011-10-14 09:39:45 -------- d-----w- c:\program files\Bonjour

2011-10-14 08:02:34 110592 ----a-w- c:\windows\system32\rtvcvfw32.dll

2011-10-14 05:07:19 -------- d-----w- c:\program files\Sophos

.

==================== Find3M ====================

.

2011-10-25 20:50:06 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-12 20:55:06 8598528 ----a-w- c:\windows\system32\drivers\atikmdag.sys

2011-10-12 20:14:36 159744 ----a-w- c:\windows\system32\atiapfxx.exe

2011-10-12 20:14:26 736768 ----a-w- c:\windows\system32\aticfx32.dll

2011-10-12 20:10:28 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll

2011-10-12 20:10:00 397312 ----a-w- c:\windows\system32\atieclxx.exe

2011-10-12 20:09:32 176128 ----a-w- c:\windows\system32\atiesrxx.exe

2011-10-12 20:08:24 159744 ----a-w- c:\windows\system32\atitmmxx.dll

2011-10-12 20:08:10 356352 ----a-w- c:\windows\system32\atipdlxx.dll

2011-10-12 20:07:58 278528 ----a-w- c:\windows\system32\Oemdspif.dll

2011-10-12 20:07:52 20992 ----a-w- c:\windows\system32\atimuixx.dll

2011-10-12 20:07:44 43520 ----a-w- c:\windows\system32\ati2edxx.dll

2011-10-12 20:04:42 4231680 ----a-w- c:\windows\system32\atidxx32.dll

2011-10-12 20:04:14 18630656 ----a-w- c:\windows\system32\atioglxx.dll

2011-10-12 19:46:18 46080 ----a-w- c:\windows\system32\aticalrt.dll

2011-10-12 19:46:08 44032 ----a-w- c:\windows\system32\aticalcl.dll

2011-10-12 19:44:28 4289024 ----a-w- c:\windows\system32\atiumdag.dll

2011-10-12 19:44:20 1828864 ----a-w- c:\windows\system32\atiumdmv.dll

2011-10-12 19:42:56 8391680 ----a-w- c:\windows\system32\aticaldd.dll

2011-10-12 19:39:36 52736 ----a-w- c:\windows\system32\coinst.dll

2011-10-12 19:33:10 4174848 ----a-w- c:\windows\system32\atiumdva.dll

2011-10-12 19:31:20 335872 ----a-w- c:\windows\system32\atiadlxx.dll

2011-10-12 19:31:02 14336 ----a-w- c:\windows\system32\atiglpxx.dll

2011-10-12 19:30:50 32768 ----a-w- c:\windows\system32\atigktxx.dll

2011-10-12 19:30:18 257024 ----a-w- c:\windows\system32\drivers\atikmpag.sys

2011-10-12 19:29:42 31744 ----a-w- c:\windows\system32\atiuxpag.dll

2011-10-12 19:29:26 29184 ----a-w- c:\windows\system32\atiu9pag.dll

2011-10-12 19:28:30 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

2011-10-12 19:16:42 53760 ----a-w- c:\windows\system32\atimpc32.dll

2011-10-12 19:16:42 53760 ----a-w- c:\windows\system32\amdpcom32.dll

2011-10-12 05:16:30 56832 ----a-w- c:\windows\system32\OpenVideo.dll

2011-10-12 05:15:40 13753856 ----a-w- c:\windows\system32\amdocl.dll

2011-10-12 05:14:50 43520 ----a-w- c:\windows\system32\OpenCL.dll

2011-10-04 08:00:00 74752 ----a-w- c:\windows\system32\ff_vfw.dll

2011-10-04 03:00:38 140072 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2011-10-04 03:00:30 280904 ----a-w- c:\windows\system32\PnkBstrB.xtr

2011-10-04 03:00:30 280904 ----a-w- c:\windows\system32\PnkBstrB.exe

2011-10-04 02:54:33 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0

2011-10-04 02:38:41 138056 ----a-w- c:\users\tommy\appdata\roaming\PnkBstrK.sys

2011-10-04 02:38:26 75136 ----a-w- c:\windows\system32\PnkBstrA.exe

2011-10-02 18:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-26 01:33:46 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe

2011-09-25 09:33:48 216064 ----a-w- c:\windows\system32\lagarith.dll

2011-09-15 06:39:50 232512 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys

2011-09-01 02:35:59 1798144 ----a-w- c:\windows\system32\jscript9.dll

2011-09-01 02:28:15 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-09-01 02:22:54 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-08-31 07:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-30 12:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe

2011-08-30 12:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll

2011-08-17 06:15:34 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

2011-08-15 05:06:20 90928 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys

2011-08-15 05:06:20 158512 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys

2011-08-15 05:06:20 104752 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys

.

============= FINISH: 20:20:58.43 ===============

Maniac · November 16, 2011

Hello master131! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

Please generate a new fresh DDS log file. Please post both logs in your next reply.

master131 · November 17, 2011

DDS.txt

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421

Run by Tommy at 19:22:10 on 2011-11-17

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.61.1033.18.3579.1902 [GMT 11:00]

.

AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\Sandboxie\SbieSvc.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\fsproflt.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Secunia\PSI\PSIA.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

C:\Program Files\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\CyberLink\TV Enhance\Kernel\TV\TVESched.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Secunia\PSI\sua.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

C:\Program Files\Internet Download Manager\idman.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RTHDVCPL.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Nero\Update\NASvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Windows Media Player\wmplayer.exe

H:\Steam\steam.exe

C:\Program Files\Common Files\Steam\SteamService.exe

C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\rundll32.exe

C:\Users\Tommy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe