Can't remove all infected files

TerryD · November 15, 2011

I get the same 184 infected files no matter how many times or ways I try to run malwarebytes.

I hope I am doing this correctly, I have never posted here before!

DDS:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7600.16385

Run by tdrosdak at 17:24:47 on 2011-11-15

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3317.1562 [GMT -5:00]

.

AV: AVG Internet Security Network Edition *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Internet Security Network Edition *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

C:\Windows\system32\atieclxx.exe

C:\Program Files\Common Files\SPBA\upeksvr.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files\Intel\Services\IPT\jhi_service.exe

C:\Program Files\Kaseya\Agent\KasAVSrv.exe

C:\Program Files\Kaseya\Agent\AgentMon.exe

C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSvcm.exe

C:\Program Files\AVG\AVG9\avgam.exe

C:\Program Files\Microsoft SQL Server\MSSQL10_50.ACT7\MSSQL\Binn\sqlservr.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TightVNC\tvnserver.exe

C:\Windows\System32\Drivers\WTSRV.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RtDCpl.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe

c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

C:\dell\DBRM\Reminder\DbrmTrayicon.exe

C:\Program Files\TightVNC\tvnserver.exe

C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe

C:\Windows\System32\WTClient.exe

C:\Program Files\Kaseya\Agent\KaUsrTsk.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\DisplayFusion\DisplayFusion.exe

C:\Program Files\ManicTime\ManicTime.exe

C:\Program Files\CompanionLink\CompanionLink.exe

C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\ACT\Act for Windows\Act.Outlook.Sync.exe

C:\Users\tdrosdak\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = 192.168.*.*;*.local

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\client server security agent\bho\1009\TmIEPlg.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~1\office14\GROOVEEX.DLL

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLL

BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile: {d5233fcd-d258-4903-89b8-fb1568e7413d} - mscoree.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [DisplayFusion] "c:\program files\displayfusion\DisplayFusion.exe"

uRun: [ManicTime] c:\program files\manictime\ManicTime.exe /minimized /name:

uRun: [CompanionLink] "c:\program files\companionlink\companionlink.exe" -Icon

uRun: [OfficeSyncProcess] "c:\program files\microsoft office\office14\MSOSYNC.EXE"

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtDCpl.exe

mRun: [iAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe

mRun: [iMSS] "c:\program files\intel\intel® management engine components\imss\PIconStartup.exe"

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [RemoteControl9] "c:\program files\cyberlink\powerdvd9\PDVD9Serv.exe"

mRun: [PDVD9LanguageShortcut] "c:\program files\cyberlink\powerdvd9\language\Language.exe"

mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\oem\12.0\sharedcom\RoxWatchTray12OEM.exe"

mRun: [Desktop Disc Tool] "c:\program files\roxio\oem\roxio burn\RoxioBurnLauncher.exe"

mRun: [DBRMTray] c:\dell\dbrm\reminder\DbrmTrayIcon.exe

mRun: [tvncontrol] "c:\program files\tightvnc\tvnserver.exe" -controlservice -slave

mRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"

mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

mRun: [Act.Outlook.Service] "c:\program files\act\act for windows\Act.Outlook.Service.exe"

mRun: [Act! Preloader] "c:\program files\act\act for windows\ActSage.exe" -preload

mRun: [WTClient] WTClient.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [KASHTHRNTW24532506725118] "c:\program files\kaseya\agent\KaUsrTsk.exe"

mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 10.0\acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [<NO NAME>]

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\users\tdrosdak\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\tdrosdak\appdata\roaming\dropbox\bin\Dropbox.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\audibl~1.lnk - c:\program files\audible\bin\AudibleDownloadHelper.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\sageac~1.lnk - c:\program files\act\act for windows\Act.Outlook.Sync.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

mPolicies-system: DisableCAD = 1 (0x1)

mPolicies-system: SoftwareSASGeneration = 1 (0x1)

IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~1\office14\ONBttnIE.dll/105

IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.224.3 192.168.224.7 192.168.232.2

TCP: Interfaces\{E5AFBC9E-9822-4344-B598-2F71600FF3F1} : DhcpNameServer = 192.168.224.3 192.168.224.7 192.168.232.2

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} -

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: spba - c:\program files\common files\spba\homefus2.dll

AppInit_DLLs: c:\windows\system32\avgrsstx.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~1\office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\tdrosdak\appdata\roaming\mozilla\firefox\profiles\uxigwg36.default\

FF - prefs.js: browser.startup.homepage - hxxps://login.yahoo.com/config/mail?.intl=us&.done=http%3A%2F%2Fus.mg5.mail.yahoo.com%2Fdc%2Flaunch%3Fymv%3D2

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\acrobat 10.0\acrobat\air\nppdf32.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\users\tdrosdak\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2011-6-14 52872]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2011-6-14 216400]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2011-6-14 29712]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2011-6-14 243152]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-4-29 176128]

R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2011-6-14 308136]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [2011-4-29 13336]

R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IPROSetMonitor.exe [2011-4-29 110752]

R2 jhi_service;Intel® Identity Protection Technology Host Interface Service;c:\program files\intel\services\ipt\jhi_service.exe [2010-11-29 210896]

R2 KaseyaAVService;Kaseya Security Service;c:\program files\kaseya\agent\KasAVSrv.exe [2011-6-14 221184]

R2 KATHRNTW24532506725118;Kaseya Agent;c:\program files\kaseya\agent\AgentMon.exe [2011-6-14 835584]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-9 366152]

R2 MotoHelper;MotoHelper Service;c:\program files\motorola\motohelper\MotoHelperService.exe [2011-4-26 223088]

R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\common files\microsoft shared\microsoft online services\MSOIDSVC.EXE [2011-4-28 1577376]

R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql10_50.act7\mssql\binn\sqlservr.exe [2010-5-5 42884448]

R2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -hvquickbooksdb18 --> c:\progra~1\intuit\quickb~1\QBDBMgrN.exe -hvQuickBooksDB18 [?]

R2 tvnserver;TightVNC Server;c:\program files\tightvnc\tvnserver.exe [2010-7-8 815704]

R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2011-4-29 2656280]

R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-1-26 7566848]

R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-1-26 238592]

R3 e1cexpress;Intel® PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\drivers\e1c6232.sys [2011-4-29 238760]

R3 KAPFA;KAPFA;c:\windows\system32\drivers\KaPFA.sys [2011-6-14 17920]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-9 22216]

R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [2011-4-29 41088]

R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [2009-6-22 23208]

R3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [2009-6-22 14504]

R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2009-7-13 17920]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\common files\roxio shared\oem\12.0\sharedcom\RoxWatch12OEM.exe [2010-11-25 219632]

S2 Sage ACT! Scheduler;Sage ACT! Scheduler;c:\program files\act\act for windows\Act.Scheduler.exe [2010-12-21 81920]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-3-25 30969208]

S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [2010-1-25 9472]

S3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files\common files\roxio shared\oem\12.0\sharedcom\RoxMediaDB12OEM.exe [2010-11-25 1116656]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-5-12 1343400]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2010-5-5 44896]

S4 RsFx0150;RsFx0150 Driver;c:\windows\system32\drivers\RsFx0150.sys [2010-4-3 240608]

S4 SQLAgent$ACT7;SQL Server Agent (ACT7);c:\program files\microsoft sql server\mssql10_50.act7\mssql\binn\SQLAGENT.EXE [2010-5-5 367456]

S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]

.

=============== Created Last 30 ================

.

2011-11-15 22:16:50 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-11-15 22:16:03 65536 ---hatw- c:\users\tdrosdak\~archive.pst.tmp

2011-10-25 14:31:13 -------- d-----w- c:\programdata\{C243CCC8-5474-45FC-A546-7FBC284A692E}

2011-10-25 14:31:09 -------- d-----w- c:\programdata\{027FFED9-6EAA-47D7-9DF1-47A5D697579E}

2011-10-20 01:53:16 2332672 ----a-w- c:\windows\system32\win32k.sys

2011-10-20 01:52:42 571904 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-20 01:52:42 233472 ----a-w- c:\windows\system32\oleacc.dll

.

==================== Find3M ====================

.

2011-11-15 22:15:26 1682 --sha-w- c:\programdata\KGyGaAvL.sys

2011-11-15 20:41:46 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-01 02:59:14 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-20 04:38:10 981504 ----a-w- c:\windows\system32\wininet.dll

2011-08-20 04:35:20 44544 ----a-w- c:\windows\system32\licmgr10.dll

2011-08-20 03:26:38 386048 ----a-w- c:\windows\system32\html.iec

2011-05-12 13:27:45 12526792 ----a-w- c:\program files\common files\lpuninstall.exe

.

============= FINISH: 17:25:33.47 ===============

Attach.txt

Maniac · November 15, 2011

Hello TerryD! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

Step 1

Now it's time to clean the cache of Java, because of malware. Malware that could be found in this cache directory are not associated with the Java that was downloaded and installed on the system. A cache directory is aa temporary storage location. When the browser runs an applet or application, Java stores files into its cache directory for better performance.

Click Start => Control Panel.

Double-click the Java icon in the control panel. The Java Control Panel appears.

Click Settings under Temporary Internet Files. The Temporary Files Settings dialog box appears.

Click Delete Files. The Delete Temporary Files dialog box appears.

Click OK on Delete Temporary Files window. Note: This deletes all the Downloaded Applications and Applets from the cache.

Click OK on Temporary Files Settings window. Note: If you want to delete a specific application and applet from the cache, click on View Application and View Applet options respectively.

Step 2

I need to know what Malwarebytes' Anti-Malware found on your system, so:

Launch Malwarebytes' Anti-Malware
Go to Update" tab and select Check for Updates.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, please post the following log files:

Malwarebytes' Anti-Malware log
a new fresh DDS log only

TerryD · November 16, 2011

Maniac,

Thanks so much for your help and clear directions. Let me know if I do this correctly...

mbam log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8175

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

11/16/2011 9:47:44 AM

mbam-log-2011-11-16 (09-47-44).txt

Scan type: Quick scan

Objects scanned: 243571

Time elapsed: 3 minute(s), 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 184

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\winapp\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windupdt\control\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\windowsupdate\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\admin\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\exch-serv\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\public\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\qbdataserviceuser18\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdrosdak\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdservice\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\desktop\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\win\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\programdata\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\admin\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\windows\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\programdata\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\admin\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\winupdater\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\winupdater\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\program files\install\winupdate.exe (Trojan.Agent.I) -> Delete on reboot.

c:\programdata\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\users\admin\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\directory\winupdate.exe (Worm.Ainslot) -> Delete on reboot.

c:\windows\cache\winupdate.exe (Email.Worm) -> Delete on reboot.

c:\windows\k\winupdate.exe (Backdoor.IRCBot) -> Delete on reboot.

c:\windows\system32\windupdt\winupdate.exe (Trojan.Dropper) -> Delete on reboot.

c:\programdata\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\users\admin\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\users\admin\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\public\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\documents\sys\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\admin\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\public\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\documents\system\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\program files\windows updates\winupdate.exe (Backdoor.Bifrose) -> Delete on reboot.

c:\windows\system32\command\winupdate.exe (Backdoor.SpyNet) -> Delete on reboot.

c:\windows\system32\system32\winupdate.exe (Backdoor.SpyNet) -> Delete on reboot.

c:\windows\system32\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\windows\system32\winupdate\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\ocxlist\winupdate.exe (Trojan.Banker) -> Delete on reboot.

c:\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\programdata\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\users\admin\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\system32\hosts\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\programdata\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\admin\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\updates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\n\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\recache\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\windupdt\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\system32\install\winupdate.exe (Trojan.Backdoor) -> Delete on reboot.

c:\windows\windowsupdate\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\programdata\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\admin\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\start menu\windupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\1634\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\winupdate\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\admin\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\public\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\local\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\temp\windupdt\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\programdata\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\admin\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\start menu\windowsupdatesystem\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\update\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\update\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\windupdte\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\aggiornamenti\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\microsoft\windows\start menu\programs\startup\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\microsoft\windows\start menu\programs\startup\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\start menu\programs\startup\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\start menu\programs\startup\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\start menu\programs\startup\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\censoredyou\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\winupt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\sys64\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\system32\win\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\programdata\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\admin\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\update\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\install\winupdate.exe (Backdoor.Agent) -> Delete on reboot.

c:\windows\system32\winndupdat\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows update\winupdate.exe (Backdoor.Bot) -> Delete on reboot.

c:\windows\system32\rrt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\programdata\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\start menu\programs\windupdt\winupdate.exe (Trojan.Inject) -> Delete on reboot.

c:\programdata\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\admin\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\exch-serv\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\qbdataserviceuser18\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdrosdak\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\tdservice\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\config\systemprofile\appdata\roaming\windows updates\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\driver\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\configuration\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\windows\system32\xwindupdt\winupdate.exe (Backdoor.Agent.DC) -> Delete on reboot.

c:\users\admin\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\exch-serv\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\public\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\qbdataserviceuser18\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdrosdak\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\users\tdservice\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\localservice\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\serviceprofiles\networkservice\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

c:\windows\system32\config\systemprofile\templates\winupdate.exe (Trojan.Agent) -> Delete on reboot.

DDS log

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.7600.16385

Run by tdrosdak at 10:03:45 on 2011-11-16

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3317.1603 [GMT -5:00]

.

AV: AVG Internet Security Network Edition *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Internet Security Network Edition *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

C:\Program Files\Common Files\SPBA\upeksvr.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files\Intel\Services\IPT\jhi_service.exe

C:\Program Files\Kaseya\Agent\KasAVSrv.exe

C:\Program Files\Kaseya\Agent\AgentMon.exe

C:\Program Files\Motorola\MotoHelper\MotoHelperService.exe

C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE

C:\Program Files\Microsoft SQL Server\MSSQL10_50.ACT7\MSSQL\Binn\sqlservr.exe

C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSvcm.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\AVG\AVG9\avgam.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\TightVNC\tvnserver.exe

C:\Windows\System32\Drivers\WTSRV.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Motorola\MotoHelper\MotoHelperAgent.exe

C:\Windows\SYSTEM32\WISPTIS.EXE

C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe

C:\Program Files\Realtek\Audio\HDA\RtDCpl.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe

c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

C:\dell\DBRM\Reminder\DbrmTrayicon.exe

C:\Program Files\TightVNC\tvnserver.exe

C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe

C:\Windows\System32\WTClient.exe

C:\Program Files\Kaseya\Agent\KaUsrTsk.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\DisplayFusion\DisplayFusion.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\ManicTime\ManicTime.exe

C:\Program Files\CompanionLink\CompanionLink.exe

C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\ACT\Act for Windows\Act.Outlook.Sync.exe

C:\Users\tdrosdak\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

C:\Windows\system32\wbem\wmiprvse.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE