Spyware Warrior

[cgordon64]

im having a problem with ads playing in my speakers even when the browser is not open. i keep hearing random adds can you guys help me out?

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Enterprise
Boot Device: \Device\HarddiskVolume1
Install Date: 6/18/2012 8:41:49 PM
System Uptime: 6/22/2012 7:00:33 PM (0 hours ago)
.
Motherboard: TOSHIBA | | Portable PC
Processor: Intel(R) Celeron(R) CPU P4600 @ 2.00GHz | CPU | 1859/1066mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 85.201 GiB free.
D: is CDROM (UDF)
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description:
Device ID: ACPI\TOS1901\2&DABA3FF&1
Manufacturer:
Name:
PNP Device ID: ACPI\TOS1901\2&DABA3FF&1
Service:
.
==== System Restore Points ===================
.
RP5: 6/20/2012 3:00:20 AM - Windows Update
RP6: 6/21/2012 3:00:20 AM - Windows Update
RP7: 6/21/2012 2:25:07 PM - Windows Update
RP8: 6/21/2012 2:25:07 PM - Windows Update
RP9: 6/22/2012 3:00:34 AM - Windows Update
RP10: 6/22/2012 3:18:33 PM - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Foxit Reader
Malwarebytes Anti-Malware version 1.61.0.1400
McAfee Security Scan Plus
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox 13.0.1 (x86 en-US)
Mozilla Maintenance Service
Music Manager
MusicBrainz Picard
TOSHIBA Web Camera Application
.
==== Event Viewer Messages From Past Week ========
.
6/22/2012 6:48:41 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
6/22/2012 10:38:45 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AudioEndpointBuilder service.
6/22/2012 10:37:45 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SysMain service.
6/20/2012 6:56:55 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR7.
6/20/2012 6:47:43 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR6.
6/20/2012 4:41:35 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Windows 7 for x64-based Systems (KB2703157).
6/20/2012 4:41:35 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Internet Explorer 8 Compatibility View List for Windows 7 for x64-based Systems (KB2598845).
6/20/2012 4:41:35 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242016: Security Update for Internet Explorer 8 for Windows 7 for x64-based Systems (KB2544521).
6/20/2012 4:38:43 AM, Error: Service Control Manager [7023] -
6/20/2012 4:35:59 AM, Error: Service Control Manager [7000] - The MBAMService service failed to start due to the following error: The pipe has been ended.
6/20/2012 4:32:14 AM, Error: Service Control Manager [7043] - The Windows Modules Installer service did not shut down properly after receiving a preshutdown control.
6/19/2012 9:38:51 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
.
==== End Of File ===========================

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by pimpdaddy at 19:09:23 on 2012-06-22
Microsoft Windows 7 Enterprise 6.1.7600.0.1252.1.1033.18.1911.697 [GMT -4:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Users\pimpdaddy\AppData\Local\Programs\Google\MusicManager\MusicManager.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
-netsvcs
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe,
uRun: [Google Update] "C:\Users\pimpdaddy\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [MusicManager] "C:\Users\pimpdaddy\AppData\Local\Programs\Google\MusicManager\MusicManager.exe"
mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
StartupFolder: C:\PROGRA~4\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E0DF3527-5F81-4888-A525-F1FA8D1B6964} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{F7DD0853-CEF8-49C4-8626-430CEAB87433} : DhcpNameServer = 192.168.1.1
mRun-x64: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\pimpdaddy\AppData\Roaming\Mozilla\Firefox\Profiles\96jabcge.default\
FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: C:\Users\pimpdaddy\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll
.
============= SERVICES / DRIVERS ===============
.
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\Windows\system32\DRIVERS\Thpevm.SYS --> C:\Windows\system32\DRIVERS\Thpevm.SYS [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-6-19 654408]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 PGEffect;Pangu effect driver;C:\Windows\system32\DRIVERS\pgeffect.sys --> C:\Windows\system32\DRIVERS\pgeffect.sys [?]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\system32\DRIVERS\rtl8192Ce.sys --> C:\Windows\system32\DRIVERS\rtl8192Ce.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-6-18 257224]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-6-19 113120]
S3 netr28ux;RT2870 USB Wireless LAN Card Driver for Vista;C:\Windows\system32\DRIVERS\netr28ux.sys --> C:\Windows\system32\DRIVERS\netr28ux.sys [?]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-06-22 23:01:53 20480 ----a-w- C:\Windows\svchost.exe
2012-06-22 19:20:31 9013136 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C87B42DE-7E9C-40B8-8418-352904C3CCC2}\mpengine.dll
2012-06-21 18:26:56 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-06-21 18:26:24 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-06-21 18:25:47 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-06-21 18:25:47 186752 ----a-w- C:\Windows\System32\wuwebv.dll
2012-06-20 23:12:37 -------- d-----w- C:\Users\pimpdaddy\AppData\Roaming\MusicBrainz
2012-06-20 23:12:27 -------- d-----w- C:\Program Files (x86)\MusicBrainz Picard
2012-06-20 23:02:57 -------- d-----w- C:\Users\pimpdaddy\AppData\Local\Programs
2012-06-20 23:02:37 -------- d-----w- C:\Users\pimpdaddy\AppData\Local\Google
2012-06-20 20:55:22 -------- d-----w- C:\Users\pimpdaddy\AppData\Roaming\Foxit Software
2012-06-20 20:52:51 -------- d-----w- C:\Program Files (x86)\Foxit Software
2012-06-20 08:34:25 -------- d-----w- C:\Windows\SysWow64\Wat
2012-06-20 08:34:25 -------- d-----w- C:\Windows\System32\Wat
2012-06-20 08:05:35 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
2012-06-20 08:05:35 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
2012-06-20 07:41:46 311808 ----a-w- C:\Windows\System32\msv1_0.dll
2012-06-20 07:41:46 257024 ----a-w- C:\Windows\SysWow64\msv1_0.dll
2012-06-20 07:22:44 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
2012-06-20 07:22:44 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
2012-06-20 07:22:44 48960 ----a-w- C:\Windows\System32\netfxperf.dll
2012-06-20 07:22:44 444752 ----a-w- C:\Windows\System32\mscoree.dll
2012-06-20 07:22:44 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
2012-06-20 07:22:44 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
2012-06-20 07:22:44 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
2012-06-20 07:22:44 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2012-06-20 07:22:44 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2012-06-20 07:22:44 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
2012-06-20 07:05:00 80896 ----a-w- C:\Windows\System32\imagehlp.dll
2012-06-20 07:05:00 22896 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-06-20 07:05:00 158720 ----a-w- C:\Windows\SysWow64\imagehlp.dll
2012-06-20 07:04:59 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2012-06-20 07:04:59 5120 ----a-w- C:\Windows\System32\wmi.dll
2012-06-20 07:04:59 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-06-20 07:04:59 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-06-20 07:01:17 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
2012-06-20 07:01:17 184832 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
2012-06-20 01:42:54 -------- d-----w- C:\Users\pimpdaddy\AppData\Roaming\Malwarebytes
2012-06-20 01:42:34 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-06-20 01:42:34 -------- d-----w- C:\ProgramData\Malwarebytes
2012-06-20 01:42:33 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-06-20 00:45:31 -------- d-----w- C:\Users\pimpdaddy\AppData\Local\Macromedia
2012-06-20 00:44:58 -------- d-----w- C:\ProgramData\McAfee Security Scan
2012-06-20 00:44:49 -------- d-----w- C:\Program Files (x86)\McAfee Security Scan
2012-06-19 19:39:58 2080256 ----a-w- C:\Program Files\Windows Mail\msoe.dll
2012-06-19 19:38:59 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
2012-06-19 19:37:59 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
2012-06-19 19:28:49 9013136 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2012-06-19 19:28:37 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-06-19 19:27:04 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2012-06-19 19:27:03 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2012-06-19 18:37:58 102400 ----a-w- C:\Windows\System32\drivers\dfsc.sys
2012-06-19 18:36:35 1328640 ----a-w- C:\Windows\SysWow64\quartz.dll
2012-06-19 18:35:34 1395712 ----a-w- C:\Windows\System32\mfc42.dll
2012-06-19 18:35:34 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
2012-06-19 18:35:34 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
2012-06-19 18:35:33 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
2012-06-19 18:33:53 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2012-06-19 18:32:37 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
2012-06-19 01:24:22 -------- d-----w- C:\Windows\Panther
2012-06-19 01:10:22 -------- d-----w- C:\Windows.old.000
2012-06-19 01:06:47 139264 ----a-w- C:\Windows\System32\cabview.dll
2012-06-19 01:06:47 132608 ----a-w- C:\Windows\SysWow64\cabview.dll
2012-06-19 01:06:42 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-06-19 01:06:42 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-06-19 01:06:34 826368 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-06-19 01:06:34 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-06-19 01:06:34 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-06-19 00:54:13 35008 ----a-w- C:\Windows\System32\drivers\PGEffect.sys
2012-06-19 00:52:42 -------- d-sh--w- C:\Windows\Installer
2012-06-19 00:52:32 -------- d-----w- C:\Program Files (x86)\TOSHIBA
2012-06-19 00:42:16 -------- d-----w- C:\Users\pimpdaddy\AppData\Local\VirtualStore
2012-06-10 21:01:41 96256 ----a-w- C:\AdbWinApi.dll
2012-06-10 21:01:41 70144 ----a-w- C:\fastboot.exe
2012-06-10 21:01:41 256 ----a-r- C:\Unlock_code.bin
2012-06-10 21:01:41 162816 ----a-w- C:\adb.exe
2012-05-30 21:56:29 -------- d-----w- C:\sn0wbreeze
2012-05-30 00:39:16 -------- d-----w- C:\Temp
.
==================== Find3M ====================
.
2012-05-15 01:32:20 3144192 ----a-w- C:\Windows\System32\win32k.sys
2012-05-04 10:52:22 5505392 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-04 10:08:16 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:08:15 3902320 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-02 05:32:43 208896 ----a-w- C:\Windows\System32\profsvc.dll
2012-04-28 03:50:40 204800 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:34:38 76288 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:34:37 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-26 05:28:32 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-04-24 05:59:45 182272 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:59:45 1460224 ----a-w- C:\Windows\System32\crypt32.dll
2012-04-24 05:59:45 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 04:47:04 139264 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:47:04 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2012-04-24 04:47:03 1156608 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-04-07 12:18:36 3213824 ----a-w- C:\Windows\System32\msi.dll
2012-04-07 11:34:37 2342400 ----a-w- C:\Windows\SysWow64\msi.dll
2012-03-30 11:09:53 1895280 ----a-w- C:\Windows\System32\drivers\tcpip.sys
.
============= FINISH: 19:12:27.76 ===============

[Cypher]

It appears you are using your computer for business purposes or connecting to a business network.
This forum was set up specifically to help home users, we do not work on business machines.

Computers used in a business environment often have policies and other modifications made to them. It is impossible for us to differentiate these from ones that have been made by an infection, so in removing what we think is an infection, we may compromise the business set up of your computer.

The scans we run often reveal information that most businesses would not want exposed in an open forum, and there are other legal constraints and ramifications involved with business machines that we are not equipped or trained to deal with.

I'm sorry but we can't help you.

I suggest you contact your IT Department, or whoever normally deals with technical issues in your company, and let them know your computer is infected. If it has been connected to a company network whilst infected, then that too may be compromised and will need to be checked.

This topic is now closed.
_________________
Admin/Teacher at Malware Removal University
Member of...