CSW.exe removed, Explorer still crashing out, gmer invokes BSOD

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages
1
2
→

You cannot start a new topic
This topic is locked

CSW.exe removed, Explorer still crashing out, gmer invokes BSOD possible system corruption caused by trojans

#1 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 27 April 2011 - 09:17 AM

Hi,

Over the weekend my laptop started behaving strangely. I would get random browser tabs opening, redirects to Stopzilla.com, random dial-up dialog boxes opening, severe system slowdown and frequent but intermittent explorer and drwatson crashes. Eventually explorer would crash and not return, leaving me with a blank desktop pattern and no means to do or launch anything or execute shut down safely. I initiated several virus checks using Avast Free edition and eventually a boot time scan which found several trojans including:

Renos AHW
Downloader-GSW
Kryptik-BAL
Obfuscated-DD

along with a number of compromised System Restore entries. Additionally Avast identified "hiberfil.sys" in the root of the C drive as a rogue process that it could not engage with. I used a PCLinuxOS boot CD to rename this file to "hiberfil._sys_.DNU"

Around this time I noticed a number of unfamiliar running processes with names such as Cs4.exe, Cs5.exe, Cs8.exe, Cs9.exe and Csw.exe. I terminated these processes and deleted the files but they kept coming back, Eventually I terminated five of them using HijackThis, which seems to have prevented them from returning.

I no longer seem to get browser redirects but I do occasionally get automatic dial-up dialog boxes popping up unasked for when I use the browser. Explorer.exe still crashes regularly, I get messages telling me that "Generic Host Process for Win32 Services" or DrWatson has encountered errors and need to close. I have followed the instructions on this site and found that while Defogger and dds.scr seem to work okay I could not get gmer to run to a conclusion. It stalled while investigating Explorer.exe and eventually invoked a Blue Screen of Death: Stop 0x0000000A message (IRQL_NOT_LESS_OR_EQUAL) with the last parameter stated as 0x804edaf7

Additionally Internet Explorer no longer seems to function at all, and if I try to launch it before Firefox that refuses to launch also. I have all the XP eye candy turned off by default, but sometimes when I reboot it is all there, curvy blue and green buttons, the lot. Most of the time it reverts to my preferred settings though.

Once the desktop items and taskbar have vanished I can no longer access the Windows Task Manager via Control-Alt-Delete so I now have to keep it available at all times in case of a problem and sometimes have to force shutdown by holding down the power button even if it appears to be available.

I can post my most recent HijackThis log too, if that helps. I have not run it since removing the rogue processes. I should also be able to dig out the Avira log too if necessary.

EDIT: re-reading the rules I realise that I should have pasted the DDS log (at the bottom it says "Warning: possible TDL3 rootkit infection !") so here it is:

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Barnabas Netherwood at 14:10:28.84 on 27/04/2011

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_23

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1023.562 [GMT 1:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\Program Files\Iomega\DriveIcons\ImgIcon.exe

C:\Program Files\ScanSoft\OmniPageSE\opware32.exe

C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe

C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe

C:\WINDOWS\MXOALDR.EXE

C:\Program Files\Alwil Software\Avast5\avastUI.exe

C:\WINDOWS\system32\MSTMON_Y.EXE

C:\Program Files\HP\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\HP\HP Share-to-Web\hpgs2wnf.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe

C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\imapi.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\PROGRA~1\Dantz\RETROS~1\retrospect.exe

C:\WINDOWS\explorer.exe

C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.co.uk/

uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=Q304&bd=pavilion&pf=laptop

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=Q304&bd=pavilion&pf=laptop

uInternet Settings,ProxyOverride = local

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [NBJ] "c:\program files\ahead\nero backitup\NBJ.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [{43BDA530-2017-F9F6-C57E-4A0DB33A8582}] "c:\documents and settings\barnabas netherwood\application data\ryezuv\kagyi.exe"

mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start

mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd.exe"

mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [ADUserMon] c:\program files\iomega\autodisk\ADUserMon.exe

mRun: [Iomega Drive Icons] c:\program files\iomega\driveicons\ImgIcon.exe

mRun: [Deskup] c:\program files\iomega\driveicons\deskup.exe /IMGSTART

mRun: [Omnipage] c:\program files\scansoft\omnipagese\opware32.exe

mRun: [MaxtorOneTouch] c:\progra~1\maxtor\onetouch\utils\OneTouch.exe

mRun: [RetroExpress] c:\progra~1\dantz\retros~1\RetroExpress.exe /h

mRun: [MXOBG] c:\windows\MXOALDR.EXE

mRun: [EPSON Stylus Photo RX420 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui

mRun: [SunJavaUpdateSched] c:\program files\java\jre6\bin\jusched.exe

mRun: [KONICA MINOLTA PagePro 1400W STD] c:\windows\system32\MSTMON_Y.EXE STARTUP

mRun: [Share-to-Web Namespace Daemon] c:\program files\hp\hp share-to-web\hpgs2wnd.exe

mRun: [nwiz] nwiz.exe /installquiet

mRun: [CamMonitor] c:\program files\hp\digital imaging\unload\hpqcmon.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palmone\HOTSYNC.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\lumixs~1.lnk - c:\program files\panasonic\lumixsimpleviewer\PhLeAutoRun.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\suitca~1.lnk - c:\program files\extensis\suitcase 9.2\Suitcase.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

SEH: DVDIdleShell Class: {93994de8-8239-4655-b1d1-5f4e91300429} - c:\progra~1\dvdreg~1\DVDShell.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\barnab~1\applic~1\mozilla\firefox\profiles\q0cahxoy.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/

FF - prefs.js: network.proxy.http - 95.48.212.219

FF - prefs.js: network.proxy.http_port - 3128

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\barnabas netherwood\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: XULRunner: {7F618381-41CA-4DB2-A13F-5FB107D3394D} - c:\documents and settings\barnabas netherwood\local settings\application data\{7F618381-41CA-4DB2-A13F-5FB107D3394D}

FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}

FF - Ext: BlockSite: {dd3d7613-0246-469d-bc65-2a3cc1668adc} - %profile%\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-3-2 371544]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-10-5 301528]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-10-5 19544]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-10-5 42184]

R2 PALMCAMUSB;Palm Handheld USB Webcam;c:\windows\system32\drivers\palmcamusb.sys [2007-2-14 215424]

R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [2003-8-15 68480]

S2 Parclass;Parclass;c:\windows\system32\drivers\PARCLASS.SYS [2006-4-14 20272]

S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [2010-10-9 25856]

S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2010-10-9 6016]

S3 EchoIndigoIO;Echo Indigo io Service;c:\windows\system32\drivers\echondgo.sys --> c:\windows\system32\drivers\echondgo.sys [?]

S3 GT681x;%GrandTechICNameNT%;c:\windows\system32\drivers\gt681x.sys --> c:\windows\system32\drivers\GT681x.SYS [?]

S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2010-10-9 19712]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2010-10-9 8320]

S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2010-10-9 42752]

S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2010-10-9 23424]

S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [2010-10-9 9472]

S3 Paloachsst;Paloachsst; [x]

S3 RD1006;Roland UA-100;c:\windows\system32\drivers\rdwm1006.sys [2006-7-2 169086]

S3 RDID1046;EDIROL UA-25;c:\windows\system32\drivers\rdwm1046.sys [2006-7-2 163390]

S3 Shfsvcxp;Shfsvcxp;c:\windows\system32\drivers\stream.sys [2002-12-12 49408]

S3 xbreader;MaxDrive XBox Driver (xbreader.sys);c:\windows\system32\drivers\xbreader.sys [2001-1-3 19677]

S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2010-9-24 160640]

S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2010-9-24 5248]

.

=============== Created Last 30 ================

.

2011-04-27 11:15:53 -------- d-----w- c:\docume~1\barnab~1\applic~1\Viduyz

2011-04-27 11:15:53 -------- d-----w- c:\docume~1\barnab~1\applic~1\Ryezuv

2011-04-24 11:49:24 -------- d-----w- c:\docume~1\barnab~1\locals~1\applic~1\{7F618381-41CA-4DB2-A13F-5FB107D3394D}

2011-04-22 10:42:47 -------- d---a-w- C:\TRK-INFECTED

2011-04-21 18:18:05 0 ----a-w- c:\windows\Glarogumamu.bin

.

==================== Find3M ====================

.

2011-03-17 02:09:35 161084 ----a-w- c:\windows\DirectShow Detective Uninstaller.exe

2011-03-17 00:10:44 1409 ----a-w- c:\windows\QTFont.for

2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:45:07 434176 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys

2011-02-23 15:04:21 40648 ----a-w- c:\windows\avastSS.scr

2011-02-17 19:00:29 832512 ----a-w- c:\windows\system32\wininet.dll

2011-02-17 19:00:28 78336 ------w- c:\windows\system32\ieencode.dll

2011-02-17 19:00:28 1830912 ------w- c:\windows\system32\inetcpl.cpl

2011-02-17 19:00:27 17408 ----a-w- c:\windows\system32\corpol.dll

2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2011-02-17 11:44:16 389120 ------w- c:\windows\system32\html.iec

2011-02-15 12:56:39 290432 ----a-w- c:\windows\system32\atmfd.dll

2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll

2011-02-08 13:33:55 978944 ----a-w- c:\windows\system32\mfc42.dll

2011-02-08 13:33:55 974848 ----a-w- c:\windows\system32\mfc42u.dll

2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: TOSHIBA_MK6026GAX rev.PA202G -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iomdisk.sys hal.dll ACPI.sys >>UNKNOWN [0x872C1730]<<

c:\windows\system32\drivers\iomdisk.sys Iomega Corporation Iomega Disk Filter Driver

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x872c7a10]; MOV EAX, [0x872c7a8c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x87304AB8]

3 CLASSPNP[0xF76C1FD7] -> nt!IofCallDriver[0x804E13B9] -> [0x87367AC8]

5 iomdisk[0xF76F2DA4] -> nt!IofCallDriver[0x804E13B9] -> \Device\0000007a[0x87374718]

7 ACPI[0xF75F9620] -> nt!IofCallDriver[0x804E13B9] -> [0x873DE030]

\Driver\atapi[0x87305A08] -> IRP_MJ_CREATE -> 0x872C1730

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV SI, 0x7be; MOV CL, 0x4; CMP [SI], CH; JL 0x2d; JNZ 0x3b; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x872C157B

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 14:18:14.18 ===============

Attached File(s)

Attach.zip (4.89K)
Number of downloads: 1
DDS.txt (13.27K)
Number of downloads: 0

This post has been edited by Norbert W: 27 April 2011 - 09:33 AM

#2 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 04 May 2011 - 08:30 AM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Posted Image

One or more of the identified infections is a backdoor trojan and password stealer.

This type of infection allows hackers to access and remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it contains any other sensitive information, then from a clean computer, change all passwords where applicable.
It would also be wise to contact those same financial institutions to appraise them of your situation.

I highly suggest you take a look at the two links provided below:
1. How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
2. When should I re-format? How should I reinstall?

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

NEXT:

Running TDSSKiller

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

NEXT:

Running OTL

We need to create an OTL Report

Please download OTL from one of the following mirrors:
- This is THE Mirror
Save it to your desktop.
Double click on the icon on your desktop.
Click the "Scan All Users" checkbox.
Push the button.
Two reports will open, copy and paste them in a reply here:
- OTL.txt <-- Will be opened
- Extra.txt <-- Will be minimized

NEXT:

Please provide an update on how things are running in your next reply.

Have I helped you? If you'd like to assist in the fight against malware, click here

The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.

#3 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 05 May 2011 - 08:27 AM

Thanks for your reply. I have previously tried TDSSKiller on several occasions. It appeared to run fine and found nothing each time. Unfortunately I am currently unable to boot into windows at all on that machine. Since I posted I have launched windows several times to run anti-virus and anti-malware tools. At some point I was attempting a deep scan (I do not remember if it was Avast or MalwareBytes but it was probably Avast) which invoked the same BSOD error code quite late into the scan. Since then I found I was unable to launch Firefox or Internet Explorer at all and Task Manager showed all processes running at zero RAM and zero CPU. Suspecting that I might have a RAM problem yesterday I tried switching out the two RAM blocks. It is possible I might have fried something as I am now not able to access Windows at all. Booting into normal mode remains on the desktop wallpaper image with no icons and booting into safe mode just gives me a black screen with "Safe Mode" in each corner, the XP version at the top and no icons. The mouse pointer appears and moves with the touchpad but nothing else. However I am able to access the internet with no problems at all via a PCLinuxOS Live CD, which I suspect might indicate that there is nothing wrong with the RAM. I have used this to put OTL onto a flash drive but, worryingly, I was not able to see the windows hard drive in the file explorer where previously I could. Has something happened to the hard drive? It would be more than annoying if this was the case as I have quite a bit of unarchived writing on there.

#4 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 05 May 2011 - 08:55 AM

Please forgive my stupidity. After failing to boot into normal mode, then into safe mode, a fresh attempt to boot into normal mode worked just fine.

I used a PCLinuxOS LiveCD to download the two tools you mentioned to a USB drive, then copied them to a folder on my desktop.

Just in case, I renamed TDSSKiller "explorer.exe".

Although I have run it before, this time it identified the rootkit. Here is the log file:

2011/05/05 14:51:56.0234 3412 TDSS rootkit removing tool 2.5.0.0 May 1 2011 14:20:16
2011/05/05 14:51:56.0250 3412 ================================================================================
2011/05/05 14:51:56.0250 3412 SystemInfo:
2011/05/05 14:51:56.0250 3412
2011/05/05 14:51:56.0250 3412 OS Version: 5.1.2600 ServicePack: 3.0
2011/05/05 14:51:56.0250 3412 Product type: Workstation
2011/05/05 14:51:56.0250 3412 ComputerName: PC180273018230
2011/05/05 14:51:56.0250 3412 UserName: Barnabas Netherwood
2011/05/05 14:51:56.0250 3412 Windows directory: C:\WINDOWS
2011/05/05 14:51:56.0250 3412 System windows directory: C:\WINDOWS
2011/05/05 14:51:56.0250 3412 Processor architecture: Intel x86
2011/05/05 14:51:56.0250 3412 Number of processors: 2
2011/05/05 14:51:56.0250 3412 Page size: 0x1000
2011/05/05 14:51:56.0250 3412 Boot type: Normal boot
2011/05/05 14:51:56.0250 3412 ================================================================================
2011/05/05 14:51:56.0984 3412 Initialize success
2011/05/05 14:51:59.0296 1748 ================================================================================
2011/05/05 14:51:59.0296 1748 Scan started
2011/05/05 14:51:59.0296 1748 Mode: Manual;
2011/05/05 14:51:59.0296 1748 ================================================================================
2011/05/05 14:52:01.0734 1748 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
2011/05/05 14:52:02.0890 1748 a347bus (1f61cacacb521215f39061789147968c) C:\WINDOWS\System32\DRIVERS\a347bus.sys
2011/05/05 14:52:03.0468 1748 a347scsi (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\System32\Drivers\a347scsi.sys
2011/05/05 14:52:03.0828 1748 Aavmker4 (83631291adf2887cffc786d034d3fa15) C:\WINDOWS\system32\drivers\Aavmker4.sys
2011/05/05 14:52:04.0765 1748 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/05/05 14:52:05.0140 1748 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/05/05 14:52:05.0875 1748 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/05/05 14:52:06.0281 1748 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys
2011/05/05 14:52:06.0750 1748 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/05/05 14:52:08.0640 1748 androidusb (0a43169e115b5e9346a4ba1effcb04cb) C:\WINDOWS\system32\Drivers\motoandroid.sys
2011/05/05 14:52:09.0000 1748 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/05/05 14:52:10.0218 1748 aswFsBlk (1c2e6bb4fe8621b1b863855b02bc33eb) C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011/05/05 14:52:10.0640 1748 aswMon2 (452d0ecd14fa02f9b061f42c8a30dd49) C:\WINDOWS\system32\drivers\aswMon2.sys
2011/05/05 14:52:10.0906 1748 aswRdr (b6a9373619d851be80fb5f1b5eed0d4e) C:\WINDOWS\system32\drivers\aswRdr.sys
2011/05/05 14:52:11.0375 1748 aswSnx (9be41c1ae8bc481eb662d85c98d979c2) C:\WINDOWS\system32\drivers\aswSnx.sys
2011/05/05 14:52:11.0921 1748 aswSP (4b1a54ba2bc5873a774df6b70ab8b0b3) C:\WINDOWS\system32\drivers\aswSP.sys
2011/05/05 14:52:12.0203 1748 aswTdi (c7f1cea32766184911293f4e1ee653f5) C:\WINDOWS\system32\drivers\aswTdi.sys
2011/05/05 14:52:12.0515 1748 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/05/05 14:52:12.0906 1748 atapi (95b858761a00e1d4f81f79a0da019aca) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/05/05 14:52:13.0562 1748 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/05/05 14:52:14.0171 1748 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/05/05 14:52:14.0500 1748 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
2011/05/05 14:52:15.0093 1748 BCM43XX (5e58a3148b98c9f356cde6049435cb21) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
2011/05/05 14:52:15.0546 1748 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/05/05 14:52:15.0859 1748 Bridge (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
2011/05/05 14:52:15.0937 1748 BridgeMP (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
2011/05/05 14:52:16.0234 1748 BTCFilterService (4813df77ede536a52e3737971f910baa) C:\WINDOWS\system32\DRIVERS\motfilt.sys
2011/05/05 14:52:16.0687 1748 CAMCAUD (5a94e9d6e2716e38183959d8f4c2a5a9) C:\WINDOWS\system32\drivers\camcaud.sys
2011/05/05 14:52:17.0187 1748 CAMCHALA (e7e737bc125d6beb50669ff4b61ced19) C:\WINDOWS\system32\drivers\camchal.sys
2011/05/05 14:52:17.0562 1748 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/05/05 14:52:17.0859 1748 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/05/05 14:52:18.0453 1748 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/05/05 14:52:18.0781 1748 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/05/05 14:52:19.0078 1748 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/05/05 14:52:19.0406 1748 CE3 (6d63e366d96494336f375ff155d47ab3) C:\WINDOWS\system32\DRIVERS\ce3n5.sys
2011/05/05 14:52:20.0125 1748 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/05/05 14:52:20.0796 1748 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/05/05 14:52:22.0125 1748 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/05/05 14:52:22.0703 1748 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/05/05 14:52:23.0296 1748 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/05/05 14:52:23.0687 1748 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/05/05 14:52:24.0125 1748 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/05/05 14:52:24.0765 1748 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/05/05 14:52:25.0046 1748 eabfiltr (3020c34ffdadfd69004570f88ff44b33) C:\WINDOWS\System32\drivers\EABFiltr.sys
2011/05/05 14:52:25.0343 1748 eabusb (1ba14da377b66278335d4b9e8824cd42) C:\WINDOWS\system32\drivers\eabusb.sys
2011/05/05 14:52:26.0156 1748 EMCR (7f07571f50353b42e6a2d93f07bec118) C:\WINDOWS\system32\DRIVERS\EMCR7SK.sys
2011/05/05 14:52:26.0484 1748 ENECBPTH (1fec25c49afbc34accbf3dc53031affe) C:\WINDOWS\system32\drivers\ENECBPTH.sys
2011/05/05 14:52:26.0843 1748 ENUM1394 (80d1b490b60e74e002dc116ec5d41748) C:\WINDOWS\system32\DRIVERS\enum1394.sys
2011/05/05 14:52:27.0281 1748 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/05/05 14:52:27.0609 1748 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/05/05 14:52:27.0953 1748 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/05/05 14:52:28.0218 1748 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/05/05 14:52:28.0531 1748 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/05/05 14:52:28.0937 1748 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/05/05 14:52:29.0234 1748 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/05/05 14:52:29.0609 1748 GEARAspiWDM (46f23cfc888b0a4397aae705c8af92af) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/05/05 14:52:29.0937 1748 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/05/05 14:52:30.0562 1748 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/05/05 14:52:31.0234 1748 HSFHWICH (2d9f10d6e7baa20c4526ce6a16444581) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys
2011/05/05 14:52:31.0875 1748 HSF_DP (2d566a7f0b4c54b417ac637cb608444b) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
2011/05/05 14:52:32.0625 1748 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/05/05 14:52:33.0578 1748 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/05/05 14:52:33.0937 1748 imagedrv (0a7c49b48c772591a2d362daa00246c8) C:\WINDOWS\system32\Drivers\imagedrv.sys
2011/05/05 14:52:34.0328 1748 imagesrv (549ba4f539e7b8d8129500b96dd7b27a) C:\WINDOWS\system32\DRIVERS\imagesrv.sys
2011/05/05 14:52:34.0765 1748 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/05/05 14:52:35.0359 1748 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/05/05 14:52:35.0734 1748 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/05/05 14:52:36.0140 1748 iomdisk (75931ebd581b9f79010640f924085fd4) C:\WINDOWS\system32\DRIVERS\iomdisk.sys
2011/05/05 14:52:36.0468 1748 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/05/05 14:52:36.0984 1748 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/05/05 14:52:37.0421 1748 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/05/05 14:52:37.0875 1748 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/05/05 14:52:38.0234 1748 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/05/05 14:52:38.0531 1748 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/05/05 14:52:38.0843 1748 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/05/05 14:52:39.0156 1748 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/05/05 14:52:39.0562 1748 Iviaspi (f59c3569a2f2c464bb78cb1bdcdca55e) C:\WINDOWS\system32\drivers\iviaspi.sys
2011/05/05 14:52:39.0890 1748 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/05/05 14:52:40.0250 1748 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/05/05 14:52:40.0609 1748 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/05/05 14:52:42.0218 1748 mdmxsdk (b72d7ea394d5f1c5053368783ad7f7ed) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2011/05/05 14:52:42.0671 1748 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/05/05 14:52:42.0984 1748 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/05/05 14:52:43.0359 1748 motccgp (c741717b0a18813dd7d12085937cee72) C:\WINDOWS\system32\DRIVERS\motccgp.sys
2011/05/05 14:52:43.0765 1748 motccgpfl (b812da6605caf02641312f1f65c75419) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
2011/05/05 14:52:44.0218 1748 MotDev (e190ed75bcc7928143f8f2af4c34d91d) C:\WINDOWS\system32\DRIVERS\motodrv.sys
2011/05/05 14:52:44.0531 1748 motmodem (54fee02961c70fd9d4d7e2f87afa23fa) C:\WINDOWS\system32\DRIVERS\motmodem.sys
2011/05/05 14:52:44.0843 1748 MotoSwitchService (fd8c2cef7ad8b23c6714103d621fac1f) C:\WINDOWS\system32\DRIVERS\motswch.sys
2011/05/05 14:52:45.0140 1748 Motousbnet (ddc489d40b49f443787e7ffa75373522) C:\WINDOWS\system32\DRIVERS\Motousbnet.sys
2011/05/05 14:52:45.0453 1748 motusbdevice (2136cca3d1bf7c0248e5366b1a6c24e3) C:\WINDOWS\system32\DRIVERS\motusbdevice.sys
2011/05/05 14:52:45.0984 1748 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/05/05 14:52:46.0312 1748 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/05/05 14:52:46.0609 1748 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/05/05 14:52:47.0250 1748 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/05/05 14:52:47.0781 1748 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/05/05 14:52:48.0218 1748 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
2011/05/05 14:52:48.0515 1748 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/05/05 14:52:48.0890 1748 MSIRCOMM (95c6432151ccff8617352f8e616a1aa4) C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
2011/05/05 14:52:49.0234 1748 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/05/05 14:52:49.0500 1748 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/05/05 14:52:49.0781 1748 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/05/05 14:52:50.0093 1748 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/05/05 14:52:50.0421 1748 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/05/05 14:52:50.0859 1748 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/05/05 14:52:51.0265 1748 MXOFX (ca68234d644aca94e7de0c90d2142f9d) C:\WINDOWS\system32\DRIVERS\MXOFX.SYS
2011/05/05 14:52:51.0578 1748 MXOPSWD (a4d5f3d1c9aadb7881460a21a9c8fb0d) C:\WINDOWS\system32\DRIVERS\mxopswd.sys
2011/05/05 14:52:51.0875 1748 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/05/05 14:52:52.0312 1748 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/05/05 14:52:52.0765 1748 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/05/05 14:52:53.0078 1748 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/05/05 14:52:53.0375 1748 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/05/05 14:52:53.0750 1748 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/05/05 14:52:54.0109 1748 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/05/05 14:52:54.0453 1748 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/05/05 14:52:54.0796 1748 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/05/05 14:52:55.0218 1748 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/05/05 14:52:55.0578 1748 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/05/05 14:52:55.0875 1748 NSCIRDA (2adc0ca9945c65284b3d19bc18765974) C:\WINDOWS\system32\DRIVERS\nscirda.sys
2011/05/05 14:52:56.0453 1748 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/05/05 14:52:57.0062 1748 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/05/05 14:52:57.0906 1748 nv (06500516671f54f74672d99a6b26950d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/05/05 14:52:58.0171 1748 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/05/05 14:52:58.0625 1748 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/05/05 14:52:58.0968 1748 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/05/05 14:52:59.0343 1748 PALMCAMUSB (e3dafafcb044672ad27c62c72805a981) C:\WINDOWS\system32\DRIVERS\palmcamusb.sys
2011/05/05 14:52:59.0843 1748 PalmUSBD (240c0d4049a833b16b63b636acf01672) C:\WINDOWS\system32\drivers\PalmUSBD.sys
2011/05/05 14:53:00.0734 1748 Parclass (f637694a01480e406a65e360c4b5e598) C:\WINDOWS\System32\Drivers\Parclass.sys
2011/05/05 14:53:01.0062 1748 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/05/05 14:53:01.0390 1748 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/05/05 14:53:01.0718 1748 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/05/05 14:53:02.0187 1748 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/05/05 14:53:02.0796 1748 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/05/05 14:53:03.0125 1748 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/05/05 14:53:03.0531 1748 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
2011/05/05 14:53:05.0671 1748 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/05/05 14:53:06.0000 1748 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/05/05 14:53:06.0328 1748 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/05/05 14:53:06.0765 1748 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/05/05 14:53:07.0125 1748 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
2011/05/05 14:53:08.0859 1748 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/05/05 14:53:09.0140 1748 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/05/05 14:53:09.0468 1748 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/05/05 14:53:09.0828 1748 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/05/05 14:53:10.0203 1748 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/05/05 14:53:10.0578 1748 RD1006 (48226fab88cafc442aa3c257f5015463) C:\WINDOWS\system32\Drivers\rdwm1006.sys
2011/05/05 14:53:10.0984 1748 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/05/05 14:53:11.0468 1748 RDID1046 (5192866ea2e156e7617e425e41e0d6f7) C:\WINDOWS\system32\Drivers\rdwm1046.sys
2011/05/05 14:53:11.0906 1748 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/05/05 14:53:12.0234 1748 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/05/05 14:53:12.0609 1748 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/05/05 14:53:13.0062 1748 RTL8023 (d88f6c53b637abe4c23de29db40a9f05) C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys
2011/05/05 14:53:13.0421 1748 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/05/05 14:53:13.0781 1748 sbp2port (b244960e5a1db8e9d5d17086de37c1e4) C:\WINDOWS\system32\DRIVERS\sbp2port.sys
2011/05/05 14:53:14.0140 1748 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/05/05 14:53:14.0531 1748 Ser2pl (b490ad520257dda26c1d587a71e527b5) C:\WINDOWS\system32\DRIVERS\ser2pl.sys
2011/05/05 14:53:14.0875 1748 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/05/05 14:53:15.0171 1748 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/05/05 14:53:15.0484 1748 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
2011/05/05 14:53:16.0203 1748 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/05/05 14:53:16.0812 1748 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/05/05 14:53:17.0140 1748 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/05/05 14:53:17.0578 1748 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/05/05 14:53:18.0140 1748 StreamDispatcher (3e5aa17e13fba9969d17b5455bde8efd) C:\WINDOWS\system32\DRIVERS\strmdisp.sys
2011/05/05 14:53:18.0421 1748 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/05/05 14:53:18.0828 1748 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/05/05 14:53:19.0109 1748 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/05/05 14:53:20.0718 1748 SynTP (0c1762fef34b265498ef2f3bef7f1d64) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/05/05 14:53:21.0343 1748 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/05/05 14:53:22.0265 1748 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/05/05 14:53:22.0828 1748 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/05/05 14:53:23.0140 1748 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/05/05 14:53:23.0421 1748 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/05/05 14:53:24.0046 1748 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/05/05 14:53:24.0984 1748 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/05/05 14:53:25.0406 1748 USB11LDR (38fa03602c6ef526c6c36290f4e81d4a) C:\WINDOWS\system32\drivers\usb11ldr.sys
2011/05/05 14:53:25.0765 1748 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/05/05 14:53:26.0187 1748 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/05/05 14:53:26.0578 1748 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/05/05 14:53:26.0875 1748 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/05/05 14:53:27.0234 1748 USBMN1X1 (ff0d4b6d6f4a179c4de25d7de4653817) C:\WINDOWS\system32\drivers\usbmn1x1.sys
2011/05/05 14:53:27.0687 1748 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/05/05 14:53:28.0375 1748 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/05/05 14:53:28.0781 1748 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\DRIVERS\usbser.sys
2011/05/05 14:53:29.0062 1748 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/05/05 14:53:29.0453 1748 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/05/05 14:53:29.0765 1748 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/05/05 14:53:30.0125 1748 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/05/05 14:53:30.0406 1748 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/05/05 14:53:30.0765 1748 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/05/05 14:53:31.0328 1748 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/05/05 14:53:32.0125 1748 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/05/05 14:53:32.0453 1748 WIBUKEY (09ebc00530cc3493df55219d0da5e03a) C:\WINDOWS\system32\DRIVERS\Wibukey.sys
2011/05/05 14:53:33.0046 1748 winachsf (88a5f20c6c221e50f01c00d8235db8c4) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2011/05/05 14:53:33.0609 1748 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/05/05 14:53:33.0953 1748 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/05/05 14:53:34.0265 1748 xbreader (05a74d2be6f493c65d7221d1d0e8a23c) C:\WINDOWS\system32\Drivers\xbreader.sys
2011/05/05 14:53:35.0218 1748 \HardDisk1 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/05/05 14:53:35.0281 1748 ================================================================================
2011/05/05 14:53:35.0281 1748 Scan finished
2011/05/05 14:53:35.0281 1748 ================================================================================
2011/05/05 14:53:35.0296 3648 Detected object count: 1
2011/05/05 14:54:13.0421 3648 \HardDisk1 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/05/05 14:54:13.0421 3648 \HardDisk1 - ok
2011/05/05 14:54:13.0421 3648 Rootkit.Win32.TDSS.tdl4(\HardDisk1) - User select action: Cure
2011/05/05 14:54:22.0828 3300 Deinitialize success

I will post again once OTL has finished its run.

This post has been edited by Norbert W: 05 May 2011 - 08:57 AM

#5 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 05 May 2011 - 09:04 AM

Here are the two logs provided by OTL:

OTL logfile created on: 05/05/2011 14:59:52 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 649.00 Mb Available Physical Memory | 63.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 0.44 Gb Free Space | 0.79% Space Free | Partition Type: NTFS
Drive E: | 42.38 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 367.70 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 1.92 Gb Total Space | 0.11 Gb Free Space | 5.58% Space Free | Partition Type: FAT

Computer Name: PC180273018230 | User Name: Barnabas Netherwood | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/05 13:02:14 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools\OTL.exe
PRC - [2011/04/28 01:11:07 | 000,037,888 | ---- | M] (Htyqfvuhm Software) -- C:\WINDOWS\Temp\hmvr\setup.exe
PRC - [2011/02/23 16:04:20 | 003,451,496 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/02/23 16:04:19 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004/12/03 11:52:38 | 000,073,728 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\System32\AppServices.exe
PRC - [2004/08/31 10:23:42 | 000,823,296 | ---- | M] (Maxtor Corporation) -- C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe
PRC - [2004/07/30 16:47:36 | 006,946,816 | ---- | M] (Dantz Development Corporation) -- C:\Program Files\Dantz\Retrospect Express HD\RetroExpress.exe
PRC - [2004/07/30 16:47:36 | 000,167,936 | ---- | M] (Dantz Development Corporation) -- C:\Program Files\Dantz\Retrospect Express HD\Retrospect.exe
PRC - [2004/07/30 16:47:36 | 000,069,632 | ---- | M] (Dantz Development Corporation) -- C:\Program Files\Dantz\Retrospect Express HD\retrorun.exe
PRC - [2003/11/18 09:31:52 | 000,241,664 | ---- | M] (Hewlett-Packard ) -- C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe
PRC - [2003/10/10 12:23:48 | 000,094,208 | ---- | M] (Cypress Semiconductor) -- C:\WINDOWS\MXOALDR.EXE
PRC - [2003/07/15 20:09:18 | 000,110,592 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PRC - [2003/06/25 11:24:48 | 000,049,152 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
PRC - [2002/10/07 00:23:20 | 000,090,112 | ---- | M] () -- C:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe
PRC - [2002/08/13 15:30:57 | 000,086,016 | ---- | M] (Iomega) -- C:\Program Files\Iomega\DriveIcons\Imgicon.exe
PRC - [2002/06/03 11:38:12 | 000,049,152 | ---- | M] (ScanSoft, Inc) -- C:\Program Files\ScanSoft\OmniPageSE\opware32.exe

========== Modules (SafeList) ==========

MOD - [2011/05/05 13:02:14 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools\OTL.exe
MOD - [2011/02/23 16:04:17 | 000,197,208 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2010/08/23 17:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2003/07/15 20:08:52 | 000,065,536 | ---- | M] (Synaptics, Inc.) -- C:\WINDOWS\system32\SynTPFcs.dll
MOD - [2002/08/06 14:01:54 | 000,286,720 | ---- | M] (Iomega Corporation) -- C:\Program Files\Iomega\DriveIcons\Imghook.dll
MOD - [2002/06/03 11:37:50 | 000,167,936 | ---- | M] (ScanSoft, Inc) -- C:\Program Files\ScanSoft\OmniPageSE\ophook32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (Iomega Activity Disk2)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/28 01:11:07 | 000,037,888 | ---- | M] (Htyqfvuhm Software) [Auto | Start_Pending] -- C:\WINDOWS\TEMP\hmvr\setup.exe -- (AMService)
SRV - [2011/02/23 16:04:19 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/04/13 19:45:15 | 000,049,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\stream.sys -- (Shfsvcxp)
SRV - [2005/05/06 13:49:11 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2004/12/03 11:52:38 | 000,073,728 | ---- | M] (Iomega Corporation) [Auto | Running] -- C:\Program Files\Iomega\System32\AppServices.exe -- (Iomega App Services)
SRV - [2004/07/30 16:47:36 | 000,110,592 | ---- | M] (Dantz Development Corporation) [Auto | Stopped] -- C:\Program Files\Dantz\Retrospect Express HD\rthlpsvc.exe -- (RetroExp Helper)
SRV - [2004/07/30 16:47:36 | 000,069,632 | ---- | M] (Dantz Development Corporation) [Auto | Running] -- C:\Program Files\Dantz\Retrospect Express HD\retrorun.exe -- (RetroExpLauncher)
SRV - [2003/11/03 12:47:08 | 000,053,248 | ---- | M] (GEAR Software) [Disabled | Stopped] -- C:\WINDOWS\system32\gearsec.exe -- (GEARSecurity)

========== Driver Services (SafeList) ==========

DRV - [2011/02/23 15:56:55 | 000,371,544 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/02/23 15:56:45 | 000,301,528 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/02/23 15:55:49 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/02/23 15:55:47 | 000,102,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/02/23 15:55:10 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/02/23 15:54:57 | 000,030,680 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011/02/23 15:54:55 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/04/01 14:31:50 | 000,023,424 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet)
DRV - [2010/01/25 19:56:44 | 000,009,472 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice)
DRV - [2009/10/27 12:02:14 | 000,023,936 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2009/07/10 13:01:06 | 000,025,856 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motoandroid.sys -- (androidusb)
DRV - [2009/06/19 16:59:34 | 000,019,712 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
DRV - [2009/05/08 11:56:12 | 000,042,752 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motodrv.sys -- (MotDev)
DRV - [2009/01/29 17:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
DRV - [2009/01/29 17:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService)
DRV - [2009/01/06 03:23:14 | 000,016,694 | ---- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PalmUSBD.sys -- (PalmUSBD)
DRV - [2007/11/02 15:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService)
DRV - [2005/10/15 19:12:58 | 000,215,424 | ---- | M] (clievideo.com) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\palmcamusb.sys -- (PALMCAMUSB)
DRV - [2005/02/06 15:23:34 | 000,022,272 | ---- | M] (Doug Fetter Software Wizardry) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbmn1x1.sys -- (USBMN1X1)
DRV - [2005/02/06 15:23:34 | 000,013,504 | ---- | M] (MIDIMAN) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usb11ldr.sys -- (USB11LDR)
DRV - [2004/12/03 11:52:50 | 000,050,898 | ---- | M] (Iomega Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\iomdisk.sys -- (iomdisk)
DRV - [2004/08/09 18:49:40 | 000,014,592 | ---- | M] (Maxtor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxopswd.sys -- (MXOPSWD)
DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/07/23 21:11:42 | 000,020,272 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\Drivers\Parclass.sys -- (Parclass)
DRV - [2004/04/30 09:37:02 | 000,160,640 | ---- | M] ( ) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\a347bus.sys -- (a347bus)
DRV - [2004/04/30 09:33:00 | 000,005,248 | ---- | M] ( ) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\a347scsi.sys -- (a347scsi)
DRV - [2004/04/29 15:10:06 | 000,274,688 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camchal.sys -- (CAMCHALA)
DRV - [2004/04/29 15:09:20 | 000,292,352 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camcaud.sys -- (CAMCAUD)
DRV - [2004/04/02 02:07:44 | 000,163,390 | R--- | M] (Roland Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rdwm1046.sys -- (RDID1046)
DRV - [2004/03/03 22:30:54 | 000,125,184 | ---- | M] (Ahead Software AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\imagesrv.sys -- (imagesrv)
DRV - [2004/03/03 22:30:54 | 000,005,504 | ---- | M] (Ahead Software AG) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\imagedrv.sys -- (imagedrv)
DRV - [2004/03/02 07:11:00 | 000,169,086 | R--- | M] (Roland Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rdwm1006.sys -- (RD1006)
DRV - [2003/12/04 13:29:58 | 000,286,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2003/11/25 12:22:54 | 000,068,352 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnic51.sys -- (RTL8023)
DRV - [2003/10/10 12:23:48 | 000,032,640 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MXOFX.SYS -- (MXOFX) USB Storage Adapter FX (MXO)
DRV - [2003/08/18 13:57:52 | 000,007,080 | ---- | M] (Hewlett-Packard Company) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)
DRV - [2003/08/15 16:10:00 | 000,068,480 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EMCR7SK.sys -- (EMCR)
DRV - [2003/07/16 07:27:40 | 000,043,264 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2003/06/06 11:46:16 | 000,005,220 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\eabusb.sys -- (eabusb)
DRV - [2003/05/05 14:32:06 | 000,067,072 | ---- | M] (WIBU-SYSTEMS AG) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Wibukey.sys -- (WIBUKEY)
DRV - [2003/05/01 14:42:00 | 000,030,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\strmdisp.sys -- (StreamDispatcher)
DRV - [2003/05/01 14:40:00 | 000,165,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2003/05/01 14:38:00 | 000,622,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/05/01 14:37:00 | 001,107,200 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/04/02 11:02:26 | 000,007,040 | ---- | M] (EnE Technology Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\ENECBPTH.sys -- (ENECBPTH)
DRV - [2001/08/17 09:46:40 | 000,006,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\enum1394.sys -- (ENUM1394)
DRV - [2001/08/17 08:13:20 | 000,027,164 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CE3N5.SYS -- (CE3)
DRV - [2001/01/03 00:53:30 | 000,019,677 | ---- | M] (Thesycon GmbH, Germany) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\xbreader.sys -- (xbreader) MaxDrive XBox Driver (xbreader.sys)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://autoconfig.cpqcorp.net

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://autoconfig.cpqcorp.net

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = http://autoconfig.cpqcorp.net

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {7F618381-41CA-4DB2-A13F-5FB107D3394D}:1.9.1
FF - prefs.js..network.proxy.http: "95.48.212.219"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{7F618381-41CA-4DB2-A13F-5FB107D3394D}: C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\{7F618381-41CA-4DB2-A13F-5FB107D3394D} [2011/04/24 12:49:24 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/22 18:20:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/24 15:20:11 | 000,000,000 | ---D | M]

[2011/01/11 01:42:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Mozilla\Extensions
[2011/01/11 01:42:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Mozilla\Extensions\celtx@celtx.com
[2011/04/27 11:06:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Mozilla\Firefox\Profiles\q0cahxoy.default\extensions
[2010/10/23 16:31:36 | 000,000,000 | ---D | M] (BlockSite) -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Mozilla\Firefox\Profiles\q0cahxoy.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2011/03/12 19:14:57 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Mozilla\Firefox\Profiles\q0cahxoy.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2011/04/27 11:06:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/11/01 11:17:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/26 19:12:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/04/24 12:49:24 | 000,000,000 | ---D | M] (XULRunner) -- C:\DOCUMENTS AND SETTINGS\BARNABAS NETHERWOOD\LOCAL SETTINGS\APPLICATION DATA\{7F618381-41CA-4DB2-A13F-5FB107D3394D}
[2010/11/01 11:13:15 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

Hosts file not found
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CamMonitor] C:\Program Files\HP\Digital Imaging\Unload\HpqCmon.exe ()
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\Cpqset.exe ()
O4 - HKLM..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe (Iomega)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [EPSON Stylus Photo RX420 Series] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [KONICA MINOLTA PagePro 1400W STD] C:\WINDOWS\System32\MSTMON_Y.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
O4 - HKLM..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe (Maxtor Corporation)
O4 - HKLM..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE (Cypress Semiconductor)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
O4 - HKLM..\Run: [RetroExpress] C:\Program Files\Dantz\Retrospect Express HD\RetroExpress.exe (Dantz Development Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] File not found
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKU\S-1-5-21-2700728924-2894260721-178917511-1007..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ekin.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe (PalmSource, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LUMIX Simple Viewer.lnk = C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe (Matsubleepa Electric Industrial Co., Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Suitcase Startup.lnk = C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe (Extensis Products Group)
O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\edire.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKU\S-1-5-21-2700728924-2894260721-178917511-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - Explorer.exe (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Program Files\DVD Region-Free\DVDShell.dll (Fengtao Software)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/04/22 20:46:35 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [1999/09/09 14:31:04 | 000,024,576 | RH-- | M] () - E:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2002/01/17 18:06:28 | 000,000,090 | RH-- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [1999/06/14 10:51:36 | 000,208,384 | R--- | M] () - F:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [1999/06/14 10:51:36 | 000,000,045 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [1999/06/14 10:51:36 | 001,061,674 | R--- | M] () - F:\autorun.pak -- [ CDFS ]
O33 - MountPoints2\{4d47159e-de11-11df-9e41-00904b9a7215}\Shell\AutoRun\command - "" = I:\Get_Started_for_Win.exe
O33 - MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\Shell - "" = AutoRun
O33 - MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\Shell\AutoRun\command - "" = I:\setup.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/27 14:28:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/04/27 14:26:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/04/27 12:15:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Viduyz
[2011/04/24 12:49:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\{7F618381-41CA-4DB2-A13F-5FB107D3394D}
[2011/04/24 12:43:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/04/22 20:46:35 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2011/04/22 18:46:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\QuickScan
[2011/04/22 18:24:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/04/22 18:20:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2011/04/22 18:20:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2011/04/22 16:58:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/04/22 11:42:47 | 000,000,000 | ---D | C] -- C:\TRK-INFECTED
[2011/04/21 02:40:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Barnabas Netherwood\Desktop\GB related
[2010/09/24 22:22:36 | 000,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys
[2010/09/24 22:22:36 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys
[2007/02/28 15:28:56 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Barnabas Netherwood\Application Data\pcouffin.sys
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\*.tmp files -> C:\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/05 14:55:56 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/04 23:34:07 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2700728924-2894260721-178917511-1007UA.job
[2011/05/04 14:33:17 | 535,859,200 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/03 15:29:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/27 14:26:15 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/27 14:02:02 | 000,000,054 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\defogger_reenable
[2011/04/27 12:34:02 | 000,000,980 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2700728924-2894260721-178917511-1007Core.job
[2011/04/27 10:54:57 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Glarogumamu.bin
[2011/04/22 16:50:01 | 000,015,899 | ---- | M] () -- C:\WINDOWS\MSTMON_Y.INI
[2011/04/21 19:18:05 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Ozemohugewuxi.dat
[2011/04/21 03:22:24 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/04/21 03:22:20 | 000,059,392 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/21 02:09:41 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2011/04/20 14:17:06 | 003,718,094 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\deposit-bond-scheme.pdf
[2011/04/20 14:16:10 | 000,041,168 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\h_tenancy_deposits.pdf
[2011/04/17 23:37:22 | 000,002,364 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/04/17 23:37:21 | 000,002,386 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\Google Chrome.lnk
[2011/04/15 12:58:53 | 000,210,488 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/15 12:41:21 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/04/14 16:21:48 | 000,337,681 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\My Documents\GODKING ASSEMBLY 2.modded.C2.pdf
[2011/04/14 16:21:48 | 000,337,681 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\My Documents\God Grant Us Safe Teleport.pdf
[2011/04/09 12:37:55 | 000,002,714 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\Trashy flicks 1942-1959.nri
[2011/04/09 12:35:46 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\Dementia, Hanyo & Spider Baby (so far...).nri
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\*.tmp files -> C:\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/04 13:57:01 | 535,859,200 | -HS- | C] () -- C:\hiberfil.sys
[2011/04/27 14:01:59 | 000,000,054 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\defogger_reenable
[2011/04/21 19:18:05 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Ozemohugewuxi.dat
[2011/04/21 19:18:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Glarogumamu.bin
[2011/04/20 14:17:04 | 003,718,094 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\deposit-bond-scheme.pdf
[2011/04/20 14:16:07 | 000,041,168 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\h_tenancy_deposits.pdf
[2011/04/14 16:22:57 | 000,337,681 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\My Documents\God Grant Us Safe Teleport.pdf
[2011/04/14 16:21:48 | 000,337,681 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\My Documents\GODKING ASSEMBLY 2.modded.C2.pdf
[2011/04/09 12:37:55 | 000,002,714 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\Trashy flicks 1942-1959.nri
[2011/04/09 12:35:45 | 000,002,277 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Desktop\Dementia, Hanyo & Spider Baby (so far...).nri
[2011/03/25 13:24:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PasswordsPlus.INI
[2011/03/17 03:09:31 | 000,161,084 | ---- | C] () -- C:\WINDOWS\DirectShow Detective Uninstaller.exe
[2011/03/10 17:58:43 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2011/02/11 17:16:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WATCH.INI
[2011/02/10 19:41:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ui.INI
[2011/01/25 03:16:55 | 000,015,899 | ---- | C] () -- C:\WINDOWS\MSTMON_Y.INI
[2011/01/25 03:16:55 | 000,012,244 | ---- | C] () -- C:\WINDOWS\MSUMLT_Y.INI
[2010/11/18 00:55:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/09/30 16:43:18 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2010/05/14 13:49:21 | 000,065,793 | ---- | C] () -- C:\WINDOWS\System32\esfw7a.bin
[2010/04/29 17:27:40 | 000,000,005 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\.sunvox_pateditor
[2010/01/10 20:18:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/01/09 18:53:22 | 003,997,696 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2009/12/22 15:15:27 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A5W.INI
[2009/11/20 02:50:11 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2008/12/12 03:35:40 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2008/03/26 01:04:42 | 000,000,342 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2008/01/23 15:28:27 | 000,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2008/01/15 05:19:08 | 000,000,562 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\AutoGK.ini
[2007/06/12 12:09:20 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2007/06/12 12:09:20 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2007/06/12 12:09:20 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2007/06/12 12:09:20 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2007/06/12 12:09:20 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2007/06/12 12:09:20 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2007/06/12 12:09:20 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2007/06/12 12:09:20 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2007/06/12 12:09:20 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2007/06/12 12:09:20 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2007/06/12 12:09:20 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2007/06/12 12:09:20 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2007/06/12 12:09:20 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2007/06/12 12:09:20 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2007/06/12 12:09:20 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2007/06/12 12:09:20 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2007/04/29 12:20:59 | 001,232,803 | ---- | C] () -- C:\WINDOWS\LightWave 3D 9.2 Uninstaller.exe
[2007/03/28 15:12:20 | 000,165,042 | ---- | C] () -- C:\WINDOWS\Video Perspective Uninstaller.exe
[2007/03/22 03:56:28 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\MMSwitch.dll
[2007/03/22 03:56:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\MMAVILNG.exe
[2007/02/28 15:28:56 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\ezpinst.exe
[2007/02/28 15:28:56 | 000,007,824 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\pcouffin.cat
[2007/02/28 15:28:56 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\pcouffin.inf
[2006/11/28 15:53:51 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS7C.DLL
[2006/11/02 03:08:42 | 000,000,059 | ---- | C] () -- C:\WINDOWS\ANS2000.INI
[2006/11/02 03:08:42 | 000,000,020 | -H-- | C] () -- C:\WINDOWS\akebook.ini
[2006/11/02 03:08:42 | 000,000,004 | -H-- | C] () -- C:\WINDOWS\a3kebook.ini
[2006/09/10 16:35:33 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2006/09/10 16:35:33 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2006/09/10 16:35:33 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2006/09/10 16:35:33 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2006/09/10 16:35:33 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2006/08/11 13:46:09 | 000,000,477 | ---- | C] () -- C:\WINDOWS\DVDFabGold.INI
[2006/07/21 13:16:44 | 000,000,147 | ---- | C] () -- C:\WINDOWS\Muxman.ini
[2006/07/02 19:12:18 | 000,038,401 | R--- | C] () -- C:\WINDOWS\System32\RdCi1006.dll
[2006/07/02 19:12:17 | 000,004,088 | R--- | C] () -- C:\WINDOWS\System32\Rd4t1006.DAT
[2006/07/02 18:58:29 | 000,038,401 | R--- | C] () -- C:\WINDOWS\System32\RdCi1046.dll
[2006/07/02 18:58:28 | 000,004,088 | R--- | C] () -- C:\WINDOWS\System32\Rd4t1046.DAT
[2006/06/23 14:29:54 | 000,002,501 | ---- | C] () -- C:\WINDOWS\Palm OS Emulator.ini
[2006/06/13 11:59:09 | 000,090,112 | ---- | C] () -- C:\WINDOWS\RSetupPalmEn.exe
[2006/06/09 10:27:22 | 000,000,075 | ---- | C] () -- C:\WINDOWS\FileNamesinQueue.ini
[2006/05/12 18:16:27 | 000,000,906 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Application Data\DVDSubEdit.ini
[2006/05/12 14:04:34 | 000,163,426 | ---- | C] () -- C:\WINDOWS\Video Cleaner Pro Uninstaller.exe
[2006/05/08 12:53:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QuickInstall.INI
[2006/04/14 01:35:26 | 000,041,984 | ---- | C] () -- C:\WINDOWS\System32\KEYSETUP.EXE
[2006/04/14 01:35:26 | 000,030,720 | ---- | C] () -- C:\WINDOWS\System32\PARCLASS.EXE
[2006/04/14 01:35:26 | 000,012,048 | ---- | C] () -- C:\WINDOWS\System32\PPMON.EXE
[2006/04/14 01:35:26 | 000,007,440 | ---- | C] () -- C:\WINDOWS\System32\PPMON.DLL
[2006/03/17 12:17:40 | 000,000,001 | -H-- | C] () -- C:\WINDOWS\mulch100.ini
[2005/12/29 17:18:37 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2005/12/29 17:18:37 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2005/12/29 17:18:36 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2005/12/29 17:00:40 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDE RX420EI.ini
[2005/12/12 15:49:50 | 000,002,076 | ---- | C] () -- C:\WINDOWS\energyXT.ini
[2005/11/06 15:55:59 | 000,000,448 | ---- | C] () -- C:\WINDOWS\IfoEdit.INI
[2005/11/06 15:20:54 | 000,000,133 | ---- | C] () -- C:\WINDOWS\VobEdit.INI
[2005/09/13 20:17:05 | 000,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2005/07/16 10:57:57 | 012,550,144 | ---- | C] () -- C:\WINDOWS\CS-80V(10 voices).dll
[2005/04/25 13:18:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\graphedt.INI
[2005/04/12 13:36:58 | 000,000,525 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2005/04/07 15:18:42 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2005/03/31 02:40:30 | 000,528,384 | ---- | C] () -- C:\WINDOWS\System32\BladeEnc.dll
[2005/03/31 02:40:29 | 000,120,832 | ---- | C] () -- C:\WINDOWS\System32\ShnDll32.dll
[2005/03/19 20:51:58 | 000,000,032 | ---- | C] () -- C:\WINDOWS\System32\msvcsv60.dll
[2005/03/19 20:51:58 | 000,000,032 | ---- | C] () -- C:\WINDOWS\msocreg32.dat
[2005/02/22 02:28:35 | 000,000,253 | ---- | C] () -- C:\WINDOWS\WSHORTEN.INI
[2005/02/16 01:22:05 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\FDlg.dll
[2005/02/04 04:59:48 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\metaflac.exe
[2005/02/04 04:59:44 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\flac.exe
[2005/01/31 15:47:04 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/01/18 14:13:09 | 000,000,091 | ---- | C] () -- C:\WINDOWS\quadriga.ini
[2005/01/18 14:10:21 | 000,000,259 | ---- | C] () -- C:\WINDOWS\boxworld.ini
[2005/01/14 14:16:27 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/01/14 14:03:30 | 000,000,067 | ---- | C] () -- C:\WINDOWS\DVDRegionFree.INI
[2005/01/12 13:16:10 | 000,000,028 | ---- | C] () -- C:\WINDOWS\MotionDVSTUDIO.INI
[2005/01/12 12:55:26 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\P_MPEG4.dll
[2005/01/11 13:30:04 | 000,118,784 | ---- | C] () -- C:\WINDOWS\dsdxirmv.exe
[2005/01/02 01:36:38 | 000,000,041 | ---- | C] () -- C:\WINDOWS\winampa.ini
[2005/01/01 00:35:22 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/12/28 00:56:57 | 000,059,392 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/12/22 10:36:43 | 000,034,468 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat
[2004/12/22 10:36:43 | 000,028,917 | ---- | C] () -- C:\WINDOWS\hpoins03.dat
[2004/12/22 09:02:47 | 000,034,468 | ---- | C] () -- C:\WINDOWS\hpomdl03.dat.temp
[2004/12/22 09:02:47 | 000,028,917 | ---- | C] () -- C:\WINDOWS\hpoins03.dat.temp
[2004/12/22 04:41:29 | 000,000,142 | ---- | C] () -- C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\fusioncache.dat
[2004/12/22 04:21:53 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/12/22 04:21:53 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/12/22 04:21:53 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/12/22 04:21:53 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/12/22 04:21:53 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/12/22 04:21:53 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/12/20 11:08:28 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2004/12/20 11:03:26 | 000,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2004/10/15 10:43:12 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\ArtFfct.dll
[2004/08/26 12:53:14 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\MXONmSpace.dll
[2004/08/26 12:49:52 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\MXONmSpMFC.dll
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/06/14 10:55:52 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\nlame.dll
[2004/06/14 10:45:38 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\pqdvdb.dll
[2004/06/14 10:45:38 | 000,654,336 | ---- | C] () -- C:\WINDOWS\System32\pqdvdf.exe
[2003/07/16 14:21:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2003/07/16 14:21:06 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2003/07/16 14:18:46 | 000,381,094 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/07/16 14:18:46 | 000,053,276 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/07/16 14:13:08 | 000,210,488 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/07/16 14:09:24 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/07/16 14:06:40 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2003/05/03 16:21:34 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll
[2003/05/03 16:09:54 | 000,000,137 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2003/05/03 16:09:13 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003/03/31 03:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 03:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 03:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 03:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 03:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 03:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/03/31 03:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/10/15 23:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2002/06/18 09:04:38 | 000,001,783 | ---- | C] () -- C:\Program Files\Enhancements_Import_1_0.dtd
[2002/06/17 20:36:10 | 000,482,816 | ---- | C] () -- C:\WINDOWS\System32\VFCodec.dll
[2002/05/28 09:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 09:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

< End of report >

and

OTL Extras logfile created on: 05/05/2011 14:59:52 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 649.00 Mb Available Physical Memory | 63.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 0.44 Gb Free Space | 0.79% Space Free | Partition Type: NTFS
Drive E: | 42.38 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 367.70 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive H: | 1.92 Gb Total Space | 0.11 Gb Free Space | 5.58% Space Free | Partition Type: FAT

Computer Name: PC180273018230 | User Name: Barnabas Netherwood | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-2700728924-2894260721-178917511-1007\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Generate MD5 Signatures] -- "C:\Program Files\Michael K. Weise\mkw Audio Compression Toolkit\mkwACT.exe" (Michael K. Weise)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files\Motorola\RSD Lite\SDL.exe" = C:\Program Files\Motorola\RSD Lite\SDL.exe:*:Enabled:SDL
"C:\Program Files\REAPER\reaper.exe" = C:\Program Files\REAPER\reaper.exe:*:Enabled:reaper -- (Cockos Incorporated)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Portable apps\uTorrentPortable\App\utorrent\utorrent.exe" = C:\Portable apps\uTorrentPortable\App\utorrent\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java™ Platform SE binary -- (Sun Microsystems, Inc.)
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\Program Files\River Past\DirectShow Detective\DSDetective.exe" = C:\Program Files\River Past\DirectShow Detective\DSDetective.exe:*:Enabled:River Past DirectShow Detective -- (River Past Corporation)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer -- (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00060000-0000-1004-8002-0000C06B5161}" = WIBU-KEY Setup (WIBU-KEY Remove)
"{0186F98B-19A2-4791-8ECA-BD7870FD0C65}_is1" = DVD Rebuilder
"{0CD3CFF0-9A22-4CDA-BF1B-FA73C1D8B95B}" = Palm
"{17D15913-C122-4FED-8F88-C330FAFCDDCF}" = Encore Subtitles
"{18BB0074-02A3-4DFC-BB24-FD1019140F63}" = Spectaculator 6.0
"{19ADD50F-39F2-4219-A1E4-9440F3DD0F29}" = Sony DVD Architect 2.0a
"{1E88F516-C8AA-4D17-9A54-8AB0768F34C1}" = Retrospect Express HD 1.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 23
"{292941A3-0314-4C9A-8881-9B4B6B187318}" = SoundRaider
"{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" = HpSdpAppCoreApp
"{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}" = LUMIX Simple Viewer
"{2EDEABB2-98FA-11D4-B185-005004EE1EBC}" = Digigram Multichannel Encoder/Decoder
"{2F1FD032-67D1-4569-923F-47EAF132BF0F}" = DocProc
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EC91FDF-FE9A-43D5-96C4-8A9C24372500}" = Maxtor OneTouch
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57853D-4EF6-47DC-A70C-4137D5AE647F}" = Ultrasoft BrainForest
"{4FB6F304-A91D-4919-98E5-D96E074EA9E5}" = SkinsHP1
"{52E819E9-C69A-4AF6-B2B3-BC01F8B0ECA3}" = Toon Boom Storyboard Pro Trial
"{5ADF6293-D60F-4425-AFA7-CEB820DB872B}" = QuickProjects
"{5D7F0A0E-369E-46C0-9F99-FAB21A064781}" = HP Photo and Imaging 2.0 - Photosmart Cameras
"{6249C22D-E6A8-407B-BA8B-40298848ED94}" = OmniPage SE
"{626ABA83-FE66-11D7-91B2-00045A5FE73D}" = ittyMIDI Player V2.12
"{6BD31B80-7E9E-4FAF-B911-0AC31FB94BF6}" = Adobe Encore DVD 1.5
"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare
"{7AEBFFF0-15A1-48A9-88F3-06604486C7C9}" = WMPTagSupportExtender
"{7BB9F5A8-5BBD-4A39-A6C5-06E2B49054F8}" = SD Viewer for DV
"{829698DE-9EAC-475E-9A05-B7BA807CA1EF}" = Director
"{86EF9FC4-F209-4520-B7E1-C7FF0EEBDFFF}" = Adobe Audition 1.5
"{874F5336-8CD6-48B6-84C8-677A0566141F}" = Phoinix ROM Converter
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{90546A9B-9B86-4D8A-B381-EF8D8AAE73E1}" = Extensis Suitcase 9.2
"{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}" = Adobe Illustrator CS
"{930D28D0-9FD8-4D50-B0C8-B55528064560}" = Documents To Go
"{939740B5-0064-4779-854A-8C1086181C05}" = Macromedia FreeHand MXa
"{94118D5F-2D5D-4BF5-9F84-11FB8A97B566}" = 2d3 SteadyMove for Adobe Premiere Pro
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}" = FlashFXP v3
"{9705A7E1-3DD1-4BAC-8CA9-FE7B1473BEC9}" = iTunes
"{9811A185-3D3D-11D6-9E14-00036D172B00}" = Adobe MPEG Encoder
"{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD
"{9A97D672-6C93-4DFA-B527-DE005A761495}" = Video Stream Driver for Panasonic DVC
"{9F4EEA0C-7174-4BD3-89AF-7AB2F9F6AEDD}" = hpmdtab
"{A14F7508-B784-40B8-B11A-E0E2EEB7229F}" = Adobe Premiere Pro 1.5
"{A363B66C-1547-47bf-90F0-3834E70A841A}" = CreativeProjects
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-0000-7EC8-7489-000000000603}" = Adobe Acrobat and Reader 6.0.3 Update
"{AC76BA86-0000-7EC8-7489-000000000604}" = Adobe Acrobat and Reader 6.0.4 Update
"{AC76BA86-0000-7EC8-7489-000000000605}" = Adobe Acrobat and Reader 6.0.5 Update
"{AC76BA86-0000-7EC8-7489-000000000606}" = Adobe Acrobat and Reader 6.0.6 Update
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{B525BB2C-9338-11D4-8B84-00B0D03E6A83}" = Palm Conduit Support for COM
"{BB406CEB-6207-4512-9BB2-89950DC9D6B6}_is1" = ConvertXtoDVD 2.1.10.208
"{C38BC5B7-62D3-4880-82DD-A4803FD81921}" = PhotoGallery
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC0A24CB-87C9-4F1C-A1F2-F87D8D4DDCAF}" = HP Software Update
"{CC8B19D1-91D2-4D5B-B331-F885F432745E}" = Final Draft 6
"{CE4F8FFB-4063-4247-9F14-ECE61AFEFA25}" = TrayApp
"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 4.20 C1
"{D1D8C9C4-89BE-4f37-9EC4-B80E3C239C41}" = Copy
"{D545BB81-DEB0-49f7-BE26-197BC31AAF57}" = SkinsHP2
"{DB10AF3B-E30E-49F9-84AC-26785D689E13}" = MainConcept MPEG Encoder
"{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" = Alcohol 120% (Trial Version)
"{EBCBA952-DA46-4687-9784-D8B4E25A6B14}" = Passwords Plus
"{F419D20A-7719-4639-8E30-C073A040D878}" = HP Deskjet Preloaded Printer Drivers
"{F9B32332-3A66-4480-9769-CAB45CA1D179}" = MotionDV STUDIO 5.1E LE for DV
"{FBBF532A-47AC-457d-AC06-0D3163D8911E}" = WebReg
"{FF0B0792-F6E7-4627-B820-EA50617E223B}" = QuarkXPress 6.0
"Ableton Live v5.0.2" = Ableton Live v5.0.2
"AC3Filter" = AC3Filter (remove only)
"Active Disk" = Active Disk
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Anarchy.Rhythms.VST.v2.0-DAC" = Anarchy.Rhythms.VST.v2.0-DAC
"Applied Acoustics Lounge Lizard EP VSTi DXi v3.0" = Applied Acoustics Lounge Lizard EP VSTi DXi v3.0
"Arturia Arp2600 V v1.0" = Arturia Arp2600 V v1.0
"Arturia CS-80V v1.5" = Arturia CS-80V v1.5
"Arturia Moog Modular V v1.1" = Arturia Moog Modular V v1.1
"Arturia.Minimoog.V.v1.5-DAC" = Arturia.Minimoog.V.v1.5-DAC
"ASIO4ALL v2" = ASIO4ALL v2
"AutoGK" = Auto Gordian Knot 2.45
"avast" = avast! Free Antivirus
"AviSynth" = AviSynth 2.5
"Bome's SendSX_is1" = Bome's SendSX V1.22
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Driver
"BRYCE3D" = Bryce® 3D
"CDisplay_is1" = CDisplay 1.8
"CNXT_MODEM_PCI_VEN_8086&DEV_24D6&SUBSYS_006A103C" = Conexant 56K ACLink Modem
"Codejedi Inc Shadow Plan for PalmOS" = Codejedi Inc Shadow Plan for PalmOS
"Conexant PCI Audio" = Conexant AC-Link Audio
"Coutts Design Inc ZiPCADPro" = Coutts Design Inc ZiPCADPro
"daHornet VSTi V1.34_is1" = daHornet Version 1.34
"dcm_pic" = Plug-In Constructor
"Digigram Multichannel Digital Audio Encoder v1.1b" = Digigram Multichannel Digital Audio Encoder v1.1b
"DirectShow Detective" = River Past DirectShow Detective
"DreamStation DXi2" = DreamStation DXi2
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Region-Free_is1" = DVD Region-Free 3.32
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDAuthorGUI" = DVDAuthorGUI (remove only)
"DVDFab Platinum_is1" = DVDFab Platinum 4.0.4.0B by Dr.Pc Putte - Team RES
"East West Drumkit From Hell 2" = East West Drumkit From Hell 2
"EMS Synth A VS VSTi v0.32" = EMS Synth A VS VSTi v0.32
"EPSON Scanner" = EPSON Scan
"FabFilter Volcano 1.00" = FabFilter Volcano 1.00
"FairUse Wizard 2" = FairUse Wizard 2
"Fallout2" = Fallout2
"FLAC" = FLAC Installer 1.1.2a (remove only)
"FXPad" = FXPad
"GFORCE_SOFTWARE_MINIMONSTA_RTAS_VSTi_v1.06-PLZ" = GFORCE_SOFTWARE_MINIMONSTA_RTAS_VSTi_v1.06-PLZ
"Glitch One MB VSTi V1.0b_is1" = Glitch One MB VSTi Version 1.0b
"GMedia Music impOSCar VSTi v1.0.0.1" = GMedia Music impOSCar VSTi v1.0.0.1
"GRM Tools Classic VST v1.6.52" = GRM Tools Classic VST v1.6.52
"GRM Tools Spectral Transform VST v1.6.52" = GRM Tools Spectral Transform VST v1.6.52
"GSpot" = GSpot Codec Information Appliance
"Half-Life" = Half-Life
"Har-Bal v2.0" = Har-Bal v2.0
"HFSExplorer" = HFSExplorer 0.21
"HP Photo & Imaging" = HP Photo & Imaging 3.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"IK Multimedia AmpliTube v1.3.1" = IK Multimedia AmpliTube v1.3.1
"ImgBurn" = ImgBurn
"Indeo® Software" = Indeo® Software
"InstallShield_{3EC91FDF-FE9A-43D5-96C4-8A9C24372500}" = Maxtor OneTouch
"InstallShield_{9705A7E1-3DD1-4BAC-8CA9-FE7B1473BEC9}" = iTunes
"InstallShield_{9A97D672-6C93-4DFA-B527-DE005A761495}" = Video Stream Driver for Panasonic DVC
"InstallShield_{DB10AF3B-E30E-49F9-84AC-26785D689E13}" = MainConcept MPEG Encoder
"IomegaWare" = IomegaWare 4.0.2
"IsoBuster_is1" = IsoBuster 2.0
"JDownloader" = JDownloader
"KONICA MINOLTA PagePro 1400W" = KONICA MINOLTA PagePro 1400W
"Lexicon PSP42 1.4" = Lexicon PSP42 1.4
"LightWave 3D 9.2" = LightWave 3D 9.2
"Live 4.1.4" = Live 4.1.4
"Magic Bullet Editors Premiere" = Magic Bullet Editors Premiere
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Midi Quest XL_is1" = Midi Quest XL 10.0.5
"MidiSportUno" = USB Midisport Uno 1.0.1.0
"mkwACT" = mkw Audio Compression Toolkit
"mmswitch" = Morgan Stream Switcher
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MusicLab-SliceDrummer v2.0 OxYGeN" = MusicLab-SliceDrummer v2.0 OxYGeN
"MXOFX" = USB Storage Adapter FX (MXO)
"Native Instruments Absynth v3.0" = Native Instruments Absynth v3.0
"Native Instruments B4 v2.0.0.7" = Native Instruments B4 v2.0.0.7
"Native Instruments Guitar Rig v1.2" = Native Instruments Guitar Rig v1.2
"Native Instruments Reaktor 4.0" = Native Instruments Reaktor 4.0
"Native Instruments Vokator v1.0" = Native Instruments Vokator v1.0
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Driver" = NVIDIA Display Driver
"oggcodecs" = oggcodecs 0.71.0946
"PocketDVDStudio_Palm" = Pocket-DVD Studio for Palm (remove only)
"QuickTime" = QuickTime
"RadLight APE DirectShow filter" = RadLight APE DirectShow filter (remove only)
"REAPER" = REAPER
"ReBirth ModPacker" = ReBirth ModPacker
"ReBirth RB-338 2.0" = ReBirth RB-338 2.0
"ReFX JunoX2 VSTi v1.51" = ReFX JunoX2 VSTi v1.51
"RESIDENT EVIL" = RESIDENT EVIL
"rgcAudio z3ta Plus v1.40" = rgcAudio z3ta Plus v1.40
"RNCompiler 6.0" = Advanced RealMedia Export Plug-in for Premiere 6.0
"SAGEM My Pictures And Sounds" = My Pictures And Sounds 7.06
"SAWStudio_is1" = SAWStudio v4.0c
"Scarbee Vintage Keyboard FX v1.0.2.3" = Scarbee Vintage Keyboard FX v1.0.2.3
"Sierra Utilities" = Sierra Utilities
"Silent Hill1.2.1" = Silent Hill
"SoftSound Shorten for Windows 2.3b" = SoftSound Shorten for Windows 2.3b
"SONAR6Producer_is1" = SONAR 6.2 Producer Edition
"Space Effect_is1" = Space Effect 2.0
"Steinberg HALion v2.0.3.5" = Steinberg HALion v2.0.3.5
"SubtitleWorkshop" = Subtitle Workshop 2.51
"SurCode DVD Pro DTS Encoder" = SurCode DVD Pro DTS Encoder
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TCEssentials" = TC Native Essentials 2.02
"The Typing of the Dead" = The Typing of the Dead
"Trivial Pursuit® Handheld Edition for Palm OS" = Trivial Pursuit® Handheld Edition for Palm OS
"UA-100 Controller" = UA-100 Controller
"Vanguard Demo_is1" = Vanguard Demo 1.2
"Video Cleaner Pro" = River Past Video Cleaner Pro
"Video Perspective" = River Past Video Perspective
"VisualSubSync" = VisualSubSync (remove only)
"VLC media player" = VLC media player 1.1.7
"VobSub" = VobSub v2.23 (Remove Only)
"Warfare Incorporated™ for Palm OS" = Warfare Incorporated™ for Palm OS
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Winamp" = Winamp (remove only)
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WordSmith" = WordSmith 2.2.24
"XviD_is1" = XviD MPEG-4 Video Codec

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2700728924-2894260721-178917511-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 27/04/2011 20:01:42 | Computer Name = PC180273018230 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 27/04/2011 20:11:04 | Computer Name = PC180273018230 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 03/05/2011 10:30:56 | Computer Name = PC180273018230 | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 03/05/2011 10:44:12 | Computer Name = PC180273018230 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 03/05/2011 10:44:12 | Computer Name = PC180273018230 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 04/05/2011 08:35:16 | Computer Name = PC180273018230 | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 04/05/2011 08:58:36 | Computer Name = PC180273018230 | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 04/05/2011 09:35:01 | Computer Name = PC180273018230 | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 05/05/2011 09:47:30 | Computer Name = PC180273018230 | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

Error - 05/05/2011 09:57:23 | Computer Name = PC180273018230 | Source = PerfNet | ID = 2004
Description = Unable to open the Server service. Server performance data will not
be returned. Error code returned is in data DWORD 0.

[ System Events ]
Error - 25/04/2011 20:04:38 | Computer Name = PC180273018230 | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 27/04/2011 08:40:53 | Computer Name = PC180273018230 | Source = Service Control Manager | ID = 7022
Description = The Automatic Updates service hung on starting.

Error - 27/04/2011 09:17:58 | Computer Name = PC180273018230 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 27/04/2011 09:18:10 | Computer Name = PC180273018230 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 27/04/2011 16:01:40 | Computer Name = PC180273018230 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 27/04/2011 19:40:26 | Computer Name = PC180273018230 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
IntelIde ViaIde

Error - 03/05/2011 10:33:06 | Computer Name = PC180273018230 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 03/05/2011 10:56:05 | Computer Name = PC180273018230 | Source = Service Control Manager | ID = 7034
Description = The AMService service terminated unexpectedly. It has done this 1
time(s).

Error - 04/05/2011 08:45:01 | Computer Name = PC180273018230 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Spooler service.

Error - 05/05/2011 08:45:09 | Computer Name = PC180273018230 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

< End of report >

#6 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 05 May 2011 - 02:45 PM

Hi!

Can you just confirm that you're able to successfully boot up your computer without using the PCLinux OS Live CD disc?

Also TDSSKiller was recently updated, which is why it was able to find a threat.

The main infection that you were infected with is called TDL4.

See the snippet of text below:

Quote

2011/05/05 14:53:35.0296 3648 Detected object count: 1
2011/05/05 14:54:13.0421 3648 \HardDisk1 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/05/05 14:54:13.0421 3648 \HardDisk1 - ok
2011/05/05 14:54:13.0421 3648 Rootkit.Win32.TDSS.tdl4(\HardDisk1) - User select action: Cure
2011/05/05 14:54:22.0828 3300 Deinitialize success

You can read more about this infection here:

Special thanks to quietman7 for providing the above links.

NEXT:

Did you set these in Firefox?

FF - prefs.js..network.proxy.http: "95.48.212.219"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.type: 0

Do you recognize these files?

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ekin.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\edire.exe

NEXT:

GooredFix
Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1

Ensure all Firefox windows are closed.
To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
When prompted to run the scan, click Yes.
GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

NEXT:

OTL Fix

We need to run an OTL Fix

Please reopen on your desktop.

Copy and Paste the following code into the Posted Image

textbox.

:Services
:OTL
PRC - [2011/04/28 01:11:07 | 000,037,888 | ---- | M] (Htyqfvuhm Software) -- C:\WINDOWS\Temp\hmvr\setup.exe
SRV - [2011/04/28 01:11:07 | 000,037,888 | ---- | M] (Htyqfvuhm Software) [Auto | Start_Pending] -- C:\WINDOWS\TEMP\hmvr\setup.exe -- (AMService)
O4 - HKLM..\Run: [EPSON Stylus Photo RX420 Series] File not found
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O33 - MountPoints2\{4d47159e-de11-11df-9e41-00904b9a7215}\Shell\AutoRun\command - "" = I:\Get_Started_for_Win.exe
O33 - MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\Shell - "" = AutoRun
O33 - MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\Shell\AutoRun\command - "" = I:\setup.exe -a
[2011/04/27 12:15:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Barnabas Netherwood\Application Data\Viduyz
[2011/04/24 12:49:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\{7F618381-41CA-4DB2-A13F-5FB107D3394D}
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\*.tmp files -> C:\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2011/04/27 10:54:57 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Glarogumamu.bin
[2011/04/21 19:18:05 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Ozemohugewuxi.dat
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\*.tmp files -> C:\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2011/04/21 19:18:05 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Ozemohugewuxi.dat
[2011/04/21 19:18:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Glarogumamu.bin

:Reg

:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[CreateRestorePoint]
[emptytemp]
[EMPTYFLASH]

Push
OTL may ask to reboot the machine. Please do so if asked.
Click the OK button.
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

#7 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 06 May 2011 - 01:49 PM

I have found that I can boot normally as long as the ethernet cable is not attached. Otherwise it freezes before loading is complete. I have been using the PCLinuxOS Live CD for reliable internet access (and to avoid making the problem worse) and to download the recommended tools.

I don't recall having set any proxies recently, certainly not a Polish proxy. I have absolutely no idea what those two .exe files are either.

GooredFix and OTL worked just fine and their logs are posted below. I am still waiting for ComboFix to do its thing. It installed the Windows Recovery Console but has since been stuck on this screen for well over half an hour now:

http://www.bleepstatic.com/combofix/en/autoscan.jpg

I will leave it alone though. Hopefully I will see some of the other lines regarding the clock and suchlike in time.

GooredFix log:

GooredFix by jpshortstuff (04.04.11.1)
Log created at 17:42 on 06/05/2011 (Barnabas Netherwood)
Firefox version 3.6.16 (en-US)

========== GooredScan ==========

Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{7F618381-41CA-4DB2-A13F-5FB107D3394D} -> Success!
Deleting C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\{7F618381-41CA-4DB2-A13F-5FB107D3394D} -> Success!

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [19:17 10/01/2010]
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [10:17 01/11/2010]
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [18:12 26/01/2011]

C:\Documents and Settings\Barnabas Netherwood\Application Data\Mozilla\Firefox\Profiles\q0cahxoy.default\extensions\
{dd3d7613-0246-469d-bc65-2a3cc1668adc} [15:31 23/10/2010]
{DDC359D1-844A-42a7-9AA1-88A850A938A8} [18:14 12/03/2011]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [10:13 01/11/2010]

---------- Old Logs ----------
GooredFix[16.08.52_23-10-2010].txt

-=E.O.F=-

OTL log:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
No active process named setup.exe was found!
Service AMService stopped successfully!
Service AMService deleted successfully!
C:\WINDOWS\Temp\hmvr\setup.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EPSON Stylus Photo RX420 Series deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4d47159e-de11-11df-9e41-00904b9a7215}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4d47159e-de11-11df-9e41-00904b9a7215}\ not found.
File I:\Get_Started_for_Win.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efccef3e-d338-11df-9e29-00904b9a7215}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efccef3e-d338-11df-9e29-00904b9a7215}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{efccef3e-d338-11df-9e29-00904b9a7215}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{efccef3e-d338-11df-9e29-00904b9a7215}\ not found.
File I:\setup.exe -a not found.
C:\Documents and Settings\Barnabas Netherwood\Application Data\Viduyz folder moved successfully.
Folder C:\Documents and Settings\Barnabas Netherwood\Local Settings\Application Data\{7F618381-41CA-4DB2-A13F-5FB107D3394D}\ not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET86.tmp deleted successfully.
C:\WINDOWS\System32\SET8A.tmp deleted successfully.
C:\WINDOWS\System32\SET8B.tmp deleted successfully.
C:\WINDOWS\System32\SET92.tmp deleted successfully.
C:\WINDOWS\System32\SETCF.tmp deleted successfully.
C:\2A.tmp deleted successfully.
C:\2C.tmp deleted successfully.
C:\86.tmp deleted successfully.
C:\9.tmp deleted successfully.
C:\WINDOWS\002135_.tmp deleted successfully.
C:\WINDOWS\005038_.tmp deleted successfully.
C:\WINDOWS\DUMP1da6.tmp deleted successfully.
C:\WINDOWS\Glarogumamu.bin moved successfully.
C:\WINDOWS\Ozemohugewuxi.dat moved successfully.
File C:\WINDOWS\Ozemohugewuxi.dat not found.
File C:\WINDOWS\Glarogumamu.bin not found.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools\cmd.bat deleted successfully.
C:\Documents and Settings\Barnabas Netherwood\Desktop\fix tools\cmd.txt deleted successfully.
========== COMMANDS ==========
HOSTS file reset successfully
Restore point Set: OTL Restore Point (0)

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: All Users

User: Barnabas Netherwood
->Temp folder emptied: 21396503 bytes
->Temporary Internet Files folder emptied: 138076237 bytes
->Java cache emptied: 557290 bytes
->FireFox cache emptied: 59311913 bytes
->Google Chrome cache emptied: 120278769 bytes
->Flash cache emptied: 126167 bytes

User: Barnabas Netherwood.PC180273018230
->Temp folder emptied: 86231 bytes
->Temporary Internet Files folder emptied: 241150 bytes

User: Default User
->Temp folder emptied: 71212793 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 10994067 bytes
->FireFox cache emptied: 34947273 bytes
->Flash cache emptied: 901 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 8608799 bytes
->Java cache emptied: 9663 bytes
->Flash cache emptied: 259 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 69029378 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 327966 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 511.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Barnabas Netherwood
->Flash cache emptied: 0 bytes

User: Barnabas Netherwood.PC180273018230

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05062011_174952

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!

Registry entries deleted on Reboot...

#8 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 06 May 2011 - 01:56 PM

Okay. Lets see what the ComboFix scan finds.

#9 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 06 May 2011 - 03:44 PM

It has been over two and a half hours now and the screen is still showing the same thing. The cursor is blinking on the blue console window and the hard drive activity light appears to be permanently on. Has ComboFix frozen? I shall leave it well alone in any case.

#10 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 06 May 2011 - 06:03 PM

Hi!

Seems like ComboFix may be held up on something.

Combofix should never take more that 1 hour to complete.

If Combofix has been running for more than this time and the system appears to have hung then

open task-manager - press ctrl alt and del at the same time then select Task Manager

end any processes for:

pev.exe
nircmd.exe
swreg.exe
cfxxe.exe

If ComboFix still will not run, then proceed with running a scan in Safe mode.

Entering Safe Mode

Restart your computer.
As the computer starts to boot-up, Tap the F8 KEY repeatedly,
This will bring up a menu.
Use the Up and Down Arrow Keys to scroll to Safe Mode
Then press the Enter Key on your Keyboard
Go into your usual account

#11 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 06 May 2011 - 06:43 PM

Over five and a half hours now without change. Unfortunately Control-Alt-Delete doesn't seem to be having any effect. Should I force close by holding down the power button or would that be bad?

EDIT:

Although the pointer icon moved I found I couldn't interact with anything on the desktop or taskbar. I pressed Ctl-Alt-Del a few more times and now the system appears to have locked up completely. The pointer doesn't want to move any more.

The system clock is still frozen at 19:07 GMT (a few minutes after I started the process.)

This post has been edited by Norbert W: 06 May 2011 - 06:51 PM

#12 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 07 May 2011 - 08:22 AM

Hello!

Please go ahead and perform a hard restart (pushing power button in).

When your computer reboots, please go ahead and try to run ComboFix in Safe mode, and see if you have better results there.

#13 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 08 May 2011 - 10:41 AM

I have tried to run ComboFix twice now in normal mode and twice in safe mode and each time it hangs on the same screen. The only diference is that in normal mode the "_" cursor kept flashing, while in safe mode after a time it stopped flashing and just remained on.

Is there something (software or a process perhaps) running on my system that is causing a conflict with ComboFix? Perhaps the file is corrupt. I shall redownload it and try it again.

#14 SweetTech

Agent ST

Group: Malware Response Team
Posts: 12,662
Joined: 15-March 09
Gender:Male
Location:Antarctica

Posted 08 May 2011 - 10:43 AM

You've ensured that all of your Security Programs are disabled before running it correct?

Please try running this scan if downloading and running a new copy of ComboFix does not work:

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

Open Malwarebytes' Anti-Malware
Select the Update tab
Click Check for Updates
After the update have been completed, Select the Scanner tab.
Select Perform quick scan, then click on Scan
Leave the default options as it is and click on Start Scan
When done, you will be prompted. Click OK, then click on Show Results
Checked (ticked) all items and click on Remove Selected
After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT:

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
Check
Click the button.
Accept any security warnings from your browser.
Check
Make sure that the option "Remove found threats" is Unchecked
When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
- Enable Anti-Stealth technology
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push , and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the button.
Push

This post has been edited by SweetTech: 08 May 2011 - 11:27 AM

#15 Norbert W

Member

Group: Members
Posts: 23
Joined: 27-April 11

Posted 08 May 2011 - 02:23 PM

Redownloaded ComboFix, same result. I was looking through this thread:

http://www.bleepingcomputer.com/forums/topic114351.html

and it occurred to me that I had no idea whether or not the Windows Firewall was enabled. I typed firewall.cpl at the Run command and immediately an error message popped up stating:

Due to an unidentified problem, Windows cannot display Windows Firewall settings.

I have no idea if this has any bearing on the issue.

Here is the Anti-Malware log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4951

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

08/05/2011 20:26:51
mbam-log-2011-05-08 (20-26-51).txt

Scan type: Quick scan
Objects scanned: 156101
Time elapsed: 12 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)