BleepingComputer.com: HiJackThis Log

Lately my computer has been on the fritz.. For example, my CPU would be at 100% after closing a program or a game and would not go down. Now for the real fun, I believe I have a hijacker virus called Tazinga which keeps forwarding to different sites and/or opens up new tabs when I'm using firefox. Normally I'm the type of person who likes to do this sort of thing myself, but I just can't seem to do it. I'm no IT specialist, but I am very computer smart and have common sense so it's not gonna be hard to help with the right instructions. Please take a look at m log and see what you can tell me. Please and Thanks.
Best Regards,
Reo

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:23:30 PM, on 5/5/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Tunngle\TnglCtrl.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E80015D7-784D-456B-A6A0-88171DDE9570}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Advanced SystemCare Service (AdvancedSystemCareService) - IObit - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files\Tunngle\TnglCtrl.exe

--
End of file - 5409 bytes

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Dalton at 17:01:52.79 on Thu 05/05/2011
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1526.696 [GMT -4:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Tunngle\TnglCtrl.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\igfxtray.exe
svchost.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Dalton\Desktop\gmer.exe
C:\Documents and Settings\Dalton\My Documents\Downloads\dds.scr
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [EEventManager] "c:\program files\epson software\event manager\EEventManager.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
uPolicies-explorer: NoInstrumentation = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
TCP: {E80015D7-784D-456B-A6A0-88171DDE9570} = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\dalton\applic~1\mozilla\firefox\profiles\utyvs4n6.default\
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-1-19 32464]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-2-10 296400]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\iobit\advanced systemcare 4\ASCService.exe [2011-4-23 352656]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-2-15 7421280]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 TunngleService;TunngleService;c:\program files\tunngle\TnglCtrl.exe [2011-5-1 718072]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-3-30 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 27216]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [2011-5-1 27136]
S3 apf001;apf001;\??\c:\game\softnyxgame\rakionis\bin\apf001.sys --> c:\game\softnyxgame\rakionis\bin\apf001.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
=============== Created Last 30 ================
.
2011-05-05 19:52:17 -------- d-----w- c:\docume~1\dalton\applic~1\GetRightToGo
2011-05-05 19:36:00 388096 ----a-r- c:\docume~1\dalton\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-05-05 19:35:59 -------- d-----w- c:\program files\Trend Micro
2011-05-05 01:43:39 5325 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2011-05-05 01:14:44 218624 ----a-w- c:\windows\system32\uxtheme.dll.backup
2011-05-05 01:06:51 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-05-05 01:05:59 19528 -c--a-w- c:\windows\system32\dllcache\w840nd.sys
2011-05-05 01:04:57 224802 -c--a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-05-05 01:03:57 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-05-05 01:02:57 4992 -c--a-w- c:\windows\system32\dllcache\toside.sys
2011-05-05 01:01:54 32640 -c--a-w- c:\windows\system32\dllcache\symc8xx.sys
2011-05-05 01:00:58 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-05-05 00:59:57 58368 -c--a-w- c:\windows\system32\dllcache\smiminib.sys
2011-05-05 00:58:59 157696 -c--a-w- c:\windows\system32\dllcache\sisv256.dll
2011-05-05 00:57:58 17664 -c--a-w- c:\windows\system32\dllcache\sermouse.sys
2011-05-05 00:56:59 179264 -c--a-w- c:\windows\system32\dllcache\s3sav3d.dll
2011-05-05 00:55:57 37563 -c--a-w- c:\windows\system32\dllcache\rlnet5.sys
2011-05-05 00:54:58 130942 -c--a-w- c:\windows\system32\dllcache\ptserlv.sys
2011-05-05 00:53:57 16384 -c--a-w- c:\windows\system32\dllcache\philcam1.dll
2011-05-05 00:52:58 116736 -c--a-w- c:\windows\system32\dllcache\ovcodec2.dll
2011-05-05 00:51:53 51552 -c--a-w- c:\windows\system32\dllcache\ntgrip.sys
2011-05-05 00:50:57 33088 -c--a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-05-05 00:49:53 2944 -c--a-w- c:\windows\system32\dllcache\msmpu401.sys
2011-05-05 00:48:59 164586 -c--a-w- c:\windows\system32\dllcache\mdgndis5.sys
2011-05-05 00:47:59 26442 -c--a-w- c:\windows\system32\dllcache\lanepic5.sys
2011-05-05 00:46:47 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
2011-05-05 00:45:56 1041536 -c--a-w- c:\windows\system32\dllcache\hsfdpsp2.sys
2011-05-05 00:44:59 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-05-05 00:43:59 454912 -c--a-w- c:\windows\system32\dllcache\fxusbase.sys
2011-05-05 00:42:53 43008 -c--a-w- c:\windows\system32\dllcache\esucm.dll
2011-05-05 00:41:59 24653 -c--a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-05-05 00:40:59 90525 -c--a-w- c:\windows\system32\dllcache\digifep5.sys
2011-05-05 00:39:59 42112 -c--a-w- c:\windows\system32\dllcache\crtaud.sys
2011-05-05 00:38:35 13824 -c--a-w- c:\windows\system32\dllcache\bulltlp3.sys
2011-05-05 00:37:56 36128 -c--a-w- c:\windows\system32\dllcache\banshee.sys
2011-05-05 00:36:50 6272 -c--a-w- c:\windows\system32\dllcache\apmbatt.sys
2011-05-05 00:35:34 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2011-05-04 23:45:52 -------- d-----w- c:\windows\pss
2011-05-04 18:16:44 -------- d-----w- c:\docume~1\dalton\applic~1\Malwarebytes
2011-05-04 18:16:36 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-04 18:16:35 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-04 18:16:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-04 18:16:35 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2011-05-03 23:55:47 -------- d-----w- c:\program files\TalismanOnline
2011-05-02 19:15:24 -------- d-----w- c:\program files\2K Games
2011-05-02 18:46:54 -------- d-----w- c:\program files\Microsoft Games
2011-05-01 18:18:24 249856 ------w- c:\windows\Setup1.exe
2011-05-01 18:18:22 73216 ----a-w- c:\windows\ST6UNST.EXE
2011-05-01 17:37:36 -------- d-----w- c:\program files\Ventrilo
2011-05-01 17:37:06 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2011-05-01 16:24:36 -------- d-----w- c:\docume~1\dalton\applic~1\Tunngle
2011-05-01 16:24:36 -------- d-----w- c:\docume~1\alluse~1\applic~1\Tunngle
2011-05-01 16:24:20 27136 ----a-w- c:\windows\system32\drivers\tap0901t.sys
2011-05-01 16:24:08 -------- d-----w- c:\program files\Tunngle
2011-05-01 15:29:35 -------- d-----w- c:\documents and settings\dalton\EurekaLog
2011-05-01 15:20:42 -------- d-----w- c:\docume~1\alluse~1\applic~1\Innovative Solutions
2011-05-01 15:18:37 -------- d-----w- c:\docume~1\dalton\locals~1\applic~1\Innovative Solutions
2011-05-01 15:18:05 -------- d-----w- c:\program files\Innovative Solutions
2011-05-01 06:39:39 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2011-05-01 06:39:39 17212 ----a-w- c:\windows\system32\SIntf32.dll
2011-05-01 06:39:39 12067 ----a-w- c:\windows\system32\SIntf16.dll
2011-05-01 06:34:08 94208 ----a-w- c:\windows\DIIUnin.exe
2011-05-01 06:34:08 2829 ----a-w- c:\windows\DIIUnin.pif
2011-05-01 06:30:58 -------- d-----w- c:\program files\Diablo II
2011-05-01 03:58:12 -------- d-----w- c:\docume~1\dalton\applic~1\BitTorrent
2011-05-01 03:40:18 -------- d-----w- c:\program files\DAEMON Tools Pro
2011-05-01 03:35:03 685816 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-05-01 03:24:31 -------- d-----w- c:\docume~1\dalton\applic~1\DAEMON Tools Pro
2011-05-01 03:24:31 -------- d-----w- c:\docume~1\alluse~1\applic~1\DAEMON Tools Pro
2011-04-29 23:45:56 -------- d-----w- c:\docume~1\dalton\locals~1\applic~1\Temp
2011-04-26 19:35:43 819200 ----a-w- c:\program files\windows media player\wmsetsdk.exe
2011-04-26 19:35:43 47616 ----a-w- c:\program files\windows media player\msoobci.dll
2011-04-26 19:35:05 -------- d-----w- c:\windows\RegisteredPackages
2011-04-25 14:35:07 12920 ----a-w- c:\windows\system32\apl001.sys
2011-04-25 14:35:06 10872 ----a-w- c:\windows\system32\apf001.sys
2011-04-25 14:00:59 -------- d-----w- C:\Game
2011-04-25 02:30:33 106557 ----a-w- c:\windows\system32\btw_ci.dll
2011-04-25 02:15:58 -------- d-----w- C:\hp
2011-04-25 02:03:58 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2011-04-25 02:03:58 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2011-04-24 20:50:57 -------- d-----w- c:\program files\KellySoftware
2011-04-24 16:18:00 -------- d-----w- c:\windows\system32\XPSViewer
2011-04-24 16:17:33 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-04-24 16:17:13 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-04-24 16:17:13 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-04-24 16:17:13 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-04-24 16:17:13 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-04-24 16:17:13 575488 ------w- c:\windows\system32\xpsshhdr.dll
2011-04-24 16:17:13 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2011-04-24 16:17:13 1676288 ------w- c:\windows\system32\xpssvcs.dll
2011-04-24 16:17:13 117760 ------w- c:\windows\system32\prntvpt.dll
2011-04-24 16:17:13 -------- d-----w- C:\98aae53050121b440c
2011-04-24 16:07:46 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2011-04-24 16:07:46 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-04-24 16:07:46 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-04-24 16:07:46 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-04-24 16:07:46 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2011-04-24 16:07:46 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-04-24 16:07:46 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2011-04-24 16:07:46 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2011-04-24 16:03:24 -------- d-----w- c:\windows\network diagnostic
2011-04-24 15:43:31 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-24 15:43:30 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-04-24 15:43:30 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-04-24 15:43:30 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-04-24 15:43:30 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-04-24 15:43:30 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-04-24 15:43:30 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-04-24 15:43:30 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-04-24 15:04:39 -------- d-----w- c:\windows\ServicePackFiles
2011-04-24 13:43:37 -------- d-----w- c:\windows\system32\CatRoot_bak
2011-04-24 13:28:41 2137088 -c--a-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2011-04-24 13:28:39 2016768 -c--a-w- c:\windows\system32\dllcache\ntkrpamp.exe
2011-04-24 13:20:38 272128 -c--a-w- c:\windows\system32\dllcache\bthport.sys
2011-04-24 13:20:38 272128 ------w- c:\windows\system32\drivers\bthport.sys
2011-04-24 13:09:25 -------- d-----w- c:\windows\system32\PreInstall
2011-04-24 13:09:22 -------- d--h--w- c:\windows\$hf_mig$
2011-04-24 02:21:06 -------- d-----w- c:\windows\system32\SoftwareDistribution
2011-04-24 01:30:57 -------- d-----w- c:\docume~1\dalton\applic~1\TS3Client
2011-04-23 23:25:03 -------- d-----w- c:\program files\TeamSpeak 3 Client
2011-04-23 23:06:48 -------- d-----w- c:\docume~1\alluse~1\applic~1\IObit
2011-04-23 23:06:09 -------- d-----w- c:\docume~1\dalton\applic~1\IObit
2011-04-23 23:06:07 -------- d-----w- c:\program files\IObit
2011-04-23 20:53:17 -------- d-----w- c:\docume~1\dalton\applic~1\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2011-04-23 20:53:17 -------- d-----w- c:\docume~1\dalton\applic~1\app
2011-04-23 20:53:10 -------- d-----w- c:\docume~1\dalton\applic~1\Dofus-3.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2011-04-23 15:51:10 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2011-04-23 15:51:10 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2011-04-23 15:50:36 9600 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2011-04-23 15:50:36 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2011-04-23 15:45:38 -------- d-----w- c:\docume~1\dalton\applic~1\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2011-04-23 15:43:55 -------- d-----w- c:\docume~1\dalton\applic~1\Dofus 2
2011-04-23 15:43:54 -------- d-----w- c:\docume~1\dalton\applic~1\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
2011-04-23 13:02:48 -------- d-----w- c:\program files\Dofus 2
2011-04-23 13:02:40 -------- d-----w- c:\docume~1\dalton\locals~1\applic~1\Adobe
2011-04-23 12:46:25 4225592 ----a-w- c:\windows\system32\GameMon.des
2011-04-23 12:45:36 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-04-23 12:45:36 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-04-23 12:44:36 -------- d-----w- c:\program files\common files\INCA Shared
2011-04-23 06:37:08 -------- d-----w- c:\program files\Flyff
2011-04-23 06:36:02 -------- d-----w- c:\program files\Pando Networks
2011-04-23 04:49:25 77824 ----a-w- c:\windows\system32\EBAPI.dll
2011-04-23 04:49:25 65536 ----a-w- c:\windows\system32\EEBUtil.dll
2011-04-23 04:49:25 55808 ----a-w- c:\windows\system32\EEBSDKIF.dll
2011-04-23 04:49:25 135168 ----a-w- c:\windows\system32\EEBAPI.dll
2011-04-23 04:49:25 110592 ----a-w- c:\windows\system32\EEBDSCVR.dll
2011-04-23 04:47:33 342016 ----a-w- c:\windows\system32\eswiaud.dll
2011-04-23 04:47:33 15872 ----a-w- c:\windows\system32\escdev.dll
2011-04-23 04:47:33 128392 ----a-w- c:\windows\system32\esdevapp.exe
2011-04-23 04:47:26 -------- d-----w- c:\program files\epson
2011-04-23 04:16:48 -------- d-----w- c:\program files\Realtek
2011-04-23 04:16:45 1284712 ----a-w- c:\windows\RtlExUpd.dll
2011-04-23 03:46:25 -------- d-----w- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
2011-04-23 03:26:01 757760 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iKernel.dll
2011-04-23 03:26:01 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\ctor.dll
2011-04-23 03:26:01 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\DotNetInstaller.exe
2011-04-23 03:26:01 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iscript.dll
2011-04-23 03:26:01 204800 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iuser.dll
2011-04-23 03:26:00 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iGdi.dll
2011-04-23 03:25:59 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\setup.dll
2011-04-23 03:16:16 -------- d-----w- c:\windows\system32\LogFiles
2011-04-23 02:53:16 -------- d--h--w- c:\windows\PIF
2011-04-23 02:49:00 26488 ----a-w- c:\windows\system32\spupdsvc.exe
2011-04-23 02:48:39 696320 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2011-04-23 02:48:39 57344 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2011-04-23 02:48:39 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2011-04-23 02:48:39 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll
2011-04-23 02:48:39 237568 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2011-04-23 02:48:39 155648 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2011-04-23 02:48:38 282756 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2011-04-23 02:48:38 163972 ----a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2011-04-23 00:54:00 172032 ----a-w- c:\windows\system32\igfxres.dll
2011-04-23 00:37:30 -------- d-----w- c:\docume~1\dalton\applic~1\AVG10
2011-04-23 00:34:52 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Common Files
2011-04-23 00:34:05 -------- d-----w- c:\windows\system32\drivers\AVG
2011-04-23 00:34:05 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVG10
2011-04-23 00:33:45 57344 ----a-w- c:\windows\system32\igxprd32.dll
2011-04-23 00:33:44 5854752 ----a-w- c:\windows\system32\drivers\igxpmp32.sys
2011-04-23 00:33:44 294912 ----a-w- c:\windows\system32\igldev32.dll
2011-04-23 00:33:44 2643968 ----a-w- c:\windows\system32\igxpdx32.dll
2011-04-23 00:33:44 2334720 ----a-w- c:\windows\system32\iglicd32.dll
2011-04-23 00:33:44 1670144 ----a-w- c:\windows\system32\igxpdv32.dll
2011-04-23 00:33:44 151040 ----a-w- c:\windows\system32\igxpgd32.dll
2011-04-23 00:33:44 147456 ----a-w- c:\windows\system32\igfxCoIn_v4926.dll
2011-04-23 00:33:36 -------- d-----w- c:\program files\AVG
2011-04-23 00:24:49 71474 ----a-w- c:\windows\BricoPackUninst.cmd
2011-04-23 00:23:03 -------- d-----w- c:\windows\BricoPacks
2011-04-22 23:54:54 -------- d-----w- c:\docume~1\alluse~1\applic~1\MFAData
2011-04-22 23:42:43 1391104 ----a-w- c:\windows\system32\drivers\BCMWL5.SYS
2011-04-22 23:26:54 534016 ----a-w- c:\windows\system32\drivers\bcmwl6.sys
2011-04-22 23:26:54 -------- d-----w- c:\program files\Broadcom
2011-04-22 23:26:53 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2011-04-22 23:26:53 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2011-04-22 23:26:53 225280 ----a-w- c:\program files\common files\installshield\iscript\iscript.dll
2011-04-22 23:26:53 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2011-04-22 23:26:52 614532 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
.
==================== Find3M ====================
.
2011-05-05 01:14:44 218624 ----a-w- c:\windows\system32\uxtheme.dll
.
============= FINISH: 17:03:56.23 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/22/2011 6:22:24 PM
System Uptime: 5/5/2011 4:20:46 PM (1 hours ago)
.
Motherboard: Hewlett-Packard | | 30C6
Processor: Intel® Celeron® M CPU 440 @ 1.86GHz | U1 | 1861/mhz
.
==== Disk Partitions =========================
.
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Advanced SystemCare 4
AVG 2011
Broadcom 802.11 Wireless LAN Adapter
Conexant HD Audio
Diablo II
Dungeon Siege 2
Dungeon Siege 2 Broken World
Epson Event Manager
EPSON NX420 Series Printer Uninstall
EPSON Scan
EpsonNet Print
EpsonNet Setup 3.3
Game Booster
HDAUDIO Soft Data Fax Modem with SmartCP
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
HP Wireless Assistant
Intel® Graphics Media Accelerator Driver
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox 4.0.1 (x86 en-US)
Pack Vista Inspirat 2 1.0
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981350)
Security Update for Windows XP (KB982381)
Tunngle beta
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB898461)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Ventrilo Client
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows Media Format SDK Hotfix - KB891122
WinRAR 4.00 (32-bit)
.
==== End Of File ===========================

GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-05 17:07:19
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\iaStor0 ST980811 rev.3.BH
Running: gmer.exe; Driver: C:\DOCUME~1\Dalton\LOCALS~1\Temp\uxlcrpow.sys


---- System - GMER 1.0.15 ----

SSDT sptd.sys ZwCreateKey [0xB9EBE0D0]
SSDT sptd.sys ZwEnumerateKey [0xB9EC3FB2]
SSDT sptd.sys ZwEnumerateValueKey [0xB9EC4340]
SSDT sptd.sys ZwOpenKey [0xB9EBE0B0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xA6301738]
SSDT sptd.sys ZwQueryKey [0xB9EC4418]
SSDT sptd.sys ZwQueryValueKey [0xB9EC4298]
SSDT sptd.sys ZwSetValueKey [0xB9EC44AA]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xA63017DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xA6301878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xA6301914]

---- Kernel code sections - GMER 1.0.15 ----

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
.text USBPORT.SYS!DllUnload B877262C 5 Bytes JMP 898011C8
? System32\Drivers\a0eex06e.SYS The system cannot find the path specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Tunngle\TnglCtrl.exe[592] ntdll.dll!DbgBreakPoint 7C90120E 1 Byte [90]
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[908] USER32.dll!SetWindowLongA 77D4DED3 5 Bytes JMP 10698DD9 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[908] USER32.dll!SetWindowLongW 77D4DEF1 5 Bytes JMP 10698D6B C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[908] USER32.dll!GetWindowInfo 77D4F122 5 Bytes JMP 104C7187 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[908] USER32.dll!TrackPopupMenu 77D94F16 5 Bytes JMP 104C7781 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[2760] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 02CF000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2760] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0316000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2760] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0240000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[2760] USER32.dll!GetWindowInfo 77D4F122 1 Byte [E9]
.text C:\Program Files\Mozilla Firefox\firefox.exe[2760] USER32.dll!GetWindowInfo 77D4F122 5 Bytes JMP 10499437 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\WINDOWS\Explorer.EXE[3392] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00CF000A
.text C:\WINDOWS\Explorer.EXE[3392] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D0000A
.text C:\WINDOWS\Explorer.EXE[3392] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C8000C

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A2D11E8

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\usbehci \Device\USBPDO-0 897DE410
Device \Driver\usbuhci \Device\USBPDO-1 898001E8
Device \Driver\usbuhci \Device\USBPDO-2 898001E8
Device \Driver\usbuhci \Device\USBPDO-3 898001E8

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Ftdisk \Device\HarddiskVolume1 8A2D31E8
Device \Driver\Cdrom \Device\CdRom0 897C11E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{E80015D7-784D-456B-A6A0-88171DDE9570} 897C71E8
Device \Driver\iaStor \Device\Ide\iaStor0 8A2D21E8
Device \Driver\atapi \Device\Ide\IdePort0 8A3421E8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A3421E8
Device \Driver\atapi \Device\Ide\IdePort1 8A3421E8
Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 8A2D21E8
Device \Driver\Cdrom \Device\CdRom1 897C11E8
Device \Driver\NetBT \Device\NetBt_Wins_Export 897C71E8
Device \Driver\PCI_NTPNP2492 \Device\0000004b sptd.sys
Device \Driver\NetBT \Device\NetbiosSmb 897C71E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{A8F6CE36-6C39-440C-A98B-4E4307ECB822} 897C71E8

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\usbuhci \Device\USBFDO-0 898001E8
Device \Driver\usbuhci \Device\USBFDO-1 898001E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89743790
Device \Driver\usbuhci \Device\USBFDO-2 898001E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89743790
Device \Driver\usbehci \Device\USBFDO-3 897DE410
Device \Driver\Ftdisk \Device\FtControl 8A2D31E8
Device \Driver\mbr \Device\mbr A47C5CDE
Device \Driver\a0eex06e \Device\Scsi\a0eex06e1Port3Path0Target0Lun0 897BB1E8
Device \Driver\a0eex06e \Device\Scsi\a0eex06e1 897BB1E8
Device \FileSystem\Cdfs \Cdfs 892025E0

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x18 0xB3 0x9D ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xF4 0xBE 0x3E 0x57 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x9C 0x61 0xC8 0xA1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x18 0xB3 0x9D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xF4 0xBE 0x3E 0x57 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x9C 0x61 0xC8 0xA1 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0x18 0xB3 0x9D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xF4 0xBE 0x3E 0x57 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x9C 0x61 0xC8 0xA1 ...

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Dalton\Local Settings\Temp\57.tmp\Created00 22182 bytes
File C:\Documents and Settings\Dalton\Local Settings\Temp\57.tmp\f3m0.dat 1228 bytes
File C:\Documents and Settings\Dalton\Local Settings\Temp\57.tmp\WhiteDir 22558 bytes
File C:\Documents and Settings\Dalton\Local Settings\Temp\57.tmp\whitedirB 184 bytes

---- EOF - GMER 1.0.15 ----

EDIT: Posts merged ~Budapest

This post has been edited by Budapest: 05 May 2011 - 04:49 PM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
  
• Please do not PM me directly for help. If you have any questions, post them in this topic.
  
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________


One or more of the identified infections is a backdoor trojan and password stealer.



I highly suggest you take a look at the two links provided below:
1. How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
2. When should I re-format? How should I reinstall?


We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.



NEXT:



Running TDSSKiller

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  
  
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  
  
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  
  
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  
  
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

NEXT:



Running OTL

We need to create an OTL Report

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
  
  
• Save it to your desktop.
  
• Double click on the icon on your desktop.
  
• Click the "Scan All Users" checkbox.
  
• Push the button.
  
• Two reports will open, copy and paste them in a reply here:
  • OTL.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

This post has been edited by SweetTech: 11 May 2011 - 02:55 PM

Please close this thread sir :D I don't know what it was that fixed it, but my computer is back to it's original state. No more redirects or anything of the sort. Thank you very much! This will be my main site for problems in the future.
Best Regards,
Reo

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.