Searchqu taking over Google searches

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

3 Pages
1
2
3
→

You cannot start a new topic
This topic is locked

Searchqu taking over Google searches I can't remove it!

#1 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 14 June 2011 - 07:34 AM

Hi,

This is a similar post to a topic closed recently as I was away, sorry. I didn't respond in time, but my searchqu issues remain.

I have included the logs as previously requested:

- DDS Scan
- RK Unhooker about half way down this page.
- Attach (attached below).

- DDS Scan below:

.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_25
Run by Sean at 0:19:48 on 2011-06-15
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.64.1033.18.2975.2002 [GMT 12:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: COMODO Defense+ *Enabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
FW: COMODO Firewall *Enabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
.
============== Running Processes ===============
.
G:\Windows\system32\wininit.exe
G:\Windows\system32\lsm.exe
G:\Windows\system32\svchost.exe -k DcomLaunch
G:\Windows\system32\svchost.exe -k RPCSS
G:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
G:\Windows\system32\svchost.exe -k NetworkService
G:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
G:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
G:\Windows\system32\svchost.exe -k netsvcs
G:\Windows\system32\svchost.exe -k LocalService
G:\Windows\System32\spoolsv.exe
G:\Program Files\Avira\AntiVir Desktop\sched.exe
G:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
G:\Program Files\Avira\AntiVir Desktop\avguard.exe
G:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
G:\Program Files\Avira\AntiVir Desktop\avshadow.exe
G:\Windows\system32\conhost.exe
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
G:\Windows\system32\svchost.exe -k imgsvc
G:\Windows\system32\taskhost.exe
G:\Windows\system32\Dwm.exe
G:\Windows\Explorer.EXE
G:\Program Files\Avira\AntiVir Desktop\avgnt.exe
G:\Program Files\COMODO\COMODO Internet Security\cfp.exe
G:\Windows\System32\igfxtray.exe
G:\Windows\System32\hkcmd.exe
G:\Windows\System32\igfxpers.exe
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\Program Files\DivX\DivX Update\DivXUpdate.exe
G:\Program Files\Common Files\Java\Java Update\jusched.exe
G:\Program Files\Skype\Phone\Skype.exe
G:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
G:\Windows\system32\WUDFHost.exe
G:\Windows\System32\StikyNot.exe
G:\Program Files\Windows Live\Messenger\msnmsgr.exe
G:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
G:\Windows\system32\SearchIndexer.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\Program Files\Windows Media Player\wmpnetwk.exe
G:\Program Files\Skype\Plugin Manager\skypePM.exe
G:\Windows\System32\svchost.exe -k secsvcs
G:\Windows\system32\wuauclt.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Windows\system32\msiexec.exe
G:\Windows\system32\SearchProtocolHost.exe
G:\Windows\system32\SearchFilterHost.exe
G:\Windows\system32\rundll32.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Windows\system32\conhost.exe
G:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
mURLSearchHooks: H - No File
mURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: vShare Plugin: {043c5167-00bb-4324-af7e-62013faedacf} - g:\program files\vshare\vshare_toolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - g:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - g:\program files\conduitengine\ConduitEngine.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - g:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - g:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - g:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - g:\program files\java\jre6\bin\jp2ssv.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - g:\program files\daemon tools toolbar\DTToolbar.dll
TB: vShare Plugin: {043c5167-00bb-4324-af7e-62013faedacf} - g:\program files\vshare\vshare_toolbar.dll
TB: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - g:\program files\conduitengine\ConduitEngine.dll
TB: {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - No File
uRun: [Skype] "g:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] g:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [RESTART_STICKY_NOTES] g:\windows\system32\StikyNot.exe
uRun: [msnmsgr] "g:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "g:\users\sean\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [avgnt] "g:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [COMODO Internet Security] "g:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [IgfxTray] g:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] g:\windows\system32\hkcmd.exe
mRun: [Persistence] g:\windows\system32\igfxpers.exe
mRun: [GrooveMonitor] "g:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "g:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "g:\program files\itunes\iTunesHelper.exe"
mRun: [DivXUpdate] "g:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [Adobe Reader Speed Launcher] "g:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "g:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "g:\program files\common files\java\java update\jusched.exe"
mRunOnce: [removeSearchqudatamngr] cmd.exe /c RD /S /Q "g:\program files\Windows iLivid Toolbar"
mRunOnce: [removeSearchqutoolbar] cmd.exe /c RD /S /Q "g:\program files\windows ilivid toolbar\ToolBar"
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - g:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - g:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - g:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~4\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{1A45AAA2-5DC4-4ED0-938B-EF375253646D} : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42} : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42}\1476E656376716E64656B6C657E646562747 : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42}\3586F62756C4962627162796563775966496 : DhcpNameServer = 202.126.207.10 202.126.207.193
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42}\36166656E65647 : DhcpNameServer = 202.126.206.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - g:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - g:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} -
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: g:\windows\system32\guard32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - g:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - g:\users\sean\appdata\roaming\mozilla\firefox\profiles\kb5pfudh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&q=
FF - component: g:\program files\common files\spigot\wtxpcom\components\WidgiToolbarFF.dll
FF - component: g:\users\sean\appdata\roaming\mozilla\firefox\profiles\kb5pfudh.default\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}\components\RadioWMPCoreGecko19.dll
FF - component: g:\users\sean\appdata\roaming\mozilla\firefox\profiles\kb5pfudh.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
FF - plugin: g:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: g:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: g:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: g:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: g:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll
FF - plugin: g:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: g:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: g:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: g:\users\sean\appdata\local\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: g:\users\sean\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: g:\windows\microsoft.net\framework\v4.0.20506\wpf\NPWPF.dll
.
============= SERVICES / DRIVERS ===============
.
R1 cmdGuard;COMODO Internet Security Sandbox Driver;g:\windows\system32\drivers\cmdGuard.sys [2010-3-23 238960]
R1 cmdHlp;COMODO Internet Security Helper Driver;g:\windows\system32\drivers\cmdhlp.sys [2010-3-3 37592]
R1 vwififlt;Virtual WiFi Filter Driver;g:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;g:\program files\avira\antivir desktop\sched.exe [2010-3-26 136360]
R2 AntiVirService;Avira AntiVir Guard;g:\program files\avira\antivir desktop\avguard.exe [2010-3-26 269480]
R2 avgntflt;avgntflt;g:\windows\system32\drivers\avgntflt.sys [2010-3-26 61960]
R3 RTL8167;Realtek 8167 NT Driver;g:\windows\system32\drivers\Rt86win7.sys [2009-6-11 139776]
R3 SrvHsfHDA;SrvHsfHDA;g:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
R3 SrvHsfV92;SrvHsfV92;g:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
R3 SrvHsfWinac;SrvHsfWinac;g:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
S2 gupdate;Google Update Service (gupdate);g:\program files\google\update\GoogleUpdate.exe [2011-3-18 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;g:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 clr_optimization_v4.0.20506_32;.NET Runtime Optimization Service v4.0.20506_X86;g:\windows\microsoft.net\framework\v4.0.20506\mscorsvw.exe [2009-5-6 104272]
S3 epmntdrv;epmntdrv;g:\windows\system32\epmntdrv.sys [2010-5-23 14216]
S3 EuGdiDrv;EuGdiDrv;g:\windows\system32\EuGdiDrv.sys [2010-5-23 8456]
S3 gupdatem;Google Update Service (gupdatem);g:\program files\google\update\GoogleUpdate.exe [2011-3-18 136176]
S3 SwitchBoard;Adobe SwitchBoard;g:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WatAdminSvc;Windows Activation Technologies Service;g:\windows\system32\wat\WatAdminSvc.exe [2010-4-13 1343400]
S3 WPFFontCache_v0400;WPFFontCache_v0400;g:\windows\microsoft.net\framework\v4.0.30128\wpf\wpffontcache_v0400.exe --> g:\windows\microsoft.net\framework\v4.0.30128\wpf\WPFFontCache_v0400.exe [?]
.
=============== Created Last 30 ================
.
2011-06-10 06:47:37 6962000 ----a-w- g:\programdata\microsoft\windows defender\definition updates\{3f1029e5-2779-4b25-971f-4b163b272a9a}\mpengine.dll
2011-05-25 11:24:27 26496 ----a-w- g:\windows\system32\drivers\Diskdump.sys
2011-05-25 10:58:41 -------- d-----w- g:\windows\system32\EventProviders
2011-05-24 09:28:53 83249512 ----a-w- g:\program files\common files\windows live\.cache\wlc35DD.tmp
2011-05-19 11:43:42 -------- d-----w- g:\users\sean\appdata\local\Ilivid Player
2011-05-19 11:42:43 -------- d-----w- g:\users\sean\appdata\local\PackageAware
2011-05-17 08:12:21 123904 ----a-w- g:\windows\system32\poqexec.exe
.
==================== Find3M ====================
.
2011-05-12 12:19:43 284744 ----a-w- g:\windows\system32\guard32.dll
2011-05-12 12:19:41 37592 ----a-w- g:\windows\system32\drivers\cmdhlp.sys
2011-05-12 12:19:40 238960 ----a-w- g:\windows\system32\drivers\cmdGuard.sys
2011-05-12 12:19:40 19088 ----a-w- g:\windows\system32\drivers\cmderd.sys
2011-04-13 17:07:59 472808 ----a-w- g:\windows\system32\deployJava1.dll
2011-04-09 06:13:06 3957632 ----a-w- g:\windows\system32\ntkrnlpa.exe
2011-04-09 06:13:06 3901824 ----a-w- g:\windows\system32\ntoskrnl.exe
2011-04-06 04:20:16 91424 ----a-w- g:\windows\system32\dnssd.dll
2011-04-06 04:20:16 75040 ----a-w- g:\windows\system32\jdns_sd.dll
2011-04-06 04:20:16 197920 ----a-w- g:\windows\system32\dnssdX.dll
2011-04-06 04:20:16 107808 ----a-w- g:\windows\system32\dns-sd.exe
.
============= FINISH: 0:23:49.56 ===============

RK Unhooker Report.

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows 7
Version 6.1.7600
Number of processors #2
==============================================
>Drivers
==============================================
0x9262C000 G:\Windows\system32\DRIVERS\igdkmd32.sys 9555968 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x82E19000 G:\Windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System)
0x82E19000 PnpManager 4259840 bytes
0x82E19000 RAW 4259840 bytes
0x82E19000 WMIxWDM 4259840 bytes
0x81EB0000 Win32k 2404352 bytes
0x81EB0000 G:\Windows\System32\win32k.sys 2404352 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8B692000 G:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver)
0x8B423000 G:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver)
0x93001000 G:\Windows\system32\DRIVERS\athr.sys 1114112 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)
0x9A008000 G:\Windows\system32\DRIVERS\VSTDPV3.SYS 1056768 bytes (Conexant Systems, Inc., HSF_DP driver)
0x8B0B0000 PCI_PNP5723 995328 bytes
0x8B0B0000 G:\Windows\System32\Drivers\sppe.sys 995328 bytes
0x8B0B0000 sptd 995328 bytes
0x92F49000 G:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8B32A000 G:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver)
0x9A10A000 G:\Windows\system32\DRIVERS\VSTCNXT3.SYS 741376 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0x8AEFC000 G:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module)
0xAF80C000 G:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x9B481000 G:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x8AE29000 G:\Windows\system32\mcupdate_GenuineIntel.dll 491520 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x8B031000 G:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime)
0x91201000 G:\Windows\system32\drivers\csc.sys 409600 bytes (Microsoft Corporation, Windows Client Side Caching Driver)
0x8B590000 G:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation)
0x9183E000 G:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xAF92A000 G:\Windows\System32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver)
0x94B4E000 G:\Windows\system32\drivers\HdAudio.sys 327680 bytes (Microsoft Corporation, High Definition Audio Function Driver)
0xAF8DB000 G:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x82160000 G:\Windows\System32\ATMFD.DLL 315392 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0x91326000 G:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8B22D000 G:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8AFA7000 G:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT)
0x9B418000 G:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x94A39000 G:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x8AEBA000 G:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver)
0x9194E000 G:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8B863000 G:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8B9A9000 G:\Windows\System32\DRIVERS\cmdguard.sys 253952 bytes (COMODO, COMODO Internet Security Sandbox Driver)
0x8B62F000 G:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem)
0x94B11000 G:\Windows\system32\DRIVERS\VSTAZL3.SYS 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver)
0x94A8E000 G:\Windows\system32\drivers\CHDRT32.sys 241664 bytes (Conexant Systems Inc., High Definition Audio Function Driver)
0x9B554000 G:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x93157000 G:\Windows\System32\Drivers\awemikc4.SYS 233472 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x912ED000 G:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS)
0x83229000 ACPI_HAL 225280 bytes
0x83229000 G:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x8B2DB000 G:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x919B0000 G:\Windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library)
0x8B8EF000 G:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver)
0x91898000 G:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8B829000 G:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x94AC9000 G:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x8B8AA000 G:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver)
0x8B552000 G:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x8B000000 G:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x9128B000 G:\Windows\system32\DRIVERS\avipbb.sys 155648 bytes (Avira GmbH, Avira Driver for Security Enhancement)
0x8B1AC000 G:\Windows\System32\Drivers\SCSIPORT.SYS 155648 bytes (Microsoft Corporation, SCSI Port Driver)
0x8B932000 G:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8B66D000 G:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages)
0x91390000 G:\Windows\system32\DRIVERS\Rt86win7.sys 151552 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS 6.20 32-bit Driver )
0x94B9E000 G:\Windows\System32\Drivers\usbvideo.sys 147456 bytes (Microsoft Corporation, USB Video Class Driver)
0x8B297000 G:\Windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x9B531000 G:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x931D2000 G:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xAF8AD000 G:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver)
0x912B1000 G:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8B7DB000 G:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0xAF97C000 G:\Windows\system32\DRIVERS\WUDFRd.sys 135168 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector)
0x8B98A000 G:\Windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x91371000 G:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x918D1000 G:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x82140000 G:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver)
0x94A0B000 G:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x9B58F000 G:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x91800000 G:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0x9B506000 G:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x94AF8000 G:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers)
0x91265000 G:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x9311B000 G:\Windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042 Port Driver)
0x931AF000 G:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x913B5000 G:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x913CD000 G:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x913E4000 G:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x8B409000 G:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver)
0x9A1E5000 G:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0x9A1CC000 G:\Windows\system32\DRIVERS\USBSTOR.SYS 94208 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0x91901000 G:\Windows\system32\DRIVERS\inspect.sys 90112 bytes (COMODO, COMODO Internet Security Firewall Driver)
0x8B278000 G:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager)
0x919E4000 G:\Windows\system32\DRIVERS\avgntflt.sys 86016 bytes (Avira GmbH, Avira Minifilter Driver)
0x8B57D000 G:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x9B46E000 G:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x91925000 G:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x9319D000 G:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager)
0x912D2000 G:\Windows\system32\DRIVERS\intelppm.sys 73728 bytes (Microsoft Corporation, Processor Device Driver)
0x9B51F000 G:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8B921000 G:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x94BEE000 G:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes
0x8B30F000 G:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x94A7D000 G:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x8B1E5000 G:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver)
0x8AEA1000 G:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x918F0000 G:\Windows\system32\DRIVERS\vwififlt.sys 69632 bytes (Microsoft Corporation, Virtual WiFi Filter Driver)
0x94A26000 G:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8B8D7000 G:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver)
0x9B45E000 G:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x91938000 G:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver)
0x8AE00000 G:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver)
0x9260B000 G:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x9127D000 G:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver)
0x91917000 G:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x8B60B000 G:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x8B2C4000 G:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8B5ED000 G:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver)
0x9261A000 G:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8B0A2000 G:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)
0x93190000 G:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator)
0x94BCC000 G:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x93133000 G:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver)
0x9A1BF000 G:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x93140000 G:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver)
0xAF8CE000 G:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8B80C000 G:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x919A4000 G:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver)
0x8B800000 G:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8AFEF000 G:\Windows\system32\DRIVERS\BATTC.SYS 45056 bytes (Microsoft Corporation, Battery Class Driver)
0x8B624000 G:\Windows\System32\DRIVERS\cmdhlp.sys 45056 bytes (COMODO, COMODO Internet Security Helper Driver)
0x94BD9000 G:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x94A00000 G:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver)
0x8B600000 G:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x931C7000 G:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8B619000 G:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x92600000 G:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x8B1DA000 G:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator)
0x94BE4000 G:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes
0x94BC2000 G:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8B2BA000 G:\Windows\system32\DRIVERS\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)
0x9199A000 G:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x91990000 G:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x8B320000 G:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0x931F4000 G:\Windows\system32\DRIVERS\rdpbus.sys 40960 bytes (Microsoft Corporation, Microsoft RDP Bus Device driver)
0xAF8A3000 G:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x93111000 G:\Windows\system32\DRIVERS\vwifibus.sys 40960 bytes (Microsoft Corporation, Virtual WiFi Bus Driver)
0x8B2D2000 G:\Windows\system32\drivers\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver)
0x8B28E000 G:\Windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0xAF99D000 G:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0x8B400000 G:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x82110000 G:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8B85A000 G:\Windows\system32\DRIVERS\vmstorfl.sys 36864 bytes (Microsoft Corporation, Virtual Storage Filter Driver)
0x912E4000 G:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x8B1A3000 G:\Windows\System32\Drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x8AEB2000 G:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8B1F6000 G:\Windows\system32\DRIVERS\compbatt.sys 32768 bytes (Microsoft Corporation, Composite Battery Driver)
0x8B8E7000 G:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver)
0x80BD0000 G:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger)
0x8B1D2000 G:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x8B819000 G:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8B821000 G:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport)
0x8B9F5000 G:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport)
0x8B8A2000 G:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x8B9EE000 G:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x8B9E7000 G:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x918CA000 G:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver)
0x93151000 G:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x91948000 G:\Windows\system32\DRIVERS\ssmdrv.sys 24576 bytes (Avira GmbH, AVIRA SnapShot Driver)
0x9314D000 G:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x931FE000 G:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x9A1E3000 G:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0x9198F000 G:\Windows\System32\Drivers\PQNTDrv.SYS 4096 bytes (PowerQuest Corporation, PowerQuest Boot Mode Driver.)
0x854F61F8 unknown_irp_handler 3592 bytes
0x854F31F8 unknown_irp_handler 3592 bytes
0x866AC1F8 unknown_irp_handler 3592 bytes
0x871F91F8 unknown_irp_handler 3592 bytes
0x868FC1F8 unknown_irp_handler 3592 bytes
0x854F51F8 unknown_irp_handler 3592 bytes
0x8681E1F8 unknown_irp_handler 3592 bytes
0x869951F8 unknown_irp_handler 3592 bytes
0x854F11F8 unknown_irp_handler 3592 bytes
0x854F41F8 unknown_irp_handler 3592 bytes
0x867261F8 unknown_irp_handler 3592 bytes
0x868C0500 unknown_irp_handler 2816 bytes
==============================================
>Stealth
==============================================
WARNING: File locked for read access [G:\Windows\system32\drivers\sptd.sys]

Thanks for your time in discussing this with me.

Attached File(s)

Attach.txt (8.41K)
Number of downloads: 0

#2 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 19 June 2011 - 03:13 AM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

Do not run any other tool untill instructed to do so!
Please Do not Attach logs or put in code boxes.
Tell me about any problems that have occurred during the fix.
Tell me of any other symptoms you may be having as these can help also.
Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

DeFogger

desktop

DeFogger

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger may ask you to reboot the machine, if it does - click OK

Do not

Download DDS:

DDS by sUBs

Link1

Link2

Link3

Please disable any anti-malware program that will block scripts from running before running DDS.

Double-Click on dds.scr and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
A window will open instructing you save & post the logs
Save the logs to a convenient place such as your desktop
Copy the contents of both logs & post in your next reply

Scan With RKUnHooker

Please Download Rootkit Unhooker Save it to your desktop.
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
Wait till the scanner has finished and then click File, Save Report.
Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

information and logs:

In your next post I need the following

.logs from DDS
log from RKUnHooker
let me know of any problems you may have had

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->

<-- Don't worry every little bit helps.

#3 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 19 June 2011 - 05:39 AM

Hi Gringo,

Thanks for offering to help me on this problem and I ran the programs as requested. Please find log files below. DDS capture first.

Attach File

DDS (Ver_2011-06-12.02)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 26/03/2010 2:50:54 p.m.
System Uptime: 19/06/2011 1:28:36 p.m. (9 hours ago)
.
Motherboard: Wistron | | 3612
Processor: Intel® Pentium® Dual CPU T3400 @ 2.16GHz | CPU | 2166/667mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 244 GiB total, 69.927 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 11 GiB total, 1.804 GiB free.
F: is Removable
G: is FIXED (NTFS) - 43 GiB total, 2.913 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
3DVIA player 5.0
Add or Remove Adobe Premiere Pro CS5
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe Color - Photoshop Specific
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe CS4 American English Speech Analysis Models
Adobe Default Language CS4
Adobe Device Central CS3
Adobe Device Central CS4
Adobe Dynamiclink Support
Adobe Encore CS4
Adobe Encore CS4 Codecs
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe Media Encoder CS4
Adobe Media Encoder CS4 Additional Exporter
Adobe Media Encoder CS4 Dolby
Adobe Media Encoder CS4 Exporter
Adobe Media Encoder CS4 Importer
Adobe Media Player
Adobe OnLocation CS4
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS3
Adobe Premiere Pro CS4
Adobe Premiere Pro CS4 Functional Content
Adobe Premiere Pro CS4 Third Party Content
Adobe Reader X (10.1.0)
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Stock Photos CS3
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Adobe XMP Panels CS4
AdobeColorCommonSetRGB
Amazon Kindle For PC
AnyBizSoft PDF Converter (Build 2.5.0)
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.2.6
Avira AntiVir Personal - Free Antivirus
BitTorrent
BitTorrentBar Toolbar
Bonjour
Brother MFL-Pro Suite DCP-195C
Catz (remove only)
CCleaner
Celtx (2.7)
COMODO Internet Security
Conexant HD Audio
DivX Setup
Dropbox
EASEUS Partition Master 5.8.1 Home Edition
Facebook Plug-In
Free WMA to MP3 Converter 1.16
Google Chrome
Google Earth
Google Update Helper
Intel® TV Wizard
iTunes
Java Auto Updater
Java™ 6 Update 20
Java™ 6 Update 25
Jump Ahead Starting Reading v1.0
Jump Ahead Starting School 2000 v2.0
Junk Mail filter update
KompoZer 0.8b3
LAME v3.98.3 for Audacity
Learning Ladder Preschool
LotWin Pro
Malwarebytes' Anti-Malware
MCE Daemon Tools Loader
Media Browser
Media Center Master v1.20
Media Center Studio
Medieval CUE Splitter
Microsoft .NET Framework 4 Client Profile Beta 1
Microsoft .NET Framework 4 Extended Beta 1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 Beta 1 x86 Redistributable - 10.0.20506
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox 4.0.1 (x86 en-US)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 7 Premium
neroxml
OpenOffice.org 3.2
PaperPort Image Printer
PartitionMagic
PDF Settings
Photoshop Camera Raw
PowerQuest PartitionMagic 8.0
QuickTime
ScanSoft PaperPort 11
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office 2007 System (KB2541012)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2541007)
Security Update for Microsoft Office Groove 2007 (KB2494047)
Security Update for Microsoft Office InfoPath 2007 (KB2510061)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype™ 4.2
Suite Shared Configuration CS4
TreeSize Free V2.5
TuneUp Companion 2.0.10
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2509470)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2536413)
VC80CRTRedist - 8.0.50727.4053
VLC media player 1.0.5
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
WinRAR archiver
YouTube Downloader 2.6.2
.
==== Event Viewer Messages From Past Week ========
.
19/06/2011 8:39:38 a.m., Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Update for Windows 7 (KB2467023).
18/06/2011 9:31:45 a.m., Error: Disk [11] - The driver detected a controller error on \...\DR5.
18/06/2011 7:51:29 p.m., Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
18/06/2011 12:44:29 a.m., Error: Service Control Manager [7023] - The Server service terminated with the following error: Not enough storage is available to complete this operation.
.
==== End Of File ===========================

DDS.txt

.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_25
Run by Sean at 22:16:30 on 2011-06-19
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.64.1033.18.2975.1541 [GMT 12:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: COMODO Defense+ *Disabled/Outdated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
.
============== Running Processes ===============
.
G:\Windows\system32\wininit.exe
G:\Windows\system32\lsm.exe
G:\Windows\system32\svchost.exe -k DcomLaunch
G:\Windows\system32\svchost.exe -k RPCSS
G:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
G:\Windows\system32\svchost.exe -k NetworkService
G:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
G:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
G:\Windows\system32\svchost.exe -k netsvcs
G:\Windows\system32\svchost.exe -k LocalService
G:\Windows\System32\spoolsv.exe
G:\Program Files\Avira\AntiVir Desktop\sched.exe
G:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
G:\Program Files\Avira\AntiVir Desktop\avguard.exe
G:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
G:\Program Files\Avira\AntiVir Desktop\avshadow.exe
G:\Windows\system32\conhost.exe
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
G:\Windows\system32\svchost.exe -k imgsvc
G:\Windows\system32\taskhost.exe
G:\Windows\system32\Dwm.exe
G:\Windows\Explorer.EXE
G:\Program Files\Avira\AntiVir Desktop\avgnt.exe
G:\Program Files\COMODO\COMODO Internet Security\cfp.exe
G:\Windows\System32\igfxtray.exe
G:\Windows\System32\hkcmd.exe
G:\Windows\System32\igfxpers.exe
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\Program Files\DivX\DivX Update\DivXUpdate.exe
G:\Program Files\Common Files\Java\Java Update\jusched.exe
G:\Windows\system32\WUDFHost.exe
G:\Program Files\Skype\Phone\Skype.exe
G:\Program Files\Windows Sidebar\sidebar.exe
G:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
G:\Windows\System32\StikyNot.exe
G:\Program Files\Windows Live\Messenger\msnmsgr.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\Program Files\Windows Media Player\wmpnetwk.exe
G:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
G:\Program Files\Skype\Plugin Manager\skypePM.exe
G:\Windows\System32\svchost.exe -k secsvcs
G:\Windows\system32\SearchIndexer.exe
G:\Windows\system32\wuauclt.exe
G:\Program Files\Microsoft Office\Office12\WINWORD.EXE
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Windows\system32\rundll32.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Users\Sean\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Windows\system32\SearchProtocolHost.exe
G:\Windows\system32\SearchFilterHost.exe
G:\Windows\system32\conhost.exe
G:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
mURLSearchHooks: H - No File
mURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - g:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - g:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - g:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - g:\program files\java\jre6\bin\jp2ssv.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - g:\program files\daemon tools toolbar\DTToolbar.dll
TB: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - g:\program files\bittorrentbar\tbBit1.dll
uRun: [Skype] "g:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] g:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [RESTART_STICKY_NOTES] g:\windows\system32\StikyNot.exe
uRun: [msnmsgr] "g:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [avgnt] "g:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [COMODO Internet Security] "g:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [IgfxTray] g:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] g:\windows\system32\hkcmd.exe
mRun: [Persistence] g:\windows\system32\igfxpers.exe
mRun: [GrooveMonitor] "g:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "g:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "g:\program files\itunes\iTunesHelper.exe"
mRun: [DivXUpdate] "g:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "g:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe ARM] "g:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - g:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - g:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - g:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~4\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{1A45AAA2-5DC4-4ED0-938B-EF375253646D} : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42} : DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42}\1476E656376716E64656B6C657E646562747 : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42}\3586F62756C4962627162796563775966496 : DhcpNameServer = 202.126.207.10 202.126.207.193
TCP: Interfaces\{B73F15F2-1508-47DC-A003-3F3AC2E3AA42}\36166656E65647 : DhcpNameServer = 202.126.206.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - g:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - g:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: g:\windows\system32\guard32.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - g:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - g:\users\sean\appdata\roaming\mozilla\firefox\profiles\kb5pfudh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.nz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&q=
FF - plugin: g:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: g:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: g:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: g:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: g:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: g:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: g:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: g:\users\sean\appdata\local\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: g:\users\sean\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: g:\windows\microsoft.net\framework\v4.0.20506\wpf\NPWPF.dll
.
============= SERVICES / DRIVERS ===============
.
R1 cmdGuard;COMODO Internet Security Sandbox Driver;g:\windows\system32\drivers\cmdGuard.sys [2010-3-23 238960]
R1 cmdHlp;COMODO Internet Security Helper Driver;g:\windows\system32\drivers\cmdhlp.sys [2010-3-3 37592]
R1 vwififlt;Virtual WiFi Filter Driver;g:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;g:\program files\avira\antivir desktop\sched.exe [2010-3-26 136360]
R2 AntiVirService;Avira AntiVir Guard;g:\program files\avira\antivir desktop\avguard.exe [2010-3-26 269480]
R2 avgntflt;avgntflt;g:\windows\system32\drivers\avgntflt.sys [2010-3-26 61960]
R3 RTL8167;Realtek 8167 NT Driver;g:\windows\system32\drivers\Rt86win7.sys [2009-6-11 139776]
R3 SrvHsfHDA;SrvHsfHDA;g:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
R3 SrvHsfV92;SrvHsfV92;g:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
R3 SrvHsfWinac;SrvHsfWinac;g:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
S2 AdobeARMservice;Adobe Acrobat Update Service;g:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
S2 gupdate;Google Update Service (gupdate);g:\program files\google\update\GoogleUpdate.exe [2011-3-18 136176]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;g:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 clr_optimization_v4.0.20506_32;.NET Runtime Optimization Service v4.0.20506_X86;g:\windows\microsoft.net\framework\v4.0.20506\mscorsvw.exe [2009-5-6 104272]
S3 epmntdrv;epmntdrv;g:\windows\system32\epmntdrv.sys [2010-5-23 14216]
S3 EuGdiDrv;EuGdiDrv;g:\windows\system32\EuGdiDrv.sys [2010-5-23 8456]
S3 gupdatem;Google Update Service (gupdatem);g:\program files\google\update\GoogleUpdate.exe [2011-3-18 136176]
S3 SwitchBoard;Adobe SwitchBoard;g:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WatAdminSvc;Windows Activation Technologies Service;g:\windows\system32\wat\WatAdminSvc.exe [2010-4-13 1343400]
S3 WPFFontCache_v0400;WPFFontCache_v0400;g:\windows\microsoft.net\framework\v4.0.30128\wpf\wpffontcache_v0400.exe --> g:\windows\microsoft.net\framework\v4.0.30128\wpf\WPFFontCache_v0400.exe [?]
.
=============== Created Last 30 ================
.
2011-06-18 07:56:27 -------- d-sh--w- G:\$RECYCLE.BIN
2011-06-18 07:27:28 98816 ----a-w- g:\windows\sed.exe
2011-06-18 07:27:28 518144 ----a-w- g:\windows\SWREG.exe
2011-06-18 07:27:28 256512 ----a-w- g:\windows\PEV.exe
2011-06-18 07:27:28 208896 ----a-w- g:\windows\MBR.exe
2011-06-17 20:39:02 6962000 ----a-w- g:\programdata\microsoft\windows defender\definition updates\{638abc5e-9a70-4f98-b371-41bdf89ff61f}\mpengine.dll
2011-06-16 06:22:58 311296 ----a-w- g:\windows\system32\drivers\srv.sys
2011-06-16 06:22:58 309760 ----a-w- g:\windows\system32\drivers\srv2.sys
2011-06-16 06:22:58 114176 ----a-w- g:\windows\system32\drivers\srvnet.sys
2011-06-16 06:22:38 338944 ----a-w- g:\windows\system32\drivers\afd.sys
2011-06-16 06:22:38 1286016 ----a-w- g:\windows\system32\drivers\tcpip.sys
2011-06-16 06:17:14 78336 ----a-w- g:\windows\system32\drivers\dfsc.sys
2011-06-16 06:17:14 571904 ----a-w- g:\windows\system32\oleaut32.dll
2011-06-16 06:17:13 740864 ----a-w- g:\windows\system32\inetcomm.dll
2011-06-16 06:10:29 96256 ----a-w- g:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 06:10:29 222720 ----a-w- g:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 06:10:29 123392 ----a-w- g:\windows\system32\drivers\mrxsmb.sys
2011-06-06 00:55:30 183696 ----a-w- g:\program files\internet explorer\plugins\nppdf32.dll
2011-05-25 11:24:27 26496 ----a-w- g:\windows\system32\drivers\Diskdump.sys
2011-05-25 10:58:41 -------- d-----w- g:\windows\system32\EventProviders
2011-05-24 09:28:53 83249512 ----a-w- g:\program files\common files\windows live\.cache\wlc35DD.tmp
.
==================== Find3M ====================
.
2011-05-28 03:00:02 1638912 ----a-w- g:\windows\system32\mshtml.tlb
2011-05-12 12:19:43 284744 ----a-w- g:\windows\system32\guard32.dll
2011-05-12 12:19:41 37592 ----a-w- g:\windows\system32\drivers\cmdhlp.sys
2011-05-12 12:19:40 238960 ----a-w- g:\windows\system32\drivers\cmdGuard.sys
2011-05-12 12:19:40 19088 ----a-w- g:\windows\system32\drivers\cmderd.sys
2011-04-22 19:31:50 981504 ----a-w- g:\windows\system32\wininet.dll
2011-04-22 19:31:26 44544 ----a-w- g:\windows\system32\licmgr10.dll
2011-04-22 18:23:59 386048 ----a-w- g:\windows\system32\html.iec
2011-04-13 17:07:59 472808 ----a-w- g:\windows\system32\deployJava1.dll
2011-04-09 06:13:06 3957632 ----a-w- g:\windows\system32\ntkrnlpa.exe
2011-04-09 06:13:06 3901824 ----a-w- g:\windows\system32\ntoskrnl.exe
2011-04-09 05:56:38 123904 ----a-w- g:\windows\system32\poqexec.exe
2011-04-06 04:20:16 91424 ----a-w- g:\windows\system32\dnssd.dll
2011-04-06 04:20:16 75040 ----a-w- g:\windows\system32\jdns_sd.dll
2011-04-06 04:20:16 197920 ----a-w- g:\windows\system32\dnssdX.dll
2011-04-06 04:20:16 107808 ----a-w- g:\windows\system32\dns-sd.exe
.
============= FINISH: 22:20:49.31 ===============

RkUnhooker

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows 7
Version 6.1.7600
Number of processors #2
==============================================
>Drivers
==============================================
0x92621000 G:\Windows\system32\DRIVERS\igdkmd32.sys 9555968 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x82E18000 G:\Windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System)
0x82E18000 PnpManager 4259840 bytes
0x82E18000 RAW 4259840 bytes
0x82E18000 WMIxWDM 4259840 bytes
0x81E80000 Win32k 2404352 bytes
0x81E80000 G:\Windows\System32\win32k.sys 2404352 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8B64B000 G:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver)
0x8B421000 G:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver)
0x91E01000 G:\Windows\system32\DRIVERS\athr.sys 1114112 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)
0x992C4000 G:\Windows\system32\DRIVERS\VSTDPV3.SYS 1056768 bytes (Conexant Systems, Inc., HSF_DP driver)
0x8B080000 G:\Windows\System32\Drivers\sptd.sys 995328 bytes
0x92F3E000 G:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8B300000 G:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver)
0x99038000 G:\Windows\system32\DRIVERS\VSTCNXT3.SYS 741376 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0x8AF0B000 G:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module)
0xAEE11000 G:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x9AA8F000 G:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x8AE38000 G:\Windows\system32\mcupdate_GenuineIntel.dll 491520 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x8B001000 G:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime)
0x91592000 G:\Windows\system32\drivers\csc.sys 409600 bytes (Microsoft Corporation, Windows Client Side Caching Driver)
0x8B58E000 G:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation)
0x91420000 G:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xAEF2F000 G:\Windows\System32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver)
0x990FA000 G:\Windows\system32\drivers\HdAudio.sys 327680 bytes (Microsoft Corporation, High Definition Audio Function Driver)
0xAEEE0000 G:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x82130000 G:\Windows\System32\ATMFD.DLL 315392 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0x91CC2000 G:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8B203000 G:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8B1A2000 G:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT)
0x9AA26000 G:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x91D9C000 G:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x8AEC9000 G:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver)
0x91530000 G:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8B821000 G:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8B967000 G:\Windows\System32\DRIVERS\cmdguard.sys 253952 bytes (COMODO, COMODO Internet Security Sandbox Driver)
0x8B3B7000 G:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem)
0x99287000 G:\Windows\system32\DRIVERS\VSTAZL3.SYS 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver)
0x99204000 G:\Windows\system32\drivers\CHDRT32.sys 241664 bytes (Conexant Systems Inc., High Definition Audio Function Driver)
0x9AB62000 G:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x91C89000 G:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS)
0x83228000 ACPI_HAL 225280 bytes
0x83228000 G:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x8B2B1000 G:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x91D68000 G:\Windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library)
0x8B8AD000 G:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver)
0x9147A000 G:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8B794000 G:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x9923F000 G:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x8B868000 G:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver)
0x8B550000 G:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0xAEFAD000 G:\Windows\System32\Drivers\fastfat.SYS 172032 bytes (Microsoft Corporation, Fast FAT File System Driver)
0x8AFCB000 G:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x91C27000 G:\Windows\system32\DRIVERS\avipbb.sys 155648 bytes (Avira GmbH, Avira Driver for Security Enhancement)
0x8B17C000 G:\Windows\System32\Drivers\SCSIPORT.SYS 155648 bytes (Microsoft Corporation, SCSI Port Driver)
0x8B8F0000 G:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8B626000 G:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages)
0x91D2C000 G:\Windows\system32\DRIVERS\Rt86win7.sys 151552 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS 6.20 32-bit Driver )
0x99184000 G:\Windows\System32\Drivers\usbvideo.sys 147456 bytes (Microsoft Corporation, USB Video Class Driver)
0x8B26D000 G:\Windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x9AB3F000 G:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x91F99000 G:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xAEEB2000 G:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver)
0x91C4D000 G:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8B9BF000 G:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0xAEF81000 G:\Windows\system32\DRIVERS\WUDFRd.sys 135168 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector)
0x8B948000 G:\Windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x91D0D000 G:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x914B3000 G:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x82110000 G:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver)
0x99000000 G:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x9AB9D000 G:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x991E6000 G:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0x9AB14000 G:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x9926E000 G:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers)
0x91400000 G:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x91F1B000 G:\Windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042 Port Driver)
0x91F76000 G:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x91FBB000 G:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x91FD3000 G:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x91D51000 G:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x8B7CE000 G:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver)
0x9916D000 G:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0x9914A000 G:\Windows\system32\DRIVERS\USBSTOR.SYS 94208 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0x914E3000 G:\Windows\system32\DRIVERS\inspect.sys 90112 bytes (COMODO, COMODO Internet Security Firewall Driver)
0x8B24E000 G:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager)
0x8AFB6000 G:\Windows\system32\drivers\52911408.sys 86016 bytes
0x9901B000 G:\Windows\system32\DRIVERS\avgntflt.sys 86016 bytes (Avira GmbH, Avira Minifilter Driver)
0x8B57B000 G:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x9AA7C000 G:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x91507000 G:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x91F64000 G:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager)
0x91C6E000 G:\Windows\system32\DRIVERS\intelppm.sys 73728 bytes (Microsoft Corporation, Processor Device Driver)
0x9AB2D000 G:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8B8DF000 G:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x991CA000 G:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes
0x8B2E5000 G:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x91DE0000 G:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x8AE00000 G:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver)
0x8AEB0000 G:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x914D2000 G:\Windows\system32\DRIVERS\vwififlt.sys 69632 bytes (Microsoft Corporation, Virtual WiFi Filter Driver)
0x993C6000 G:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8B895000 G:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver)
0x9AA6C000 G:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x9151A000 G:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver)
0x8AE24000 G:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver)
0x92600000 G:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x8B600000 G:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver)
0x914F9000 G:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x8B813000 G:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x8B29A000 G:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8B5EB000 G:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver)
0x9260F000 G:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8B072000 G:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)
0x91F57000 G:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator)
0x991A8000 G:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x91F33000 G:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver)
0x990ED000 G:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x91F40000 G:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver)
0xAEED3000 G:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8B9E0000 G:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x91586000 G:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver)
0x8B9B3000 G:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8AE19000 G:\Windows\system32\DRIVERS\BATTC.SYS 45056 bytes (Microsoft Corporation, Battery Class Driver)
0x8B7F0000 G:\Windows\System32\DRIVERS\cmdhlp.sys 45056 bytes (COMODO, COMODO Internet Security Helper Driver)
0x991B5000 G:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0xAEE00000 G:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver)
0x8B808000 G:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x91F8E000 G:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8B7E5000 G:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x92FF5000 G:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x8B1F2000 G:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator)
0x991C0000 G:\Windows\System32\Drivers\dump_msahci.sys 40960 bytes
0x99163000 G:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8B290000 G:\Windows\system32\DRIVERS\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)
0x9157C000 G:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x91572000 G:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x8B2F6000 G:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0x91FEA000 G:\Windows\system32\DRIVERS\rdpbus.sys 40960 bytes (Microsoft Corporation, Microsoft RDP Bus Device driver)
0xAEEA8000 G:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x91F11000 G:\Windows\system32\DRIVERS\vwifibus.sys 40960 bytes (Microsoft Corporation, Virtual WiFi Bus Driver)
0x8B2A8000 G:\Windows\system32\drivers\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver)
0x8B264000 G:\Windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0xAEFD7000 G:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0x8B400000 G:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x820E0000 G:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8B7C5000 G:\Windows\system32\DRIVERS\vmstorfl.sys 36864 bytes (Microsoft Corporation, Virtual Storage Filter Driver)
0x91C80000 G:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x8B173000 G:\Windows\System32\Drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x8AEC1000 G:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8AE11000 G:\Windows\system32\DRIVERS\compbatt.sys 32768 bytes (Microsoft Corporation, Composite Battery Driver)
0x8B8A5000 G:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver)
0x80BCC000 G:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger)
0x8B1EA000 G:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x8B9ED000 G:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8B9F5000 G:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport)
0x8B800000 G:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport)
0x8B860000 G:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x8B9AC000 G:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0xAEFA2000 G:\Users\Sean\AppData\Local\Temp\mbr.sys 28672 bytes
0x8B9A5000 G:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x914AC000 G:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver)
0x91F51000 G:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x9152A000 G:\Windows\system32\DRIVERS\ssmdrv.sys 24576 bytes (Avira GmbH, AVIRA SnapShot Driver)
0x91F4D000 G:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x91FF4000 G:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x99161000 G:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0x91571000 G:\Windows\System32\Drivers\PQNTDrv.SYS 4096 bytes (PowerQuest Corporation, PowerQuest Boot Mode Driver.)
==============================================
>Stealth
==============================================

Look forward to hearing from you shortly.

Sean.

#4 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 19 June 2011 - 12:00 PM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1

Link 2

Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

<-- Don't worry every little bit helps.

#5 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 20 June 2011 - 04:46 AM

Hi Gringo,

The log from combofix is shown below. Took 20 minutes to run although that maybe says more for the age of the laptop (just over 2 years) than anything else. No problems in running in. I disabled all malware/antivirus etc while running combofix.

ComboFix 11-06-17.04 - Sean 20/06/2011 21:19:03.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.64.1033.18.2975.2061 [GMT 12:00]
Running from: g:\users\Sean\Downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
FW: COMODO Firewall *Disabled* {4D6F75E0-14AF-2E9E-AACD-24CDCF08AA2A}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: COMODO Defense+ *Disabled/Updated* {CE351521-78FA-2048-BB22-B68A4A5CA7EC}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-05-20 to 2011-06-20 )))))))))))))))))))))))))))))))
.
.
2011-06-20 09:37 . 2011-06-20 09:37 -------- d-----w- g:\users\Default\AppData\Local\temp
2011-06-20 09:37 . 2011-06-20 09:37 -------- d-----w- g:\users\Administrator\AppData\Local\temp
2011-06-19 11:27 . 2011-06-19 11:27 -------- d-----w- g:\program files\Amazon
2011-06-17 20:39 . 2011-05-09 20:46 6962000 ----a-w- g:\programdata\Microsoft\Windows Defender\Definition Updates\{638ABC5E-9A70-4F98-B371-41BDF89FF61F}\mpengine.dll
2011-06-16 06:22 . 2011-04-29 02:57 311296 ----a-w- g:\windows\system32\drivers\srv.sys
2011-06-16 06:22 . 2011-04-29 02:57 309760 ----a-w- g:\windows\system32\drivers\srv2.sys
2011-06-16 06:22 . 2011-04-29 02:57 114176 ----a-w- g:\windows\system32\drivers\srvnet.sys
2011-06-16 06:22 . 2011-04-25 04:56 1286016 ----a-w- g:\windows\system32\drivers\tcpip.sys
2011-06-16 06:22 . 2011-04-25 02:35 338944 ----a-w- g:\windows\system32\drivers\afd.sys
2011-06-16 06:17 . 2011-04-27 02:33 78336 ----a-w- g:\windows\system32\drivers\dfsc.sys
2011-06-16 06:17 . 2010-12-18 05:31 571904 ----a-w- g:\windows\system32\oleaut32.dll
2011-06-16 06:17 . 2011-05-03 04:50 740864 ----a-w- g:\windows\system32\inetcomm.dll
2011-06-16 06:10 . 2011-05-04 02:43 222720 ----a-w- g:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 06:10 . 2011-05-04 02:43 96256 ----a-w- g:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 06:10 . 2011-05-04 02:43 123392 ----a-w- g:\windows\system32\drivers\mrxsmb.sys
2011-06-06 00:55 . 2011-06-06 00:55 183696 ----a-w- g:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-05-25 11:24 . 2011-04-22 19:36 26496 ----a-w- g:\windows\system32\drivers\Diskdump.sys
2011-05-25 10:58 . 2011-05-25 10:58 -------- d-----w- g:\windows\system32\EventProviders
2011-05-24 09:28 . 2011-05-24 09:28 83249512 ----a-w- g:\program files\Common Files\Windows Live\.cache\wlc35DD.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-12 12:19 . 2010-03-03 04:54 284744 ----a-w- g:\windows\system32\guard32.dll
2011-05-12 12:19 . 2010-03-03 04:54 82400 ----a-w- g:\windows\system32\drivers\inspect.sys
2011-05-12 12:19 . 2010-03-03 04:54 37592 ----a-w- g:\windows\system32\drivers\cmdhlp.sys
2011-05-12 12:19 . 2010-03-23 05:39 238960 ----a-w- g:\windows\system32\drivers\cmdGuard.sys
2011-05-12 12:19 . 2010-03-03 04:54 19088 ----a-w- g:\windows\system32\drivers\cmderd.sys
2011-05-02 21:52 . 2010-03-26 02:02 48648 ----a-w- g:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2011-04-20 23:19 . 2010-04-13 09:25 48648 ----a-w- g:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2011-04-13 17:07 . 2010-05-17 01:15 472808 ----a-w- g:\windows\system32\deployJava1.dll
2011-04-09 06:13 . 2011-05-11 08:38 3957632 ----a-w- g:\windows\system32\ntkrnlpa.exe
2011-04-09 06:13 . 2011-05-11 08:38 3901824 ----a-w- g:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-17 08:12 123904 ----a-w- g:\windows\system32\poqexec.exe
2011-04-06 04:20 . 2011-04-06 04:20 91424 ----a-w- g:\windows\system32\dnssd.dll
2011-04-06 04:20 . 2011-04-06 04:20 75040 ----a-w- g:\windows\system32\jdns_sd.dll
2011-04-06 04:20 . 2011-04-06 04:20 197920 ----a-w- g:\windows\system32\dnssdX.dll
2011-04-06 04:20 . 2011-04-06 04:20 107808 ----a-w- g:\windows\system32\dns-sd.exe
2011-05-21 11:20 . 2011-03-25 09:51 142296 ----a-w- g:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "g:\program files\BitTorrentBar\tbBit1.dll" [2011-03-31 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
2011-03-31 05:06 3911776 ----a-w- g:\program files\BitTorrentBar\tbBit1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{88c7f2aa-f93f-432c-8f0e-b7d85967a527}"= "g:\program files\BitTorrentBar\tbBit1.dll" [2011-03-31 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- g:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- g:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- g:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="g:\program files\Skype\Phone\Skype.exe" [2010-03-08 26100520]
"Sidebar"="g:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"RESTART_STICKY_NOTES"="g:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"msnmsgr"="g:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="g:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]
"COMODO Internet Security"="g:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-05-12 2552648]
"IgfxTray"="g:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="g:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="g:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"GrooveMonitor"="g:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-24 31072]
"QuickTime Task"="g:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="g:\program files\iTunes\iTunesHelper.exe" [2011-04-26 421160]
"DivXUpdate"="g:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="g:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"Adobe ARM"="g:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=g:\windows\System32\guard32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\persistentroutes]
"125.252.224.88,255.255.255.252,192.168.0.200,1"=""
.
[HKLM\~\startupfolder\G:^Users^Sean^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=g:\users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=g:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-05 15:44 500208 ------w- g:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2009-05-26 04:46 1159168 ------w- g:\program files\Brother\Brmfcmon\BrMfcWnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2008-12-23 22:26 114688 ------w- g:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-26 02:06 136176 ----atw- g:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2008-07-09 11:05 46368 ----a-w- g:\program files\ScanSoft\PaperPort\IndexSearch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 10:12 3872080 ----a-w- g:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 03:57 153136 ----a-w- g:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2008-07-09 11:07 29984 ----a-w- g:\program files\ScanSoft\PaperPort\pptd40nt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-08-25 06:45 170520 ----a-w- g:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPort11reminder]
2007-08-30 21:01 328992 ----a-w- g:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speech Recognition]
2009-07-14 01:14 51712 ----a-w- g:\windows\Speech\Common\sapisvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-24 21:03 210472 ----a-w- g:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 01:37 517096 ----a-w- g:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
R2 gupdate;Google Update Service (gupdate);g:\program files\Google\Update\GoogleUpdate.exe [2011-03-17 136176]
R3 clr_optimization_v4.0.20506_32;.NET Runtime Optimization Service v4.0.20506_X86;g:\windows\Microsoft.NET\Framework\v4.0.20506\mscorsvw.exe [2009-05-05 104272]
R3 epmntdrv;epmntdrv;g:\windows\system32\epmntdrv.sys [2010-02-22 14216]
R3 EuGdiDrv;EuGdiDrv;g:\windows\system32\EuGdiDrv.sys [2010-02-22 8456]
R3 gupdatem;Google Update Service (gupdatem);g:\program files\Google\Update\GoogleUpdate.exe [2011-03-17 136176]
R3 SwitchBoard;Adobe SwitchBoard;g:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 WatAdminSvc;Windows Activation Technologies Service;g:\windows\system32\Wat\WatAdminSvc.exe [2010-04-13 1343400]
R3 WPFFontCache_v0400;WPFFontCache_v0400;g:\windows\Microsoft.NET\Framework\v4.0.30128\WPF\WPFFontCache_v0400.exe [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;g:\windows\system32\DRIVERS\cmdguard.sys [2011-05-12 238960]
S1 cmdHlp;COMODO Internet Security Helper Driver;g:\windows\system32\DRIVERS\cmdhlp.sys [2011-05-12 37592]
S1 vwififlt;Virtual WiFi Filter Driver;g:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;g:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;g:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-30 136360]
S3 RTL8167;Realtek 8167 NT Driver;g:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S3 SrvHsfHDA;SrvHsfHDA;g:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;g:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;g:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-20 g:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- g:\program files\Google\Update\GoogleUpdate.exe [2011-03-17 21:09]
.
2011-06-20 g:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- g:\program files\Google\Update\GoogleUpdate.exe [2011-03-17 21:09]
.
2011-06-19 g:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-1000Core.job
- g:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-26 02:06]
.
2011-06-20 g:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-1000UA.job
- g:\users\Sean\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-26 02:06]
.
2011-06-20 g:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-500Core.job
- g:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-27 21:09]
.
2011-06-20 g:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-500UA.job
- g:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-27 21:09]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - g:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
FF - ProfilePath - g:\users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.nz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&q=
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(532)
g:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(4940)
g:\windows\system32\guard32.dll
g:\users\Sean\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2011-06-20 21:41:43
ComboFix-quarantined-files.txt 2011-06-20 09:41
ComboFix2.txt 2011-06-18 07:56
.
Pre-Run: 2,929,266,688 bytes free
Post-Run: 2,877,394,944 bytes free
.
- - End Of File - - 32F73B21FC0B6776FAB1222DBDAB18EF

Not sure if I need to reboot but the first search I tried after running combofix immediately brought up the searchqu query when I did a test search from the Google Chrome search bar. Then, as it has when this happens before, timed out with this error message 'Oops! Google Chrome could not find www.search-results.com'

Awaiting further instructions, thanks.

Sean.

#6 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 21 June 2011 - 08:19 AM

Hello

I would like to get a little deeper scan of the system so I would like you to run this for me

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.

Double click on OTL.exe to run it.
Under Output, ensure that Minimal Output is selected.
Under Extra Registry section, select Use SafeList.
Click the Scan All Users checkbox.
Click on Run Scan at the top left hand corner.
When done, two Notepad files will open.
- OTL.txt <-- Will be opened and the that I need posted back here
- Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
Please post the contents of OTListIt.txt in your next reply.

Gringo

<-- Don't worry every little bit helps.

#7 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 21 June 2011 - 02:47 PM

Please see output below, thanks.

OTL logfile created on: 6/22/2011 7:39:56 AM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = G:\Users\Sean\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: New Zealand | Language: ENZ | Date Format: d/MM/yyyy

2.91 Gb Total Physical Memory | 1.60 Gb Available Physical Memory | 55.02% Memory free
5.81 Gb Paging File | 4.26 Gb Available in Paging File | 73.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = G: | %SystemRoot% = G:\Windows | %ProgramFiles% = G:\Program Files
Drive C: | 243.78 Gb Total Space | 69.93 Gb Free Space | 28.68% Space Free | Partition Type: NTFS
Drive E: | 11.10 Gb Total Space | 1.80 Gb Free Space | 16.25% Space Free | Partition Type: NTFS
Drive G: | 43.20 Gb Total Space | 2.68 Gb Free Space | 6.20% Space Free | Partition Type: NTFS

Computer Name: SEAN-PC | User Name: Sean | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - G:\Users\Sean\Downloads\OTL.exe (OldTimer Tools)
PRC - G:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - G:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - G:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - G:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - G:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - G:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - G:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - G:\Windows\explorer.exe (Microsoft Corporation)
PRC - G:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - G:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - G:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - G:\Windows\System32\StikyNot.exe (Microsoft Corporation)
PRC - G:\Windows\System32\conhost.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - G:\Users\Sean\Downloads\OTL.exe (OldTimer Tools)
MOD - G:\Windows\System32\guard32.dll (COMODO)
MOD - G:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) -- File not found
SRV - (AdobeARMservice) -- G:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (cmdAgent) -- G:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (AntiVirSchedulerService) -- G:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- G:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- G:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (WatAdminSvc) -- G:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- G:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (SensrSvc) -- G:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- G:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- G:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (inspect) -- G:\Windows\System32\drivers\inspect.sys (COMODO)
DRV - (cmdHlp) -- G:\Windows\System32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) -- G:\Windows\System32\drivers\cmdGuard.sys (COMODO)
DRV - (avipbb) -- G:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- G:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (epmntdrv) -- G:\Windows\System32\epmntdrv.sys ()
DRV - (EuGdiDrv) -- G:\Windows\System32\EuGdiDrv.sys ()
DRV - (vmbus) -- G:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- G:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- G:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WinUsb) -- G:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) -- G:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- G:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (athr) -- G:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (ssmdrv) -- G:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (CnxtHdAudService) -- G:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (PQNTDrv) -- G:\Windows\System32\drivers\PQNTDRV.sys (PowerQuest Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - G:\Program Files\BitTorrentBar\tbBit1.dll (Conduit Ltd.)

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-nz
IE - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 87 1B 95 99 41 2D CC 01 [binary data]
IE - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - G:\Program Files\BitTorrentBar\tbBit1.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: calendar-timezones@mozilla.org:0.1.2008d
FF - prefs.js..extensions.enabledItems: default-palette@celtx.com:1.0
FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.0
FF - prefs.js..extensions.enabledItems: messagestyle-blackened@addons.instantbird.org:0.9
FF - prefs.js..extensions.enabledItems: messagestyle-depth@addons.instantbird.org:1.1
FF - prefs.js..extensions.enabledItems: messagestyle-minimal20@addons.instantbird.org:1.5

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: G:\Windows\Microsoft.NET\Framework\v4.0.20506\WPF\DotNetAssistantExtension\ [2010/04/01 05:58:47 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: G:\Program Files\Mozilla Firefox\components [2011/05/21 23:20:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: G:\Program Files\Mozilla Firefox\plugins

[2011/06/15 00:11:54 | 000,000,000 | ---D | M] (No name found) -- G:\Users\Sean\AppData\Roaming\Mozilla\Extensions
[2010/04/05 03:12:08 | 000,000,000 | ---D | M] (No name found) -- G:\Users\Sean\AppData\Roaming\Mozilla\Extensions\celtx@celtx.com
[2011/06/15 00:12:00 | 000,000,000 | ---D | M] (No name found) -- G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions
[2010/09/22 22:05:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/03/26 09:14:24 | 000,000,000 | ---D | M] (BitTorrentBar Community Toolbar) -- G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}
[2011/03/26 09:14:21 | 000,000,000 | ---D | M] (Conduit Engine) -- G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com
[2011/06/15 00:12:15 | 000,000,000 | ---D | M] (No name found) -- G:\Program Files\Mozilla Firefox\extensions
[2011/05/19 23:47:10 | 000,000,000 | ---D | M] (Java Console) -- G:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\EXTENSIONS\CALENDAR-TIMEZONES@MOZILLA.ORG
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\EXTENSIONS\DEFAULT-PALETTE@CELTX.COM
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\EXTENSIONS\INSPECTOR@MOZILLA.ORG
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\EXTENSIONS\MESSAGESTYLE-BLACKENED@ADDONS.INSTANTBIRD.ORG
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\EXTENSIONS\MESSAGESTYLE-DEPTH@ADDONS.INSTANTBIRD.ORG
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\EXTENSIONS\MESSAGESTYLE-MINIMAL20@ADDONS.INSTANTBIRD.ORG
[2011/05/21 23:20:28 | 000,142,296 | ---- | M] (Mozilla Foundation) -- G:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 20:00:00 | 000,002,252 | ---- | M] () -- G:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/06/18 19:51:27 | 000,000,027 | ---- | M]) - G:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - G:\Program Files\BitTorrentBar\tbBit1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found
O3 - HKLM\..\Toolbar: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - G:\Program Files\BitTorrentBar\tbBit1.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found
O4 - HKLM..\Run: [avgnt] G:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [COMODO Internet Security] G:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [DivXUpdate] G:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKU\S-1-5-21-3892213315-733465618-2972856026-1000..\Run: [RESTART_STICKY_NOTES] G:\Windows\System32\StikyNot.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - G:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - G:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found
O20 - AppInit_DLLs: (G:\Windows\System32\guard32.dll) - G:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - G:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - G:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/19 09:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/11 09:42:20 | 000,000,024 | ---- | M] () - G:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/20 21:41:45 | 000,000,000 | ---D | C] -- G:\Windows\temp
[2011/06/20 21:41:08 | 000,000,000 | -HSD | C] -- G:\$RECYCLE.BIN
[2011/06/19 23:27:29 | 000,000,000 | ---D | C] -- G:\Program Files\Amazon
[2011/06/18 20:01:32 | 000,000,000 | ---D | C] -- G:\Config.Msi
[2011/06/18 19:27:28 | 000,518,144 | ---- | C] (SteelWerX) -- G:\Windows\SWREG.exe
[2011/06/18 19:27:28 | 000,406,528 | ---- | C] (SteelWerX) -- G:\Windows\SWSC.exe
[2011/06/18 19:27:28 | 000,060,416 | ---- | C] (NirSoft) -- G:\Windows\NIRCMD.exe
[2011/06/18 19:27:14 | 000,000,000 | ---D | C] -- G:\Windows\ERDNT
[2011/06/18 19:24:23 | 000,000,000 | ---D | C] -- G:\Qoobox
[2011/06/17 10:45:26 | 000,000,000 | ---D | C] -- G:\Users\Sean\Desktop\Ant's Stuff
[2011/06/16 18:12:14 | 000,161,792 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\d3d10_1.dll
[2011/06/16 18:12:05 | 000,606,208 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\mstime.dll
[2011/06/16 18:12:05 | 000,599,552 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\msfeeds.dll
[2011/06/16 18:12:05 | 000,381,440 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\iedkcs32.dll
[2011/06/16 18:12:05 | 000,185,856 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\iepeers.dll
[2011/06/16 18:12:05 | 000,176,640 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\ieui.dll
[2011/06/16 18:12:05 | 000,064,512 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\msfeedsbs.dll
[2011/06/16 18:12:05 | 000,048,128 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\jsproxy.dll
[2011/06/16 18:12:05 | 000,044,544 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\licmgr10.dll
[2011/06/16 18:12:04 | 001,638,912 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\mshtml.tlb
[2011/06/16 18:12:04 | 000,386,048 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\html.iec
[2011/06/16 18:12:04 | 000,012,800 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\msfeedssync.exe
[2011/05/30 00:29:52 | 000,000,000 | ---D | C] -- G:\Users\Sean\Documents\Acting Docs and Scripts
[2011/05/27 01:18:28 | 000,000,000 | ---D | C] -- G:\Users\Sean\Desktop\Malware Logs
[2011/05/25 23:24:27 | 000,026,496 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\drivers\Diskdump.sys
[2011/05/25 22:58:41 | 000,000,000 | ---D | C] -- G:\Windows\System32\EventProviders
[2011/05/24 21:34:08 | 000,000,000 | ---D | C] -- G:\Users\Sean\Documents\My Received Files
[2010/08/25 17:59:08 | 000,004,096 | ---- | C] ( ) -- G:\Windows\System32\IGFXDEVLib.dll
[2 G:\Users\Sean\Desktop\*.tmp files -> G:\Users\Sean\Desktop\*.tmp -> ]
[2 G:\Users\Sean\*.tmp files -> G:\Users\Sean\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/22 07:41:10 | 000,017,168 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/22 07:41:10 | 000,017,168 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/22 07:39:00 | 000,000,940 | ---- | M] () -- G:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-500UA.job
[2011/06/22 07:35:31 | 000,000,904 | ---- | M] () -- G:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-1000UA.job
[2011/06/22 07:35:28 | 000,000,882 | ---- | M] () -- G:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/22 07:35:24 | 000,067,584 | --S- | M] () -- G:\Windows\bootstat.dat
[2011/06/21 23:25:00 | 000,000,852 | ---- | M] () -- G:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-1000Core.job
[2011/06/21 21:40:05 | 000,015,982 | ---- | M] () -- G:\Users\Sean\Desktop\Duped.pdf
[2011/06/21 19:03:54 | 000,000,878 | ---- | M] () -- G:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/21 18:58:14 | 000,000,888 | ---- | M] () -- G:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3892213315-733465618-2972856026-500Core.job
[2011/06/19 23:27:35 | 000,002,005 | ---- | M] () -- G:\Users\Sean\Desktop\Kindle.lnk
[2011/06/19 22:12:02 | 000,000,156 | ---- | M] () -- G:\Users\Sean\defogger_reenable
[2011/06/19 00:24:28 | 000,687,918 | ---- | M] () -- G:\Windows\System32\perfh009.dat
[2011/06/19 00:24:28 | 000,128,620 | ---- | M] () -- G:\Windows\System32\perfc009.dat
[2011/06/18 20:02:06 | 000,001,989 | ---- | M] () -- G:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/06/18 19:51:27 | 000,000,027 | ---- | M] () -- G:\Windows\System32\drivers\etc\hosts
[2011/06/15 11:36:55 | 000,002,391 | ---- | M] () -- G:\Users\Sean\Desktop\Google Chrome.lnk
[2011/06/12 16:19:39 | 000,000,000 | -H-- | M] () -- G:\Users\Sean\Documents\Default.rdp
[2011/06/08 01:29:36 | 000,170,900 | ---- | M] () -- G:\Users\Sean\Desktop\De(b)t.pdf
[2011/05/28 15:00:02 | 001,638,912 | ---- | M] (Microsoft Corporation) -- G:\Windows\System32\mshtml.tlb
[2 G:\Users\Sean\Desktop\*.tmp files -> G:\Users\Sean\Desktop\*.tmp -> ]
[2 G:\Users\Sean\*.tmp files -> G:\Users\Sean\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/19 23:27:35 | 000,002,005 | ---- | C] () -- G:\Users\Sean\Desktop\Kindle.lnk
[2011/06/19 22:12:00 | 000,000,156 | ---- | C] () -- G:\Users\Sean\defogger_reenable
[2011/06/18 20:02:06 | 000,002,441 | ---- | C] () -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/06/18 20:02:06 | 000,001,989 | ---- | C] () -- G:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/06/18 19:27:28 | 000,256,512 | ---- | C] () -- G:\Windows\PEV.exe
[2011/06/18 19:27:28 | 000,208,896 | ---- | C] () -- G:\Windows\MBR.exe
[2011/06/18 19:27:28 | 000,098,816 | ---- | C] () -- G:\Windows\sed.exe
[2011/06/18 19:27:28 | 000,080,412 | ---- | C] () -- G:\Windows\grep.exe
[2011/06/18 19:27:28 | 000,068,096 | ---- | C] () -- G:\Windows\zip.exe
[2011/06/12 16:19:39 | 000,000,000 | -H-- | C] () -- G:\Users\Sean\Documents\Default.rdp
[2011/06/12 00:12:35 | 000,015,982 | ---- | C] () -- G:\Users\Sean\Desktop\Duped.pdf
[2011/06/08 01:29:36 | 000,170,900 | ---- | C] () -- G:\Users\Sean\Desktop\De(b)t.pdf
[2011/04/29 21:53:40 | 000,000,056 | -H-- | C] () -- G:\Windows\System32\ezsidmv.dat
[2011/03/31 17:04:33 | 000,000,000 | ---- | C] () -- G:\Windows\nsreg.dat
[2011/03/07 11:26:56 | 000,000,376 | ---- | C] () -- G:\Windows\ODBC.INI
[2011/01/14 19:01:18 | 000,000,037 | ---- | C] () -- G:\Windows\QTW.INI
[2011/01/03 10:09:39 | 000,178,904 | ---- | C] () -- G:\Users\Sean\AppData\Roaming\UserTile.png
[2011/01/02 13:48:51 | 000,000,178 | ---- | C] () -- G:\Windows\_delis43.ini
[2011/01/02 13:28:29 | 000,000,750 | ---- | C] () -- G:\Windows\KA.INI
[2010/08/25 18:30:02 | 000,439,308 | ---- | C] () -- G:\Windows\System32\igcompkrng500.bin
[2010/08/25 18:30:00 | 000,982,240 | ---- | C] () -- G:\Windows\System32\igkrng500.bin
[2010/08/25 18:30:00 | 000,092,356 | ---- | C] () -- G:\Windows\System32\igfcg500m.bin
[2010/07/28 02:43:49 | 000,000,000 | ---- | C] () -- G:\Windows\Irremote.ini
[2010/05/24 23:08:59 | 000,598,016 | ---- | C] () -- G:\Windows\System32\viscomqtde.dll
[2010/05/24 21:22:43 | 000,000,069 | ---- | C] () -- G:\Windows\NeroDigital.ini
[2010/05/23 09:22:40 | 001,718,912 | ---- | C] () -- G:\Windows\System32\BootMan.exe
[2010/05/23 09:22:40 | 000,014,848 | ---- | C] () -- G:\Windows\System32\EuEpmGdi.dll
[2010/05/23 09:22:28 | 000,086,408 | ---- | C] () -- G:\Windows\System32\setupempdrv03.exe
[2010/05/23 09:22:11 | 000,008,456 | ---- | C] () -- G:\Windows\System32\EuGdiDrv.sys
[2010/05/23 09:21:42 | 000,014,216 | ---- | C] () -- G:\Windows\System32\epmntdrv.sys
[2010/05/20 17:19:37 | 000,001,025 | ---- | C] () -- G:\Windows\System32\sysprs7.dll
[2010/05/20 17:19:37 | 000,001,025 | ---- | C] () -- G:\Windows\System32\clauth2.dll
[2010/05/20 17:19:37 | 000,001,025 | ---- | C] () -- G:\Windows\System32\clauth1.dll
[2010/05/20 17:19:37 | 000,000,205 | ---- | C] () -- G:\Windows\System32\lsprst7.dll
[2010/05/20 17:19:37 | 000,000,073 | ---- | C] () -- G:\Windows\System32\ssprs.dll
[2010/05/20 17:19:37 | 000,000,021 | ---- | C] () -- G:\Windows\SurCode.INI
[2010/05/18 00:06:56 | 000,000,419 | ---- | C] () -- G:\Windows\BRWMARK.INI
[2010/05/18 00:05:15 | 000,000,050 | ---- | C] () -- G:\Windows\System32\bridf08b.dat
[2010/05/18 00:00:11 | 000,031,767 | ---- | C] () -- G:\Windows\maxlink.ini
[2010/04/19 04:03:03 | 000,000,081 | ---- | C] () -- G:\Users\Sean\AppData\Roaming\default.pls
[2010/04/01 16:15:26 | 000,008,192 | ---- | C] () -- G:\Users\Sean\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/31 02:12:31 | 000,165,376 | ---- | C] () -- G:\Windows\System32\unrar.dll
[2010/03/31 02:12:30 | 000,000,038 | ---- | C] () -- G:\Windows\avisplitter.ini
[2010/03/31 02:12:26 | 000,881,664 | ---- | C] () -- G:\Windows\System32\xvidcore.dll
[2010/03/31 02:12:26 | 000,205,824 | ---- | C] () -- G:\Windows\System32\xvidvfw.dll
[2010/03/31 02:12:22 | 000,085,504 | ---- | C] () -- G:\Windows\System32\ff_vfw.dll
[2010/03/29 23:19:25 | 000,007,594 | ---- | C] () -- G:\Users\Sean\AppData\Local\Resmon.ResmonCfg
[2010/03/27 23:38:58 | 000,140,288 | ---- | C] () -- G:\Windows\System32\igfxtvcx.dll
[2010/02/10 23:12:08 | 000,000,151 | ---- | C] () -- G:\Windows\System32\GfxUI.exe.config
[2010/02/10 23:05:42 | 000,208,896 | ---- | C] () -- G:\Windows\System32\iglhsip32.dll
[2010/02/10 23:05:42 | 000,143,360 | ---- | C] () -- G:\Windows\System32\iglhcp32.dll
[2009/07/14 16:57:37 | 000,067,584 | --S- | C] () -- G:\Windows\bootstat.dat
[2009/07/14 16:33:53 | 002,367,536 | ---- | C] () -- G:\Windows\System32\FNTCACHE.DAT
[2009/07/14 14:05:48 | 000,687,918 | ---- | C] () -- G:\Windows\System32\perfh009.dat
[2009/07/14 14:05:48 | 000,291,294 | ---- | C] () -- G:\Windows\System32\perfi009.dat
[2009/07/14 14:05:48 | 000,128,620 | ---- | C] () -- G:\Windows\System32\perfc009.dat
[2009/07/14 14:05:48 | 000,031,548 | ---- | C] () -- G:\Windows\System32\perfd009.dat
[2009/07/14 14:05:05 | 000,000,741 | ---- | C] () -- G:\Windows\System32\NOISE.DAT
[2009/07/14 14:04:11 | 000,215,943 | ---- | C] () -- G:\Windows\System32\dssec.dat
[2009/07/14 12:19:49 | 000,066,048 | ---- | C] () -- G:\Windows\System32\PrintBrmUi.exe
[2009/07/14 11:55:01 | 000,043,131 | ---- | C] () -- G:\Windows\mib.bin
[2009/07/14 11:51:43 | 000,073,728 | ---- | C] () -- G:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 11:42:10 | 000,064,000 | ---- | C] () -- G:\Windows\System32\BWContextHandler.dll
[2009/07/14 11:13:11 | 000,008,704 | ---- | C] () -- G:\Windows\System32\procinst.dll
[2009/07/14 10:09:19 | 000,139,824 | ---- | C] () -- G:\Windows\System32\igfcg500.bin
[2009/06/11 09:26:10 | 000,673,088 | ---- | C] () -- G:\Windows\System32\mlang.dat

< End of report >

#8 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 25 June 2011 - 03:12 PM

Hello

I want you to run this custem OTL script for me and then let me know how things are after you finish.

Run OTL Script

Double-click OTL.exe to start the program.

Copy and Paste the following code into the Posted Image

textbox. Do not include the word Code

:otl
IE - HKLM\..\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found
O3 - HKU\S-1-5-21-3892213315-733465618-2972856026-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
[2011/03/26 09:14:21 | 000,000,000 | ---D | M] (Conduit Engine) -- G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com
[2010/07/15 15:23:48 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
O2 - BHO: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - G:\Program Files\BitTorrentBar\tbBit1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - G:\Program Files\BitTorrentBar\tbBit1.dll (Conduit Ltd.)
O32 - AutoRun File - [2006/09/19 09:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/11 09:42:20 | 000,000,024 | ---- | M] () - G:\autoexec.bat -- [ NTFS ]
:Files
ipconfig /flushdns /c
:Commands
[PURITY] 
[EMPTYTEMP]
[EMPTYFLASH]
[RESETHOSTS]

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

<-- Don't worry every little bit helps.

#9 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 25 June 2011 - 08:03 PM

Hi Gringo,

Performed and output below, rebooted as it requested one. Thanks.

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3892213315-733465618-2972856026-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
G:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechrome\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}\ not found.
File {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\META-INF folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\lib folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\defaults folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\components folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com\chrome folder moved successfully.
G:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\kb5pfudh.default\extensions\engine@conduit.com folder moved successfully.
C:\PROGRAM FILES\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE\chrome folder moved successfully.
C:\PROGRAM FILES\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE folder moved successfully.
Prefs.js: emoticons-msn-smileys@m513901.de:0.1 removed from extensions.enabledItems
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}\ deleted successfully.
G:\Program Files\BitTorrentBar\tbBit1.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{88c7f2aa-f93f-432c-8f0e-b7d85967a527} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}\ not found.
File G:\Program Files\BitTorrentBar\tbBit1.dll not found.
C:\autoexec.bat moved successfully.
G:\autoexec.bat moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
G:\Users\Sean\Downloads\cmd.bat deleted successfully.
G:\Users\Sean\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 697964 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 49773583 bytes
->Google Chrome cache emptied: 181197645 bytes
->Flash cache emptied: 21576 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Sean
->Temp folder emptied: 2479593 bytes
->Temporary Internet Files folder emptied: 19211599 bytes
->Java cache emptied: 1079444 bytes
->FireFox cache emptied: 58386491 bytes
->Google Chrome cache emptied: 293582798 bytes
->Flash cache emptied: 73798 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 94797273 bytes
RecycleBin emptied: 85430 bytes

Total Files Cleaned = 669.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default

User: Default User

User: Public

User: Sean
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

G:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.24.1 log created on 06262011_124823

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Sean.

#10 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 25 June 2011 - 11:28 PM

Hello

How are things doing now?

gringo

<-- Don't worry every little bit helps.

#11 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 25 June 2011 - 11:51 PM

Hi gringo,

About the same. When I type in a search from the top chrome URL search bar, searchqu is shown in this bar and results take a while to come through. But it is intermittent, so doesn't happen every time.

Sean.

#12 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 26 June 2011 - 12:02 AM

Create and Run Batch File

Notepad

@echo off
>Log1.txt (
ipconfig /all
nslookup google.com
nslookup yahoo.com
ping -n 2 google.com
ping -n 2 yahoo.com
route print
)
start Log1.txt
del %0

router.bat

Save type as - All Files

Desktop

router.bat

gringo

<-- Don't worry every little bit helps.

#13 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 26 June 2011 - 04:42 AM

Hi gringo,

Please find the batch file output below:

Windows IP Configuration

Host Name . . . . . . . . . . . . : Sean-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : localdomain

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : Atheros AR5007 802.11b/g WiFi Adapter
Physical Address. . . . . . . . . : 00-24-2B-8A-93-F7
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Sunday, 26 June 2011 1:01:29 p.m.
Lease Expires . . . . . . . . . . : Monday, 27 June 2011 9:37:19 p.m.
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC (NDIS 6.20)
Physical Address. . . . . . . . . : 00-1F-16-6D-3D-4B
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.dummy.porta.siemens.net:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:24bc:34aa:89a3:cb2e(Preferred)
Link-local IPv6 Address . . . . . : fe80::24bc:34aa:89a3:cb2e%14(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter 6TO4 Adapter:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.localdomain:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 192.168.1.1

Name: google.com
Addresses: 64.233.183.147
64.233.183.99
64.233.183.103
64.233.183.104
64.233.183.105
64.233.183.106

Server: UnKnown
Address: 192.168.1.1

Name: yahoo.com
Addresses: 98.137.149.56
209.191.122.70
67.195.160.76
69.147.125.65
72.30.2.43

Pinging google.com [64.233.183.106] with 32 bytes of data:
Reply from 64.233.183.106: bytes=32 time=180ms TTL=47
Reply from 64.233.183.106: bytes=32 time=181ms TTL=47

Ping statistics for 64.233.183.106:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 180ms, Maximum = 181ms, Average = 180ms

Pinging yahoo.com [72.30.2.43] with 32 bytes of data:
Reply from 72.30.2.43: bytes=32 time=160ms TTL=52
Reply from 72.30.2.43: bytes=32 time=171ms TTL=52

Ping statistics for 72.30.2.43:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 160ms, Maximum = 171ms, Average = 165ms
===========================================================================
Interface List
12...00 24 2b 8a 93 f7 ......Atheros AR5007 802.11b/g WiFi Adapter
11...00 1f 16 6d 3d 4b ......Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC (NDIS 6.20)
1...........................Software Loopback Interface 1
13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.3 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.3 281
192.168.1.3 255.255.255.255 On-link 192.168.1.3 281
192.168.1.255 255.255.255.255 On-link 192.168.1.3 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.3 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.3 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
125.252.224.88 255.255.255.252 192.168.0.200 1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
14 58 ::/0 On-link
1 306 ::1/128 On-link
14 58 2001::/32 On-link
14 306 2001:0:4137:9e76:24bc:34aa:89a3:cb2e/128
On-link
14 306 fe80::/64 On-link
14 306 fe80::24bc:34aa:89a3:cb2e/128
On-link
1 306 ff00::/8 On-link
14 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Regards,

Sean.

#14 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,463
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 26 June 2011 - 05:50 AM

After you have run these steps - you need to let me know how the computer is doing

Resetting Router

This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
If you don’t know the router's default password, you can look it up. Here
You also need to reconfigure any security settings you had in place prior to the reset.
You may also need to consult with your Internet service provider to find out which DNS servers your network should be using or you can use OpenDNS

Note: After resetting your router, it is important to set a non-default password, and if possible, username, on the router. This will assist in eliminating the possibility of the router being hijacked again.

flush the DNS:

Now lets flush the DNS on the computer:

click on Start
select run
enter cmd and hit enter
a black window will open.
please enter the following text into that window and hit enter:

Now lets check the router again

Create and Run Batch File

Notepad

@echo off
>Log1.txt (
ipconfig /all
nslookup google.com
nslookup yahoo.com
ping -n 2 google.com
ping -n 2 yahoo.com
route print
)
start Log1.txt
del %0

router.bat

Save type as - All Files

Desktop

router.bat

gringo

<-- Don't worry every little bit helps.

#15 SeanOC

Member

Group: Members
Posts: 35
Joined: 24-May 11

Posted 26 June 2011 - 06:13 AM

Hi gringo,

Interesting you say about the router being hijacked as I live in a place with 2 other guys and we have noticed slow internet over the last 3 weeks (probably since this started happening when I think about it). We put it down to us going over net usage for the month as our ISP then throttles back to dial-up for the remainder of the billing period. We have usage caps here in New Zealand.

I did a speed test yesterday and we weren't on download of 56Kbps, more like 80Mbps, so I knew something else was a problem. I said to my friend that we should try a router reset this morning and this speeded things a great deal. Back to 10Mbps on download.

I have just reset the router again and flushed DNS as requested. Here is the output:

Windows IP Configuration

Host Name . . . . . . . . . . . . : Sean-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : localdomain

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : Atheros AR5007 802.11b/g WiFi Adapter
Physical Address. . . . . . . . . : 00-24-2B-8A-93-F7
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Sunday, 26 June 2011 1:01:29 p.m.
Lease Expires . . . . . . . . . . : Monday, 27 June 2011 9:37:18 p.m.
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1
192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC (NDIS 6.20)
Physical Address. . . . . . . . . : 00-1F-16-6D-3D-4B
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.dummy.porta.siemens.net:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:24bc:34aa:89a3:cb2e(Preferred)
Link-local IPv6 Address . . . . . : fe80::24bc:34aa:89a3:cb2e%14(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter 6TO4 Adapter:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.localdomain:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 192.168.1.1

Name: google.com
Addresses: 64.233.183.105
64.233.183.104
64.233.183.103
64.233.183.99
64.233.183.147
64.233.183.106

Server: UnKnown
Address: 192.168.1.1

Name: yahoo.com
Addresses: 98.137.149.56
72.30.2.43
69.147.125.65
67.195.160.76
209.191.122.70

Pinging google.com [64.233.183.104] with 32 bytes of data:
Reply from 64.233.183.104: bytes=32 time=188ms TTL=47
Reply from 64.233.183.104: bytes=32 time=180ms TTL=47

Ping statistics for 64.233.183.104:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 180ms, Maximum = 188ms, Average = 184ms

Pinging yahoo.com [72.30.2.43] with 32 bytes of data:
Reply from 72.30.2.43: bytes=32 time=150ms TTL=52
Reply from 72.30.2.43: bytes=32 time=150ms TTL=52

Ping statistics for 72.30.2.43:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 150ms, Maximum = 150ms, Average = 150ms
===========================================================================
Interface List
12...00 24 2b 8a 93 f7 ......Atheros AR5007 802.11b/g WiFi Adapter
11...00 1f 16 6d 3d 4b ......Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC (NDIS 6.20)
1...........................Software Loopback Interface 1
13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.3 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.3 281
192.168.1.3 255.255.255.255 On-link 192.168.1.3 281
192.168.1.255 255.255.255.255 On-link 192.168.1.3 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.3 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.3 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
125.252.224.88 255.255.255.252 192.168.0.200 1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
14 58 ::/0 On-link
1 306 ::1/128 On-link
14 58 2001::/32 On-link
14 306 2001:0:4137:9e76:24bc:34aa:89a3:cb2e/128
On-link
14 306 fe80::/64 On-link
14 306 fe80::24bc:34aa:89a3:cb2e/128
On-link
1 306 ff00::/8 On-link
14 306 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Regards,

Sean.