WINDOWS RESTORE 2011 is WINNING. Please help.

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

4 Pages
1
2
3
→
Last »

You cannot start a new topic
This topic is locked

WINDOWS RESTORE 2011 is WINNING. Please help.

#1 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 20 June 2011 - 02:52 AM

Hi there, I feel stupefied.

Two weeks ago I got the Windows Restore 2011 virus. I had it two months ago too, named AntiVirus XP 2011, and Dell and Microsoft removed it after many hours using Vipre Rescue scanner, Malwarebytes and some registry work.

In comes the Windows Restore 2011 virus. I ran Malwarebytes first in safe mode, did some registry work, unhid my hidden stuff, got my internet back (for the most part), and ran Vipre Rescue and Spybot.

Since then, June 8th, I have full internet access and the comp works fine but cannot do the following things:
**it cannot run System Restore. It has daily restore points for every day since the 8th of June, but none of them work. It gets to reboot, and then it tells me that it cannot restore after reboot. This worries me.
**it cannot open most of my often-used banking websites and a few other sites requiring a login. I did get into two of them for about four solid minutes and felt just elated, and then they clogged up on me again. This happens in Firefox (with a timeout message) and in Explorer (with a Bing search redirect and then on clicking the websitename.com there is an Internet Explorer Cannot Display This Webpage message).

Dell technicians have visited my computer. One said I'd have to do a restore of the whole system. Another one just gave up and disconnected two hours in. My ISP and I confirmed it is only on this computer.

So I have installed:
Microsoft Security Essentials
Malwarebytes
CCleaner (Dell installed this week)
Cleanup! (Dell installed this week)
Vipre Rescue (latest version, not yet run)
Hijack This

I don't actually know what to do with hijack This, but it won't update anyway.

I tried resetting the hosts file on the suggestion of my ISP. Nope.

I have read about Combofix and am afraid. Should this be the next step?

Thanks for any help. (By the way, I tried to remove the virus with the tutorial from bleepingcomputer.)

Below are DDS. Attached is attach.txt and GMER log as ark.txt...

attach.txt (18.93K)
Number of downloads: 0

ark.txt (2.76K)
Number of downloads: 1
.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_26
Run by bigcat1 at 0:56:50 on 2011-06-20
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.318 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Battery Meter\BTMeter.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
svchost.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\bigcat1\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.live.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [BTMeter] c:\program files\battery meter\BTMeter.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
Trusted Zone: capitalone.com\www
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{A8B8B82A-5A00-4025-BA7A-4241B4585A33} : DhcpNameServer = 209.18.47.61 209.18.47.62
Notify: GoToAssist - c:\program files\citrix\gotoassist\615\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bigcat1\application data\mozilla\firefox\profiles\n88xghee.default\
FF - plugin: c:\documents and settings\bigcat1\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\bigcat1\local settings\application data\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [2009-8-20 14248]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl609c047a;MpKsl609c047a;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\MpKsl609c047a.sys [2011-6-19 28752]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-4-27 98392]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-8-20 143840]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [2009-8-20 135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [2009-8-20 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [2009-8-20 272032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-8-20 162816]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-16 39984]
S1 MpKsl22e89228;MpKsl22e89228;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\mpksl22e89228.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\MpKsl22e89228.sys [?]
S1 MpKsl3448d419;MpKsl3448d419;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{74623d37-6d76-4c1c-8642-6857c725856c}\mpksl3448d419.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{74623d37-6d76-4c1c-8642-6857c725856c}\MpKsl3448d419.sys [?]
S1 MpKsl3ee8e49f;MpKsl3ee8e49f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{56026812-6d03-433b-a527-527aff942f78}\mpksl3ee8e49f.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{56026812-6d03-433b-a527-527aff942f78}\MpKsl3ee8e49f.sys [?]
S1 MpKsl765192aa;MpKsl765192aa;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\mpksl765192aa.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\MpKsl765192aa.sys [?]
S1 MpKslbede01a6;MpKslbede01a6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\mpkslbede01a6.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\MpKslbede01a6.sys [?]
S2 0114211258051431mcinstcleanup;McAfee Application Installer Cleanup (0114211258051431);c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-8-20 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-6-12 135664]
.
=============== Created Last 30 ================
.
2011-06-20 03:37:53 -------- d-----w- C:\VIPRERESCUE
2011-06-20 03:30:05 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\MpKsl609c047a.sys
2011-06-20 03:29:25 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\mpengine.dll
2011-06-20 02:09:06 -------- d-----w- c:\documents and settings\bigcat1\application data\SupportSoft
2011-06-20 02:08:10 -------- d-----w- c:\program files\common files\supportsoft
2011-06-17 12:04:26 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-17 06:24:24 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-06-16 06:49:03 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-16 06:48:54 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-16 06:12:21 -------- d-----w- c:\program files\Microsoft Security Client
2011-06-16 04:27:17 -------- d-----w- c:\documents and settings\bigcat1\local settings\application data\WMTools Downloaded Files
2011-06-16 03:53:13 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-06-16 03:53:06 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-06-16 03:53:06 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-06-16 03:52:59 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-06-16 03:52:53 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-06-16 03:52:46 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2011-06-16 03:52:39 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-06-16 03:52:38 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-06-16 03:52:34 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-06-16 03:52:33 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2011-06-16 03:52:20 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-06-16 03:52:17 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-06-16 03:52:11 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-06-16 03:52:00 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-06-16 03:50:57 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2011-06-16 03:50:57 19528 -c--a-w- c:\windows\system32\dllcache\w840nd.sys
2011-06-16 03:50:51 64605 -c--a-w- c:\windows\system32\dllcache\vvoice.sys
2011-06-16 03:50:44 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll
2011-06-16 03:50:44 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-06-16 03:50:43 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll
2011-06-16 03:50:37 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys
2011-06-16 03:50:31 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys
2011-06-16 03:50:25 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys
2011-06-16 03:50:22 11325 -c--a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-06-16 03:50:16 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-06-16 03:50:10 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2011-06-16 03:50:03 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2011-06-16 03:48:58 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-06-16 03:48:52 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-06-16 03:48:46 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-06-16 03:48:40 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-06-16 03:48:34 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-06-16 03:48:28 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-06-16 03:48:23 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2011-06-16 03:48:20 44672 -c--a-w- c:\windows\system32\dllcache\uagp35.sys
2011-06-16 03:48:14 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2011-06-16 03:48:14 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2011-06-16 03:48:07 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-06-16 03:48:01 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2011-06-16 03:47:55 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-06-16 03:47:49 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2011-06-16 03:47:43 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-06-16 03:47:38 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2011-06-16 03:47:32 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2011-06-16 03:47:26 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll
2011-06-16 03:47:24 82944 -c--a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-06-16 03:47:19 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll
2011-06-16 03:47:12 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-06-16 03:47:06 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-06-16 03:47:00 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-06-16 03:45:55 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2011-06-16 03:45:50 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2011-06-16 03:45:44 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-06-16 03:45:39 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-06-16 03:45:34 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-06-16 03:45:29 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-06-16 03:45:23 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-06-16 03:45:17 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-06-16 03:45:12 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-06-16 03:45:07 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2011-06-16 03:45:01 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-06-16 03:43:55 7168 -c--a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-06-16 03:42:56 28160 -c--a-w- c:\windows\system32\dllcache\sm91w.dll
2011-06-16 03:41:55 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-06-16 03:40:54 57856 -c--a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-06-16 03:40:54 11648 -c--a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-06-16 03:40:48 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys
2011-06-16 03:40:43 16640 -c--a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-06-16 03:40:38 23936 -c--a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-06-16 03:40:33 23936 -c--a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-06-16 03:40:31 43904 -c--a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-06-16 03:40:26 495616 -c--a-w- c:\windows\system32\dllcache\sblfx.dll
2011-06-16 03:40:20 75392 -c--a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-06-16 03:40:15 245632 -c--a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-06-16 03:40:10 77824 -c--a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-06-16 03:40:05 198400 -c--a-w- c:\windows\system32\dllcache\s3sav4.dll
2011-06-16 03:40:00 61504 -c--a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2011-06-16 03:38:55 30720 -c--a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-06-16 03:37:55 3328 -c--a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-06-16 03:36:56 121344 -c--a-w- c:\windows\system32\dllcache\phvfwext.dll
2011-06-16 03:35:56 26153 -c--a-w- c:\windows\system32\dllcache\pcmlm56.sys
2011-06-16 03:34:59 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-06-16 03:33:58 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-06-16 03:33:56 28672 -c--a-w- c:\windows\system32\dllcache\nscirda.sys
2011-06-16 03:33:50 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-06-16 03:33:45 126080 -c--a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2011-06-16 03:33:40 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys
2011-06-16 03:33:38 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
2011-06-16 03:33:32 65278 -c--a-w- c:\windows\system32\dllcache\netflx3.sys
2011-06-16 03:33:27 39264 -c--a-w- c:\windows\system32\dllcache\neo20xx.sys
2011-06-16 03:33:22 60480 -c--a-w- c:\windows\system32\dllcache\neo20xx.dll
2011-06-16 03:33:17 15872 -c--a-w- c:\windows\system32\dllcache\ne2000.sys
2011-06-16 03:33:11 91488 -c--a-w- c:\windows\system32\dllcache\n9i3disp.dll
2011-06-16 03:33:06 27936 -c--a-w- c:\windows\system32\dllcache\n9i3d.sys
2011-06-16 03:33:01 33088 -c--a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-06-16 03:31:54 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys
2011-06-16 03:30:55 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
2011-06-16 03:29:59 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
2011-06-16 03:28:59 6656 -c--a-w- c:\windows\system32\dllcache\kbdlk41a.dll
2011-06-16 03:27:56 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys
2011-06-16 03:26:57 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-16 03:25:56 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
2011-06-16 03:24:57 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-06-16 03:23:59 46464 -c--a-w- c:\windows\system32\dllcache\gagp30kx.sys
2011-06-16 03:22:57 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-06-16 03:21:58 37120 -c--a-w- c:\windows\system32\dllcache\es1370mp.sys
2011-06-16 03:20:59 24653 -c--a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-06-16 03:19:59 41046 -c--a-w- c:\windows\system32\dllcache\digiisdn.dll
2011-06-16 03:18:59 93952 -c--a-w- c:\windows\system32\dllcache\cwcwdm.sys
2011-06-16 03:17:59 49182 -c--a-w- c:\windows\system32\dllcache\cem56n5.sys
2011-06-16 03:16:59 60416 -c--a-w- c:\windows\system32\dllcache\brserwdm.sys
2011-06-16 03:15:58 28672 -c--a-w- c:\windows\system32\dllcache\atinsnxx.sys
2011-06-16 03:14:59 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-06-16 03:13:49 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2011-06-14 10:26:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-13 03:19:50 -------- d-----w- c:\program files\CCleaner
2011-06-13 03:06:38 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-06-13 03:04:02 -------- d-----w- c:\program files\CleanUp!
2011-06-07 20:30:55 -------- d-sh--w- c:\documents and settings\bigcat1\IECompatCache
2011-05-22 02:36:37 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-05-04 06:25:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-28 16:43:30 103784 ----a-w- c:\documents and settings\bigcat1\GoToAssistDownloadHelper.exe
2011-04-25 15:51:58 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51:57 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51:57 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01:21 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 0:58:07.37 ===============

ark.txt (2.76K)
Number of downloads: 1

This post has been edited by schildkraut1: 20 June 2011 - 02:59 AM

#2 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 22 June 2011 - 12:15 PM

Update: The audio is distorted now, as of yesterday, at Windows startup jingle and on anything else requiring audio. It sounds like sounds get stuck and buzz momentarily.

No changes have been made to the computer since the first posting.

#3 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,453
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 25 June 2011 - 11:39 PM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

Do not run any other tool untill instructed to do so!
Please Do not Attach logs or put in code boxes.
Tell me about any problems that have occurred during the fix.
Tell me of any other symptoms you may be having as these can help also.
Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

DeFogger

desktop

DeFogger

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger may ask you to reboot the machine, if it does - click OK

Do not

Download DDS:

DDS by sUBs

Link1

Link2

Link3

Please disable any anti-malware program that will block scripts from running before running DDS.

Double-Click on dds.scr and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
A window will open instructing you save & post the logs
Save the logs to a convenient place such as your desktop
Copy the contents of both logs & post in your next reply

Scan With RKUnHooker

Please Download Rootkit Unhooker Save it to your desktop.
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
Wait till the scanner has finished and then click File, Save Report.
Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

information and logs:

In your next post I need the following

.logs from DDS
log from RKUnHooker
let me know of any problems you may have had

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->

<-- Don't worry every little bit helps.

#4 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 25 June 2011 - 11:45 PM

Thank you!!! Maybe a dumb question, but should i run these things in any specific order? Can I keep Firefox open?

This post has been edited by schildkraut1: 25 June 2011 - 11:55 PM

#5 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,453
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 26 June 2011 - 12:01 AM

run in the order listed and yes you can have firefox open for these

gringo

<-- Don't worry every little bit helps.

#6 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 26 June 2011 - 12:39 AM

OK. Before you go on to look at this, know that as of a few days ago the audio is distorted at startup and at all other times, as if something is getting stuck and hanging. The system has really slowed down.

dds.txt

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_26
Run by bigcat1 at 1:08:39 on 2011-06-26
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.561 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Battery Meter\BTMeter.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.live.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search

helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows

live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [BTMeter] c:\program files\battery meter\BTMeter.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
Trusted Zone: capitalone.com\www
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{A8B8B82A-5A00-4025-BA7A-4241B4585A33} : DhcpNameServer = 209.18.47.61 209.18.47.62
Notify: GoToAssist - c:\program files\citrix\gotoassist\615\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop

search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bigcat1\application data\mozilla\firefox\profiles\n88xghee.default\
FF - plugin: c:\documents and settings\bigcat1\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\bigcat1\local settings\application data\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [2009-8-20 14248]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl3c484091;MpKsl3c484091;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\MpKsl3c484091.sys [2011-6-25 28752]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-4-27 98392]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-8-20 143840]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [2009-8-20

135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [2009-8-20 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [2009-8-20 272032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-8-20 162816]
S1 MpKsl22e89228;MpKsl22e89228;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\mpksl22e89228.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\MpKsl22e89228.sys [?]
S1 MpKsl3448d419;MpKsl3448d419;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{74623d37-6d76-4c1c-8642-6857c725856c}\mpksl3448d419.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{74623d37-6d76-4c1c-8642-6857c725856c}\MpKsl3448d419.sys [?]
S1 MpKsl3ee8e49f;MpKsl3ee8e49f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{56026812-6d03-433b-a527-527aff942f78}\mpksl3ee8e49f.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{56026812-6d03-433b-a527-527aff942f78}\MpKsl3ee8e49f.sys [?]
S1 MpKsl5c26aa7c;MpKsl5c26aa7c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{40e38812-d861-422a-855f-8f046381331c}\mpksl5c26aa7c.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{40e38812-d861-422a-855f-8f046381331c}\MpKsl5c26aa7c.sys [?]
S1 MpKsl67e668a7;MpKsl67e668a7;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\mpksl67e668a7.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\MpKsl67e668a7.sys [?]
S1 MpKsl765192aa;MpKsl765192aa;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\mpksl765192aa.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\MpKsl765192aa.sys [?]
S1 MpKslbede01a6;MpKslbede01a6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\mpkslbede01a6.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\MpKslbede01a6.sys [?]
S2 0114211258051431mcinstcleanup;McAfee Application Installer Cleanup

(0114211258051431);c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog

-service --> c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-8-20 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-6-12 135664]
.
=============== Created Last 30 ================
.
2011-06-26 03:03:24 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\MpKsl3c484091.sys
2011-06-26 02:50:04 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\mpengine.dll
2011-06-23 21:45:09 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-23 21:45:07 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-22 15:02:16 -------- d-----w- c:\documents and settings\bigcat1\application data\ElevatedDiagnostics
2011-06-20 03:37:53 -------- d-----w- C:\VIPRERESCUE
2011-06-20 02:09:06 -------- d-----w- c:\documents and settings\bigcat1\application data\SupportSoft
2011-06-20 02:08:10 -------- d-----w- c:\program files\common files\supportsoft
2011-06-17 12:04:26 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-17 06:24:24 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\backup\mpengine.dll
2011-06-16 06:49:03 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-16 06:48:54 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-16 06:12:21 -------- d-----w- c:\program files\Microsoft Security Client
2011-06-16 04:27:17 -------- d-----w- c:\documents and settings\bigcat1\local settings\application data\WMTools Downloaded Files
2011-06-16 03:53:13 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-06-16 03:53:06 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-06-16 03:53:06 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-06-16 03:52:59 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-06-16 03:52:53 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-06-16 03:52:46 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2011-06-16 03:52:39 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-06-16 03:52:38 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-06-16 03:52:34 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-06-16 03:52:33 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2011-06-16 03:52:20 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-06-16 03:52:17 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-06-16 03:52:11 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-06-16 03:52:00 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-06-16 03:50:57 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2011-06-16 03:50:57 19528 -c--a-w- c:\windows\system32\dllcache\w840nd.sys
2011-06-16 03:50:51 64605 -c--a-w- c:\windows\system32\dllcache\vvoice.sys
2011-06-16 03:50:44 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll
2011-06-16 03:50:44 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-06-16 03:50:43 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll
2011-06-16 03:50:37 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys
2011-06-16 03:50:31 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys
2011-06-16 03:50:25 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys
2011-06-16 03:50:22 11325 -c--a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-06-16 03:50:16 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-06-16 03:50:10 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2011-06-16 03:50:03 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2011-06-16 03:48:58 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-06-16 03:48:52 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-06-16 03:48:46 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-06-16 03:48:40 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-06-16 03:48:34 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-06-16 03:48:28 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-06-16 03:48:23 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2011-06-16 03:48:20 44672 -c--a-w- c:\windows\system32\dllcache\uagp35.sys
2011-06-16 03:48:14 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2011-06-16 03:48:14 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2011-06-16 03:48:07 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-06-16 03:48:01 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2011-06-16 03:47:55 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-06-16 03:47:49 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2011-06-16 03:47:43 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-06-16 03:47:38 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2011-06-16 03:47:32 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2011-06-16 03:47:26 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll
2011-06-16 03:47:24 82944 -c--a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-06-16 03:47:19 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll
2011-06-16 03:47:12 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-06-16 03:47:06 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-06-16 03:47:00 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-06-16 03:45:55 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2011-06-16 03:45:50 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2011-06-16 03:45:44 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-06-16 03:45:39 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-06-16 03:45:34 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-06-16 03:45:29 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-06-16 03:45:23 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-06-16 03:45:17 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-06-16 03:45:12 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-06-16 03:45:07 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2011-06-16 03:45:01 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-06-16 03:43:55 7168 -c--a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-06-16 03:42:56 28160 -c--a-w- c:\windows\system32\dllcache\sm91w.dll
2011-06-16 03:41:55 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-06-16 03:40:54 57856 -c--a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-06-16 03:40:54 11648 -c--a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-06-16 03:40:48 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys
2011-06-16 03:40:43 16640 -c--a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-06-16 03:40:38 23936 -c--a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-06-16 03:40:33 23936 -c--a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-06-16 03:40:31 43904 -c--a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-06-16 03:40:26 495616 -c--a-w- c:\windows\system32\dllcache\sblfx.dll
2011-06-16 03:40:20 75392 -c--a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-06-16 03:40:15 245632 -c--a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-06-16 03:40:10 77824 -c--a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-06-16 03:40:05 198400 -c--a-w- c:\windows\system32\dllcache\s3sav4.dll
2011-06-16 03:40:00 61504 -c--a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2011-06-16 03:38:55 30720 -c--a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-06-16 03:37:55 3328 -c--a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-06-16 03:36:56 121344 -c--a-w- c:\windows\system32\dllcache\phvfwext.dll
2011-06-16 03:35:56 26153 -c--a-w- c:\windows\system32\dllcache\pcmlm56.sys
2011-06-16 03:34:59 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-06-16 03:33:58 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-06-16 03:33:56 28672 -c--a-w- c:\windows\system32\dllcache\nscirda.sys
2011-06-16 03:33:50 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-06-16 03:33:45 126080 -c--a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2011-06-16 03:33:40 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys
2011-06-16 03:33:38 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
2011-06-16 03:33:32 65278 -c--a-w- c:\windows\system32\dllcache\netflx3.sys
2011-06-16 03:33:27 39264 -c--a-w- c:\windows\system32\dllcache\neo20xx.sys
2011-06-16 03:33:22 60480 -c--a-w- c:\windows\system32\dllcache\neo20xx.dll
2011-06-16 03:33:17 15872 -c--a-w- c:\windows\system32\dllcache\ne2000.sys
2011-06-16 03:33:11 91488 -c--a-w- c:\windows\system32\dllcache\n9i3disp.dll
2011-06-16 03:33:06 27936 -c--a-w- c:\windows\system32\dllcache\n9i3d.sys
2011-06-16 03:33:01 33088 -c--a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-06-16 03:31:54 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys
2011-06-16 03:30:55 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
2011-06-16 03:29:59 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
2011-06-16 03:28:59 6656 -c--a-w- c:\windows\system32\dllcache\kbdlk41a.dll
2011-06-16 03:27:56 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys
2011-06-16 03:26:57 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-16 03:25:56 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
2011-06-16 03:24:57 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-06-16 03:23:59 46464 -c--a-w- c:\windows\system32\dllcache\gagp30kx.sys
2011-06-16 03:22:57 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-06-16 03:21:58 37120 -c--a-w- c:\windows\system32\dllcache\es1370mp.sys
2011-06-16 03:20:59 24653 -c--a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-06-16 03:19:59 41046 -c--a-w- c:\windows\system32\dllcache\digiisdn.dll
2011-06-16 03:18:59 93952 -c--a-w- c:\windows\system32\dllcache\cwcwdm.sys
2011-06-16 03:17:59 49182 -c--a-w- c:\windows\system32\dllcache\cem56n5.sys
2011-06-16 03:16:59 60416 -c--a-w- c:\windows\system32\dllcache\brserwdm.sys
2011-06-16 03:15:58 28672 -c--a-w- c:\windows\system32\dllcache\atinsnxx.sys
2011-06-16 03:14:59 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-06-16 03:13:49 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2011-06-14 10:26:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-13 03:19:50 -------- d-----w- c:\program files\CCleaner
2011-06-13 03:06:38 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-06-13 03:04:02 -------- d-----w- c:\program files\CleanUp!
2011-06-07 20:30:55 -------- d-sh--w- c:\documents and settings\bigcat1\IECompatCache
.
==================== Find3M ====================
.
2011-06-22 02:57:39 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-04 06:25:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-28 16:43:30 103784 ----a-w- c:\documents and settings\bigcat1\GoToAssistDownloadHelper.exe
2011-04-25 15:51:58 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51:57 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51:57 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01:21 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 1:10:56.79 ===============

attach.txt

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_26
Run by bigcat1 at 1:08:39 on 2011-06-26
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.561 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Battery Meter\BTMeter.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.live.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search

helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows

live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [BTMeter] c:\program files\battery meter\BTMeter.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
Trusted Zone: capitalone.com\www
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{A8B8B82A-5A00-4025-BA7A-4241B4585A33} : DhcpNameServer = 209.18.47.61 209.18.47.62
Notify: GoToAssist - c:\program files\citrix\gotoassist\615\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop

search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bigcat1\application data\mozilla\firefox\profiles\n88xghee.default\
FF - plugin: c:\documents and settings\bigcat1\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\bigcat1\local settings\application data\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [2009-8-20 14248]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl3c484091;MpKsl3c484091;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\MpKsl3c484091.sys [2011-6-25 28752]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-4-27 98392]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-8-20 143840]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [2009-8-20

135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [2009-8-20 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [2009-8-20 272032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-8-20 162816]
S1 MpKsl22e89228;MpKsl22e89228;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\mpksl22e89228.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\MpKsl22e89228.sys [?]
S1 MpKsl3448d419;MpKsl3448d419;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{74623d37-6d76-4c1c-8642-6857c725856c}\mpksl3448d419.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{74623d37-6d76-4c1c-8642-6857c725856c}\MpKsl3448d419.sys [?]
S1 MpKsl3ee8e49f;MpKsl3ee8e49f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{56026812-6d03-433b-a527-527aff942f78}\mpksl3ee8e49f.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{56026812-6d03-433b-a527-527aff942f78}\MpKsl3ee8e49f.sys [?]
S1 MpKsl5c26aa7c;MpKsl5c26aa7c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{40e38812-d861-422a-855f-8f046381331c}\mpksl5c26aa7c.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{40e38812-d861-422a-855f-8f046381331c}\MpKsl5c26aa7c.sys [?]
S1 MpKsl67e668a7;MpKsl67e668a7;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\mpksl67e668a7.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\MpKsl67e668a7.sys [?]
S1 MpKsl765192aa;MpKsl765192aa;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\mpksl765192aa.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\MpKsl765192aa.sys [?]
S1 MpKslbede01a6;MpKslbede01a6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\mpkslbede01a6.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\MpKslbede01a6.sys [?]
S2 0114211258051431mcinstcleanup;McAfee Application Installer Cleanup

(0114211258051431);c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog

-service --> c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-8-20 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-6-12 135664]
.
=============== Created Last 30 ================
.
2011-06-26 03:03:24 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\MpKsl3c484091.sys
2011-06-26 02:50:04 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\mpengine.dll
2011-06-23 21:45:09 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-23 21:45:07 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-22 15:02:16 -------- d-----w- c:\documents and settings\bigcat1\application data\ElevatedDiagnostics
2011-06-20 03:37:53 -------- d-----w- C:\VIPRERESCUE
2011-06-20 02:09:06 -------- d-----w- c:\documents and settings\bigcat1\application data\SupportSoft
2011-06-20 02:08:10 -------- d-----w- c:\program files\common files\supportsoft
2011-06-17 12:04:26 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-17 06:24:24 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\backup\mpengine.dll
2011-06-16 06:49:03 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-16 06:48:54 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-16 06:12:21 -------- d-----w- c:\program files\Microsoft Security Client
2011-06-16 04:27:17 -------- d-----w- c:\documents and settings\bigcat1\local settings\application data\WMTools Downloaded Files
2011-06-16 03:53:13 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-06-16 03:53:06 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-06-16 03:53:06 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-06-16 03:52:59 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-06-16 03:52:53 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-06-16 03:52:46 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2011-06-16 03:52:39 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-06-16 03:52:38 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-06-16 03:52:34 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-06-16 03:52:33 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2011-06-16 03:52:20 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-06-16 03:52:17 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-06-16 03:52:11 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-06-16 03:52:00 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-06-16 03:50:57 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2011-06-16 03:50:57 19528 -c--a-w- c:\windows\system32\dllcache\w840nd.sys
2011-06-16 03:50:51 64605 -c--a-w- c:\windows\system32\dllcache\vvoice.sys
2011-06-16 03:50:44 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll
2011-06-16 03:50:44 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-06-16 03:50:43 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll
2011-06-16 03:50:37 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys
2011-06-16 03:50:31 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys
2011-06-16 03:50:25 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys
2011-06-16 03:50:22 11325 -c--a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-06-16 03:50:16 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-06-16 03:50:10 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2011-06-16 03:50:03 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2011-06-16 03:48:58 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-06-16 03:48:52 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-06-16 03:48:46 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-06-16 03:48:40 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-06-16 03:48:34 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-06-16 03:48:28 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-06-16 03:48:23 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2011-06-16 03:48:20 44672 -c--a-w- c:\windows\system32\dllcache\uagp35.sys
2011-06-16 03:48:14 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2011-06-16 03:48:14 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2011-06-16 03:48:07 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-06-16 03:48:01 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2011-06-16 03:47:55 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-06-16 03:47:49 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2011-06-16 03:47:43 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-06-16 03:47:38 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2011-06-16 03:47:32 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2011-06-16 03:47:26 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll
2011-06-16 03:47:24 82944 -c--a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-06-16 03:47:19 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll
2011-06-16 03:47:12 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-06-16 03:47:06 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-06-16 03:47:00 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-06-16 03:45:55 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2011-06-16 03:45:50 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2011-06-16 03:45:44 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-06-16 03:45:39 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-06-16 03:45:34 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-06-16 03:45:29 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-06-16 03:45:23 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-06-16 03:45:17 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-06-16 03:45:12 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-06-16 03:45:07 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2011-06-16 03:45:01 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-06-16 03:43:55 7168 -c--a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-06-16 03:42:56 28160 -c--a-w- c:\windows\system32\dllcache\sm91w.dll
2011-06-16 03:41:55 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-06-16 03:40:54 57856 -c--a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-06-16 03:40:54 11648 -c--a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-06-16 03:40:48 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys
2011-06-16 03:40:43 16640 -c--a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-06-16 03:40:38 23936 -c--a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-06-16 03:40:33 23936 -c--a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-06-16 03:40:31 43904 -c--a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-06-16 03:40:26 495616 -c--a-w- c:\windows\system32\dllcache\sblfx.dll
2011-06-16 03:40:20 75392 -c--a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-06-16 03:40:15 245632 -c--a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-06-16 03:40:10 77824 -c--a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-06-16 03:40:05 198400 -c--a-w- c:\windows\system32\dllcache\s3sav4.dll
2011-06-16 03:40:00 61504 -c--a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2011-06-16 03:38:55 30720 -c--a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-06-16 03:37:55 3328 -c--a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-06-16 03:36:56 121344 -c--a-w- c:\windows\system32\dllcache\phvfwext.dll
2011-06-16 03:35:56 26153 -c--a-w- c:\windows\system32\dllcache\pcmlm56.sys
2011-06-16 03:34:59 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-06-16 03:33:58 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-06-16 03:33:56 28672 -c--a-w- c:\windows\system32\dllcache\nscirda.sys
2011-06-16 03:33:50 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-06-16 03:33:45 126080 -c--a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2011-06-16 03:33:40 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys
2011-06-16 03:33:38 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
2011-06-16 03:33:32 65278 -c--a-w- c:\windows\system32\dllcache\netflx3.sys
2011-06-16 03:33:27 39264 -c--a-w- c:\windows\system32\dllcache\neo20xx.sys
2011-06-16 03:33:22 60480 -c--a-w- c:\windows\system32\dllcache\neo20xx.dll
2011-06-16 03:33:17 15872 -c--a-w- c:\windows\system32\dllcache\ne2000.sys
2011-06-16 03:33:11 91488 -c--a-w- c:\windows\system32\dllcache\n9i3disp.dll
2011-06-16 03:33:06 27936 -c--a-w- c:\windows\system32\dllcache\n9i3d.sys
2011-06-16 03:33:01 33088 -c--a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-06-16 03:31:54 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys
2011-06-16 03:30:55 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
2011-06-16 03:29:59 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
2011-06-16 03:28:59 6656 -c--a-w- c:\windows\system32\dllcache\kbdlk41a.dll
2011-06-16 03:27:56 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys
2011-06-16 03:26:57 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-16 03:25:56 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
2011-06-16 03:24:57 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-06-16 03:23:59 46464 -c--a-w- c:\windows\system32\dllcache\gagp30kx.sys
2011-06-16 03:22:57 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-06-16 03:21:58 37120 -c--a-w- c:\windows\system32\dllcache\es1370mp.sys
2011-06-16 03:20:59 24653 -c--a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-06-16 03:19:59 41046 -c--a-w- c:\windows\system32\dllcache\digiisdn.dll
2011-06-16 03:18:59 93952 -c--a-w- c:\windows\system32\dllcache\cwcwdm.sys
2011-06-16 03:17:59 49182 -c--a-w- c:\windows\system32\dllcache\cem56n5.sys
2011-06-16 03:16:59 60416 -c--a-w- c:\windows\system32\dllcache\brserwdm.sys
2011-06-16 03:15:58 28672 -c--a-w- c:\windows\system32\dllcache\atinsnxx.sys
2011-06-16 03:14:59 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-06-16 03:13:49 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2011-06-14 10:26:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-13 03:19:50 -------- d-----w- c:\program files\CCleaner
2011-06-13 03:06:38 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-06-13 03:04:02 -------- d-----w- c:\program files\CleanUp!
2011-06-07 20:30:55 -------- d-sh--w- c:\documents and settings\bigcat1\IECompatCache
.
==================== Find3M ====================
.
2011-06-22 02:57:39 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-04 06:25:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-28 16:43:30 103784 ----a-w- c:\documents and settings\bigcat1\GoToAssistDownloadHelper.exe
2011-04-25 15:51:58 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51:57 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51:57 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01:21 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 1:10:56.79 ===============

report.txt

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_26
Run by bigcat1 at 1:08:39 on 2011-06-26
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.561 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Battery Meter\BTMeter.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.live.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search

helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows

live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [BTMeter] c:\program files\battery meter\BTMeter.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
Trusted Zone: capitalone.com\www
DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{A8B8B82A-5A00-4025-BA7A-4241B4585A33} : DhcpNameServer = 209.18.47.61 209.18.47.62
Notify: GoToAssist - c:\program files\citrix\gotoassist\615\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop

search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bigcat1\application data\mozilla\firefox\profiles\n88xghee.default\
FF - plugin: c:\documents and settings\bigcat1\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\bigcat1\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\bigcat1\local settings\application data\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [2009-8-20 14248]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKsl3c484091;MpKsl3c484091;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\MpKsl3c484091.sys [2011-6-25 28752]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2011-4-27 98392]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2009-8-20 143840]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [2009-8-20

135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [2009-8-20 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [2009-8-20 272032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-8-20 162816]
S1 MpKsl22e89228;MpKsl22e89228;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\mpksl22e89228.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{0f414c0c-8225-41a2-aad3-fe74ad63a500}\MpKsl22e89228.sys [?]
S1 MpKsl3448d419;MpKsl3448d419;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{74623d37-6d76-4c1c-8642-6857c725856c}\mpksl3448d419.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{74623d37-6d76-4c1c-8642-6857c725856c}\MpKsl3448d419.sys [?]
S1 MpKsl3ee8e49f;MpKsl3ee8e49f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{56026812-6d03-433b-a527-527aff942f78}\mpksl3ee8e49f.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{56026812-6d03-433b-a527-527aff942f78}\MpKsl3ee8e49f.sys [?]
S1 MpKsl5c26aa7c;MpKsl5c26aa7c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{40e38812-d861-422a-855f-8f046381331c}\mpksl5c26aa7c.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{40e38812-d861-422a-855f-8f046381331c}\MpKsl5c26aa7c.sys [?]
S1 MpKsl67e668a7;MpKsl67e668a7;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\mpksl67e668a7.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{b39b6617-b593-4e05-8ae4-ff30aa02c044}\MpKsl67e668a7.sys [?]
S1 MpKsl765192aa;MpKsl765192aa;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\mpksl765192aa.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{628dbfb3-c8f1-46cc-861d-444c6ed98f49}\MpKsl765192aa.sys [?]
S1 MpKslbede01a6;MpKslbede01a6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\mpkslbede01a6.sys --> c:\documents and settings\all users\application

data\microsoft\microsoft antimalware\definition updates\{4e6b78d2-c002-4ea0-be42-15e4650d0e97}\MpKslbede01a6.sys [?]
S2 0114211258051431mcinstcleanup;McAfee Application Installer Cleanup

(0114211258051431);c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog

-service --> c:\docume~1\bigcat1\locals~1\temp\011421~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-8-20 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-3-20 32408]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-6-12 135664]
.
=============== Created Last 30 ================
.
2011-06-26 03:03:24 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\MpKsl3c484091.sys
2011-06-26 02:50:04 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\{7e7a4b37-4b5b-4805-a4a0-93179b265655}\mpengine.dll
2011-06-23 21:45:09 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-23 21:45:07 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-22 15:02:16 -------- d-----w- c:\documents and settings\bigcat1\application data\ElevatedDiagnostics
2011-06-20 03:37:53 -------- d-----w- C:\VIPRERESCUE
2011-06-20 02:09:06 -------- d-----w- c:\documents and settings\bigcat1\application data\SupportSoft
2011-06-20 02:08:10 -------- d-----w- c:\program files\common files\supportsoft
2011-06-17 12:04:26 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-17 06:24:24 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition

updates\backup\mpengine.dll
2011-06-16 06:49:03 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-16 06:48:54 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-16 06:12:21 -------- d-----w- c:\program files\Microsoft Security Client
2011-06-16 04:27:17 -------- d-----w- c:\documents and settings\bigcat1\local settings\application data\WMTools Downloaded Files
2011-06-16 03:53:13 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-06-16 03:53:06 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-06-16 03:53:06 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-06-16 03:52:59 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-06-16 03:52:53 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-06-16 03:52:46 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2011-06-16 03:52:39 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-06-16 03:52:38 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-06-16 03:52:34 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-06-16 03:52:33 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2011-06-16 03:52:20 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-06-16 03:52:17 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-06-16 03:52:11 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-06-16 03:52:00 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2011-06-16 03:50:57 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2011-06-16 03:50:57 19528 -c--a-w- c:\windows\system32\dllcache\w840nd.sys
2011-06-16 03:50:51 64605 -c--a-w- c:\windows\system32\dllcache\vvoice.sys
2011-06-16 03:50:44 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll
2011-06-16 03:50:44 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys
2011-06-16 03:50:43 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll
2011-06-16 03:50:37 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys
2011-06-16 03:50:31 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys
2011-06-16 03:50:25 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys
2011-06-16 03:50:22 11325 -c--a-w- c:\windows\system32\dllcache\vchnt5.dll
2011-06-16 03:50:16 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-06-16 03:50:10 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2011-06-16 03:50:03 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2011-06-16 03:48:58 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-06-16 03:48:52 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-06-16 03:48:46 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-06-16 03:48:40 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-06-16 03:48:34 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-06-16 03:48:28 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2011-06-16 03:48:23 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2011-06-16 03:48:20 44672 -c--a-w- c:\windows\system32\dllcache\uagp35.sys
2011-06-16 03:48:14 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2011-06-16 03:48:14 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2011-06-16 03:48:07 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-06-16 03:48:01 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2011-06-16 03:47:55 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-06-16 03:47:49 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2011-06-16 03:47:43 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-06-16 03:47:38 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2011-06-16 03:47:32 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2011-06-16 03:47:26 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll
2011-06-16 03:47:24 82944 -c--a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-06-16 03:47:19 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll
2011-06-16 03:47:12 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-06-16 03:47:06 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-06-16 03:47:00 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-06-16 03:45:55 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2011-06-16 03:45:50 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2011-06-16 03:45:44 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-06-16 03:45:39 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-06-16 03:45:34 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-06-16 03:45:29 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-06-16 03:45:23 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-06-16 03:45:17 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-06-16 03:45:12 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-06-16 03:45:07 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2011-06-16 03:45:01 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2011-06-16 03:43:55 7168 -c--a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-06-16 03:42:56 28160 -c--a-w- c:\windows\system32\dllcache\sm91w.dll
2011-06-16 03:41:55 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-06-16 03:40:54 57856 -c--a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-06-16 03:40:54 11648 -c--a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-06-16 03:40:48 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys
2011-06-16 03:40:43 16640 -c--a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-06-16 03:40:38 23936 -c--a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-06-16 03:40:33 23936 -c--a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-06-16 03:40:31 43904 -c--a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-06-16 03:40:26 495616 -c--a-w- c:\windows\system32\dllcache\sblfx.dll
2011-06-16 03:40:20 75392 -c--a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-06-16 03:40:15 245632 -c--a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-06-16 03:40:10 77824 -c--a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-06-16 03:40:05 198400 -c--a-w- c:\windows\system32\dllcache\s3sav4.dll
2011-06-16 03:40:00 61504 -c--a-w- c:\windows\system32\dllcache\s3sav3dm.sys
2011-06-16 03:38:55 30720 -c--a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-06-16 03:37:55 3328 -c--a-w- c:\windows\system32\dllcache\qv2kux.sys
2011-06-16 03:36:56 121344 -c--a-w- c:\windows\system32\dllcache\phvfwext.dll
2011-06-16 03:35:56 26153 -c--a-w- c:\windows\system32\dllcache\pcmlm56.sys
2011-06-16 03:34:59 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-06-16 03:33:58 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-06-16 03:33:56 28672 -c--a-w- c:\windows\system32\dllcache\nscirda.sys
2011-06-16 03:33:50 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-06-16 03:33:45 126080 -c--a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2011-06-16 03:33:40 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys
2011-06-16 03:33:38 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
2011-06-16 03:33:32 65278 -c--a-w- c:\windows\system32\dllcache\netflx3.sys
2011-06-16 03:33:27 39264 -c--a-w- c:\windows\system32\dllcache\neo20xx.sys
2011-06-16 03:33:22 60480 -c--a-w- c:\windows\system32\dllcache\neo20xx.dll
2011-06-16 03:33:17 15872 -c--a-w- c:\windows\system32\dllcache\ne2000.sys
2011-06-16 03:33:11 91488 -c--a-w- c:\windows\system32\dllcache\n9i3disp.dll
2011-06-16 03:33:06 27936 -c--a-w- c:\windows\system32\dllcache\n9i3d.sys
2011-06-16 03:33:01 33088 -c--a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-06-16 03:31:54 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys
2011-06-16 03:30:55 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
2011-06-16 03:29:59 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
2011-06-16 03:28:59 6656 -c--a-w- c:\windows\system32\dllcache\kbdlk41a.dll
2011-06-16 03:27:56 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys
2011-06-16 03:26:57 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-16 03:25:56 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
2011-06-16 03:24:57 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-06-16 03:23:59 46464 -c--a-w- c:\windows\system32\dllcache\gagp30kx.sys
2011-06-16 03:22:57 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-06-16 03:21:58 37120 -c--a-w- c:\windows\system32\dllcache\es1370mp.sys
2011-06-16 03:20:59 24653 -c--a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-06-16 03:19:59 41046 -c--a-w- c:\windows\system32\dllcache\digiisdn.dll
2011-06-16 03:18:59 93952 -c--a-w- c:\windows\system32\dllcache\cwcwdm.sys
2011-06-16 03:17:59 49182 -c--a-w- c:\windows\system32\dllcache\cem56n5.sys
2011-06-16 03:16:59 60416 -c--a-w- c:\windows\system32\dllcache\brserwdm.sys
2011-06-16 03:15:58 28672 -c--a-w- c:\windows\system32\dllcache\atinsnxx.sys
2011-06-16 03:14:59 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-06-16 03:13:49 32827 -c--a-w- c:\windows\system32\dllcache\tcptest.exe
2011-06-14 10:26:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-13 03:19:50 -------- d-----w- c:\program files\CCleaner
2011-06-13 03:06:38 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-06-13 03:04:02 -------- d-----w- c:\program files\CleanUp!
2011-06-07 20:30:55 -------- d-sh--w- c:\documents and settings\bigcat1\IECompatCache
.
==================== Find3M ====================
.
2011-06-22 02:57:39 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-04 06:25:49 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-28 16:43:30 103784 ----a-w- c:\documents and settings\bigcat1\GoToAssistDownloadHelper.exe
2011-04-25 15:51:58 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51:57 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51:57 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01:21 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
============= FINISH: 1:10:56.79 ===============

#7 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,453
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 26 June 2011 - 02:39 AM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1

Link 2

Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

<-- Don't worry every little bit helps.

#8 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 26 June 2011 - 06:42 AM

OK. Here is the Combofix log. The webpage issue is unsolved and the audio is still screwed up.

ComboFix 11-06-25.05 - bigcat1 06/26/2011 5:48.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.508 [GMT -4:00]
Running from: c:\documents and settings\bigcat1\My Documents\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\GoToAssistDownloadHelper.exe
c:\documents and settings\bigcat1\GoToAssistDownloadHelper.exe
c:\windows\regedit.com
.
c:\windows\system32\userinit.exe . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-05-26 to 2011-06-26 )))))))))))))))))))))))))))))))
.
.
2011-06-26 05:45 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A23099BF-7CBD-4C60-AFF5-2B0187F0B867}\mpengine.dll
2011-06-23 21:45 . 2011-06-23 21:45 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-23 21:45 . 2011-06-23 21:45 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-22 15:02 . 2011-06-22 15:02 -------- d-----w- c:\documents and settings\bigcat1\Application Data\ElevatedDiagnostics
2011-06-20 03:37 . 2011-06-20 03:46 -------- d-----w- C:\VIPRERESCUE
2011-06-20 02:09 . 2011-06-20 02:09 -------- d-----w- c:\documents and settings\bigcat1\Application Data\SupportSoft
2011-06-20 02:08 . 2011-06-20 02:08 -------- d-----w- c:\program files\Common Files\supportsoft
2011-06-17 12:04 . 2011-06-17 12:31 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-17 06:24 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-06-16 06:49 . 2011-05-29 13:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-16 06:48 . 2011-05-29 13:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-16 06:12 . 2011-06-16 06:12 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\PCHealth
2011-06-16 06:12 . 2011-06-16 06:12 -------- d-----w- c:\program files\Microsoft Security Client
2011-06-16 04:27 . 2011-06-16 12:02 -------- d-----w- c:\documents and settings\bigcat1\Local Settings\Application Data\WMTools Downloaded Files
2011-06-16 03:43 . 2001-08-18 02:36 7168 -c--a-w- c:\windows\system32\dllcache\EXCH_snprfdll.dll
2011-06-16 03:43 . 2001-08-18 02:36 12288 -c--a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll
2011-06-16 03:41 . 2001-08-18 02:36 26112 -c--a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2011-06-16 03:40 . 2001-08-18 02:36 57856 -c--a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-06-16 03:38 . 2001-08-18 02:36 23040 -c--a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2011-06-16 03:37 . 2001-08-17 17:53 7168 -c--a-w- c:\windows\system32\dllcache\pnrmc.sys
2011-06-16 03:37 . 2008-04-14 12:00 6144 -c--a-w- c:\windows\system32\dllcache\pmxgl.dll
2011-06-16 03:37 . 2008-04-14 12:00 131584 -c--a-w- c:\windows\system32\dllcache\pmxviceo.dll
2011-06-16 03:37 . 2008-04-14 12:00 11264 -c--a-w- c:\windows\system32\dllcache\pmxmcro.dll
2011-06-16 03:37 . 2008-04-14 12:00 70144 -c--a-w- c:\windows\system32\dllcache\pintlphr.exe
2011-06-16 03:37 . 2008-04-14 12:00 67584 -c--a-w- c:\windows\system32\dllcache\pmigrate.dll
2011-06-16 03:37 . 2008-04-14 12:00 53760 -c--a-w- c:\windows\system32\dllcache\pintlcsd.dll
2011-06-16 03:37 . 2008-04-14 12:00 175104 -c--a-w- c:\windows\system32\dllcache\pintlcsa.dll
2011-06-16 03:35 . 2001-08-17 16:12 26153 -c--a-w- c:\windows\system32\dllcache\pcmlm56.sys
2011-06-16 03:34 . 2001-08-17 18:05 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys
2011-06-16 03:33 . 2001-08-17 17:53 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2011-06-16 03:33 . 2008-04-14 04:24 28672 -c--a-w- c:\windows\system32\dllcache\nscirda.sys
2011-06-16 03:33 . 2001-08-17 16:20 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys
2011-06-16 03:33 . 2001-08-17 16:20 126080 -c--a-w- c:\windows\system32\dllcache\nm5a2wdm.sys
2011-06-16 03:33 . 2001-08-17 16:12 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys
2011-06-16 03:33 . 2008-04-14 02:05 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys
2011-06-16 03:33 . 2001-08-17 16:11 65278 -c--a-w- c:\windows\system32\dllcache\netflx3.sys
2011-06-16 03:33 . 2001-08-17 16:50 39264 -c--a-w- c:\windows\system32\dllcache\neo20xx.sys
2011-06-16 03:33 . 2001-08-18 02:36 60480 -c--a-w- c:\windows\system32\dllcache\neo20xx.dll
2011-06-16 03:33 . 2001-08-17 17:49 15872 -c--a-w- c:\windows\system32\dllcache\ne2000.sys
2011-06-16 03:33 . 2001-08-17 18:56 91488 -c--a-w- c:\windows\system32\dllcache\n9i3disp.dll
2011-06-16 03:33 . 2001-08-17 16:50 27936 -c--a-w- c:\windows\system32\dllcache\n9i3d.sys
2011-06-16 03:33 . 2001-08-17 16:50 33088 -c--a-w- c:\windows\system32\dllcache\n9i128v2.sys
2011-06-16 03:31 . 2008-04-14 04:16 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys
2011-06-16 03:30 . 2001-08-17 16:50 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys
2011-06-16 03:29 . 2008-04-14 04:10 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
2011-06-16 03:28 . 2008-04-14 12:00 6656 -c--a-w- c:\windows\system32\dllcache\kbdlk41a.dll
2011-06-16 03:27 . 2001-08-17 17:50 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys
2011-06-16 03:26 . 2001-08-17 18:06 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-16 03:25 . 2001-08-17 17:28 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
2011-06-16 03:24 . 2001-08-18 02:36 31232 -c--a-w- c:\windows\system32\dllcache\hpgt42tk.dll
2011-06-16 03:23 . 2008-04-14 04:06 46464 -c--a-w- c:\windows\system32\dllcache\gagp30kx.sys
2011-06-16 03:22 . 2001-08-17 16:10 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys
2011-06-16 03:21 . 2001-08-17 16:19 37120 -c--a-w- c:\windows\system32\dllcache\es1370mp.sys
2011-06-16 03:20 . 2001-08-17 16:10 24653 -c--a-w- c:\windows\system32\dllcache\el574nd4.sys
2011-06-16 03:19 . 2001-08-18 02:36 41046 -c--a-w- c:\windows\system32\dllcache\digiisdn.dll
2011-06-16 03:18 . 2001-08-17 16:19 93952 -c--a-w- c:\windows\system32\dllcache\cwcwdm.sys
2011-06-16 03:17 . 2001-08-17 16:13 49182 -c--a-w- c:\windows\system32\dllcache\cem56n5.sys
2011-06-16 03:16 . 2001-08-17 17:12 60416 -c--a-w- c:\windows\system32\dllcache\brserwdm.sys
2011-06-16 03:15 . 2008-04-14 02:04 28672 -c--a-w- c:\windows\system32\dllcache\atinsnxx.sys
2011-06-16 03:14 . 2008-04-14 09:41 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-06-16 03:13 . 2003-03-24 20:52 20538 -c--a-w- c:\windows\system32\dllcache\fpremadm.exe
2011-06-14 10:27 . 2011-06-14 10:27 -------- d-----w- c:\program files\Common Files\Java
2011-06-14 10:26 . 2011-05-04 08:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-13 03:19 . 2011-06-13 03:19 -------- d-----w- c:\program files\CCleaner
2011-06-13 03:19 . 2011-06-13 03:19 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2011-06-13 03:18 . 2011-06-13 03:19 -------- d-----w- c:\program files\Google
2011-06-13 03:06 . 2011-06-13 03:06 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-06-13 03:06 . 2011-06-13 03:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2011-06-13 03:04 . 2011-06-13 03:04 -------- d-----w- c:\program files\CleanUp!
2011-06-07 20:30 . 2011-06-07 20:30 -------- d-sh--w- c:\documents and settings\bigcat1\IECompatCache
2011-06-07 03:55 . 2011-06-07 03:55 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-06-06 23:44 . 2011-06-06 23:44 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-22 02:57 . 2011-05-22 02:36 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-04 06:25 . 2009-08-20 23:23 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31 . 2008-04-26 01:44 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2008-04-25 20:33 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 15:51 . 2008-04-25 20:33 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51 . 2011-04-29 03:10 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51 . 2008-04-25 20:33 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51 . 2008-04-25 20:33 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01 . 2008-04-25 20:33 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-04-25 20:33 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2011-06-23 21:45 . 2011-04-05 14:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BTMeter"="c:\program files\Battery Meter\BTMeter.exe" [2008-11-05 623912]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2011-04-28 16:43 13672 ---ha-w- c:\program files\Citrix\GoToAssist\615\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 07:38 34672 ---ha-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2009-03-15 21:31 57344 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2009-01-06 23:53 2289664 ----a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapsLKNotify]
2009-02-23 14:03 320808 ---ha-w- c:\program files\CapsLKNotify\CapsLKNotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-09-13 18:15 133104 ----atw- c:\documents and settings\bigcat1\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2009-02-15 21:34 166424 ----a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2009-02-15 21:34 141848 ----a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-05-29 13:11 449584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2010-11-30 17:20 997408 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2008-12-03 03:41 3882312 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OA012Mon]
2009-05-11 21:11 24576 ----a-w- c:\windows\OA012Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2009-02-15 21:34 137752 ----a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-15 21:32 17529856 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 16:59 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2011-06-13 03:19 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-15 22:49 1434920 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WSED]
2009-03-31 21:03 251176 ----a-w- c:\program files\WSED\WSED.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"gupdate"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell Video Chat\\DellVideoChat.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Documents and Settings\\bigcat1\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\bigcat1\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"=
"c:\\Program Files\\Turbine\\DDO Unlimited\\dndclient.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56866:TCP"= 56866:TCP:Pando Media Booster
"56866:UDP"= 56866:UDP:Pando Media Booster
"58148:TCP"= 58148:TCP:Pando Media Booster
"58148:UDP"= 58148:UDP:Pando Media Booster
.
R0 EMSC;COMPAL Embedded System Control;c:\windows\system32\drivers\EMSC.sys [8/20/2009 7:24 PM 14248]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [4/27/2011 3:13 PM 98392]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [8/20/2009 7:34 PM 143840]
R3 OA012Afx;Provides a software interface to control audio effects of OA012 camera.;c:\windows\system32\drivers\OA012Afx.sys [8/20/2009 10:02 PM 135168]
R3 OA012Ufd;Creative Camera OA012 Upper Filter Driver;c:\windows\system32\drivers\OA012Ufd.sys [8/20/2009 10:02 PM 133632]
R3 OA012Vid;Creative Camera OA012 Function Driver;c:\windows\system32\drivers\OA012Vid.sys [8/20/2009 10:02 PM 272032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [8/20/2009 10:02 PM 162816]
S1 MpKsl22e89228;MpKsl22e89228;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F414C0C-8225-41A2-AAD3-FE74AD63A500}\MpKsl22e89228.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0F414C0C-8225-41A2-AAD3-FE74AD63A500}\MpKsl22e89228.sys [?]
S1 MpKsl3448d419;MpKsl3448d419;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{74623D37-6D76-4C1C-8642-6857C725856C}\MpKsl3448d419.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{74623D37-6D76-4C1C-8642-6857C725856C}\MpKsl3448d419.sys [?]
S1 MpKsl3ee8e49f;MpKsl3ee8e49f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{56026812-6D03-433B-A527-527AFF942F78}\MpKsl3ee8e49f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{56026812-6D03-433B-A527-527AFF942F78}\MpKsl3ee8e49f.sys [?]
S1 MpKsl5c26aa7c;MpKsl5c26aa7c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{40E38812-D861-422A-855F-8F046381331C}\MpKsl5c26aa7c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{40E38812-D861-422A-855F-8F046381331C}\MpKsl5c26aa7c.sys [?]
S1 MpKsl67e668a7;MpKsl67e668a7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B39B6617-B593-4E05-8AE4-FF30AA02C044}\MpKsl67e668a7.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B39B6617-B593-4E05-8AE4-FF30AA02C044}\MpKsl67e668a7.sys [?]
S1 MpKsl765192aa;MpKsl765192aa;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{628DBFB3-C8F1-46CC-861D-444C6ED98F49}\MpKsl765192aa.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{628DBFB3-C8F1-46CC-861D-444C6ED98F49}\MpKsl765192aa.sys [?]
S1 MpKslbede01a6;MpKslbede01a6;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4E6B78D2-C002-4EA0-BE42-15E4650D0E97}\MpKslbede01a6.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{4E6B78D2-C002-4EA0-BE42-15E4650D0E97}\MpKslbede01a6.sys [?]
S2 0114211258051431mcinstcleanup;McAfee Application Installer Cleanup (0114211258051431);c:\docume~1\bigcat1\LOCALS~1\Temp\011421~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\bigcat1\LOCALS~1\Temp\011421~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8/20/2009 10:01 PM 1684736]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/7/2008 12:23 PM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [5/9/2008 11:08 AM 174336]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [3/20/2009 7:03 PM 32408]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6/12/2011 11:19 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-13 03:19]
.
2011-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2171957096-2234996846-376362670-1006Core.job
- c:\documents and settings\bigcat1\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-13 18:15]
.
2011-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2171957096-2234996846-376362670-1006UA.job
- c:\documents and settings\bigcat1\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-13 18:15]
.
2011-06-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 16:26]
.
2011-06-26 c:\windows\Tasks\User_Feed_Synchronization-{068F4ED8-A014-46FC-BC80-B1A3F7C326E9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 22:36]
.
.
------- Supplementary Scan -------
.
Trusted Zone: capitalone.com\www
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
FF - ProfilePath - c:\documents and settings\bigcat1\Application Data\Mozilla\Firefox\Profiles\n88xghee.default\
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
MSConfigStartUp-dellsupportcenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-26 06:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(880)
c:\program files\Citrix\GoToAssist\615\G2AWinLogon.dll
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(3280)
c:\windows\system32\WININET.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Flip Video\FlipShare\FlipShareService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\snmp.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2011-06-26 06:14:08 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-26 10:14
.
Pre-Run: 84,110,123,008 bytes free
Post-Run: 84,430,807,040 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 018A4A72CEF14D7FFBED51B0C1D11E6D

#9 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,453
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 26 June 2011 - 11:51 AM

I want you to run this tool for me next.

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Gringo

<-- Don't worry every little bit helps.

#10 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 26 June 2011 - 12:36 PM

Here it is. Are you seeing anything notable???

2011/06/26 13:32:46.0265 3292 TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15
2011/06/26 13:32:46.0765 3292 ================================================================================
2011/06/26 13:32:46.0765 3292 SystemInfo:
2011/06/26 13:32:46.0765 3292
2011/06/26 13:32:46.0765 3292 OS Version: 5.1.2600 ServicePack: 3.0
2011/06/26 13:32:46.0765 3292 Product type: Workstation
2011/06/26 13:32:46.0765 3292 ComputerName: BIGCAT
2011/06/26 13:32:46.0765 3292 UserName: bigcat1
2011/06/26 13:32:46.0765 3292 Windows directory: C:\WINDOWS
2011/06/26 13:32:46.0765 3292 System windows directory: C:\WINDOWS
2011/06/26 13:32:46.0765 3292 Processor architecture: Intel x86
2011/06/26 13:32:46.0765 3292 Number of processors: 2
2011/06/26 13:32:46.0765 3292 Page size: 0x1000
2011/06/26 13:32:46.0765 3292 Boot type: Normal boot
2011/06/26 13:32:46.0765 3292 ================================================================================
2011/06/26 13:32:50.0203 3292 Initialize success
2011/06/26 13:33:06.0156 1788 ================================================================================
2011/06/26 13:33:06.0171 1788 Scan started
2011/06/26 13:33:06.0171 1788 Mode: Manual;
2011/06/26 13:33:06.0171 1788 ================================================================================
2011/06/26 13:33:07.0968 1788 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/06/26 13:33:08.0640 1788 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/06/26 13:33:09.0312 1788 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/06/26 13:33:09.0937 1788 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/06/26 13:33:10.0937 1788 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/06/26 13:33:11.0890 1788 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/06/26 13:33:12.0781 1788 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/06/26 13:33:13.0406 1788 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/06/26 13:33:13.0953 1788 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/06/26 13:33:14.0515 1788 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/06/26 13:33:15.0078 1788 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/06/26 13:33:15.0656 1788 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/06/26 13:33:16.0203 1788 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/06/26 13:33:18.0015 1788 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
2011/06/26 13:33:20.0140 1788 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/06/26 13:33:20.0718 1788 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/06/26 13:33:21.0265 1788 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/06/26 13:33:21.0781 1788 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/06/26 13:33:22.0296 1788 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/06/26 13:33:22.0843 1788 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/06/26 13:33:23.0453 1788 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/06/26 13:33:24.0546 1788 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/06/26 13:33:25.0093 1788 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/06/26 13:33:26.0546 1788 BCM43XX (37f385a93c620cbe0f89c17e45f697a1) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
2011/06/26 13:33:28.0140 1788 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/06/26 13:33:28.0781 1788 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/06/26 13:33:29.0343 1788 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/06/26 13:33:29.0921 1788 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/06/26 13:33:30.0593 1788 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/06/26 13:33:31.0156 1788 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/06/26 13:33:31.0718 1788 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/06/26 13:33:32.0328 1788 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/06/26 13:33:33.0468 1788 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/06/26 13:33:34.0078 1788 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/06/26 13:33:34.0640 1788 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/06/26 13:33:35.0234 1788 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/06/26 13:33:35.0921 1788 CtClsFlt (b27d15c551a6678137c6b751b160756d) C:\WINDOWS\system32\DRIVERS\CtClsFlt.sys
2011/06/26 13:33:36.0671 1788 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/06/26 13:33:37.0328 1788 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/06/26 13:33:37.0906 1788 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/06/26 13:33:39.0000 1788 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/06/26 13:33:40.0171 1788 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/06/26 13:33:40.0859 1788 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/06/26 13:33:41.0437 1788 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/06/26 13:33:42.0140 1788 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/06/26 13:33:42.0734 1788 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/06/26 13:33:43.0281 1788 EMSC (a6da3468ffafbdce403ef2973ff03865) C:\WINDOWS\system32\DRIVERS\EMSC.SYS
2011/06/26 13:33:43.0921 1788 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/06/26 13:33:44.0562 1788 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/06/26 13:33:45.0109 1788 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/06/26 13:33:45.0843 1788 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/06/26 13:33:46.0500 1788 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/06/26 13:33:47.0125 1788 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/06/26 13:33:47.0750 1788 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/06/26 13:33:48.0375 1788 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/06/26 13:33:49.0093 1788 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/06/26 13:33:49.0765 1788 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/06/26 13:33:50.0312 1788 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/06/26 13:33:51.0109 1788 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/06/26 13:33:51.0890 1788 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/06/26 13:33:52.0453 1788 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/06/26 13:33:53.0109 1788 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/06/26 13:33:57.0578 1788 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2011/06/26 13:34:02.0281 1788 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/06/26 13:34:02.0953 1788 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/06/26 13:34:06.0921 1788 IntcAzAudAddService (cb1113029fae50c685198eabd9885161) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/06/26 13:34:08.0921 1788 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/06/26 13:34:09.0515 1788 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/06/26 13:34:10.0156 1788 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/06/26 13:34:10.0750 1788 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/06/26 13:34:11.0359 1788 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/06/26 13:34:12.0109 1788 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/06/26 13:34:12.0906 1788 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/06/26 13:34:13.0531 1788 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/06/26 13:34:14.0125 1788 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/06/26 13:34:14.0812 1788 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/06/26 13:34:15.0437 1788 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/06/26 13:34:16.0203 1788 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/06/26 13:34:17.0078 1788 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/06/26 13:34:18.0218 1788 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/06/26 13:34:18.0781 1788 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/06/26 13:34:20.0281 1788 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
2011/06/26 13:34:21.0859 1788 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/06/26 13:34:22.0484 1788 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/06/26 13:34:23.0078 1788 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/06/26 13:34:23.0765 1788 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
2011/06/26 13:34:24.0046 1788 MpKsl14a6dfb5 (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{8AA24619-2040-4FAD-A979-90AAB2C16BEF}\MpKsl14a6dfb5.sys
2011/06/26 13:34:25.0046 1788 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/06/26 13:34:25.0703 1788 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/06/26 13:34:26.0687 1788 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/06/26 13:34:27.0515 1788 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/06/26 13:34:28.0109 1788 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/06/26 13:34:28.0671 1788 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/06/26 13:34:29.0281 1788 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/06/26 13:34:29.0968 1788 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/06/26 13:34:30.0593 1788 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/06/26 13:34:31.0218 1788 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/06/26 13:34:31.0875 1788 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/06/26 13:34:32.0640 1788 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/06/26 13:34:33.0296 1788 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/06/26 13:34:33.0906 1788 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/06/26 13:34:34.0468 1788 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/06/26 13:34:35.0078 1788 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/06/26 13:34:35.0734 1788 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/06/26 13:34:36.0343 1788 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/06/26 13:34:36.0984 1788 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/06/26 13:34:37.0734 1788 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/06/26 13:34:38.0671 1788 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/06/26 13:34:39.0625 1788 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/06/26 13:34:40.0390 1788 NWADI (0973c0c696780161f4526586d5eac422) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys
2011/06/26 13:34:41.0078 1788 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/06/26 13:34:41.0640 1788 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/06/26 13:34:42.0234 1788 NWUSBCDFIL (1fde5b2d61d97d803594df4b3bc28c4b) C:\WINDOWS\system32\DRIVERS\NwUsbCdFil.sys
2011/06/26 13:34:42.0937 1788 NWUSBPort (65b471bb7e57c416a1e685ec07d4abfa) C:\WINDOWS\system32\DRIVERS\nwusbser.sys
2011/06/26 13:34:43.0718 1788 NWUSBPort2 (65b471bb7e57c416a1e685ec07d4abfa) C:\WINDOWS\system32\DRIVERS\nwusbser2.sys
2011/06/26 13:34:44.0484 1788 OA012Afx (aff089842ba83be89e51d7ea0aa09e53) C:\WINDOWS\system32\Drivers\OA012Afx.sys
2011/06/26 13:34:45.0140 1788 OA012Ufd (2cf21d5f8f1b74bb1922135ac2b12ddb) C:\WINDOWS\system32\DRIVERS\OA012Ufd.sys
2011/06/26 13:34:45.0953 1788 OA012Vid (71346423b584daa06ea26e0bd2cb67c2) C:\WINDOWS\system32\DRIVERS\OA012Vid.sys
2011/06/26 13:34:46.0734 1788 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/06/26 13:34:47.0328 1788 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/06/26 13:34:47.0843 1788 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/06/26 13:34:48.0468 1788 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/06/26 13:34:49.0531 1788 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/06/26 13:34:50.0203 1788 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/06/26 13:34:52.0984 1788 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/06/26 13:34:53.0546 1788 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/06/26 13:34:54.0187 1788 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/06/26 13:34:54.0781 1788 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/06/26 13:34:55.0390 1788 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/06/26 13:34:55.0984 1788 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/06/26 13:34:56.0531 1788 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/06/26 13:34:57.0125 1788 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/06/26 13:34:57.0734 1788 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/06/26 13:34:58.0296 1788 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/06/26 13:34:58.0859 1788 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/06/26 13:34:59.0421 1788 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/06/26 13:34:59.0984 1788 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/06/26 13:35:00.0546 1788 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/06/26 13:35:01.0203 1788 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/06/26 13:35:01.0796 1788 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/06/26 13:35:02.0484 1788 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/06/26 13:35:03.0218 1788 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/06/26 13:35:03.0875 1788 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/06/26 13:35:04.0671 1788 RSUSBSTOR (7ffa9821b1c5e0e0667e0a2685cfb89f) C:\WINDOWS\system32\Drivers\RtsUStor.sys
2011/06/26 13:35:05.0328 1788 RTLE8023xp (6e7470477d08f6e47e91016d6a1c5a5f) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2011/06/26 13:35:06.0296 1788 SBRE (c1ae5d1f53285d79a0b73a62af20734f) C:\WINDOWS\system32\drivers\SBREdrv.sys
2011/06/26 13:35:07.0046 1788 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/06/26 13:35:07.0703 1788 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/06/26 13:35:08.0453 1788 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/06/26 13:35:09.0593 1788 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/06/26 13:35:10.0171 1788 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/06/26 13:35:10.0437 1788 SMSIVZAM5 (1e715247efffdda938c085913045d599) C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS
2011/06/26 13:35:11.0093 1788 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/06/26 13:35:11.0687 1788 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/06/26 13:35:12.0312 1788 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/06/26 13:35:13.0140 1788 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/06/26 13:35:13.0890 1788 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/06/26 13:35:14.0500 1788 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/06/26 13:35:15.0125 1788 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/06/26 13:35:15.0765 1788 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/06/26 13:35:16.0390 1788 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/06/26 13:35:16.0984 1788 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/06/26 13:35:17.0593 1788 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/06/26 13:35:18.0312 1788 SynTP (a10d781153bb23036b474ffedb448266) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/06/26 13:35:19.0062 1788 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/06/26 13:35:19.0890 1788 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/06/26 13:35:20.0656 1788 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/06/26 13:35:21.0187 1788 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/06/26 13:35:21.0796 1788 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/06/26 13:35:22.0375 1788 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/06/26 13:35:22.0937 1788 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/06/26 13:35:23.0593 1788 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/06/26 13:35:24.0562 1788 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/06/26 13:35:25.0562 1788 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/06/26 13:35:26.0156 1788 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/06/26 13:35:26.0859 1788 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/06/26 13:35:27.0500 1788 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/06/26 13:35:28.0109 1788 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/06/26 13:35:28.0781 1788 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/06/26 13:35:29.0453 1788 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/06/26 13:35:30.0093 1788 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/06/26 13:35:30.0703 1788 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/06/26 13:35:31.0328 1788 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/06/26 13:35:31.0921 1788 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/06/26 13:35:32.0812 1788 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/06/26 13:35:34.0375 1788 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/06/26 13:35:35.0437 1788 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/06/26 13:35:36.0109 1788 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/06/26 13:35:36.0796 1788 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/06/26 13:35:36.0953 1788 MBR (0x1B8) (cdb4de4bbd714f152979da2dcbef57eb) \Device\Harddisk0\DR0
2011/06/26 13:35:37.0000 1788 ================================================================================
2011/06/26 13:35:37.0000 1788 Scan finished
2011/06/26 13:35:37.0000 1788 ================================================================================
2011/06/26 13:35:37.0015 2360 Detected object count: 0
2011/06/26 13:35:37.0015 2360 Actual detected object count: 0

#11 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,453
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 26 June 2011 - 02:34 PM

Create and Run Batch File

Notepad

@echo off
>Log1.txt (
ipconfig /all
nslookup google.com
nslookup yahoo.com
ping -n 2 google.com
ping -n 2 yahoo.com
route print
)
start Log1.txt
del %0

router.bat

Save type as - All Files

Desktop

router.bat

gringo

<-- Don't worry every little bit helps.

#12 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 26 June 2011 - 04:19 PM

Windows IP Configuration

Host Name . . . . . . . . . . . . : bigcat

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : nyc.rr.com

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : nyc.rr.com

Description . . . . . . . . . . . : Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC

Physical Address. . . . . . . . . : 00-24-E8-CE-BF-5A

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 72.231.11.119

Subnet Mask . . . . . . . . . . . : 255.255.252.0

Default Gateway . . . . . . . . . : 72.231.8.1

DHCP Server . . . . . . . . . . . : 10.33.224.1

DNS Servers . . . . . . . . . . . : 209.18.47.61

209.18.47.62

Lease Obtained. . . . . . . . . . : Sunday, June 26, 2011 4:21:41 PM

Lease Expires . . . . . . . . . . : Monday, June 27, 2011 4:21:41 AM

Ethernet adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected

Description . . . . . . . . . . . : Dell Wireless 1397 WLAN Mini-Card

Physical Address. . . . . . . . . : 00-26-5E-3B-12-76

Server: dns-cac-lb-01.rr.com
Address: 209.18.47.61

Name: google.com
Addresses: 74.125.91.106, 74.125.91.147, 74.125.91.99, 74.125.91.103
74.125.91.104, 74.125.91.105

Server: dns-cac-lb-01.rr.com
Address: 209.18.47.61

Name: yahoo.com
Addresses: 98.137.149.56, 209.191.122.70, 67.195.160.76, 69.147.125.65
72.30.2.43

Pinging google.com [74.125.115.99] with 32 bytes of data:

Reply from 74.125.115.99: bytes=32 time=35ms TTL=52

Reply from 74.125.115.99: bytes=32 time=28ms TTL=52

Ping statistics for 74.125.115.99:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 28ms, Maximum = 35ms, Average = 31ms

Pinging yahoo.com [72.30.2.43] with 32 bytes of data:

Reply from 72.30.2.43: bytes=32 time=87ms TTL=53

Reply from 72.30.2.43: bytes=32 time=87ms TTL=53

Ping statistics for 72.30.2.43:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 87ms, Maximum = 87ms, Average = 87ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 24 e8 ce bf 5a ...... Realtek RTL8102E/RTL8103E Family PCI-E Fast Ethernet NIC - Packet Scheduler Miniport
0x3 ...00 26 5e 3b 12 76 ...... Dell Wireless 1397 WLAN Mini-Card - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 72.231.8.1 72.231.11.119 20
72.231.8.0 255.255.252.0 72.231.11.119 72.231.11.119 20
72.231.11.119 255.255.255.255 127.0.0.1 127.0.0.1 20
72.255.255.255 255.255.255.255 72.231.11.119 72.231.11.119 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
224.0.0.0 240.0.0.0 72.231.11.119 72.231.11.119 20
255.255.255.255 255.255.255.255 72.231.11.119 72.231.11.119 1
255.255.255.255 255.255.255.255 72.231.11.119 3 1
Default Gateway: 72.231.8.1
===========================================================================
Persistent Routes:
None

#13 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,453
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 27 June 2011 - 11:42 AM

SystemLook:

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:filefind
userinit.exe

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

<-- Don't worry every little bit helps.

#14 schildkraut1

Member

Group: Members
Posts: 75
Joined: 19-June 11
Gender:Female
Location:Brooklyn, NY

Posted 27 June 2011 - 11:53 AM

SystemLook 04.09.10 by jpshortstuff
Log created at 12:50 on 27/06/2011 by bigcat1
Administrator - Elevation successful

========== filefind ==========

Searching for "userinit.exe"
C:\WINDOWS\ERDNT\cache\userinit.exe --a---- 26112 bytes [10:11 26/06/2011] [12:00 14/04/2008] A93AEE1928A9D7CE3E16D24EC7380F89
C:\WINDOWS\system32\userinit.exe --a---- 26112 bytes [20:33 25/04/2008] [12:00 14/04/2008] A93AEE1928A9D7CE3E16D24EC7380F89

-= EOF =-