I ran the GMER rootkit scanner (in safe mode) and was able to kill the tootkit (gaopdx......sys) file successfully (I hope), but on subsequent run of GMER scanner again showed one gaopdx....sys related service (hidden) in red. When I attempted to delete the service, it gave me an error that the specified file could not be found. Unable to delete, I attempted to disable the service - which GMER scanner actioned and now the service entry shows disabled when I run GMER scanner (though it still appears in red everytime)! Have searched "Windows/system32" and "Windows/system32/drivers" directories through GMER itself and do not find any gao*.* files!
Since then, I have carried out in-depth scan of the system with ESET NOD32, Avast4.8 Home and Kaspersky Internet Security 2009 and all of these now give the system a clean chit.
So I am hoping that the infection is actually gone - but would like help from experts to confirm this for me, so that I can be 100% sure. I am also concerned that GMER scanner still shows a service entry in red (although disabled) and multiple suspect gaopdxserv.sys entries in the registry (these appear in black, not red) that I don't know are harmful or harmless. Need to help to clean up these entries as well.
Thanks in advance

regards
GMER Log
GMER 1.0.15.14944 - http://www.gmer.net
Rootkit scan 2009-03-24 17:18:50
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwAdjustPrivilegesToken [0xF640F1DA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwClose [0xF640F7AE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwConnectPort [0xF64111EA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateFile [0xF6410B9C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateKey [0xF640E950]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xF6412B7C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwCreateThread [0xF640F5AE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeleteKey [0xF640ED92]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeleteValueKey [0xF640EF92]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDeviceIoControlFile [0xF6410EAC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwDuplicateObject [0xF6413084]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateKey [0xF640F0A8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwEnumerateValueKey [0xF640F110]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwFsControlFile [0xF6410D5E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwLoadDriver [0xF6412620]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenFile [0xF64109F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenKey [0xF640EAB2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenProcess [0xF640F3B2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenSection [0xF6412BA6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwOpenThread [0xF640F2FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryKey [0xF640F178]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryMultipleValueKey [0xF640EE7C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueryValueKey [0xF640EC5A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwQueueApcThread [0xF6412888]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwReplaceKey [0xF640E5D2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwRequestWaitReplyPort [0xF6411A74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwRestoreKey [0xF640E734]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwResumeThread [0xF6412F56]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSaveKey [0xF640E3D0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSecureConnectPort [0xF641108C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetContextThread [0xF640F6AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetSecurityObject [0xF641271A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetSystemInformation [0xF6412BD0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSetValueKey [0xF640EB08]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSuspendProcess [0xF6412CB4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSuspendThread [0xF6412DE0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwSystemDebugControl [0xF641254C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwTerminateProcess [0xF640F47E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) ZwWriteVirtualMemory [0xF640F4F0]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab) IoIsOperationSynchronous
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + F0 804E274C 4 Bytes JMP 16B71D91
.text ntoskrnl.exe!_abnormal_termination + 228 804E2884 4 Bytes JMP 80E5F640
.text ntoskrnl.exe!_abnormal_termination + 440 804E2A9C 12 Bytes [B4, 2C, 41, F6, E0, 2D, 41, ...]
.text ntoskrnl.exe!IoIsOperationSynchronous 804E875A 5 Bytes JMP F64269E0 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80512919 5 Bytes JMP F6426626 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
---- User code sections - GMER 1.0.15 ----
? C:\Program Files\Kaspersky Internet Security 2009\avp.exe[188] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Internet Security 2009\avp.exe[188] USER32.dll!AlignRects + FFFA5598 7E412A78 4 Bytes [70, 11, 41, 6D] {JO 0x13; INC ECX; INSD }
? C:\Program Files\Kaspersky Internet Security 2009\avp.exe[656] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Internet Security 2009\avp.exe[656] USER32.dll!AlignRects + FFFA5598 7E412A78 4 Bytes [70, 11, 41, 6D] {JO 0x13; INC ECX; INSD }
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F802B1E0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F802ADD0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F802AC50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] [F803E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] [F803E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F802B3B0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F802AC50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F802ADD0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F802B1E0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\irda.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\irda.sys[NDIS.SYS!NdisOpenAdapter] [F802ADD0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\irda.sys[NDIS.SYS!NdisRegisterProtocol] [F802AC50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\irda.sys[NDIS.SYS!NdisCloseAdapter] [F802B1E0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\irda.sys[NDIS.SYS!NdisDeregisterProtocol] [F802B3B0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkipx.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisDeregisterProtocol] [F802B3B0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisCloseAdapter] [F802B1E0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisOpenAdapter] [F802ADD0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkipx.sys[NDIS.SYS!NdisRegisterProtocol] [F802AC50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkipx.sys[TDI.SYS!TdiRegisterDeviceObject] [F803E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnknb.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnknb.sys[TDI.SYS!TdiRegisterDeviceObject] [F803E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F802AC50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F802B3B0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F802B1E0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F802ADD0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkspx.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\nwlnkspx.sys[TDI.SYS!TdiRegisterDeviceObject] [F803E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\mrxdav.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\ParVdm.SYS[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\Fastfat.SYS[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice] [F803E400] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Services - GMER 1.0.15 ----
Service system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys (*** hidden *** ) [DISABLED] gaopdxserv.sys <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\ControlSet001\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet001\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet002\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet002\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet004\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet005\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet006\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet007\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet008\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet009\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet010\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet011\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@start 4
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys@imagepath \systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys\modules
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys\modules@gaopdxserv \\?\globalroot\systemroot\system32\drivers\gaopdxptbqqobirwoxpfmudjolilrlxbehwhxy.sys
Reg HKLM\SYSTEM\ControlSet013\Services\gaopdxserv.sys\modules@gaopdxl \\?\globalroot\systemroot\system32\gaopdxmppbsxnrjlsbowkavgknkeskovdasssf.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{44034FD7-1AAB-56DE-05376226E3E18762}\{E5927D01-F17A-5508-2A74EFC6C5188D90}\{F4E471EB-CB8D-E257-550ABC7FEB789AD1}
Reg HKLM\SOFTWARE\Classes\CLSID\{44034FD7-1AAB-56DE-05376226E3E18762}\{E5927D01-F17A-5508-2A74EFC6C5188D90}\{F4E471EB-CB8D-E257-550ABC7FEB789AD1}@RA4KGUJC6T6LBNJRIDQ63C2L6C1 0x01 0x00 0x01 0x00 ...
---- EOF - GMER 1.0.15 ----
DDS Report
DDS (Ver_09-03-16.01) - NTFSx86
Run by Sushant Dev at 1:21:21.76 on 25-Mar-09
Internet Explorer: 7.0.5730.13
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.hotmail.com/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Page_URL = hxxp://www.toshiba.com
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: IE to GetRight Helper: {31ff080d-12a3-439a-a2ef-4ba95a3148e8} - c:\program files\getright6.3c\xx2gr.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky internet security 2009\ievkbd.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Discuss: {bdeade7f-c265-11d0-bced-00a0c90ab50f} - shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [pdfSaver3] "c:\program files\tracker software\pdf-xchange 3\pdfsaver\pdfSaver3.exe"
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe"
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [NWTRAY] NWTRAY.EXE
mRun: [Tpwrtray] TPWRTRAY.EXE
mRun: [TFNF5] TFNF5.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe
mRun: [nwiz] nwiz.exe /installquiet
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [Drag'n Drop CD] c:\program files\drag'n drop cd\binfiles\DragDrop.exe /StartUp
mRun: [AS00_Gear511] c:\program files\netgear\wg511scu\utility.\Gear511.exe -hide
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [AVP] "c:\program files\kaspersky internet security 2009\avp.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
IE: Add to Banner Ad Blocker - c:\program files\kaspersky internet security 2009\ie_banner_deny.htm
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download with GetRight Pro - c:\program files\getright6.3c\GRdownload.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: Open with GetRight Pro Browser - c:\program files\getright6.3c\GRbrowse.htm
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\windows\system32\msjava.dll
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky internet security 2009\SCIEPlgn.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: etihadairways.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv9dmo.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://officebeta.microsoft.com/officeupdate/content/opuc.cab
DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} - hxxp://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} - hxxp://office.microsoft.com/productupdates/content/opuc.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1132412944307
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37641.5232638889
DPF: {B020B534-4AA2-4B99-BD6D-5F6EE286DF5C} - hxxps://a248.e.akamai.net/f/248/5462/2h/www.symantecstore.com/v2.0-img/operations/symbizpr/xcontrol/SymDlBrg.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\adialhk.dll,c:\progra~1\kasper~1\kloehk.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 nwv1_0
============= SERVICES / DRIVERS ===============
=============== Created Last 30 ================
2009-03-25 00:11 <DIR> --d----- c:\program files\WinZip12
2009-03-24 23:23 2,657 a------- c:\windows\system32\%LocalXml%
2009-03-24 03:32 <DIR> --d----- c:\program files\Trend Micro
2009-03-23 23:29 101,287 a------- c:\windows\system32\drivers\klin.dat
2009-03-23 23:29 89,601 a------- c:\windows\system32\drivers\klick.dat
2009-03-23 23:25 5,053,472 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-03-23 23:25 573,472 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2009-03-23 23:25 40,560 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-03-23 23:25 3,040 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2009-03-23 23:25 <DIR> --d----- c:\program files\Kaspersky Internet Security 2009
2009-03-23 23:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2009-03-23 04:41 <DIR> -cd----- C:\common.temp
2009-03-23 04:24 <DIR> --d----- c:\docume~1\sushan~1\applic~1\WinBatch
2009-03-19 22:49 8,192 a--sh--- c:\windows\system32\Thumbs.db
2009-03-11 03:07 <DIR> --d----- c:\program files\Nero
2009-03-11 01:04 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-11 00:42 <DIR> --d----- c:\program files\Microsoft ActiveSync
2009-03-11 00:35 <DIR> --d----- c:\program files\common files\L&H
==================== Find3M ====================
2009-03-23 23:58 33,808 a------- c:\windows\system32\drivers\klbg.sys
2009-03-23 14:57 95,416 ac------ c:\docume~1\sushan~1\applic~1\GDIPFONTCACHEV1.DAT
2009-03-09 05:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-09 11:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-06 14:24 93,336 -------- c:\windows\system32\drivers\epfwtdir.sys
2009-02-06 14:23 106,208 -------- c:\windows\system32\drivers\ehdrv.sys
2009-02-06 14:19 113,448 -------- c:\windows\system32\drivers\eamon.sys
2009-02-04 05:22 2,828 a--sh--- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys
2009-02-04 05:13 8 ---shr-- c:\docume~1\alluse~1\applic~1\1CA47D6C27.sys
2008-05-11 14:53 284 ac------ c:\docume~1\sushan~1\applic~1\ViewerApp.dat
2006-03-23 01:27 488,992 a------- c:\windows\inf\wg511nd5.sys
2008-08-30 07:55 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008083020080831\index.dat
============= FINISH: 1:25:55.14 ===============
Kaspersky Internet Security 2009 scan report
24-Mar-09 11:03:44 PM Task completed
24-Mar-09 11:03:43 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\508370.tmp
24-Mar-09 11:03:35 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\344745.tmp
24-Mar-09 11:03:31 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\292630.tmp
24-Mar-09 11:03:31 PM Deleted: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\268035.tmp
24-Mar-09 11:01:53 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\268035.tmp
24-Mar-09 10:56:47 PM Detected: http://www.viruslist.com/en/advisories/23655 c:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll
24-Mar-09 10:56:46 PM Detected: http://www.viruslist.com/en/advisories/23655 c:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
24-Mar-09 10:56:46 PM Detected: http://www.viruslist.com/en/advisories/23655 c:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
24-Mar-09 10:55:58 PM Untreated: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\508370.tmp Postponed
24-Mar-09 10:55:53 PM Untreated: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\268035.tmp Postponed
24-Mar-09 10:55:52 PM Untreated: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\292630.tmp Postponed
24-Mar-09 10:55:52 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\508370.tmp
24-Mar-09 10:55:51 PM Untreated: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\344745.tmp Postponed
24-Mar-09 10:55:49 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\268035.tmp
24-Mar-09 10:55:49 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\292630.tmp
24-Mar-09 10:55:49 PM Detected: HEUR:Trojan.Win32.Generic c:\WINDOWS\Temp\344745.tmp
24-Mar-09 9:13:13 PM Detected: http://www.viruslist.com/en/advisories/12430 c:\program files\winzip\winzip32.exe
24-Mar-09 8:58:15 PM Detected: http://www.viruslist.com/en/advisories/29321 c:\program files\Microsoft Office\Office\MSO9.DLL
24-Mar-09 8:49:54 PM Detected: http://www.viruslist.com/en/advisories/32991 c:\program files\Java\j2re1.4.2\bin\eula.dll
24-Mar-09 8:26:36 PM Detected: http://www.viruslist.com/en/advisories/31744 c:\program files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL
24-Mar-09 8:21:45 PM Detected: http://www.viruslist.com/en/advisories/26027 c:\program files\Common Files\AOL\Flasha.ocx
24-Mar-09 8:16:48 PM Detected: http://www.viruslist.com/en/advisories/13246 c:\program files\Citrix\icaweb32\temp.016
24-Mar-09 6:33:46 PM Detected: http://www.viruslist.com/en/advisories/12430 c:\program files\winzip\winzip32.exe
24-Mar-09 6:26:24 PM Task started
----- END of KIS report----------
Attached Files
Edited by sushd, 25 March 2009 - 06:33 AM.