Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

infected with trojans a variant of Win32/Kryptik.arv


  • This topic is locked This topic is locked
35 replies to this topic

#1 dano_style

dano_style

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 30 October 2009 - 12:46 PM

hello started with the fakepro virus thought it was gone and now with computer online ESETNOD32 will quarantine different trojans one after another.have tried malware bytes,finds many problems but cannot solve problem.also tried superantispyware,Asquared and spybot.Always same results find infection but cant delete them out of the system.1feefe444e61c0f
DDS (Ver_09-10-26.01) - NTFSx86
Run by Windows at 13:58:46.81 on Wed 10/28/2009
Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_16
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3573.2558 [GMT -7:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskeng.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\Explorer.EXE
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\bittorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Windows\Desktop\extra\dds(2).scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [UnHackMe Monitor] c:\program files\unhackme\hackmon.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Notify: igfxcui - igfxdev.dll
SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\users\windows\appdata\roaming\mozilla\firefox\profiles\rnxexv1f.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2009-5-14 93312]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-8-8 111616]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [2007-10-10 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [2007-3-5 7424]
S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2009-10-28 34760]
S3 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2009-10-20 73728]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2009-10-28 24416]
S3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [2008-1-20 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\system32\drivers\VSTBS23.SYS [2008-1-20 251904]

=============== Created Last 30 ================

2009-10-28 20:33:30 0 d-----w- c:\program files\Trend Micro
2009-10-28 18:48:51 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2009-10-28 18:44:20 2 --shatr- c:\windows\winstart.bat
2009-10-28 18:44:04 35040 ----a-w- c:\windows\system32\Partizan.exe
2009-10-28 18:44:04 34760 ----a-w- c:\windows\system32\drivers\Partizan.sys
2009-10-28 18:43:58 12752 ----a-w- c:\windows\system32\drivers\UnHackMeDrv.sys
2009-10-28 18:43:35 0 d-----w- c:\program files\UnHackMe
2009-10-28 07:34:52 0 d-----w- c:\program files\ESET
2009-10-27 18:03:08 0 d-----w- c:\program files\Windows Portable Devices
2009-10-27 18:02:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-10-27 18:02:15 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2009-10-27 18:02:15 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2009-10-27 18:02:15 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2009-10-27 18:00:37 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-27 18:00:37 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-27 18:00:37 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-27 18:00:02 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 18:00:01 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-27 03:26:39 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-27 03:26:30 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-27 03:26:26 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-27 03:26:26 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-26 22:18:08 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-26 03:30:10 0 d-----w- c:\users\windows\appdata\roaming\ESET
2009-10-26 03:29:28 0 d-----w- c:\programdata\ESET
2009-10-25 05:56:27 0 d-----w- c:\users\windows\appdata\roaming\Tific
2009-10-24 22:57:06 0 d-----w- c:\programdata\Norton
2009-10-24 22:54:31 0 d-----w- c:\programdata\NortonInstaller
2009-10-24 04:43:59 81984 ----a-w- c:\windows\system32\bdod.bin
2009-10-24 04:38:33 0 d-----w- c:\programdata\BitDefender
2009-10-24 04:38:33 0 d-----w- c:\program files\Softwin
2009-10-24 04:37:23 0 d-----w- c:\program files\common files\Softwin
2009-10-24 03:34:29 81800 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-10-24 03:27:40 0 d-----w- c:\programdata\SITEguard
2009-10-24 03:26:49 0 d-----w- c:\program files\common files\iS3
2009-10-24 03:12:43 0 d-----w- c:\program files\bittorrent
2009-10-23 17:18:01 0 d---a-w- c:\programdata\TEMP
2009-10-23 16:50:43 626688 ----a-w- c:\windows\system32\msvcr80.dll
2009-10-21 05:54:13 0 d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-20 07:58:53 73728 ----a-w- c:\windows\system32\AEstSrv.exe
2009-10-20 07:58:53 647168 ----a-w- c:\windows\system32\aestecap.dll
2009-10-20 07:58:53 4947968 ----a-w- c:\windows\system32\stacgui.cpl
2009-10-20 07:58:53 1601536 ----a-w- c:\windows\system32\stlang.dll
2009-10-20 07:58:53 131072 ----a-w- c:\windows\system32\aestacap.dll
2009-10-20 07:58:53 102400 ----a-w- c:\windows\system32\stacsv.exe
2009-10-20 07:58:03 527872 ----a-w- c:\windows\system32\stapo.dll
2009-10-20 07:58:03 330752 ----a-w- c:\windows\system32\drivers\stwrt.sys
2009-10-20 07:58:03 328704 ----a-w- c:\windows\system32\stcplx.dll
2009-10-20 07:58:03 312320 ----a-w- c:\windows\system32\stapi32.dll
2009-10-20 07:58:02 150016 ----a-w- c:\windows\system32\st325866.dll
2009-10-20 07:53:08 172032 ----a-w- c:\windows\system32\igfxres.dll
2009-10-17 19:38:42 0 d-----w- c:\users\windows\appdata\roaming\Auslogics
2009-10-17 19:38:38 0 d-----w- c:\program files\Auslogics
2009-10-16 23:33:49 0 d-----w- c:\program files\MediaMonkey
2009-10-15 21:46:02 834048 ----a-w- c:\windows\system32\wininet.dll
2009-10-15 21:45:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-15 21:45:52 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 21:45:52 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-15 21:45:50 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-15 21:44:57 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-15 21:44:55 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-15 21:44:37 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-14 05:43:05 0 d-----w- c:\program files\ExtractNow
2009-10-09 06:15:48 0 d-----w- c:\users\windows\appdata\roaming\Malwarebytes
2009-10-09 06:15:47 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-09 06:15:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 06:15:43 0 d-----w- c:\programdata\Malwarebytes
2009-10-09 06:15:43 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-07 03:43:44 0 d-----w- c:\program files\WinAVI Video Converter
2009-10-07 03:08:12 69 ----a-w- c:\windows\NeroDigital.ini
2009-10-04 20:10:48 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-04 19:53:53 0 d-----w- c:\program files\VS Revo Group
2009-10-04 07:16:59 0 d-----w- c:\users\windows\appdata\roaming\Foxit
2009-10-04 07:16:59 0 d-----w- c:\program files\Foxit Software
2009-10-04 07:13:11 0 d-----w- c:\program files\VideoLAN
2009-10-04 03:14:59 0 d-----w- c:\users\windows\appdata\roaming\BitTorrent
2009-10-02 20:16:51 0 d-----w- c:\windows\system32\vi-VN
2009-10-02 20:16:51 0 d-----w- c:\windows\system32\eu-ES
2009-10-02 20:16:51 0 d-----w- c:\windows\system32\ca-ES
2009-10-02 20:12:46 0 d-----w- c:\windows\system32\SPReview
2009-10-02 20:00:58 93696 ----a-w- c:\windows\system32\eappgnui.dll
2009-10-02 19:58:32 0 d-----w- c:\windows\system32\EventProviders
2009-10-02 19:16:32 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-10-02 19:16:31 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-10-02 19:16:31 4096 ----a-w- c:\windows\system32\msdxm.ocx
2009-10-02 19:16:31 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-10-02 19:16:30 43520 ----a-w- c:\windows\system32\msdxm.tlb
2009-10-02 19:16:29 18432 ----a-w- c:\windows\system32\amcompat.tlb
2009-10-02 19:11:52 16058 ----a-w- c:\windows\system32\results.xml
2009-10-02 19:03:59 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-02 19:02:01 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-02 18:35:39 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-10-02 18:32:40 1696768 ----a-w- c:\windows\system32\gameux.dll
2009-10-02 18:31:54 160256 ----a-w- c:\windows\system32\wkssvc.dll
2009-10-02 18:31:53 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-10-02 18:31:50 71680 ----a-w- c:\windows\system32\atl.dll
2009-10-02 18:25:57 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-10-02 18:21:56 0 d-----w- c:\program files\Cisco
2009-10-02 18:20:19 744318 ----a-w- c:\windows\system32\oem9.inf
2009-10-02 18:15:22 22729 ----a-w- C:\newkey
2009-10-02 18:15:22 22729 ----a-w- C:\newfile.enc
2009-10-02 18:14:33 53248 ----a-w- c:\windows\system32\aestaren.dll
2009-10-02 18:13:36 492544 ----a-w- c:\windows\system32\ctapo32.dll
2009-10-02 18:13:36 45568 ----a-w- c:\windows\system32\ctppld.dll
2009-10-02 18:13:36 146944 ----a-w- c:\windows\system32\st325614.dll
2009-10-02 18:13:36 0 d-----w- c:\program files\SigmaTel
2009-10-02 18:12:45 0 d-----w- c:\program files\Marvell
2009-10-02 18:11:53 0 d-----w- c:\users\windows\appdata\roaming\TMP
2009-10-02 18:10:35 0 d-----w- C:\Old Data
2009-10-02 18:07:41 0 d-----w- c:\program files\Dell
2009-10-02 18:01:12 920088 ----a-w- c:\windows\system32\igxpun.exe
2009-10-02 18:01:12 319456 ----a-w- c:\windows\system32\difxapi.dll
2009-10-02 18:01:12 0 d-----w- c:\windows\system32\Lang
2009-10-02 18:00:49 0 d-----w- C:\Intel
2009-10-02 17:46:54 0 d-sh--we c:\programdata\Documents
2009-10-02 17:46:54 0 d-sh--we C:\Documents and Settings

==================== Find3M ====================

2009-10-27 18:03:02 86016 ----a-w- c:\windows\inf\infstrng.dat
2009-10-27 18:03:02 86016 ----a-w- c:\windows\inf\infstor.dat
2009-10-27 18:03:02 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-10-27 18:03:02 51200 ----a-w- c:\windows\inf\infpub.dat
2009-10-02 20:11:08 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-10-01 01:02:17 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02:05 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02:04 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02:02 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02:00 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01:59 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01:59 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01:56 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01:56 350208 ----a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01:56 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01:56 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01:54 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-09-25 02:10:10 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07:08 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04:32 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49:22 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48:08 351232 ----a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38:29 847360 ----a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36:13 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35:31 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33:25 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33:15 829440 ----a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33:01 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32:59 252928 ----a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31:53 519680 ----a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31:26 486912 ----a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31:21 161280 ----a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31:19 218112 ----a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31:16 1030144 ----a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31:15 828928 ----a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30:23 481792 ----a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30:23 190464 ----a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27:25 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27:04 793088 ----a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27:04 37888 ----a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27:04 1064448 ----a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54:55 258048 ----a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54:53 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54:52 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-08-29 00:27:49 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-14 15:53:34 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49:20 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49:18 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49:18 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49:15 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49:14 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49:14 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49:13 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48:02 105984 ----a-w- c:\windows\system32\netiohlp.dll
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 13:59:26.54 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:02:08 AM

Posted 06 November 2009 - 11:57 AM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
  • Please download OTL from following mirror:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#3 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 06 November 2009 - 11:30 PM

OTL Extras logfile created on: 11/6/2009 8:17:38 PM - Run 1
OTL by OldTimer - Version 3.1.4.0 Folder = C:\Users\Windows\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 175.51 Gb Free Space | 79.57% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 9.68 Gb Free Space | 99.08% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WINDOWS-PC
Current User Name: Windows
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- "%SystemRoot%\hh.exe" %1
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-889768581-779896947-403300133-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox 3.6 Beta 1\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
chm.file [open] -- "%SystemRoot%\hh.exe" %1 File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{13E79623-8296-4124-897B-B4D6DB2AD922}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{E7C3ABD9-1C34-412B-B8C0-009522A1558C}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{C35AF014-3A95-460A-8A57-607AA6B66D05}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{FE69E7EE-0A6F-4526-87E3-1C020C81744C}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{7777EFE5-6E6D-4E4E-AD65-AB219024434A}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{E03EC570-3A90-41DC-BC93-1F36E1EFD3CD}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 16
"{2EEBAC31-3EEF-4118-91CB-1A286A507DB2}" = ESET NOD32 Antivirus
"{4E5386F5-C0F6-4532-A54A-374865AEAB71}" = Cisco PEAP Module
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76F9CF97-FC4B-4E20-B363-D127C888448F}" = Cisco LEAP Module
"{8046A32C-88A7-45DA-B6D7-B6191E261033}" = Nero 7 Essentials
"{93D34EE3-99B3-4DB1-8B0A-0A657466F90D}" = Rogers Connection Manager
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{BF53252E-4AB2-4C7F-A0FD-6100755745E3}" = Cisco EAP-FAST Module
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"BitTorrent" = BitTorrent
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"ExtractNow_is1" = ExtractNow
"Foxit Reader" = Foxit Reader
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaMonkey_is1" = MediaMonkey 3.0
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.3)" = Mozilla Firefox (3.5.3)
"Mozilla Firefox (3.6b1)" = Mozilla Firefox (3.6b1)
"Revo Uninstaller" = Revo Uninstaller 1.83
"VLC media player" = VLC media player 1.0.2
"WinAVI Video Converter_is1" = WinAVI Video Converter

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-889768581-779896947-403300133-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"309a46b1dc89b774" = Dell Driver Download Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/31/2009 12:35:07 AM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 1:05:25 AM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 1:25:12 AM | Computer Name = Windows-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/31/2009 1:25:20 AM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 1:33:49 AM | Computer Name = Windows-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/31/2009 1:34:13 AM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 2:17:46 AM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 2:26:44 PM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 2:45:18 PM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2009 9:29:48 PM | Computer Name = Windows-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 10/26/2009 11:27:15 PM | Computer Name = Windows-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 10/27/2009 1:44:29 PM | Computer Name = Windows-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10/27/2009 1:44:29 PM | Computer Name = Windows-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 10/27/2009 1:44:29 PM | Computer Name = Windows-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >OTL logfile created on: 11/6/2009 8:17:38 PM - Run 1
OTL by OldTimer - Version 3.1.4.0 Folder = C:\Users\Windows\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 220.58 Gb Total Space | 175.51 Gb Free Space | 79.57% Space Free | Partition Type: NTFS
Drive D: | 9.77 Gb Total Space | 9.68 Gb Free Space | 99.08% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WINDOWS-PC
Current User Name: Windows
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/11/06 20:16:11 | 00,528,896 | ---- | M] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe
PRC - [2009/10/26 14:17:55 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009/05/14 14:47:54 | 00,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009/05/14 14:47:08 | 02,029,640 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2009/04/10 22:27:46 | 00,636,080 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/04/10 22:27:38 | 02,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/10 22:27:22 | 00,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe
PRC - [2009/02/18 10:38:44 | 00,879,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
PRC - [2008/12/15 09:02:12 | 07,170,560 | ---- | M] () -- C:\Program Files\Rogers Connection Manager\UIMain.exe
PRC - [2008/10/08 15:30:12 | 00,091,648 | ---- | M] () -- C:\Windows\System32\SupportAppXL\AutoDect.exe
PRC - [2008/02/15 17:25:34 | 00,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\stacsv.exe
PRC - [2008/01/20 18:25:33 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe
PRC - [2008/01/20 18:25:33 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe
PRC - [2008/01/20 18:25:11 | 00,125,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehtray.exe
PRC - [2008/01/20 18:25:11 | 00,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehmsas.exe
PRC - [2007/12/08 13:34:40 | 00,024,064 | ---- | M] () -- C:\Windows\System32\WLTRYSVC.EXE
PRC - [2007/12/08 13:34:10 | 02,506,752 | ---- | M] (Dell Inc.) -- C:\Windows\System32\BCMWLTRY.EXE


========== Modules (SafeList) ==========

MOD - [2009/11/06 20:16:11 | 00,528,896 | ---- | M] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe
MOD - [2009/04/10 22:21:40 | 01,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/09/24 17:27:04 | 00,793,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/05/14 14:54:22 | 00,020,680 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009/05/14 14:47:54 | 00,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2009/03/29 20:42:16 | 00,066,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/02/18 10:39:22 | 00,043,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0)
SRV - [2009/02/18 10:38:44 | 00,879,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc)
SRV - [2009/02/18 10:38:44 | 00,129,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2008/02/15 17:25:34 | 00,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\stacsv.exe -- (STacSV)
SRV - [2008/01/20 18:25:33 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008/01/20 18:25:09 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe -- (ehRecvr)
SRV - [2008/01/20 18:23:32 | 00,272,952 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/08 13:34:40 | 00,024,064 | ---- | M] () -- C:\Windows\System32\WLTRYSVC.EXE -- (wltrysvc)
SRV - [2007/09/20 14:31:10 | 00,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
SRV - [2007/05/08 18:47:22 | 00,271,920 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2007/04/13 20:09:56 | 00,792,112 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2006/11/02 04:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched)
SRV - [2006/11/02 04:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehstart.dll -- (ehstart)


========== Driver Services (SafeList) ==========

DRV - [2009/05/14 14:49:34 | 00,093,312 | ---- | M] (ESET) -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2009/05/14 14:47:14 | 00,107,256 | ---- | M] (ESET) -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009/05/14 14:41:10 | 00,114,472 | ---- | M] (ESET) -- C:\Windows\System32\drivers\eamon.sys -- (eamon)
DRV - [2008/09/19 11:25:00 | 00,104,960 | ---- | M] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2008/09/19 11:25:00 | 00,104,960 | ---- | M] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2008/09/19 11:24:58 | 00,104,960 | ---- | M] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008/09/19 11:24:58 | 00,007,168 | ---- | M] (ZTE Incorporated) -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2008/03/05 23:58:44 | 00,111,616 | ---- | M] (Intel® Corporation) -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2008/03/05 23:58:12 | 02,016,256 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2008/02/15 17:27:02 | 00,330,752 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2008/01/20 18:23:27 | 00,386,616 | ---- | M] (LSI Corporation, Inc.) -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/20 18:23:27 | 00,149,560 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/20 18:23:27 | 00,031,288 | ---- | M] (LSI Corporation) -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/20 18:23:26 | 00,101,432 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/20 18:23:26 | 00,074,808 | ---- | M] (Silicon Integrated Systems) -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/20 18:23:26 | 00,040,504 | ---- | M] (Hewlett-Packard Company) -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/20 18:23:25 | 00,987,648 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (VST_DPV)
DRV - [2008/01/20 18:23:25 | 00,987,648 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (HSF_DPV)
DRV - [2008/01/20 18:23:25 | 00,654,336 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\VSTCNXT3.SYS -- (winachsf)
DRV - [2008/01/20 18:23:25 | 00,300,600 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/20 18:23:25 | 00,251,904 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2008/01/20 18:23:25 | 00,089,656 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/20 18:23:24 | 01,122,360 | ---- | M] (QLogic Corporation) -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/20 18:23:24 | 00,118,784 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60)
DRV - [2008/01/20 18:23:24 | 00,079,928 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/20 18:23:23 | 00,235,064 | ---- | M] (Intel Corporation) -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/20 18:23:23 | 00,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/20 18:23:23 | 00,115,816 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/20 18:23:23 | 00,096,312 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/20 18:23:23 | 00,096,312 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/20 18:23:23 | 00,079,416 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/20 18:23:22 | 00,342,584 | ---- | M] (Emulex) -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/20 18:23:22 | 00,200,704 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2008/01/20 18:23:21 | 00,422,968 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/20 18:23:21 | 00,102,968 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/20 18:23:21 | 00,045,112 | ---- | M] (NVIDIA Corporation) -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/20 18:23:20 | 00,238,648 | ---- | M] (ULi Electronics Inc.) -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/20 18:23:02 | 04,422,560 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/01/20 18:23:00 | 00,020,024 | ---- | M] (VIA Technologies, Inc.) -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/20 18:23:00 | 00,019,000 | ---- | M] (CMD Technology, Inc.) -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/20 18:23:00 | 00,017,464 | ---- | M] (Acer Laboratories Inc.) -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/12/06 20:52:42 | 01,044,984 | ---- | M] (Broadcom Corp.) -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/12/06 08:51:00 | 00,298,496 | ---- | M] (Marvell) -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
DRV - [2007/10/10 16:03:00 | 00,235,648 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007/03/05 09:45:04 | 00,007,424 | ---- | M] (EyePower Games Pte. Ltd.) -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2006/11/14 16:35:20 | 00,037,376 | ---- | M] (REDC) -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/02 01:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 01:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 01:50:19 | 00,045,160 | ---- | M] (IBM Corporation) -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 01:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 01:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 01:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 01:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 01:50:05 | 00,035,944 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 01:50:03 | 00,034,920 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 01:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 01:49:56 | 00,031,848 | ---- | M] (LSI Logic) -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 00:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brserid.sys -- (Brserid)
DRV - [2006/11/02 00:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 00:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 00:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 00:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 00:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/01 23:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/01 23:30:56 | 00,429,056 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006/11/01 22:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv)
DRV - [2005/12/22 16:02:22 | 00,051,840 | ---- | M] (REDC) -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 19:28:32 | 00,028,928 | ---- | M] (REDC) -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-889768581-779896947-403300133-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKU\S-1-5-21-889768581-779896947-403300133-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKU\S-1-5-21-889768581-779896947-403300133-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-889768581-779896947-403300133-1000\S-1-5-21-889768581-779896947-403300133-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:0.0.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6b1
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/10/04 09:38:47 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/03 13:14:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/10/26 14:18:08 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6b1\extensions\\Components: C:\Program Files\Mozilla Firefox 3.6 Beta 1\components [2009/10/31 17:40:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6b1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 3.6 Beta 1\plugins [2009/10/31 17:40:24 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009/10/27 23:34:53 | 00,000,000 | ---D | M]

[2009/10/03 13:14:56 | 00,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Mozilla\Extensions
[2009/10/03 13:14:56 | 00,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/10/17 12:19:38 | 00,000,000 | ---D | M] -- C:\Users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\rnxexv1f.default\extensions
[2009/10/26 14:18:46 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/10/03 13:14:26 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/10/26 14:18:10 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
[2009/08/24 12:15:25 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll
[2009/08/24 12:15:26 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll
[2009/10/26 14:17:55 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
[2009/10/13 20:48:00 | 00,072,960 | ---- | M] (Foxit Software Company) -- C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2009/08/24 12:15:27 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
[2009/08/24 10:45:46 | 00,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml
[2009/08/24 10:45:46 | 00,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml
[2009/08/24 10:45:46 | 00,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml
[2009/08/24 10:45:46 | 00,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
[2009/08/24 10:45:46 | 00,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml
[2009/08/24 10:45:46 | 00,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml
[2009/08/24 10:45:46 | 00,000,792 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

O1 HOSTS File: (21 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.
O4 - HKLM..\Run: [autodetect] C:\Windows\System32\SupportAppXL\AutoDect.exe ()
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-889768581-779896947-403300133-1000..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found
O4 - HKLM..\RunOnceEx: [Title] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-889768581-779896947-403300133-1000\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-889768581-779896947-403300133-1000\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-889768581-779896947-403300133-1000_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-889768581-779896947-403300133-1000_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - Reg Error: Key error. File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (MACHINE) - File not found
O34 - HKLM BootExecute: (BootExecut) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/11/06 20:16:02 | 00,528,896 | ---- | C] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe
[2009/11/06 19:47:19 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\ESET
[2009/11/06 19:41:55 | 00,000,000 | ---D | C] -- C:\Windows\LastGood
[2009/11/06 19:41:52 | 00,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbser6k.sys
[2009/11/06 19:41:52 | 00,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbnmea.sys
[2009/11/06 19:41:52 | 00,104,960 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys
[2009/11/06 19:41:52 | 00,007,168 | ---- | C] (ZTE Incorporated) -- C:\Windows\System32\drivers\massfilter.sys
[2009/11/06 19:41:49 | 00,000,000 | ---D | C] -- C:\Windows\System32\SupportAppXL
[2009/11/06 19:41:45 | 00,000,000 | ---D | C] -- C:\Program Files\Rogers Connection Manager
[2009/10/31 17:40:22 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox 3.6 Beta 1
[2009/10/30 15:39:19 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\dvdcss
[2009/10/29 08:46:10 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\Microsoft Games
[2009/10/28 19:42:03 | 00,000,000 | ---D | C] -- C:\RootkitNO
[2009/10/28 19:40:56 | 00,000,000 | ---D | C] -- C:\Users\Public\Documents\RegRunInfo
[2009/10/28 12:33:30 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/28 12:30:47 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\CrashDumps
[2009/10/28 10:43:58 | 00,000,000 | ---D | C] -- C:\Users\Windows\Documents\RegRun2
[2009/10/27 23:34:52 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009/10/27 10:10:58 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\Ahead
[2009/10/27 10:03:08 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2009/10/27 10:02:15 | 03,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2009/10/27 10:02:15 | 01,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2009/10/27 10:02:15 | 00,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2009/10/27 10:01:52 | 00,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgkrnl.sys
[2009/10/27 10:01:52 | 00,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2009/10/27 10:01:52 | 00,258,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winspool.drv
[2009/10/27 10:01:52 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2009/10/27 10:01:51 | 00,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll
[2009/10/27 10:01:51 | 00,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2009/10/27 10:01:51 | 00,829,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2009/10/27 10:01:51 | 00,828,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2009/10/27 10:01:51 | 00,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2009/10/27 10:01:51 | 00,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2009/10/27 10:01:51 | 00,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2009/10/27 10:01:51 | 00,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2009/10/27 10:01:51 | 00,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2009/10/27 10:01:51 | 00,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2009/10/27 10:01:51 | 00,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2009/10/27 10:01:51 | 00,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2009/10/27 10:01:51 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2009/10/27 10:01:50 | 01,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2009/10/27 10:01:50 | 01,064,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2009/10/27 10:01:50 | 01,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2009/10/27 10:01:50 | 00,793,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2009/10/27 10:01:50 | 00,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2009/10/27 10:01:50 | 00,486,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2009/10/27 10:01:50 | 00,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2009/10/27 10:01:50 | 00,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2009/10/27 10:01:50 | 00,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2009/10/27 10:01:50 | 00,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2009/10/27 10:01:29 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpdbusenum.dll
[2009/10/27 10:01:29 | 00,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2009/10/27 10:01:29 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2009/10/27 10:01:28 | 00,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2009/10/27 10:01:26 | 02,537,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpdshext.dll
[2009/10/27 10:01:26 | 00,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2009/10/27 10:01:26 | 00,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2009/10/27 10:01:26 | 00,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2009/10/27 10:01:26 | 00,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2009/10/27 10:01:26 | 00,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2009/10/27 10:01:26 | 00,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2009/10/27 10:01:26 | 00,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShServiceObj.dll
[2009/10/27 10:00:37 | 00,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2009/10/27 10:00:37 | 00,234,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleacc.dll
[2009/10/27 10:00:37 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2009/10/27 10:00:04 | 10,627,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmp.dll
[2009/10/27 10:00:02 | 00,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2009/10/27 10:00:01 | 08,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2009/10/26 19:26:40 | 00,053,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuauclt.exe
[2009/10/26 19:26:40 | 00,044,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2009/10/26 19:26:39 | 02,421,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2009/10/26 19:26:39 | 01,929,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuaueng.dll
[2009/10/26 19:26:30 | 00,575,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2009/10/26 19:26:30 | 00,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2009/10/26 19:26:30 | 00,035,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2009/10/26 19:26:26 | 00,171,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2009/10/26 19:26:26 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2009/10/26 14:34:58 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\Apps
[2009/10/26 14:18:08 | 00,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll
[2009/10/26 14:18:08 | 00,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2009/10/26 14:18:08 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2009/10/26 14:18:08 | 00,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2009/10/26 14:10:22 | 00,000,000 | ---D | C] -- C:\Users\Windows\Documents\JavaRa
[2009/10/25 19:30:10 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\ESET
[2009/10/25 19:29:28 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET
[2009/10/25 19:29:28 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET
[2009/10/24 21:56:30 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Local\Tific
[2009/10/24 21:56:27 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Tific
[2009/10/23 19:12:43 | 00,000,000 | ---D | C] -- C:\Program Files\bittorrent
[2009/10/23 08:50:43 | 00,626,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcr80.dll
[2009/10/21 09:18:39 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009/10/21 04:02:41 | 00,000,000 | ---D | C] -- C:\Windows\Minidump
[2009/10/19 23:58:53 | 04,947,968 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\stacgui.cpl
[2009/10/19 23:58:53 | 01,601,536 | ---- | C] (SigmaTel, Inc.) -- C:\Windows\System32\stlang.dll
[2009/10/19 23:58:53 | 00,647,168 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\aestecap.dll
[2009/10/19 23:58:53 | 00,131,072 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\aestacap.dll
[2009/10/19 23:58:53 | 00,102,400 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\stacsv.exe
[2009/10/19 23:58:53 | 00,073,728 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe
[2009/10/19 23:58:03 | 00,527,872 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\stapo.dll
[2009/10/19 23:58:03 | 00,330,752 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\drivers\stwrt.sys
[2009/10/19 23:58:03 | 00,328,704 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\stcplx.dll
[2009/10/19 23:58:03 | 00,312,320 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\stapi32.dll
[2009/10/19 23:58:02 | 00,150,016 | ---- | C] (IDT, Inc.) -- C:\Windows\System32\st325866.dll
[2009/10/19 23:53:08 | 00,172,032 | ---- | C] (Intel Corporation) -- C:\Windows\System32\igfxres.dll
[2009/10/17 11:38:42 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Auslogics
[2009/10/17 11:38:38 | 00,000,000 | ---D | C] -- C:\Program Files\Auslogics
[2009/10/16 15:33:49 | 00,000,000 | ---D | C] -- C:\Program Files\MediaMonkey
[2009/10/15 13:46:02 | 00,834,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll
[2009/10/15 13:46:01 | 01,176,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll
[2009/10/15 13:46:00 | 03,599,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll
[2009/10/15 13:45:58 | 06,079,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll
[2009/10/15 13:45:58 | 00,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2009/10/15 13:45:57 | 00,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2009/10/15 13:45:57 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2009/10/15 13:45:52 | 03,600,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2009/10/15 13:45:52 | 03,548,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2009/10/15 13:45:50 | 00,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msv1_0.dll
[2009/10/15 13:44:57 | 00,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msasn1.dll
[2009/10/15 13:44:55 | 00,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2009/10/15 13:44:37 | 00,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv2.sys
[2009/10/14 10:27:17 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\vlc
[2009/10/13 21:43:05 | 00,000,000 | ---D | C] -- C:\Program Files\ExtractNow
[2009/10/08 22:15:48 | 00,000,000 | ---D | C] -- C:\Users\Windows\AppData\Roaming\Malwarebytes
[2009/10/08 22:15:47 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2009/10/08 22:15:44 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/10/08 22:15:43 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2009/10/08 22:15:43 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2009/10/08 22:15:43 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

========== Files - Modified Within 30 Days ==========

[2009/11/06 20:17:53 | 01,310,720 | -HS- | M] () -- C:\Users\Windows\NTUSER.DAT
[2009/11/06 20:16:11 | 00,528,896 | ---- | M] (OldTimer Tools) -- C:\Users\Windows\Desktop\OTL.exe
[2009/11/06 19:44:02 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2009/11/06 19:44:02 | 00,595,684 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2009/11/06 19:44:02 | 00,101,350 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2009/11/06 19:41:51 | 00,001,595 | ---- | M] () -- C:\Users\Public\Desktop\Rogers Connection Manager.lnk
[2009/11/06 19:40:21 | 00,005,184 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/11/06 19:40:20 | 00,005,184 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/11/06 19:40:18 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009/11/06 19:40:07 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009/11/03 03:19:47 | 00,524,288 | -HS- | M] () -- C:\Users\Windows\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2009/11/03 03:19:47 | 00,065,536 | -HS- | M] () -- C:\Users\Windows\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2009/11/03 03:19:45 | 01,472,994 | -H-- | M] () -- C:\Users\Windows\AppData\Local\IconCache.db
[2009/11/03 03:19:30 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2009/11/02 20:42:06 | 00,195,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2009/10/31 17:40:28 | 00,001,829 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox 3.6 Beta 1.lnk
[2009/10/28 12:38:14 | 00,000,021 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2009/10/28 12:33:31 | 00,001,876 | ---- | M] () -- C:\Users\Windows\Desktop\HijackThis.lnk
[2009/10/28 12:14:43 | 00,000,830 | ---- | M] () -- C:\Users\Windows\Desktop\bittorrent.exe.lnk
[2009/10/28 10:44:20 | 00,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2009/10/28 10:44:20 | 00,001,688 | ---- | M] () -- C:\Windows\System32\autoexec.nt
[2009/10/28 10:44:20 | 00,000,002 | RHS- | M] () -- C:\Windows\winstart.bat
[2009/10/27 10:02:56 | 00,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2009/10/26 17:52:54 | 00,052,776 | ---- | M] () -- C:\Users\Windows\AppData\Local\GDIPFONTCACHEV1.DAT
[2009/10/26 14:17:53 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deploytk.dll
[2009/10/26 14:17:53 | 00,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2009/10/26 14:17:53 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2009/10/26 14:17:53 | 00,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2009/10/23 21:49:21 | 00,081,984 | ---- | M] () -- C:\Windows\System32\bdod.bin
[2009/10/23 19:34:36 | 00,081,800 | ---- | M] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2009/10/19 23:53:01 | 00,016,058 | ---- | M] () -- C:\Windows\System32\results.xml
[2009/10/15 11:24:47 | 00,012,579 | ---- | M] () -- C:\Users\Windows\Desktop\11182475.jpg
[2009/10/08 15:12:09 | 00,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\en-US\dxgkrnl.sys.mui
[2009/10/08 13:08:01 | 00,555,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2009/10/08 13:08:01 | 00,234,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\oleacc.dll
[2009/10/08 13:07:59 | 00,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll

========== Files Created - No Company Name ==========

[2009/11/06 19:41:45 | 00,001,595 | ---- | C] () -- C:\Users\Public\Desktop\Rogers Connection Manager.lnk
[2009/10/31 17:40:28 | 00,001,829 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox 3.6 Beta 1.lnk
[2009/10/31 00:31:39 | 01,472,994 | -H-- | C] () -- C:\Users\Windows\AppData\Local\IconCache.db
[2009/10/28 12:33:31 | 00,001,876 | ---- | C] () -- C:\Users\Windows\Desktop\HijackThis.lnk
[2009/10/28 12:14:23 | 00,000,830 | ---- | C] () -- C:\Users\Windows\Desktop\bittorrent.exe.lnk
[2009/10/28 10:44:20 | 00,000,002 | RHS- | C] () -- C:\Windows\winstart.bat
[2009/10/27 10:02:56 | 00,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2009/10/26 17:52:54 | 00,052,776 | ---- | C] () -- C:\Users\Windows\AppData\Local\GDIPFONTCACHEV1.DAT
[2009/10/23 20:43:59 | 00,081,984 | ---- | C] () -- C:\Windows\System32\bdod.bin
[2009/10/23 19:34:29 | 00,081,800 | ---- | C] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2009/10/15 11:24:47 | 00,012,579 | ---- | C] () -- C:\Users\Windows\Desktop\11182475.jpg
[2009/10/06 19:08:12 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009/10/02 12:00:56 | 00,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/10/02 10:19:13 | 00,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2008/08/08 21:38:20 | 00,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2008/08/08 21:38:19 | 01,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008/08/08 21:38:19 | 01,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008/08/08 21:38:19 | 00,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008/08/08 21:38:19 | 00,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2006/11/02 04:50:50 | 00,000,174 | -HS- | C] () -- C:\Program Files\desktop.ini
[2006/11/02 04:37:35 | 00,037,665 | ---- | C] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
[2006/11/02 04:37:35 | 00,029,779 | ---- | C] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 04:37:35 | 00,026,489 | ---- | C] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 04:37:35 | 00,026,040 | ---- | C] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 04:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini
[2006/11/02 02:23:31 | 00,000,144 | ---- | C] () -- C:\Windows\win.ini
[2006/11/01 23:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005/05/06 18:06:00 | 00,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
< End of report >

#4 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 06 November 2009 - 11:37 PM

sorry computer wont let me use the options button at top of page.says im not logged in so i hope i did all the rest you asked correctly hope to hear from you soon DANO

#5 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:02:08 AM

Posted 07 November 2009 - 11:26 AM

Hi,

can you please tell me were Eset was finding those infections?

Please also run a scan with malwarebytes:
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
If you have a previous version of MBAM, remove it via Add/Remove Programs and download a fresh copy.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.

And a scan with gmer:
Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#6 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 07 November 2009 - 06:37 PM

Malwarebytes' Anti-Malware 1.41
Database version: 3119
Windows 6.0.6002 Service Pack 2

11/7/2009 2:59:14 PM
mbam-log-2009-11-07 (14-59-14).txt

Scan type: Quick Scan
Objects scanned: 81785
Time elapsed: 1 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-07 15:26:56
Windows 6.0.6002 Service Pack 2
Running: cj69j14j.exe; Driver: C:\Users\Windows\AppData\Local\Temp\uwtdyfob.sys


---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1788] kernel32.dll!SetUnhandledExceptionFilter 7677A84F 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort0 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort1 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort2 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat eamon.sys (Amon monitor/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:340] 86778930

---- Files - GMER 1.0.15 ----

File C:\Windows\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----
as far as the eset.nod goes the viruses are found in c/system32/tdlwsp.dll http.// 212.117.183.13.installus.exe

#7 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:02:08 AM

Posted 08 November 2009 - 07:29 AM

Hi,

please run Combofix:

Please download ComboFix from one of these locations:

Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Temporarily disable isable your AntiVirus and AntiSpyware applications. They may otherwise interfere with our tools
    Usually this can be done via a right click on the System Tray icon, check this tutorial for disabling the most common security programs: Link

  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#8 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 08 November 2009 - 02:32 PM

thanks for all your help the log file is attached.ComboFix 09-11-07.04 - Windows 11/08/2009 11:12.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3573.2378 [GMT -8:00]
Running from: c:\users\Windows\Desktop\extra\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-188071009-3223217472-2721726515-1000
c:\windows\run.log
c:\windows\system32\oem9.inf
D:\resycled

.
((((((((((((((((((((((((( Files Created from 2009-10-08 to 2009-11-08 )))))))))))))))))))))))))))))))
.

2009-11-07 22:55 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-07 22:55 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-07 22:55 . 2009-11-07 22:55 4096 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-07 03:47 . 2009-11-07 03:47 -------- d-----w- c:\users\Windows\AppData\Local\ESET
2009-11-07 03:41 . 2008-09-19 19:25 104960 ----a-w- c:\windows\system32\drivers\ZTEusbser6k.sys
2009-11-07 03:41 . 2008-09-19 19:25 104960 ----a-w- c:\windows\system32\drivers\ZTEusbnmea.sys
2009-11-07 03:41 . 2008-09-19 19:24 7168 ----a-w- c:\windows\system32\drivers\massfilter.sys
2009-11-07 03:41 . 2008-09-19 19:24 104960 ----a-w- c:\windows\system32\drivers\ZTEusbmdm6k.sys
2009-11-07 03:41 . 2009-11-07 03:42 4096 d-----w- c:\windows\system32\SupportAppXL
2009-11-07 03:41 . 2009-11-08 01:34 4096 d-----w- c:\program files\Rogers Connection Manager
2009-11-01 01:40 . 2009-11-08 18:56 8192 d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1
2009-10-30 23:39 . 2009-10-30 23:39 -------- d-----w- c:\users\Windows\AppData\Roaming\dvdcss
2009-10-29 16:46 . 2009-10-29 17:05 -------- d-----w- c:\users\Windows\AppData\Local\Microsoft Games
2009-10-29 03:42 . 2009-10-30 16:40 4096 d-----w- C:\RootkitNO
2009-10-28 20:33 . 2009-10-28 20:33 -------- d-----w- c:\program files\Trend Micro
2009-10-28 20:30 . 2009-11-08 19:19 -------- d-----w- c:\users\Windows\AppData\Local\CrashDumps
2009-10-28 18:44 . 2009-10-28 18:44 2 --shatr- c:\windows\winstart.bat
2009-10-28 07:34 . 2009-10-28 07:34 -------- d-----w- c:\program files\ESET
2009-10-27 18:10 . 2009-10-27 18:10 -------- d-----w- c:\users\Windows\AppData\Local\Ahead
2009-10-27 18:03 . 2009-10-27 18:03 -------- d-----w- c:\program files\Windows Portable Devices
2009-10-27 18:02 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2009-10-27 18:02 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2009-10-27 18:02 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2009-10-27 18:00 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-27 18:00 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-27 18:00 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-27 18:00 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 18:00 . 2009-09-10 14:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-27 03:26 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-27 03:26 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-27 03:26 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-27 03:26 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-27 03:26 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-27 03:26 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-27 03:26 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-27 03:26 . 2009-08-07 02:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-27 03:26 . 2009-08-07 01:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-27 01:52 . 2009-10-27 01:52 52776 ----a-w- c:\users\Windows\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-26 22:34 . 2009-10-26 22:34 -------- d-----w- c:\users\Windows\AppData\Local\Apps
2009-10-26 22:18 . 2009-10-26 22:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-25 05:56 . 2009-10-25 05:56 -------- d-----w- c:\users\Windows\AppData\Local\Tific
2009-10-25 05:56 . 2009-10-25 05:56 -------- d-----w- c:\users\Windows\AppData\Roaming\Tific
2009-10-24 04:43 . 2009-10-24 05:49 81984 ----a-w- c:\windows\system32\bdod.bin
2009-10-24 03:12 . 2009-10-24 03:12 -------- d-----w- c:\program files\bittorrent
2009-10-23 16:50 . 2005-09-23 14:29 626688 ----a-w- c:\windows\system32\msvcr80.dll
2009-10-20 07:58 . 2008-02-16 01:25 102400 ----a-w- c:\windows\system32\stacsv.exe
2009-10-20 07:58 . 2007-09-20 22:31 647168 ----a-w- c:\windows\system32\aestecap.dll
2009-10-20 07:58 . 2007-09-20 22:31 131072 ----a-w- c:\windows\system32\aestacap.dll
2009-10-20 07:58 . 2007-09-20 22:31 73728 ----a-w- c:\windows\system32\AEstSrv.exe
2009-10-20 07:58 . 2007-04-11 01:02 1601536 ----a-w- c:\windows\system32\stlang.dll
2009-10-20 07:58 . 2008-02-16 01:27 330752 ----a-w- c:\windows\system32\drivers\stwrt.sys
2009-10-20 07:58 . 2008-02-16 01:26 328704 ----a-w- c:\windows\system32\stcplx.dll
2009-10-20 07:58 . 2008-02-16 01:25 527872 ----a-w- c:\windows\system32\stapo.dll
2009-10-20 07:58 . 2008-02-16 01:23 312320 ----a-w- c:\windows\system32\stapi32.dll
2009-10-20 07:58 . 2008-02-16 01:24 150016 ----a-w- c:\windows\system32\st325866.dll
2009-10-20 07:53 . 2008-03-06 07:58 172032 ----a-w- c:\windows\system32\igfxres.dll
2009-10-17 19:38 . 2009-10-17 19:38 -------- d-----w- c:\users\Windows\AppData\Roaming\Auslogics
2009-10-17 19:38 . 2009-10-17 19:38 -------- d-----w- c:\program files\Auslogics
2009-10-16 23:33 . 2009-10-16 23:33 8192 d-----w- c:\program files\MediaMonkey
2009-10-15 21:46 . 2009-08-27 12:40 834048 ----a-w- c:\windows\system32\wininet.dll
2009-10-15 21:45 . 2009-08-27 13:29 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-15 21:45 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 21:45 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-15 21:45 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-15 21:44 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-15 21:44 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-15 21:44 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-14 18:27 . 2009-11-08 05:19 4096 d-----w- c:\users\Windows\AppData\Roaming\vlc
2009-10-14 05:43 . 2009-10-14 05:43 4096 d-----w- c:\program files\ExtractNow

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-08 03:57 . 2009-10-04 03:14 12288 d-----w- c:\users\Windows\AppData\Roaming\BitTorrent
2009-11-07 03:41 . 2009-10-02 18:13 4096 d--h--w- c:\program files\InstallShield Installation Information
2009-11-03 04:42 . 2009-10-02 19:02 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 16:24 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-10-27 18:03 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-10-27 18:02 . 2009-10-27 18:02 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-10-26 22:17 . 2008-11-01 18:18 -------- d-----w- c:\program files\Java
2009-10-24 03:34 . 2009-10-24 03:34 81800 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-10-17 18:09 . 2009-10-02 18:10 -------- d-----w- c:\program files\Intel
2009-10-09 06:15 . 2009-10-09 06:15 -------- d-----w- c:\users\Windows\AppData\Roaming\Malwarebytes
2009-10-09 06:15 . 2009-10-09 06:15 -------- d-----w- c:\programdata\Malwarebytes
2009-10-07 05:34 . 2009-10-03 21:05 -------- d-----w- c:\users\Windows\AppData\Roaming\Ahead
2009-10-07 03:43 . 2009-10-07 03:43 4096 d-----w- c:\program files\WinAVI Video Converter
2009-10-04 19:55 . 2009-10-02 18:07 -------- d-----w- c:\program files\Dell
2009-10-04 19:53 . 2009-10-04 19:53 -------- d-----w- c:\program files\VS Revo Group
2009-10-04 07:16 . 2009-10-04 07:16 -------- d-----w- c:\users\Windows\AppData\Roaming\Foxit
2009-10-04 07:16 . 2009-10-04 07:16 -------- d-----w- c:\program files\Foxit Software
2009-10-04 07:13 . 2009-10-04 07:13 -------- d-----w- c:\program files\VideoLAN
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Sidebar
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Journal
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Collaboration
2009-10-02 20:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Photo Gallery
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Defender
2009-10-02 18:22 . 2009-10-02 18:21 -------- d-----w- c:\program files\Cisco
2009-10-02 18:15 . 2009-10-02 18:15 -------- d-----w- c:\users\Windows\AppData\Roaming\InstallShield
2009-10-02 18:13 . 2009-10-02 18:13 -------- d-----w- c:\program files\SigmaTel
2009-10-02 18:13 . 2009-10-02 18:12 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-02 18:12 . 2009-10-02 18:12 -------- d-----w- c:\program files\Marvell
2009-10-02 18:11 . 2009-10-02 18:11 -------- d-----w- c:\users\Windows\AppData\Roaming\TMP
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Templates
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Start Menu
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Favorites
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Documents
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Desktop
2009-10-01 01:02 . 2009-10-27 18:01 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02 . 2009-10-27 18:01 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02 . 2009-10-27 18:01 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02 . 2009-10-27 18:01 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02 . 2009-10-27 18:01 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-10-27 18:01 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01 . 2009-10-27 18:01 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01 . 2009-10-27 18:01 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01 . 2009-10-27 18:01 350208 ----a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01 . 2009-10-27 18:01 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01 . 2009-10-27 18:01 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01 . 2009-10-27 18:01 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-09-25 02:10 . 2009-10-27 18:01 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-10-27 18:01 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-10-27 18:01 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-10-27 18:01 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-10-27 18:01 351232 ----a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-10-27 18:01 847360 ----a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-10-27 18:01 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-10-27 18:01 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-10-27 18:01 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-10-27 18:01 829440 ----a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-10-27 18:01 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-10-27 18:01 252928 ----a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-10-27 18:01 519680 ----a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-10-27 18:01 486912 ----a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-10-27 18:01 161280 ----a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-10-27 18:01 218112 ----a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-10-27 18:01 1030144 ----a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-10-27 18:01 828928 ----a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-10-27 18:01 481792 ----a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-10-27 18:01 190464 ----a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-10-27 18:01 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-10-27 18:01 37888 ----a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-10-27 18:01 793088 ----a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-10-27 18:01 1064448 ----a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-10-27 18:01 258048 ----a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-10-27 18:01 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-10-27 18:01 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-08-29 00:27 . 2009-10-02 18:32 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-10-02 18:32 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-14 16:27 . 2009-10-02 18:33 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-10-02 18:33 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-10-02 18:33 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-10-02 18:33 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-10-02 18:33 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-10-02 18:33 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-10-02 18:33 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-10-02 18:33 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-10-02 18:33 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-10-02 18:33 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-10-02 18:33 105984 ----a-w- c:\windows\system32\netiohlp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-26 149280]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-02-16 405504]
"autodetect"="c:\windows\system32\SupportAppXL\AutoDect.exe" [2008-10-08 91648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:(:f2,c2,01,30,9e,43,ca,01

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [5/14/2009 2:47 PM 107256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [5/14/2009 2:47 PM 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\System32\drivers\epfwwfpr.sys [5/14/2009 2:49 PM 93312]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [8/8/2008 9:38 PM 111616]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [10/10/2007 4:03 PM 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [3/5/2007 9:45 AM 7424]
S3 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [10/19/2009 11:58 PM 73728]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 6:23 PM 21504]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\System32\drivers\massfilter.sys [11/6/2009 7:41 PM 7168]
S3 VST_DPV;VST_DPV;c:\windows\System32\drivers\VSTDPV3.SYS [1/20/2008 6:23 PM 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\System32\drivers\VSTBS23.SYS [1/20/2008 6:23 PM 251904]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - MBR
*NewlyCreated* - PROCEXP113
*Deregistered* - mbr
*Deregistered* - PROCEXP113

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
TCP: {A2F4BDA2-5B48-4D6B-B287-6B4C9368A991} = 64.71.255.198 207.181.101.5
FF - ProfilePath - c:\users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\rnxexv1f.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
AddRemove-BitTorrent - c:\program files\BitTorrent\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 11:19
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-11-08 11:22
ComboFix-quarantined-files.txt 2009-11-08 19:22

Pre-Run: 188,141,473,792 bytes free
Post-Run: 188,096,888,832 bytes free

- - End Of File - - E24E8A55DD3BE81D0723F6830D40A0BB

#9 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:02:08 AM

Posted 08 November 2009 - 03:13 PM

Hi,

could you please run gmer again.

Please also run the following systemlook scan:
Please download SystemLook from jpshortstuff and save it to your Desktop
Download Mirror #1
Download Mirror #2
  • Double-click the SystemLook and copy/paste the following into the box
    :filefind
    atapi*
  • Hit the Look button. Let it finish the scan
  • A log will then pop-up to your Desktop.. Post the content of the log here in your next reply
please post back both logs from gmer and systemlook.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#10 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 08 November 2009 - 05:03 PM

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 14:00 on 08/11/2009 by Windows (Administrator - Elevation successful)

========== filefind ==========

Searching for "atapi*"
C:\Windows\ERDNT\cache\atapi.sys --a--- 19944 bytes [19:20 08/11/2009] [06:32 11/04/2009] 1F05B78AB91C9075565A9D8A4B880BC4
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys --a--- 19944 bytes [20:00 02/10/2009] [06:32 11/04/2009] 1F05B78AB91C9075565A9D8A4B880BC4
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys --a--- 19048 bytes [10:25 02/11/2006] [09:49 02/11/2006] 4F4FCB8B6EA06784FB6D475B7EC7300F
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys --a--- 21560 bytes [02:23 21/01/2008] [02:23 21/01/2008] 2D9C903DC76A66813D350A562DE40ED9
C:\Windows\System32\drivers\atapi.sys --a--- 19944 bytes [20:00 02/10/2009] [06:32 11/04/2009] 1F05B78AB91C9075565A9D8A4B880BC4
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys --a--- 21560 bytes [02:23 21/01/2008] [02:23 21/01/2008] 2D9C903DC76A66813D350A562DE40ED9
C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys --a--- 19944 bytes [20:00 02/10/2009] [06:32 11/04/2009] 1F05B78AB91C9075565A9D8A4B880BC4

-=End Of File=-GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-08 13:57:46
Windows 6.0.6002 Service Pack 2
Running: wuvhz2qt.exe; Driver: C:\Users\Windows\AppData\Local\Temp\uwtdyfob.sys


---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1800] kernel32.dll!SetUnhandledExceptionFilter 776CA84F 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 [807A49B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort0 [807A49B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort1 [807A49B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort2 [807A49B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2 [807A49B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat eamon.sys (Amon monitor/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:376] 881F1930

---- Files - GMER 1.0.15 ----

File C:\Windows\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

#11 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:02:08 AM

Posted 08 November 2009 - 05:45 PM

Hi,

you are infected with a rootkit and unfortunately Combofix did not take care of it.

We're going to try to replace the files manually:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

FCopy::
C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys|C:\windows\system32\drivers\atapi.sys


Save this as CFScript.txt, in the same location as ComboFix.exe


Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply, please also create a new log with gmer and post it in your next reply.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#12 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 08 November 2009 - 08:24 PM

ComboFix 09-11-07.04 - Windows 11/08/2009 16:36.2.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3573.2357 [GMT -8:00]
Running from: c:\users\Windows\Desktop\extra\ComboFix.exe
Command switches used :: c:\users\Windows\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-10-09 to 2009-11-09 )))))))))))))))))))))))))))))))
.

2009-11-09 00:43 . 2009-11-09 00:47 4096 d-----w- c:\users\Windows\AppData\Local\temp
2009-11-09 00:43 . 2009-11-09 00:43 -------- d-----w- c:\users\Public\AppData\Local\temp
2009-11-07 22:55 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-07 22:55 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-07 22:55 . 2009-11-07 22:55 4096 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-07 03:47 . 2009-11-07 03:47 -------- d-----w- c:\users\Windows\AppData\Local\ESET
2009-11-07 03:41 . 2008-09-19 19:25 104960 ----a-w- c:\windows\system32\drivers\ZTEusbser6k.sys
2009-11-07 03:41 . 2008-09-19 19:25 104960 ----a-w- c:\windows\system32\drivers\ZTEusbnmea.sys
2009-11-07 03:41 . 2008-09-19 19:24 7168 ----a-w- c:\windows\system32\drivers\massfilter.sys
2009-11-07 03:41 . 2008-09-19 19:24 104960 ----a-w- c:\windows\system32\drivers\ZTEusbmdm6k.sys
2009-11-07 03:41 . 2009-11-07 03:42 4096 d-----w- c:\windows\system32\SupportAppXL
2009-11-07 03:41 . 2009-11-09 00:47 4096 d-----w- c:\program files\Rogers Connection Manager
2009-11-01 01:40 . 2009-11-09 00:08 8192 d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1
2009-10-30 23:39 . 2009-10-30 23:39 -------- d-----w- c:\users\Windows\AppData\Roaming\dvdcss
2009-10-29 16:46 . 2009-10-29 17:05 -------- d-----w- c:\users\Windows\AppData\Local\Microsoft Games
2009-10-29 03:42 . 2009-10-30 16:40 -------- d-----w- C:\RootkitNO
2009-10-28 20:33 . 2009-10-28 20:33 -------- d-----w- c:\program files\Trend Micro
2009-10-28 20:30 . 2009-11-09 00:46 4096 d-----w- c:\users\Windows\AppData\Local\CrashDumps
2009-10-28 18:44 . 2009-10-28 18:44 2 --shatr- c:\windows\winstart.bat
2009-10-28 07:34 . 2009-10-28 07:34 -------- d-----w- c:\program files\ESET
2009-10-27 18:10 . 2009-10-27 18:10 -------- d-----w- c:\users\Windows\AppData\Local\Ahead
2009-10-27 18:03 . 2009-10-27 18:03 -------- d-----w- c:\program files\Windows Portable Devices
2009-10-27 18:02 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2009-10-27 18:02 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2009-10-27 18:02 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2009-10-27 18:00 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-27 18:00 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-10-27 18:00 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-10-27 18:00 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 18:00 . 2009-09-10 14:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-27 03:26 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-27 03:26 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-27 03:26 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-27 03:26 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-27 03:26 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-27 03:26 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-27 03:26 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-27 03:26 . 2009-08-07 02:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-27 03:26 . 2009-08-07 01:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-27 01:52 . 2009-10-27 01:52 52776 ----a-w- c:\users\Windows\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-26 22:34 . 2009-10-26 22:34 -------- d-----w- c:\users\Windows\AppData\Local\Apps
2009-10-26 22:18 . 2009-10-26 22:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-25 05:56 . 2009-10-25 05:56 -------- d-----w- c:\users\Windows\AppData\Local\Tific
2009-10-25 05:56 . 2009-10-25 05:56 -------- d-----w- c:\users\Windows\AppData\Roaming\Tific
2009-10-24 04:43 . 2009-10-24 05:49 81984 ----a-w- c:\windows\system32\bdod.bin
2009-10-24 03:12 . 2009-10-24 03:12 -------- d-----w- c:\program files\bittorrent
2009-10-23 16:50 . 2005-09-23 14:29 626688 ----a-w- c:\windows\system32\msvcr80.dll
2009-10-20 07:58 . 2008-02-16 01:25 102400 ----a-w- c:\windows\system32\stacsv.exe
2009-10-20 07:58 . 2007-09-20 22:31 647168 ----a-w- c:\windows\system32\aestecap.dll
2009-10-20 07:58 . 2007-09-20 22:31 131072 ----a-w- c:\windows\system32\aestacap.dll
2009-10-20 07:58 . 2007-09-20 22:31 73728 ----a-w- c:\windows\system32\AEstSrv.exe
2009-10-20 07:58 . 2007-04-11 01:02 1601536 ----a-w- c:\windows\system32\stlang.dll
2009-10-20 07:58 . 2008-02-16 01:27 330752 ----a-w- c:\windows\system32\drivers\stwrt.sys
2009-10-20 07:58 . 2008-02-16 01:26 328704 ----a-w- c:\windows\system32\stcplx.dll
2009-10-20 07:58 . 2008-02-16 01:25 527872 ----a-w- c:\windows\system32\stapo.dll
2009-10-20 07:58 . 2008-02-16 01:23 312320 ----a-w- c:\windows\system32\stapi32.dll
2009-10-20 07:58 . 2008-02-16 01:24 150016 ----a-w- c:\windows\system32\st325866.dll
2009-10-20 07:53 . 2008-03-06 07:58 172032 ----a-w- c:\windows\system32\igfxres.dll
2009-10-17 19:38 . 2009-10-17 19:38 -------- d-----w- c:\users\Windows\AppData\Roaming\Auslogics
2009-10-17 19:38 . 2009-10-17 19:38 -------- d-----w- c:\program files\Auslogics
2009-10-16 23:33 . 2009-10-16 23:33 8192 d-----w- c:\program files\MediaMonkey
2009-10-15 21:46 . 2009-08-27 12:40 834048 ----a-w- c:\windows\system32\wininet.dll
2009-10-15 21:45 . 2009-08-27 13:29 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-15 21:45 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 21:45 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-15 21:45 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-15 21:44 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-15 21:44 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-15 21:44 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-14 18:27 . 2009-11-08 05:19 -------- d-----w- c:\users\Windows\AppData\Roaming\vlc
2009-10-14 05:43 . 2009-10-14 05:43 4096 d-----w- c:\program files\ExtractNow

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-09 00:20 . 2009-10-04 03:14 12288 d-----w- c:\users\Windows\AppData\Roaming\BitTorrent
2009-11-07 03:41 . 2009-10-02 18:13 4096 d--h--w- c:\program files\InstallShield Installation Information
2009-11-03 04:42 . 2009-10-02 19:02 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 16:24 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail
2009-10-27 18:03 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-10-27 18:02 . 2009-10-27 18:02 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-10-26 22:17 . 2008-11-01 18:18 -------- d-----w- c:\program files\Java
2009-10-24 03:34 . 2009-10-24 03:34 81800 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-10-17 18:09 . 2009-10-02 18:10 -------- d-----w- c:\program files\Intel
2009-10-09 06:15 . 2009-10-09 06:15 -------- d-----w- c:\users\Windows\AppData\Roaming\Malwarebytes
2009-10-09 06:15 . 2009-10-09 06:15 -------- d-----w- c:\programdata\Malwarebytes
2009-10-07 05:34 . 2009-10-03 21:05 -------- d-----w- c:\users\Windows\AppData\Roaming\Ahead
2009-10-07 03:43 . 2009-10-07 03:43 4096 d-----w- c:\program files\WinAVI Video Converter
2009-10-04 19:55 . 2009-10-02 18:07 -------- d-----w- c:\program files\Dell
2009-10-04 19:53 . 2009-10-04 19:53 -------- d-----w- c:\program files\VS Revo Group
2009-10-04 07:16 . 2009-10-04 07:16 -------- d-----w- c:\users\Windows\AppData\Roaming\Foxit
2009-10-04 07:16 . 2009-10-04 07:16 -------- d-----w- c:\program files\Foxit Software
2009-10-04 07:13 . 2009-10-04 07:13 -------- d-----w- c:\program files\VideoLAN
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Sidebar
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Journal
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Collaboration
2009-10-02 20:17 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Photo Gallery
2009-10-02 20:17 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Defender
2009-10-02 18:22 . 2009-10-02 18:21 -------- d-----w- c:\program files\Cisco
2009-10-02 18:15 . 2009-10-02 18:15 -------- d-----w- c:\users\Windows\AppData\Roaming\InstallShield
2009-10-02 18:13 . 2009-10-02 18:13 -------- d-----w- c:\program files\SigmaTel
2009-10-02 18:13 . 2009-10-02 18:12 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-02 18:12 . 2009-10-02 18:12 -------- d-----w- c:\program files\Marvell
2009-10-02 18:11 . 2009-10-02 18:11 -------- d-----w- c:\users\Windows\AppData\Roaming\TMP
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Templates
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Start Menu
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Favorites
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Documents
2009-10-02 17:46 . 2009-10-02 17:46 -------- d-sh--we c:\programdata\Desktop
2009-10-01 01:02 . 2009-10-27 18:01 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02 . 2009-10-27 18:01 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02 . 2009-10-27 18:01 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02 . 2009-10-27 18:01 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02 . 2009-10-27 18:01 31232 ----a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-10-27 18:01 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01 . 2009-10-27 18:01 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01 . 2009-10-27 18:01 60928 ----a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01 . 2009-10-27 18:01 350208 ----a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01 . 2009-10-27 18:01 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01 . 2009-10-27 18:01 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01 . 2009-10-27 18:01 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-09-25 02:10 . 2009-10-27 18:01 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-10-27 18:01 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-10-27 18:01 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-10-27 18:01 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-10-27 18:01 351232 ----a-w- c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-10-27 18:01 847360 ----a-w- c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-10-27 18:01 280064 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-10-27 18:01 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-10-27 18:01 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-10-27 18:01 829440 ----a-w- c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-10-27 18:01 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-10-27 18:01 252928 ----a-w- c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-10-27 18:01 519680 ----a-w- c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-10-27 18:01 486912 ----a-w- c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-10-27 18:01 161280 ----a-w- c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-10-27 18:01 218112 ----a-w- c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-10-27 18:01 1030144 ----a-w- c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-10-27 18:01 828928 ----a-w- c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-10-27 18:01 481792 ----a-w- c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-10-27 18:01 190464 ----a-w- c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-10-27 18:01 634880 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-10-27 18:01 37888 ----a-w- c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-10-27 18:01 793088 ----a-w- c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-10-27 18:01 1064448 ----a-w- c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-10-27 18:01 258048 ----a-w- c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-10-27 18:01 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-10-27 18:01 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2009-08-29 00:27 . 2009-10-02 18:32 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-10-02 18:32 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-14 16:27 . 2009-10-02 18:33 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-10-02 18:33 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-10-02 18:33 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-10-02 18:33 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-10-02 18:33 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-10-02 18:33 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-10-02 18:33 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-10-02 18:33 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-10-02 18:33 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-10-02 18:33 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-10-02 18:33 105984 ----a-w- c:\windows\system32\netiohlp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-26 149280]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2008-02-16 405504]
"autodetect"="c:\windows\system32\SupportAppXL\AutoDect.exe" [2008-10-08 91648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:(:f2,c2,01,30,9e,43,ca,01

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [5/14/2009 2:47 PM 107256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [5/14/2009 2:47 PM 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\System32\drivers\epfwwfpr.sys [5/14/2009 2:49 PM 93312]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [8/8/2008 9:38 PM 111616]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [10/10/2007 4:03 PM 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [3/5/2007 9:45 AM 7424]
S3 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [10/19/2009 11:58 PM 73728]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [1/20/2008 6:23 PM 21504]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\System32\drivers\massfilter.sys [11/6/2009 7:41 PM 7168]
S3 VST_DPV;VST_DPV;c:\windows\System32\drivers\VSTDPV3.SYS [1/20/2008 6:23 PM 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\System32\drivers\VSTBS23.SYS [1/20/2008 6:23 PM 251904]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
FF - ProfilePath - c:\users\Windows\AppData\Roaming\Mozilla\Firefox\Profiles\rnxexv1f.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", true);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox 3.6 Beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-08 16:46
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe
c:\windows\ehome\ehmsas.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2009-11-09 16:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-09 00:54
ComboFix2.txt 2009-11-08 19:22

Pre-Run: 187,485,749,248 bytes free
Post-Run: 187,440,005,120 bytes free

- - End Of File - - BCC7B1B80615CD62B760E2DC018AFE32
GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-08 17:19:31
Windows 6.0.6002 Service Pack 2
Running: wuvhz2qt.exe; Driver: C:\Users\Windows\AppData\Local\Temp\uwtdyfob.sys


---- Kernel code sections - GMER 1.0.15 ----

? C:\ComboFix\catchme.sys The system cannot find the path specified. !
? C:\Windows\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1836] kernel32.dll!SetUnhandledExceptionFilter 761DA84F 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort0 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort1 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort2 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-2 [807AA9B0] \SystemRoot\system32\drivers\atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat eamon.sys (Amon monitor/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:340] 88005930

---- Files - GMER 1.0.15 ----

File C:\Windows\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

#13 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 08 November 2009 - 08:31 PM

just checked my firefox browser is still redirecting when using google thanks DANO

#14 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,771 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:02:08 AM

Posted 09 November 2009 - 06:12 AM

Hi,

yes, saddly ComboFix did not take care of that file.

Please try the following approach:
  • Restart your computer
  • Before Windows loads, you will be prompted to choose which Operating System to start
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press enter.
  • At the C:\Windows prompt, type the following bolded text, and press Enter:

    set AllowAllPaths=TRUE
    set AllowRemovableMedia =TRUE

  • At the next prompt type the following bolded text, and press Enter before starting a new line:

    cd C:\windows\system32\drivers
    ren atapi.sys atapi.bak
    copy C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

  • The command should then show 1 file(s) copied. At the next prompt type the following bolded text, and press Enter:

    exit
Windows will now begin loading. Please run a new scan with gmer again.

regards _temp_

Edited by _temp_, 09 November 2009 - 06:13 AM.

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#15 dano_style

dano_style
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:04:08 PM

Posted 09 November 2009 - 11:02 PM

hello tryed running cfix twice now.neither time has it prompted me to download Windows Recovery Console.making it hard to continue your instructions thanks DAno




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users