Possible rootkit infection; atapi.sys?

Hi,
Please help me! Several different tasks start up from the registry and use up max resources, block internet etc. Tried antivirus (NOD32), said it was some kind of rootkit, couldn't remove it. Tried removing entries from the registry, startup entries, they get written back. Tried physically deleting files, they either jump right back or can't be deleted no matter what, or they change names. Only method that keeps me afloat is to end processes from the Task Manager, that keeps the beligerent programs away for a few hours. Atapi.sys, I think, is the main hijacked item, but I can't be sure; must be a rootkit, since antivirus can't deal with it, only pinpoints it as an uncleanable infection. Thank you! -Pete

DDS (Ver_09-12-01.01) - NTFSx86
Run by e 6300 at 11:58:56.48 on Thu 12/03/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.2.1250.36.1033.18.2558.1971 [GMT 2:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PCI Latency Tool 3\LtcyCfgSvc.exe
C:\WINDOWS\explorer.exe
"C:\WINDOWS\system32\svchost.exe" 92869
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\e 6300.CORE2DUO\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
mWinlogon: Userinit=c:\windows\system32\userinit.exe
mWinlogon: Taskman=c:\recycler\s-1-5-21-8329874806-6032439113-178661398-5917\rundll32.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: {53707962-6F74-2D53-2644-206D7942484F} - No File
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Windows Update] c:\windows\system32\wuaucIt.exe
mRun: [Regedit32] c:\windows\system32\regedit.exe
mExplorerRun: [Microsoft Driver Setup] c:\windows\wind7upd.exe
mExplorerRun: [csrcs] c:\windows\system32\csrcs.exe
StartupFolder: c:\docume~1\e6300~1.cor\startm~1\programs\startup\zappon~1.lnk - c:\program files\zapp online express\ZappOnlineExpress.exe
IE: E&xportálás Microsoft Excel formátumba - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
TCP: {7045F739-9440-4AB2-96A5-A85B5BDFC12F} = 213.157.167.157
TCP: {DF4806F0-63B6-48E4-8F19-8257B46D5465} = 213.167.157.167
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\e6300~1.cor\applic~1\mozilla\firefox\profiles\2sjrwenn.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\e 6300.core2duo\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 jwjprwhl;jwjprwhl;c:\windows\system32\drivers\jwjprwhl.sys [2009-11-21 40128]
R2 LtcyCfgSvc;PCI Latency Tool Service;c:\program files\pci latency tool 3\LtcyCfgSvc.exe [2005-12-25 5120]
R3 LtcyCfgWDM;PCI Latency Tool Driver Service;c:\windows\system32\drivers\LtcyCfgWDM.sys [2005-12-25 6656]
S2 eeeaohejgyy4ly;SmartLinkService;c:\documents and settings\localservice.nt authority\application data\microsoft\koufegidut.exe --> c:\documents and settings\localservice.nt authority\application data\microsoft\koufegidut.exe [?]
S2 Kilgray: MemoQ update permissions manager. 978527.;Kilgray: MemoQ update permissions manager. 978527.;c:\program files\kilgray\memoq\auclient.exe -permissionmanagerrun --> c:\program files\kilgray\memoq\AUClient.exe -PermissionManagerRun [?]
S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\common files\microsoft shared\speech\csvd.exe [2009-5-26 11573248]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;c:\windows\system32\drivers\adusbser.sys [2008-10-10 93440]
S3 DuaFire_01;Service for DuaFire - 1;c:\windows\system32\drivers\duafwdm.sys --> c:\windows\system32\drivers\DuaFWdm.sys [?]
S3 DuaFire_AA;Service for DuaFire Audio Driver (EWDM);c:\windows\system32\drivers\DuaFire.sys [2009-10-3 58784]
S3 emuumidi;E-MU USB-MIDI Driver;c:\windows\system32\drivers\emuumidi.sys --> c:\windows\system32\drivers\emuumidi.sys [?]
S3 musbehco;musbehco;\??\c:\docume~1\e6300~1.cor\locals~1\temp\musbehco.sys --> c:\docume~1\e6300~1.cor\locals~1\temp\musbehco.sys [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S3 ZDBRGSYS;ZDBRGSYS NDIS Protocol Driver;c:\windows\system32\ZDBRGSYS.sys [2009-5-26 19200]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-12-03 09:01:17 6144 ---ha-w- c:\documents and settings\e 6300.core2duo\ayfiek.exe
2009-12-03 09:01:05 1 ----a-w- c:\documents and settings\e 6300.core2duo\oashdihasidhasuidhiasdhiashdiuasdhasd
2009-12-03 00:40:39 103424 ----a-w- c:\windows\system32\drivers\921.exe
2009-12-02 17:06:30 27711 ----a-w- c:\windows\system32\av_md.exe
2009-12-02 17:06:30 27711 ----a-w- c:\documents and settings\e 6300.core2duo\av_md.exe
2009-12-02 17:06:26 6144 ---ha-w- c:\documents and settings\e 6300.core2duo\nxh.exe
2009-12-02 17:05:42 103424 ----a-w- c:\windows\system32\drivers\62.exe
2009-12-02 16:58:11 103424 ----a-w- c:\windows\system32\drivers\515.exe
2009-12-01 11:35:27 103424 ----a-w- c:\windows\system32\drivers\875.exe
2009-11-29 23:59:59 103424 --sh--r- c:\windows\wind7upd.exe
2009-11-29 23:59:57 71420 ----a-w- c:\windows\system32\drivers\593.exe
2009-11-29 23:57:56 28780 ----a-w- c:\windows\system32\photo_id.exe
2009-11-29 23:57:56 28780 ----a-w- c:\documents and settings\e 6300.core2duo\photo_id.exe
2009-11-29 06:39:39 278 ----a-w- c:\windows\game.ini
2009-11-27 10:02:25 71428 ----a-w- c:\windows\system32\drivers\125.exe
2009-11-26 19:56:21 147616 -c--a-w- c:\windows\system32\dllcache\atapi.sys
2009-11-26 07:10:18 71428 --sh--r- c:\windows\msdrv32.exe
2009-11-26 07:10:13 75436 ----a-w- c:\windows\system32\drivers\250.exe
2009-11-25 19:33:25 4 ----a-w- c:\documents and settings\e 6300.core2duo\proxy_port
2009-11-24 17:03:05 0 d-----w- c:\docume~1\e6300~1.cor\applic~1\MemoQ
2009-11-21 17:12:03 40128 ----a-w- c:\windows\system32\drivers\jwjprwhl.sys
2009-11-21 17:11:21 45056 ---h--w- c:\windows\system32\secupdat.dat
2009-11-21 17:11:21 45056 ---h--w- c:\documents and settings\e 6300.core2duo\secupdat.dat
2009-11-20 20:56:51 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2009-11-20 20:56:51 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2009-11-20 20:56:50 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll
2009-11-20 20:56:50 514384 ----a-w- c:\windows\system32\XAudio2_3.dll
2009-11-20 20:56:50 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2009-11-20 20:56:50 235856 ----a-w- c:\windows\system32\xactengine3_3.dll
2009-11-20 20:56:49 23376 ----a-w- c:\windows\system32\X3DAudio1_5.dll
2009-11-16 18:37:25 102474 ----a-w- c:\windows\system32\msvcrt2.dll
2009-11-16 14:20:14 119296 --sh--w- c:\windows\system32\wuaucIt.exe
2009-11-10 11:37:30 0 d-----w- C:\downloads
2009-11-10 11:30:17 0 d-----w- c:\program files\Free Download Manager
2009-11-10 10:44:34 0 d-----w- c:\program files\AVG
2009-11-10 10:29:55 0 d-----w- c:\program files\Quicksys
2009-11-10 10:29:55 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Quicksys
2009-11-10 09:50:52 0 d-----w- c:\docume~1\e6300~1.cor\applic~1\AVG8
2009-11-09 22:47:07 0 d-----w- c:\docume~1\e6300~1.cor\applic~1\OpenOffice.org
2009-11-09 22:46:10 0 d-----w- c:\program files\JRE
2009-11-09 22:46:07 0 d-----w- c:\program files\OpenOffice.org 3
2009-11-09 22:45:52 411368 ----a-w- c:\windows\system32\deploytk.dll

==================== Find3M ====================

2009-12-03 09:00:21 147616 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-11-24 17:33:00 22676 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-18 18:03:18 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-11-07 07:48:21 249856 ------w- c:\windows\Setup1.exe
2009-11-07 07:48:19 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-11-02 18:54:32 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2009-10-28 18:20:23 15341 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-10-28 18:17:27 5640880 ----a-w- c:\windows\system32\SpoonUninstall.exe
2009-09-27 16:20:04 2173544 ----a-w- c:\windows\system32\nvcplui.exe
2009-09-27 16:20:00 81920 ----a-w- c:\windows\system32\nvwddi.dll
2009-09-27 16:19:52 3166208 ----a-w- c:\windows\system32\nvwss.dll
2009-09-27 16:19:50 4026368 ----a-w- c:\windows\system32\nvvitvs.dll
2009-09-27 16:19:48 3547136 ----a-w- c:\windows\system32\nvgames.dll
2009-09-27 16:19:48 188416 ----a-w- c:\windows\system32\nvmccss.dll
2009-09-27 16:19:48 1286144 ----a-w- c:\windows\system32\nvmobls.dll
2009-09-27 16:19:46 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-09-27 16:19:46 4935680 ----a-w- c:\windows\system32\nvdisps.dll
2009-09-27 16:19:46 172100 ----a-w- c:\windows\system32\nvsvc32.exe
2009-09-27 16:19:46 143360 ----a-w- c:\windows\system32\nvcolor.exe
2009-09-27 16:19:46 13918208 ----a-w- c:\windows\system32\nvcpl.dll
2009-09-27 16:19:40 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-09-27 14:12:22 888832 ----a-w- c:\windows\system32\nvapi.dll
2009-09-27 14:12:22 5900416 ----a-w- c:\windows\system32\nv4_disp.dll
2009-09-27 14:12:22 490088 ----a-w- c:\windows\system32\nvudisp.exe
2009-09-27 14:12:22 2194024 ----a-w- c:\windows\system32\nvcuvid.dll
2009-09-27 14:12:22 2007040 ----a-w- c:\windows\system32\nvcuda.dll
2009-09-27 14:12:22 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-09-27 14:12:22 170600 ----a-w- c:\windows\system32\nvcodins.dll
2009-09-27 14:12:22 170600 ----a-w- c:\windows\system32\nvcod.dll
2009-09-27 14:12:22 1604482 ----a-w- c:\windows\system32\nvdata.bin
2009-09-27 14:12:22 10756096 ----a-w- c:\windows\system32\nvoglnt.dll
2009-09-24 07:24:18 490088 ----a-w- c:\windows\system32\NVUNINST.EXE
2004-09-28 03:00:00 26240 ----a-w- c:\windows\inf\RAMDSK.SYS
2004-08-04 16:00:52 735682 --sha-r- c:\windows\system32\csrcs.exe

============= FINISH: 11:59:12.62 ===============

Welcome to the BleepingComputer Forums.

Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again.

• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Please post the contents of log.txt.

Thank you for your patience.

Please see Preparation Guide for use before posting about your potential Malware problem.

If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.

Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so.

While we are working on your HijackThis log, please:

• Reply to this thread; do not start another!
• Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so.
• Do not run any other tool until instructed to do so!
• Let me know if any of the links do not work or if any of the tools do not work.
• Tell me about problems or symptoms that occur during the fix.
• Do not run any other programs or open any other windows while doing a fix.
• Ask any questions that you have regarding the fix(es), the infection(s), the performance of your computer, etc.

Thanks.

Hi,

Thanks for replying. RSIT gave me an error fist time I ran it, asked whether I would like to report the error, then took me to a webpage with troubleshooting faq's, Trend-something. Second time I ran it everything was fine. It also generated an info.txt - should I do anything with that?
Here's the log, and thanks again!

-Pete


Logfile of random's system information tool 1.06 (written by random/random)
Run by e 6300 at 2009-12-16 23:49:20
Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (8%) free of 21 GB
Total RAM: 2558 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49:28 PM, on 12/16/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kilgray\MemoQ\AUClient.exe
C:\Program Files\PCI Latency Tool 3\LtcyCfgSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dlllhost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\fxstaller.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\e 6300.CORE2DUO\Desktop\RSIT.exe
C:\Program Files\trend micro\e 6300.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\dlllhost.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\system32\wuaucIt.exe
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKLM\..\Run: [Microsoft Corp] svchosts.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] fxstaller.exe
O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\wind7upd.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - Startup: Zapp Online Express.lnk = C:\Program Files\Zapp Online Express\ZappOnlineExpress.exe
O8 - Extra context menu item: E&xportálás Microsoft Excel formátumba - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Kutatás - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {814EA0DA-E0D9-4AA4-833C-A1A6D38E79E9} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{7045F739-9440-4AB2-96A5-A85B5BDFC12F}: NameServer = 213.157.167.157
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF4806F0-63B6-48E4-8F19-8257B46D5465}: NameServer = 213.167.157.167
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\
O23 - Service: SmartLinkService (eeeaohejgyy4ly) - Unknown owner - C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Microsoft\koufegidut.exe (file missing)
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kilgray: MemoQ update permissions manager. 978527. - Unknown owner - C:\Program Files\Kilgray\MemoQ\AUClient.exe
O23 - Service: PCI Latency Tool Service (LtcyCfgSvc) - Unknown owner - C:\Program Files\PCI Latency Tool 3\LtcyCfgSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5428 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-1580436667-725345543-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-1580436667-725345543-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-09-23 1657448]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-09-27 13918208]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-09-27 86016]
"Windows Update"=C:\WINDOWS\system32\wuaucIt.exe [2009-11-21 119296]
"Regedit32"=C:\WINDOWS\system32\regedit.exe []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Microsoft Corp"=C:\WINDOWS\svchosts.exe [2009-12-15 86528]
"Windows UDP Control Center"=C:\WINDOWS\fxstaller.exe [2009-12-16 74752]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Microsoft Driver Setup"=C:\WINDOWS\wind7upd.exe [2009-12-03 103424]
"csrcs"=C:\WINDOWS\system32\csrcs.exe [2004-08-04 809358]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"DAEMON Tools Pro Agent"=C:\Program Files\DAEMON Tools Pro\DTProAgent.exe []
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]
C:\Program Files\MSI\Live Update 3\LMonitor.exe [2006-07-31 484864]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^PC Alert 4.lnk]
E:\PROGRA~1\PCAlert4.exe [2006-09-13 552960]

C:\Documents and Settings\e 6300.CORE2DUO\Start Menu\Programs\Startup
Zapp Online Express.lnk - C:\Program Files\Zapp Online Express\ZappOnlineExpress.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=223

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"E:\Program files\EA GAMES\Need For Speed Underground\Speed.exe"="E:\Program files\EA GAMES\Need For Speed Underground\Speed.exe:*:Disabled:Speed"
"C:\Program Files\InterVideo\WinDVD4PR\WinDVD.exe"="C:\Program Files\InterVideo\WinDVD4PR\WinDVD.exe:*:Disabled:WinDVD"
"C:\WINDOWS\system32\drivers\250.exe"="C:\WINDOWS\system32\drivers\250.exe:*:C:\WINDOWS\msdrv32.exe"
"C:\WINDOWS\system32\drivers\125.exe"="C:\WINDOWS\system32\drivers\125.exe:*:C:\WINDOWS\msdrv32.exe"
"C:\WINDOWS\system32\drivers\593.exe"="C:\WINDOWS\system32\drivers\593.exe:*:C:\WINDOWS\wind7upd.exe"
"C:\WINDOWS\system32\drivers\875.exe"="C:\WINDOWS\system32\drivers\875.exe:*:C:\WINDOWS\wind7upd.exe"
"C:\WINDOWS\system32\drivers\515.exe"="C:\WINDOWS\system32\drivers\515.exe:*:C:\WINDOWS\wind7upd.exe"
"C:\WINDOWS\system32\drivers\62.exe"="C:\WINDOWS\system32\drivers\62.exe:*:C:\WINDOWS\wind7upd.exe"
"C:\WINDOWS\system32\drivers\921.exe"="C:\WINDOWS\system32\drivers\921.exe:*:C:\WINDOWS\wind7upd.exe"
"C:\WINDOWS\svchosts.exe"="C:\WINDOWS\svchosts.exe:*:Enabled:Microsoft Corp"
"C:\WINDOWS\system32\service.exe"="C:\WINDOWS\system32\service.exe:*:Enabled:UPnP Firewall"
"C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\08.exe"="C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\08.exe:*:Enabled:Microsoft Corp"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\08.scr"="C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\08.scr:*:Enabled:Microsoft Corp"
"C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\04.exe"="C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\04.exe:*:Enabled:Microsoft Corp"
"C:\WINDOWS\system32\dlllhost.exe"="C:\WINDOWS\system32\dlllhost.exe:*:Enabled:Netlogon"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\service.exe"="C:\WINDOWS\system32\service.exe:*:Enabled:UPnP Firewall"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a47a0c07-11ac-11dc-a239-001617d7a1b4}]
shell\Auto\command - boot.exe
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a868b45a-0603-11dc-a216-001617d7a1b4}]
shell\AutoRun\command - F:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c71752d7-bc99-11de-ba32-daa07d34e613}]
shell\AutoRun\command - G:\zstjrv.exe
shell\explore\command - G:\zstjrv.exe
shell\open\command - G:\zstjrv.exe


======File associations======

.reg - open - "regedit.exe" "%1"

======List of files/folders created in the last 1 months======

2009-12-16 23:46:11 ----D---- C:\Program Files\trend micro
2009-12-16 23:46:10 ----D---- C:\rsit
2009-12-16 20:01:20 ----RSH---- C:\WINDOWS\fxstaller.exe
2009-12-16 01:35:55 ----RSH---- C:\WINDOWS\system32\dlllhost.exe
2009-12-15 14:22:11 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nokia
2009-12-15 13:40:13 ----N---- C:\WINDOWS\system32\spmsgXP_2k3.dll
2009-12-15 13:40:11 ----HDC---- C:\WINDOWS\$NtUninstallWdf01007$
2009-12-15 13:38:01 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\Nokia
2009-12-15 13:37:59 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\PC Suite
2009-12-15 13:37:58 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2009-12-15 13:37:27 ----D---- C:\Program Files\Common Files\PCSuite
2009-12-15 13:37:25 ----D---- C:\Program Files\Common Files\Nokia
2009-12-15 13:37:12 ----D---- C:\Program Files\PC Connectivity Solution
2009-12-15 13:37:05 ----A---- C:\WINDOWS\system32\wdfcoinstaller01007.dll
2009-12-15 13:37:05 ----A---- C:\WINDOWS\system32\nmwcdcocls.dll
2009-12-15 13:36:57 ----D---- C:\Program Files\Nokia
2009-12-15 13:36:57 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2009-12-15 13:35:13 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
2009-12-14 21:30:55 ----RSH---- C:\WINDOWS\system.exe
2009-12-13 19:31:25 ----RSH---- C:\WINDOWS\system32\service.exe
2009-12-13 18:10:03 ----AH---- C:\a.txt
2009-12-13 18:09:57 ----RSH---- C:\WINDOWS\svchosts.exe
2009-12-04 23:08:08 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\BioWare
2009-12-03 12:07:02 ----A---- C:\RootRepeal report 12-03-09 (12-07-02).txt
2009-12-02 19:06:30 ----A---- C:\WINDOWS\system32\av_md.exe
2009-11-30 01:59:59 ----RSH---- C:\WINDOWS\wind7upd.exe
2009-11-30 01:57:56 ----A---- C:\WINDOWS\system32\photo_id.exe
2009-11-29 08:29:15 ----A---- C:\xml2.txt
2009-11-26 11:09:00 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\ESET
2009-11-26 10:38:05 ----D---- C:\WINDOWS\CSC
2009-11-26 09:10:23 ----A---- C:\WINDOWS\logfile32.txt
2009-11-26 09:10:18 ----RSH---- C:\WINDOWS\msdrv32.exe
2009-11-24 19:21:38 ----A---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft.SqlServer.Compact.351.32.bc
2009-11-24 19:03:05 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\MemoQ
2009-11-20 22:56:51 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2009-11-20 22:56:51 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2009-11-20 22:56:50 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2009-11-20 22:56:50 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2009-11-20 22:56:50 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2009-11-20 22:56:50 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2009-11-20 22:56:49 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2009-11-18 20:03:23 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\Bioshock
2009-11-18 20:03:18 ----RHD---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\SecuROM

======List of files/folders modified in the last 1 months======

2009-12-16 23:47:54 ----AD---- C:\WINDOWS\Temp
2009-12-16 23:46:59 ----D---- C:\Program Files\Mozilla Firefox
2009-12-16 23:46:11 ----RD---- C:\Program Files
2009-12-16 23:43:32 ----D---- C:\Program Files\Common Files
2009-12-16 23:42:29 ----SHD---- C:\WINDOWS\Installer
2009-12-16 23:42:29 ----D---- C:\WINDOWS
2009-12-16 09:43:31 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-12-16 07:10:19 ----D---- C:\WINDOWS\Prefetch
2009-12-16 01:35:55 ----D---- C:\WINDOWS\system32
2009-12-15 14:46:42 ----D---- C:\WINDOWS\system32\drivers
2009-12-15 14:22:07 ----D---- C:\WINDOWS\WinSxS
2009-12-15 13:40:39 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-15 13:40:15 ----HD---- C:\WINDOWS\inf
2009-12-15 13:37:41 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-12-15 13:37:05 ----D---- C:\WINDOWS\system32\CatRoot2
2009-12-15 13:30:19 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\vlc
2009-12-14 23:31:37 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\uTorrent
2009-12-14 13:06:54 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\Skype
2009-12-14 12:56:04 ----SD---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\Microsoft
2009-12-14 09:03:51 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\MemoQ
2009-12-13 19:31:56 ----A---- C:\WINDOWS\system32\svchost.exe
2009-12-08 15:53:56 ----RSHD---- C:\RECYCLER
2009-12-07 21:58:15 ----D---- C:\Documents and Settings\e 6300.CORE2DUO\Application Data\dvdcss
2009-12-05 17:58:51 ----D---- C:\Program Files\uTorrent
2009-12-04 23:01:37 ----D---- C:\Program Files\AGEIA Technologies
2009-12-04 23:01:06 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-12-04 22:39:46 ----A---- C:\WINDOWS\NeroDigital.ini
2009-12-04 22:38:51 ----HD---- C:\Program Files\InstallShield Installation Information
2009-12-04 22:36:40 ----A---- C:\WINDOWS\Tcsofla.INI
2009-12-02 11:52:02 ----A---- C:\WINDOWS\CIV.INI
2009-11-29 08:29:42 ----RSD---- C:\WINDOWS\assembly
2009-11-29 08:29:42 ----D---- C:\WINDOWS\system32\DirectX
2009-11-26 18:01:14 ----D---- C:\Atad
2009-11-26 10:38:12 ----A---- C:\WINDOWS\ntbtlog.txt
2009-11-26 08:37:10 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-11-24 16:36:04 ----D---- C:\Program Files\Zapp Online Express
2009-11-24 16:36:04 ----A---- C:\WINDOWS\red_dialer.ini
2009-11-21 19:07:18 ----SH---- C:\WINDOWS\system32\wuaucIt.exe
2009-11-19 23:30:12 ----N---- C:\WINDOWS\win.ini
2009-11-19 14:02:53 ----D---- C:\downloads
2009-11-18 20:48:57 ----D---- C:\WINDOWS\Help
2009-11-18 20:48:02 ----D---- C:\WINDOWS\nview
2009-11-18 20:47:52 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-11-18 20:03:18 ----A---- C:\WINDOWS\system32\CmdLineExt.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2004-01-26 52224]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-09-03 279712]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-09-03 25888]
R3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5b.sys [2004-04-15 42496]
R3 HdAudAddService;VIA High Definition Audio Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2007-04-23 199808]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 LtcyCfgWDM;PCI Latency Tool Driver Service; C:\WINDOWS\system32\DRIVERS\LtcyCfgWDM.sys [2005-12-25 6656]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-09-27 7655872]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-02-24 14604]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
S3 61883;61883 Unit Device; C:\WINDOWS\system32\DRIVERS\61883.sys [2004-08-03 48128]
S3 a9uydwwc;a9uydwwc; C:\WINDOWS\system32\drivers\a9uydwwc.sys []
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; C:\WINDOWS\system32\DRIVERS\adusbser.sys [2006-10-23 93440]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]
S3 Avc;AVC Device; C:\WINDOWS\system32\DRIVERS\avc.sys [2004-08-03 38912]
S3 bdfdll;bdfdll; \??\C:\Program Files\Softwin\BitDefender10\bdfdll.sys []
S3 DuaFire_01;Service for DuaFire - 1; C:\WINDOWS\system32\drivers\DuaFWdm.sys []
S3 DuaFire_AA;Service for DuaFire Audio Driver (EWDM); C:\WINDOWS\system32\DRIVERS\DuaFire.sys [2008-08-29 58784]
S3 emuumidi;E-MU USB-MIDI Driver; C:\WINDOWS\system32\drivers\emuumidi.sys []
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 MSICPL;MSICPL; \??\D:\install4\MSICPL.sys []
S3 musbehco;musbehco; \??\C:\DOCUME~1\E6300~1.COR\LOCALS~1\Temp\musbehco.sys []
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2009-03-19 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2009-03-19 8320]
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 RivaTuner32;RivaTuner32; \??\C:\Program Files\RivaTuner v2.11\RivaTuner32.sys []
S3 RT73;D-Link USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\Dr71WU.sys [2008-01-15 459520]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 sermouse;Serial Mouse Driver; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-08-17 17664]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\D:\NTGLM7X.sys []
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 ZD1211U(ZyDAS);ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS); C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-09-29 247296]
S3 ZDBRGSYS;ZDBRGSYS NDIS Protocol Driver; \??\C:\WINDOWS\system32\ZDBRGSYS.SYS []
S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\ZDPNDIS5.SYS []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sr;System Restore Filter Driver; C:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-04 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-11-10 153376]
R2 Kilgray: MemoQ update permissions manager. 978527.;Kilgray: MemoQ update permissions manager. 978527.; C:\Program Files\Kilgray\MemoQ\AUClient.exe [2009-08-28 651264]
R2 LtcyCfgSvc;PCI Latency Tool Service; C:\Program Files\PCI Latency Tool 3\LtcyCfgSvc.exe [2005-12-25 5120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-09-27 172100]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]
S2 eeeaohejgyy4ly;SmartLinkService; C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\Microsoft\koufegidut.exe []
S2 ICF;ICF; C:\WINDOWS\system32\svchost.exe [2009-12-13 14336]
S2 RPCHE;Remote Procedure Call (RPCE); C:\Program Files\Common Files\Microsoft Shared\Speech\csvd.exe [2009-05-26 11573248]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Since you mentioned Rootkits, I must give you this warning.

IMPORTANT NOTE: Rootkits, backdoor Trojans, Botnets, and IRCBots are very dangerous because they use advanced techniques (backdoors) as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. You should change each password by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised, please read How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Although the rootkit has been identified and may be removed, your computer has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because this malware has been removed, the computer is secure. In some instances, an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. Some infections are difficult to remove completely because of their morphing characteristics which allows the malware to regenerate itself. Sometimes there is another hidden piece of malware which has not been detected by your security tools that protects malicious files and registry keys (which have been detected) so they cannot be permanently deleted. The malware may leave so many remnants behind that security tools cannot find them. Most experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:
When should I re-format? How should I reinstall?
Help: I Got Hacked. Now What Do I Do?
Where to draw the line? When to recommend a format and reinstall?

I strongly recommend that you reformat your computer. Even if we were able to clean the computer of some of the infections, your computer is not trustworthy and the removal of all affected files may not be successful. Tell me what you want to do.

Hi,

I did as you advised and reformatted. Needless to say, everything works fine. Maybe it was time for a system wipe anyway, been using the same install for 2 years now.

I request closing the topic, problem solved.

Thanks for your time!

-Peter

Good decision!

Tips To Protect Your Computer

• Avoid clicking on links in instant messages.
• Avoid opening email attachments.
• Avoid visiting every poker site on the net.
• Avoid downloading all that free cute junk.
• Avoid using the peer-to-peer file sharing.
• Avoid getting those handy toolbar doodads for your browsers.
• Malware is out there just waiting to pounce on your system if you only pass by where they are lurking which may be at some seemingly innocent web site. Be careful because some of the malware are so vicious that no one can possibly save you once you let them in.
• Remember that new malware emerges every week of the year. Take responsibility for protecting your system because you are its first and best defense.

Tools Downloaded To Clean Your Computer

I may have asked you to install some tools. Whether or not you need to keep these programs must be decided by you. If you choose to uninstall them, follow these directions:

• Click Start > Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight the program, click Remove.
• Close the Add or Remove Programs and the Control Panel windows.

Optional Tools:

• Ad-Aware 2008 scans, detects, and removes spyware on your computer.
• ATF-Cleaner cleans all user temp folders, Java cache, (which seems to be harboring more and more malware), the cache, cookies, history, download history, visited links and saved passwords. Scan weekly if you have high Internet use.
• Trend Micro's HijackThis or random's System Information Tool (RSIT) may be uninstalled; however, if you should ever encounter another problem and seek help in this forum or others like it, you will need to download this application.
• SUPERAntiSpyware scans, detects, and removes spyware on your computer.
• Malwarebytes ' Anti-Malware scans, detects, and removes malware on your computer.
• a-squared Free scans, detects, and removes trojans, worms, spyware on your computer.
• Spybot S&D scans, detects, and removes malware on your computer.

If you have changed the default settings for files/folders, please restore the default settings for files/folders.

• Go to My Computer.
• Select the Tools menu and click Folder Options.
• Click the View tab.
• Under Advanced Settings, click the Restore Defaults button in the lower right corner.
• Click Apply and then the OK and close My Computer.

Please take the time to read the "Steps To Keep Your Computer Clean And Secure" below.

STEPS TO KEEP YOUR COMPUTER CLEAN AND SECURE:

Please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. After cleaning, you will need to disable the System Restore function For Windows XP.
  Files placed in the System volume information folder are source files for the System Restore function that is available in Windows XP operating system. Files that were healed were moved in their original INFECTED state into this folder and it is necessary to DELETE them by following these steps:
  • Close all open programs. Then right-click My Computer on the Windows' desktop
  • Click on Properties.
  • Click on the System Restore tab.
  • Check Turn off System Restore on all drives.
  • Restart the system.
  • Enable System Restore by going through the first four steps again and uncheck the item mentioned in Step d.
  • You can find instructions on how to disable and enable system restore in the Windows XP System Restore Guide.
• Make your Internet Explorer more secure: This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it asks you if you want to save the settings, press the Yes button.
  • Click Apply > OK button and then the OK to exit the Internet Properties page.
• Use a Firewall: - I cannot stress how important it is that you use a Firewall on your computer.  Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
  Computer Safety On line - Software Firewalls. For more information about firewalls, and why a two-way firewall is better than the Windows XP one-way firewall, please read Understanding and Using Firewalls.
• Use An Antivirus Software and Keep It Updated: - It is very important that your computer has an antivirus software running on your machine.  This alone can save you a lot of trouble with malware in the future.  It is imperative that you update your antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software, then it will not be able to catch any of the new variants that may come out. For an article on antivirus programs and a listing of some available ones see the link below:
  Computer Safety On line - Anti-Virus
• Visit Microsoft's Windows Update Site Frequently: It is important that you visit Microsoft Windows Update regularly. This will ensure your computer has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
• You should scan your computer with Spybot S&D on a regular basis just as you would an anti- virus software. A tutorial on installing & using this product can be found here:
  Using Spybot - Search & Destroy to remove Spyware from Your Computer
• You should scan your computer with Ad-Aware 2007/2008 as well as Spybot S&D and your anti-virus program on a regular basis. A tutorial on installing & using this product can be found here:
  Ad-Aware 2008.
• Update SpywareBlaster (at least weekly): SpywareBlaster will add a large list of programs and sites into your Internet Explorer and Firec settings that will protect you from running and downloading known malicious programs. An article on anti-malware products with links for this program and others can be found here:
  Computer Safety on line Anti Malware
• Use the hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate web pages. We can customize a hosts file so that it blocks certain web pages. However, it can slow down certain computers. This is why using a hosts file is optional. Download mvps hosts file Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  • Click the start button on the task bar at the bottom of your screen
  • Click run
  • In the dialog box, type services.msc
  • hit enter, then locate dns client
  • Highlight it, then doubleclick it.
  • On the dropdown box, change the setting from automatic to manual.
  • Click OK.
• Use an alternative instant messenger program:.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
• Please read Tony Klein's excellent article: How I got Infected in the First Place
• Please read Understanding Spyware, Browser Hijackers, and Dialers
• Please read Simple and easy ways to keep your computer safe and secure on the Internet.
• If you are using Internet Explorer, please consider using an alternate browser: Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built in popup blocker (as an added benefit!) that I have ever seen.
  Another good browser is Opera . Opera 9 comes loaded with the tools to keep you productive and safe. Try it today, it's absolutely free. Some of the Opera features are: Customization, BitTorrent, Content blocker, Add your favorite search engines, Thumbnail preview of tabs, Widgets, Transfer manager, Tabbed browsing, Password manager, Sessions (You can save a collection of open tabs as a session, for later retrieval, or start with the pages you had open when Opera was last closed.), Keyboard Shortcuts, Cookie control, a multitude of languages, Validate code, Toggle graphics and style sheets, and Special features such as Full-screen mode, Kiosk mode.
• Update all these programs regularly: Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
• If your computer was infected by a website, a program, IM, MSN, or p2p, check this site because it is Time To Fight Back.

Follow these steps and your potential for being infected again will reduce dramatically.
Good luck!

This subject is now closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.