Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google being redirected, cant down load GMER or DDS


  • This topic is locked This topic is locked
18 replies to this topic

#1 klogman

klogman

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 06 June 2010 - 02:56 PM

Hello, I'm new and need help. My computer is messes up, i recently got the spyware remover virus problem and think that I cleaned it up by following your instructions, now a month later, however, I am having some other problems, If i click on a link in google, i am redirected to some random site, i have tried to download GMER and DDS to provide you a log to start with but they dont download, I tried through AOL and i get a message " application falied to xtart because ISWUL.dll was not found" When i try on IE, a little window opens up and then closes before I can see whats on it. Same thing happens on link one of the GMER links when i click on the second link i am taken to major geeks but then the file does not download. also, every now and then, a random website opens up on my ie all by itself if i am on another site
Please help, I am at my wits end. I do have hijack this on my system, I have run MBAM and SPybot sevweral times but this keeps coming back.
Klogman

Run by Kellogg at 17:17:40.76 on Sun 06/06/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.471 [GMT -4:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:WINDOWSsystem32svchost -k DcomLaunch
C:WINDOWSsystem32svchost -k rpcss
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:Program FilesCheckPointZAForceFieldIswSvc.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1COMMON~1AOLACSAOLacsd.exe
C:Program FilesCommon FilesAppleMobile Device SupportbinAppleMobileDeviceService.exe
C:Program FilesBonjourmDNSResponder.exe
C:WINDOWSsystem32CTsvcCDA.exe
C:WINDOWSeHomeehRecvr.exe
C:WINDOWSeHomeehSched.exe
C:Program FilesIntelIntel Matrix Storage Manageriaantmon.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSehomemcrdsvc.exe
C:WINDOWSsystem32dllhost.exe
C:WINDOWSSystem32alg.exe
C:Program FilesCheckPointZAForceFieldForceField.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32Rundll32.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb05.exe
C:WINDOWSsystem32hphmon04.exe
C:Program FilesiTunesiTunesHelper.exe
C:DOCUME~1KelloggLOCALS~1Tempclclean.0001
C:WINDOWSsystem32ctfmon.exe
C:Program FilesCommon FilesCreative Labs SharedServiceCreativeLicensing.exe
C:Program FilesLogitechMouseWaresystemem_exec.exe
C:Program FilesiPodbiniPodService.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesSpybot - Search & DestroySpybotSD.exe
C:Documents and SettingsKelloggDesktopdds.scr
C:WINDOWSsystem32wbemwmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://google.com/
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uWinlogon: Userinit=c:windowssystem32vvgeowbv.exe,c:windowssystem32userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:program filesspybot - search & destroySDHelper.dll
BHO: ZoneAlarm Toolbar Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:program filescheckpointzaforcefieldtrustcheckerbinTrustCheckerIEPlugin.dll
TB: ZoneAlarm Toolbar: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:program filescheckpointzaforcefieldtrustcheckerbinTrustCheckerIEPlugin.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
uRun: [SpybotSD TeaTimer] c:program filesspybot - search & destroyTeaTimer.exe
uRun: [AOL Fast Start] "c:program filesaol 9.1AOL.EXE" -b
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [MBMon] Rundll32 CTMBHA.DLL,MBMon
mRun: [HPDJ Taskbar Utility] c:windowssystem32spooldriversw32x863hpztsb05.exe
mRun: [HPHmon04] c:windowssystem32hphmon04.exe
mRun: [HPHUPD04] "c:program fileshp photosmart 11hphinstallunipatchhphupd04.exe"
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [iTunesHelper] "c:program filesitunesiTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe"
mRun: [ZoneAlarm Client] "c:program fileszone labszonealarmzlclient.exe"
mRun: [ISW] "c:program filescheckpointzaforcefieldForceField.exe" /icon="hidden"
mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe"
mRun: [QuickTime Task] "c:program filesquicktimeqttask.exe" -atboottime
uPolicies-explorer: New Value #1 = NoClose"=dword:00000000
IE: &AOL Toolbar Search
IE: Append Link Target to Existing PDF - c:program filescommon filesadobeacrobatactivexAcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:progra~1mi1933~1office12EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:windowssystem32Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:program filesspybot - search & destroySDHelper.dll
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {3234504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/a/0/0/a0043c6c-8cd6-428e-9c9e-01883020f5ce/mpg4dmo.CAB
DPF: {32564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv8dmo.cab
DPF: {3334504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL

============= SERVICES / DRIVERS ===============

R0 kl1;kl1;c:windowssystem32driverskl1.sys [2010-3-15 128016]
R1 KLIF;Kaspersky Lab Driver;c:windowssystem32driversklif.sys [2010-3-15 317072]
R1 vsdatant;vsdatant;c:windowssystem32vsdatant.sys [2010-3-15 486280]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:program filescheckpointzaforcefieldISWKL.sys [2009-10-14 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:program filescheckpointzaforcefieldISWSVC.exe [2009-10-14 476528]
R2 McrdSvc;Media Center Extender Service;c:windowsehomemcrdsvc.exe [2005-8-5 99328]
S1 MPFIREWL;MPFIREWL;c:windowssystem32driversmpfirewall.sys --> c:windowssystem32driversMpFirewall.sys [?]
S2 gupdate;Google Update Service (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2009-10-25 133104]
S2 McDetect.exe;McAfee WSC Integration;c:program filesmcafee.comagentmcdetect.exe --> c:program filesmcafee.comagentmcdetect.exe [?]
S2 McShield;McAfee.com McShield;c:progra~1mcafee.comvsomcshield.exe --> c:progra~1mcafee.comvsomcshield.exe [?]
S2 McTskshd.exe;McAfee Task Scheduler;c:progra~1mcafee.comagentmctskshd.exe --> c:progra~1mcafee.comagentmctskshd.exe [?]
S2 vsmon;TrueVector Internet Monitor;c:windowssystem32zonelabsvsmon.exe -service --> c:windowssystem32zonelabsvsmon.exe -service [?]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:progra~1mcafee.comagentmcupdmgr.exe --> c:progra~1mcafee.comagentmcupdmgr.exe [?]
S3 NaiAvFilter1;NaiAvFilter1;c:windowssystem32driversnaiavf5x.sys --> c:windowssystem32driversnaiavf5x.sys [?]

=============== Created Last 30 ================

2010-06-05 22:37:47 0 d-----w- c:windowssystem32wbemRepository
2010-05-28 12:41:36 303 --s-a-w- c:windowssystem321742336943.dat

==================== Find3M ====================

2010-05-27 02:12:19 41318 ----a-w- c:docume~1kelloggapplic~1wklnhst.dat
2010-05-11 03:11:09 3350 --sha-w- c:windowssystem32KGyGaAvL.sys
2010-04-29 19:39:38 38224 ----a-w- c:windowssystem32driversmbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:windowssystem32driversmbam.sys
2010-04-17 05:01:22 4212 ---ha-w- c:windowssystem32zllictbl.dat
2008-04-01 03:06:46 19489 ----a-w- c:program filescommon filesonesa.lib
2007-07-22 21:10:28 1808261 --sha-w- c:windowssystem32wybeg.bak1
2007-07-23 21:10:36 1795587 --sha-w- c:windowssystem32wybeg.bak2

============= FINISH: 17:19:34.14 ===============

Edited by Budapest, 06 June 2010 - 05:24 PM.
Posts merged ~BP


BC AdBot (Login to Remove)

 


#2 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:04:22 AM

Posted 09 June 2010 - 01:17 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE



Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.


  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#3 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 09 June 2010 - 02:31 PM

Thanksfor you help in advance, I was getting ready to pull my hair out with this one.
Here is the DDS log, I am having some trouble connecting to the internet so i will post this and then try to download and post the gmer log again.

DDS (Ver_10-03-17.01) - NTFSx86
Run by Kellogg at 15:24:17.67 on Wed 06/09/2010
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.626 [GMT -4:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\system32\hphmon04.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Program Files\AOL 9.1\shellmon.exe
C:\Documents and Settings\Kellogg\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://google.com/
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uWinlogon: Userinit=c:\windows\system32\vvgeowbv.exe,c:\windows\system32\userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [MBMon] Rundll32 CTMBHA.DLL,MBMon
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
mRun: [HPHmon04] c:\windows\system32\hphmon04.exe
mRun: [HPHUPD04] "c:\program files\hp photosmart 11\hphinstall\unipatch\hphupd04.exe"
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
uPolicies-explorer: New Value #1 = NoClose"=dword:00000000
IE: &AOL Toolbar Search
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {3234504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/a/0/0/a0043c6c-8cd6-428e-9c9e-01883020f5ce/mpg4dmo.CAB
DPF: {32564D57-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv8dmo.cab
DPF: {3334504D-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

============= SERVICES / DRIVERS ===============

R0 kl1;kl1;c:\windows\system32\drivers\kl1.sys [2010-3-15 128016]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-3-15 317072]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-3-15 486280]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
S1 MPFIREWL;MPFIREWL;c:\windows\system32\drivers\mpfirewall.sys --> c:\windows\system32\drivers\MpFirewall.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-25 133104]
S2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\mcdetect.exe --> c:\program files\mcafee.com\agent\mcdetect.exe [?]
S2 McShield;McAfee.com McShield;c:\progra~1\mcafee.com\vso\mcshield.exe --> c:\progra~1\mcafee.com\vso\mcshield.exe [?]
S2 McTskshd.exe;McAfee Task Scheduler;c:\progra~1\mcafee.com\agent\mctskshd.exe --> c:\progra~1\mcafee.com\agent\mctskshd.exe [?]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe --> c:\progra~1\mcafee.com\agent\mcupdmgr.exe [?]
S3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys --> c:\windows\system32\drivers\naiavf5x.sys [?]

=============== Created Last 30 ================

2010-06-05 22:37:47 0 d-----w- c:\windows\system32\wbem\Repository
2010-05-28 12:41:36 303 --s-a-w- c:\windows\system32\1742336943.dat

==================== Find3M ====================

2010-05-27 02:12:19 41318 ----a-w- c:\docume~1\kellogg\applic~1\wklnhst.dat
2010-05-11 03:11:09 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-17 05:01:22 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2008-04-01 03:06:46 19489 ----a-w- c:\program files\common files\onesa.lib
2007-07-22 21:10:28 1808261 --sha-w- c:\windows\system32\wybeg.bak1
2007-07-23 21:10:36 1795587 --sha-w- c:\windows\system32\wybeg.bak2

============= FINISH: 15:26:05.43 ===============


#4 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 09 June 2010 - 02:33 PM

sorry ran it twice

Edited by klogman, 09 June 2010 - 07:09 PM.


#5 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 09 June 2010 - 04:25 PM

have now downloaded GMER and am running it in safe mode seems to be taking a real long time. I will post the log when it finishes
thanks

#6 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 09 June 2010 - 07:11 PM

ran gmer 2 times something does not look right, third and fourth try it locked up on me 5th time got the blue screen of death
when i restart at least half of the time i cant get on th einternet, says it cannot renew the IP address THis computer is hardwired to the gateway, the wireless laptop and other hardwired pc all connect ok

also says error loading CTMBHA.DLL DLL initialization routine failed


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-09 19:08:06
Windows 5.1.2600 Service Pack 2
Running: x1dp0m1x.exe; Driver: C:\DOCUME~1\Kellogg\LOCALS~1\Temp\pxtyqpod.sys


---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\svchost.exe[688] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\svchost.exe[688] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0099000A
.text C:\WINDOWS\system32\svchost.exe[688] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0097000C
.text C:\WINDOWS\system32\svchost.exe[688] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00B5000A
.text C:\WINDOWS\Explorer.EXE[864] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00B6000A
.text C:\WINDOWS\Explorer.EXE[864] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00C4000A
.text C:\WINDOWS\Explorer.EXE[864] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00B5000C

---- EOF - GMER 1.0.15 ----

MER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-09 18:55:09
Windows 5.1.2600 Service Pack 2
Running: x1dp0m1x.exe; Driver: C:\DOCUME~1\Kellogg\LOCALS~1\Temp\pxtyqpod.sys


---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\Explorer.EXE[812] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00B6000A
.text C:\WINDOWS\Explorer.EXE[812] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00C4000A
.text C:\WINDOWS\Explorer.EXE[812] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00B5000C

---- EOF - GMER 1.0.15 ----

Edited by klogman, 09 June 2010 - 07:25 PM.


#7 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 09 June 2010 - 08:10 PM

Just realized i didn't include the attach file

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 12/13/2006 12:57:25 AM
System Uptime: 6/9/2010 3:10:58 PM (0 hours ago)

Motherboard: Dell Inc. | | 0FJ030
Processor: Intel® Pentium® D CPU 2.80GHz | Microprocessor | 2793/800mhz
Processor: Intel® Pentium® D CPU 2.80GHz | Microprocessor | 2793/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 293 GiB total, 251.158 GiB free.
D: is CDROM ()
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP389: 3/12/2010 5:42:57 AM - System Checkpoint
RP390: 3/13/2010 7:12:01 AM - System Checkpoint
RP391: 3/14/2010 9:12:26 AM - System Checkpoint
RP392: 3/15/2010 9:41:00 AM - System Checkpoint
RP393: 3/16/2010 10:05:26 AM - System Checkpoint
RP394: 3/17/2010 11:05:25 AM - System Checkpoint
RP395: 3/18/2010 11:57:34 AM - System Checkpoint
RP396: 3/19/2010 12:57:34 PM - System Checkpoint
RP397: 3/20/2010 1:57:34 PM - System Checkpoint
RP398: 3/21/2010 2:17:41 PM - System Checkpoint
RP399: 3/22/2010 5:47:42 PM - System Checkpoint
RP400: 3/23/2010 6:16:40 PM - System Checkpoint
RP401: 3/24/2010 6:41:42 PM - System Checkpoint
RP402: 3/25/2010 10:13:44 PM - System Checkpoint
RP403: 3/26/2010 10:16:40 PM - System Checkpoint
RP404: 3/28/2010 1:48:23 AM - System Checkpoint
RP405: 3/29/2010 2:16:20 AM - System Checkpoint
RP406: 3/30/2010 3:16:18 AM - System Checkpoint
RP407: 3/31/2010 4:15:31 AM - System Checkpoint
RP408: 4/1/2010 4:16:19 AM - System Checkpoint
RP409: 4/2/2010 5:16:20 AM - System Checkpoint
RP410: 4/3/2010 6:16:18 AM - System Checkpoint
RP411: 4/4/2010 2:39:12 PM - System Checkpoint
RP412: 4/5/2010 4:12:52 PM - System Checkpoint
RP413: 4/6/2010 5:09:17 PM - System Checkpoint
RP414: 4/7/2010 6:20:25 PM - System Checkpoint
RP415: 4/8/2010 7:07:12 PM - System Checkpoint
RP416: 4/9/2010 9:31:17 PM - System Checkpoint
RP417: 4/10/2010 10:06:08 PM - System Checkpoint
RP418: 4/12/2010 1:45:06 AM - System Checkpoint
RP419: 4/13/2010 2:04:41 AM - System Checkpoint
RP420: 4/14/2010 3:03:38 AM - System Checkpoint
RP421: 4/15/2010 4:03:36 AM - System Checkpoint
RP422: 4/16/2010 5:03:34 AM - System Checkpoint
RP423: 4/17/2010 6:03:38 AM - System Checkpoint
RP424: 4/18/2010 7:02:10 AM - System Checkpoint
RP425: 4/19/2010 8:01:10 AM - System Checkpoint
RP426: 4/20/2010 8:31:50 AM - System Checkpoint
RP427: 4/21/2010 9:01:12 AM - System Checkpoint
RP428: 4/22/2010 10:01:09 AM - System Checkpoint
RP429: 4/23/2010 11:01:10 AM - System Checkpoint
RP430: 4/24/2010 12:17:35 PM - System Checkpoint
RP431: 4/25/2010 2:37:37 PM - System Checkpoint
RP432: 4/26/2010 3:06:21 PM - System Checkpoint
RP433: 4/27/2010 6:53:11 PM - System Checkpoint
RP434: 4/28/2010 7:32:35 PM - System Checkpoint
RP435: 4/29/2010 9:20:45 PM - System Checkpoint
RP436: 4/30/2010 10:04:13 PM - System Checkpoint
RP437: 5/1/2010 10:43:08 PM - System Checkpoint
RP438: 5/2/2010 10:58:42 PM - System Checkpoint
RP439: 5/4/2010 12:17:23 AM - System Checkpoint
RP440: 5/5/2010 12:58:44 AM - System Checkpoint
RP441: 5/6/2010 1:03:33 AM - System Checkpoint
RP442: 5/7/2010 1:15:59 AM - System Checkpoint
RP443: 5/8/2010 2:15:59 AM - System Checkpoint
RP444: 5/9/2010 3:16:01 AM - System Checkpoint
RP445: 5/10/2010 4:16:01 AM - System Checkpoint
RP446: 5/11/2010 5:51:59 AM - System Checkpoint
RP447: 5/12/2010 6:16:00 AM - System Checkpoint
RP448: 5/13/2010 7:22:11 AM - System Checkpoint
RP449: 5/14/2010 7:24:57 AM - System Checkpoint
RP450: 5/15/2010 8:16:04 AM - System Checkpoint
RP451: 5/16/2010 9:32:24 AM - System Checkpoint
RP452: 5/17/2010 10:16:01 AM - System Checkpoint
RP453: 5/18/2010 10:46:48 AM - System Checkpoint
RP454: 5/19/2010 11:46:49 AM - System Checkpoint
RP455: 5/20/2010 12:46:52 PM - System Checkpoint
RP456: 5/21/2010 1:46:50 PM - System Checkpoint
RP457: 5/22/2010 2:46:52 PM - System Checkpoint
RP458: 5/23/2010 3:09:48 PM - System Checkpoint
RP459: 5/24/2010 3:20:37 PM - System Checkpoint
RP460: 5/25/2010 3:45:48 PM - System Checkpoint
RP461: 5/26/2010 5:50:35 PM - System Checkpoint
RP462: 5/27/2010 8:15:28 PM - System Checkpoint
RP463: 5/28/2010 9:03:15 PM - System Checkpoint
RP464: 6/5/2010 6:36:42 PM - Restore Operation
RP465: 6/6/2010 7:41:48 PM - System Checkpoint
RP466: 6/7/2010 10:53:35 AM - Removed Get High Speed Internet!
RP467: 6/8/2010 11:02:00 AM - System Checkpoint
RP468: 6/8/2010 3:56:39 PM - Restore Operation
RP469: 6/8/2010 4:01:14 PM - Restore Operation
RP470: 6/8/2010 4:05:47 PM - Restore Operation
RP471: 6/8/2010 4:09:31 PM - Restore Operation

==== Installed Programs ======================

Acrobat.com
Adobe Acrobat - Reader 6.0.2 Update
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 6.0.1
Adobe Reader 9.3.2
Adobe Shockwave Player 11
America Online (Choose which version to remove)
Andrea VoiceCenter
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Connectivity Services
AOLIcon
Apple Mobile Device Support
Apple Software Update
Banctec Service Agreement
Bonjour
BridgePro
Corel Photo Album 6
Creative MediaSource
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Support 3.1
Dell System Restore
Digital Content Portal
Documentation & Support Launcher
EarthLink setup files
EducateU
ELIcon
ESPNMotion
Games, Music, & Photos Launcher
Google Desktop
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
HijackThis 1.99.1
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB908673)
Hotfix for Windows XP (KB912024)
Hotfix for Windows XP (KB915865)
Hoyle Board Games Demo
Hoyle Card Games 3
HP Photo and Imaging 1.0 - HP Photosmart Printer Series
Intel Matrix Storage Manager
Intel® PRO Network Connections Drivers
Intel® PROSet for Wired Connections
Intel® Quick Resume Technology Drivers
Intel® Viiv™
Internet Service Offers Launcher
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
kernel
Learn2 Player (Uninstall Only)
Logitech MouseWare 9.79.1
Malwarebytes' Anti-Malware
McAfee Uninstaller
MCU
Microsoft .NET Framework 1.0 Hotfix (KB887998)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB886903)
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Standard 2006
Microsoft Digital Image Standard 2006 Editor
Microsoft Digital Image Standard 2006 Library
Microsoft Encarta Encyclopedia Standard 2006
Microsoft Greetings
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Excel Viewer 2003
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional 2007
Microsoft Office Professional 2007 Trial
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Streets & Trips 2006
Microsoft Visual C++ 2005 Redistributable
Microsoft Word 2002
Microsoft Works
Microsoft Works Setup Launcher
Microsoft Works Suite 2006 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
MSXML 4.0 SP2 (KB927978)
Musicmatch for Windows Media Player
Musicmatch® Jukebox
NetZeroInstallers
NVIDIA Drivers
Oblivion
Photosmart Printer 130,230,7150,7350,7550 (Remove only)
Picasa 3
QuickTime
Roxio DLA
Roxio Express Labeler
Roxio MyDVD LE
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Search Assist
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
Sierra Utilities
SmartDraw 2009
Sonic Activation Module
Sonic Advanced Decoder
Sonic Encoders
Sonic Update Manager
Sound Blaster Audigy ADVANCED MB
Sound Blaster Audigy ADVANCED MB Product Registration
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
Update for Windows Media Player 10 (KB910393)
Update for Windows XP (KB894391)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update Rollup 2 for Windows XP Media Center Edition 2005
URL Assistant
VC 9.0 Runtime
Viewpoint Media Player
Watchtower Library 2005 - English Edition
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB839210
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889673
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB912067
WinRAR archiver
Works Upgrade
ZoneAlarm Security Suite

==== Event Viewer Messages From Past Week ========

6/9/2010 3:12:05 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/9/2010 2:51:16 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/9/2010 2:38:25 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/9/2010 2:28:55 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/9/2010 2:27:24 PM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/9/2010 2:27:24 PM, error: Service Control Manager [7001] - The Intel® Quick Resume Technology Drivers service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/9/2010 2:20:08 PM, error: Service Control Manager [7001] - The Intel® Quick Resume Technology Drivers service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/9/2010 2:18:12 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
6/9/2010 2:17:46 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/9/2010 2:15:02 PM, error: Service Control Manager [7034] - The COM+ System Application service terminated unexpectedly. It has done this 3 time(s).
6/9/2010 2:15:02 PM, error: Service Control Manager [7031] - The COM+ System Application service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
6/9/2010 2:15:02 PM, error: Service Control Manager [7031] - The COM+ System Application service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
6/9/2010 2:15:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Fast User Switching Compatibility service to connect.
6/9/2010 2:15:02 PM, error: Service Control Manager [7001] - The Intel® Quick Resume Technology Drivers service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/9/2010 2:15:02 PM, error: Service Control Manager [7000] - The Fast User Switching Compatibility service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 8:28:25 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 7:58:44 AM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 6:44:57 AM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 6:42:04 AM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 8053a9f1, parameter3 ef02fc64, parameter4 00000000.
6/8/2010 6:40:44 AM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 5:18:18 AM, error: BROWSER [8007] - The browser was unable to update the service status bits. The data is the error.
6/8/2010 4:08:54 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 4:05:18 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Time service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Management Instrumentation service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Telephony service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the System Restore Service service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Server service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Secondary Logon service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Network Connections service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HID Input Service service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Distributed Link Tracking Client service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Automatic Updates service to connect.
6/8/2010 4:03:32 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7001] - The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7001] - The Intel® Quick Resume Technology Drivers service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7001] - The Fax service depends on the Telephony service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The Telephony service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The HID Input Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:03:32 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2010 4:00:26 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
6/8/2010 3:56:07 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 3:50:14 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/8/2010 3:36:23 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/8/2010 2:37:54 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
6/7/2010 10:45:34 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Intel® Quick Resume Technology Drivers service to connect.
6/7/2010 10:45:34 PM, error: Service Control Manager [7000] - The Intel® Quick Resume Technology Drivers service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:40:25 AM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/7/2010 10:36:06 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/7/2010 10:34:08 AM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Workstation service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Wireless Zero Configuration service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Audio service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Themes service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Task Scheduler service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Shell Hardware Detection service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Logical Disk Manager service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Help and Support service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Error Reporting Service service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the DHCP Client service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Cryptographic Services service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the COM+ Event System service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Background Intelligent Transfer Service service to connect.
6/7/2010 10:34:07 AM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the Cryptographic Services service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7001] - The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Workstation service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Wireless Zero Configuration service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Windows Audio service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Themes service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Task Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The McAfee.com McShield service failed to start due to the following error: The system cannot find the path specified.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The McAfee WSC Integration service failed to start due to the following error: The system cannot find the file specified.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The McAfee Task Scheduler service failed to start due to the following error: The system cannot find the file specified.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The McAfee SpamKiller Server service failed to start due to the following error: The system cannot find the file specified.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The McAfee Personal Firewall Service service failed to start due to the following error: The system cannot find the path specified.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Logical Disk Manager service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Help and Support service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The DHCP Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Cryptographic Services service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The COM+ Event System service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/7/2010 10:34:07 AM, error: Service Control Manager [7000] - The Background Intelligent Transfer Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/6/2010 8:08:58 AM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/6/2010 7:24:57 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/6/2010 7:24:38 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
6/6/2010 7:24:01 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MPFIREWL
6/6/2010 7:24:01 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/6/2010 7:03:17 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/6/2010 6:57:49 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/6/2010 5:37:46 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/6/2010 4:14:03 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/5/2010 6:45:23 PM, error: Service Control Manager [7034] - The TrueVector Internet Monitor service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:43:17 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/5/2010 6:39:22 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Wireless Zero Configuration service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Windows Time service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Windows Firewall/Internet Connection Sharing (ICS) service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Telephony service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The System Restore Service service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The System Event Notification service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Security Center service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Secondary Logon service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Remote Access Connection Manager service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Distributed Link Tracking Client service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7034] - The Automatic Updates service terminated unexpectedly. It has done this 1 time(s).
6/5/2010 6:02:39 PM, error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/5/2010 6:02:39 PM, error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/5/2010 6:02:39 PM, error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 6000 milliseconds: Restart the service.
6/5/2010 4:14:17 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/5/2010 11:01:04 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
6/5/2010 11:01:04 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/5/2010 11:01:04 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
6/5/2010 10:59:31 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.
6/5/2010 10:49:49 PM, error: Service Control Manager [7023] - The Intel® Quick Resume Technology Drivers service terminated with the following error: The system could not find the environment option that was entered.

==== End Of File ===========================



#8 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 10 June 2010 - 06:17 PM

is anybody out there?, still looking for help
my computer problems
1. Have to start it several times to get it to recognize my IP address and connect with the internet.
2. Still redirecting the browser and randomly opening websites
3. seems to want to lock up after being on for a long time
4. wont rum GMER to completion even in safe mode
5. still says error loading CTMBHA.DLL DLL initialization routine failed

#9 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:04:22 AM

Posted 12 June 2010 - 02:22 AM

Hello, klogman
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 4-5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
  • Please set your system to show all files.
    Click Start, open My Computer, select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.


Sorry for the delay, had some private issues.




Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.
    When finished, it will produce a report for you.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#10 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 12 June 2010 - 02:48 PM

Here is the Combofix log
still having to redtart several times to get an internet connection, when i try to repair it it says unable to repair, could not renew I.P. address. I then have to restart it until this message does not come up.
THanks again

ComboFix 10-06-11.01 - Kellogg 06/12/2010 14:49:36.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.650 [GMT -4:00]
Running from: c:\documents and settings\Kellogg\Desktop\schrauber.exe
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2010-05-12 to 2010-06-12 )))))))))))))))))))))))))))))))
.

2010-06-10 22:38 . 2008-04-14 09:42 1306624 -c----w- c:\windows\system32\dllcache\msxml6.dll
2010-06-10 22:38 . 2008-04-14 09:42 1306624 ------w- c:\windows\system32\msxml6.dll
2010-06-10 22:38 . 2008-04-14 02:57 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll
2010-06-10 22:38 . 2008-04-14 02:57 79872 ------w- c:\windows\system32\msxml6r.dll
2010-06-10 22:32 . 2010-06-10 22:38 -------- d-----w- c:\windows\ServicePackFiles
2010-06-08 17:59 . 2010-06-08 17:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities
2010-06-05 22:37 . 2010-06-05 22:37 -------- d-----w- c:\windows\system32\wbem\Repository
2010-05-31 13:46 . 2010-05-31 13:46 -------- d-----w- c:\documents and settings\Diana Nance\Application Data\Malwarebytes
2010-05-29 05:11 . 2010-05-29 05:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-10 23:28 . 2010-03-16 03:56 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-06-10 22:41 . 2005-08-16 08:41 89319 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-06-10 00:59 . 2006-08-24 21:04 -------- d-----w- c:\program files\Watchtower
2010-06-10 00:59 . 2006-07-21 05:29 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-09 23:46 . 2008-07-28 02:32 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-09 01:17 . 2006-08-24 22:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-06-08 02:43 . 2010-06-08 02:43 1876992 ----a-w- c:\windows\Internet Logs\xDB4.tmp
2010-06-08 02:43 . 2010-06-08 02:43 137728 ----a-w- c:\windows\Internet Logs\xDB3.tmp
2010-06-06 12:17 . 2006-08-24 22:22 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-06 00:26 . 2008-08-11 00:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-05 22:45 . 2010-06-06 02:58 52736 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-05-28 14:02 . 2010-06-05 20:13 1564672 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-05-27 02:12 . 2006-08-11 22:11 41318 ----a-w- c:\documents and settings\Kellogg\Application Data\wklnhst.dat
2010-05-17 07:33 . 2006-07-21 05:42 -------- d-----w- c:\program files\Google
2010-05-11 03:11 . 2006-08-10 02:16 88 --sh--r- c:\windows\system32\F2D6E2B635.sys
2010-05-11 03:11 . 2006-08-10 02:16 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
2010-05-05 20:27 . 2010-05-05 20:27 -------- d-----w- c:\documents and settings\Kelley.KLOGZOID\Application Data\CheckPoint
2010-04-29 19:39 . 2008-08-11 00:17 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2008-08-11 00:17 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-14 17:00 . 2010-04-14 17:00 -------- d-----w- c:\program files\Microsoft Silverlight
2008-04-01 03:06 . 2008-04-01 03:06 19489 ----a-w- c:\program files\Common Files\onesa.lib
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-08 04:06 . 2007-10-11 00:51 39792 c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe
2008-10-15 06:04 . 2008-10-15 06:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

2005-06-10 14:44 . 2005-06-10 14:44 81920 c:\program files\Common Files\InstallShield\UpdateService\bak\issch.exe

2005-06-10 14:44 . 2005-06-10 14:44 249856 c:\program files\Common Files\InstallShield\UpdateService\bak\isuspm.exe

2006-12-23 04:37 . 2006-12-23 04:37 185896 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2006-07-21 05:30 . 2005-09-15 13:47 57344 c:\program files\Creative\SBAudigy\Surround Mixer\bak\CTSysVol.exe

2006-07-21 05:31 . 2005-09-19 11:42 1159168 c:\program files\Creative\VoiceCenter\bak\AndreaVC.exe

2005-10-05 07:12 . 2006-05-03 07:12 98304 c:\program files\Dell\Media Experience\bak\DMXLauncher.exe

2007-03-15 15:09 . 2007-03-15 15:09 460784 c:\program files\DellSupport\bak\DSAgnt.exe

2006-07-21 05:42 . 2006-07-21 05:42 169984 c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe

2002-04-11 08:19 . 2002-04-11 08:19 69632 c:\program files\Hewlett-Packard\HP Share-to-Web\bak\hpgs2wnd.exe

2006-07-21 05:29 . 2005-06-17 11:56 139264 c:\program files\Intel\Intel Matrix Storage Manager\bak\iaanotif.exe

2007-03-05 15:26 . 2007-01-17 22:30 152144 c:\program files\McAfee\MSK\bak\MskAgent.exe
2007-03-05 15:26 . 2007-11-26 14:46 141640 c:\program files\McAfee\MSK\mskagent.exe

2007-08-27 00:42 . 2007-08-27 00:42 98304 c:\program files\QuickTime\bak\qttask.exe
2008-09-06 19:09 . 2008-09-06 19:09 413696 c:\program files\QuickTime\QTTask.exe

2006-08-25 01:30 . 2005-08-08 17:48 1109504 c:\program files\Webroot\Washer\bak\wwDisp.exe

2006-07-21 05:30 . 2000-05-11 05:00 90112 c:\windows\bak\UpdReg.EXE

2006-07-21 05:41 . 2005-09-08 09:20 122940 c:\windows\system32\DLA\bak\DLACTRLW.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 24576]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2008-06-03 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-15 7323648]
"MBMon"="CTMBHA.DLL" [2005-05-19 1345520]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-04-04 188416]
"HPHmon04"="c:\windows\system32\hphmon04.exe" [2002-04-04 335872]
"HPHUPD04"="c:\program files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe" [2002-04-04 49152]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-10-17 1037192]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"New Value #1"= NoClose"=dword:00000000

[HKLM\~\startupfolder\C:^Documents and Settings^Kellogg^Start Menu^Programs^Startup^Secunia PSI (RC3).lnk]
path=c:\documents and settings\Kellogg\Start Menu\Programs\Startup\Secunia PSI (RC3).lnk
backup=c:\windows\pss\Secunia PSI (RC3).lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-05-08 14:05 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/25/2009 11:08 AM 133104]
.
Contents of the 'Scheduled Tasks' folder

2010-06-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2010-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-25 15:08]

2010-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-25 15:08]

2010-05-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-03-05 17:32]

2010-05-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-03-05 17:32]

2010-06-12 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2008-09-03 11:29]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://google.com/
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar Search
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-12 15:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x865BDD01]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7596f28
\Driver\ACPI -> ACPI.sys @ 0xf7429cb8
\Driver\atapi -> atapi.sys @ 0xf72e6852
\Driver\iaStor -> iaStor.sys @ 0xf730ab10
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
user & kernel MBR OK

**************************************************************************
.
Completion time: 2010-06-12 15:29:42
ComboFix-quarantined-files.txt 2010-06-12 19:29
ComboFix2.txt 2010-06-10 21:39

Pre-Run: 276,176,367,616 bytes free
Post-Run: 276,710,457,344 bytes free

- - End Of File - - 0A4D07979AB63ADB5FB93C6B698E062B


#11 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:04:22 AM

Posted 13 June 2010 - 10:49 PM

Hi,


  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#12 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 14 June 2010 - 01:29 PM

The log you requested.
i ran TDSSkiller. it rebooted
still says error loading CTMBHA.DLL DLL initialization routine failed
but i was able to get on the internet the first try
klog


14:17:18:953 3104 TDSS rootkit removing tool 2.3.2.0 May 31 2010 10:39:48
14:17:18:953 3104 ================================================================================
14:17:18:953 3104 SystemInfo:

14:17:18:953 3104 OS Version: 5.1.2600 ServicePack: 3.0
14:17:18:953 3104 Product type: Workstation
14:17:18:953 3104 ComputerName: KLOGZOID
14:17:18:953 3104 UserName: Kellogg
14:17:18:953 3104 Windows directory: C:\WINDOWS
14:17:18:953 3104 Processor architecture: Intel x86
14:17:18:953 3104 Number of processors: 2
14:17:18:953 3104 Page size: 0x1000
14:17:18:953 3104 Boot type: Normal boot
14:17:18:953 3104 ================================================================================
14:17:19:453 3104 Initialize success
14:17:19:453 3104
14:17:19:453 3104 Scanning Services ...
14:17:19:531 3104 Raw services enum returned 360 services
14:17:19:546 3104
14:17:19:546 3104 Scanning Drivers ...
14:17:20:281 3104 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
14:17:20:343 3104 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:17:20:390 3104 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
14:17:20:453 3104 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
14:17:20:515 3104 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
14:17:20:562 3104 AFD (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys
14:17:20:640 3104 AFS2K (b34b1ab0a7690a0e2301fec6d17b2fc1) C:\WINDOWS\system32\drivers\AFS2K.sys
14:17:20:734 3104 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
14:17:20:812 3104 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
14:17:20:906 3104 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
14:17:21:031 3104 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
14:17:21:078 3104 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
14:17:21:109 3104 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
14:17:21:203 3104 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
14:17:21:281 3104 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
14:17:21:343 3104 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
14:17:21:375 3104 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
14:17:21:453 3104 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
14:17:21:453 3104 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
14:17:21:500 3104 ASCTRM (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
14:17:21:593 3104 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:17:21:718 3104 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
14:17:21:828 3104 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:17:21:906 3104 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
14:17:21:984 3104 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
14:17:22:250 3104 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
14:17:22:296 3104 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
14:17:22:328 3104 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
14:17:22:437 3104 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
14:17:22:484 3104 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
14:17:22:562 3104 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:17:22:625 3104 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys
14:17:22:734 3104 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
14:17:22:812 3104 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
14:17:22:890 3104 ctsfm2k (8db84de3aab34a8b4c2f644eff41cd76) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys
14:17:22:937 3104 CTUSFSYN (4ee8822adb764edd28ce44e808097995) C:\WINDOWS\system32\drivers\ctusfsyn.sys
14:17:23:000 3104 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
14:17:23:078 3104 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
14:17:23:171 3104 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
14:17:23:312 3104 DLABOIOM (e2d0de31442390c35e3163c87cb6a9eb) C:\WINDOWS\system32\DLA\DLABOIOM.SYS
14:17:23:359 3104 DLACDBHM (d979bebcf7edcc9c9ee1857d1a68c67b) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS
14:17:23:437 3104 DLADResN (83545593e297f50a8e2524b4c071a153) C:\WINDOWS\system32\DLA\DLADResN.SYS
14:17:23:453 3104 DLAIFS_M (96e01d901cdc98c7817155cc057001bf) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS
14:17:23:468 3104 DLAOPIOM (0a60a39cc5e767980a31ca5d7238dfa9) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS
14:17:23:500 3104 DLAPoolM (9fe2b72558fc808357f427fd83314375) C:\WINDOWS\system32\DLA\DLAPoolM.SYS
14:17:23:515 3104 DLARTL_N (7ee0852ae8907689df25049dcd2342e8) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS
14:17:23:562 3104 DLAUDFAM (f08e1dafac457893399e03430a6a1397) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS
14:17:23:593 3104 DLAUDF_M (e7d105ed1e694449d444a9933df8e060) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS
14:17:23:812 3104 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
14:17:23:890 3104 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\DRIVERS\dmio.sys
14:17:23:906 3104 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
14:17:23:984 3104 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
14:17:24:062 3104 Dot4 HPH11 (8685290bf149e784a5a249d08db68ca4) C:\WINDOWS\system32\DRIVERS\hphid411.sys
14:17:24:125 3104 Dot4Print HPH11 (6fd0c47a4660ac84d291b093aa87343e) C:\WINDOWS\system32\DRIVERS\hphipr11.sys
14:17:24:156 3104 Dot4Usb HPH11 (8238cdd9239b6c7a1a2483b6227a4c1b) C:\WINDOWS\system32\drivers\hphius11.sys
14:17:24:218 3104 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
14:17:24:265 3104 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
14:17:24:312 3104 DRVMCDB (fd0f95981fef9073659d8ec58e40aa3c) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS
14:17:24:375 3104 DRVNDDM (b4869d320428cdc5ec4d7f5e808e99b5) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS
14:17:24:468 3104 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
14:17:24:562 3104 e1express (5b75bbf89d8341f424171df7ad9dc465) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
14:17:24:609 3104 ELacpi (1976fedf6d7f87135c9b7f5cb4c8c868) C:\WINDOWS\system32\DRIVERS\ELacpi.sys
14:17:24:687 3104 ELhid (ae65c02444907966378454138b9f99f0) C:\WINDOWS\system32\DRIVERS\ELhid.sys
14:17:24:703 3104 ELkbd (e485c3ba1daddeef3e14fea1e8fda6e1) C:\WINDOWS\system32\DRIVERS\ELkbd.sys
14:17:24:750 3104 ELmon (0d87cb825ed6cb2ebcc147a10a42f1d6) C:\WINDOWS\system32\DRIVERS\ELmon.sys
14:17:24:812 3104 ELmou (a4add3847b67bacab6fc851a2b60fdb3) C:\WINDOWS\system32\DRIVERS\ELmou.sys
14:17:24:937 3104 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
14:17:24:968 3104 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
14:17:24:968 3104 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
14:17:24:984 3104 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
14:17:25:062 3104 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
14:17:25:140 3104 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:17:25:218 3104 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:17:25:281 3104 GEARAspiWDM (df6e37b27a9a1a498c6d9f29995b7a03) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
14:17:25:359 3104 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:17:25:437 3104 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:17:25:468 3104 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:17:25:531 3104 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
14:17:25:609 3104 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
14:17:25:640 3104 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
14:17:25:687 3104 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
14:17:25:781 3104 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
14:17:25:875 3104 iastor (9a65e42664d1534b68512caad0efe963) C:\WINDOWS\system32\DRIVERS\iaStor.sys
14:17:25:906 3104 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
14:17:25:984 3104 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
14:17:26:046 3104 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
14:17:26:171 3104 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:17:26:296 3104 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
14:17:26:421 3104 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:17:26:468 3104 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:17:26:546 3104 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:17:26:578 3104 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:17:26:625 3104 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
14:17:26:703 3104 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:17:26:734 3104 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:17:26:765 3104 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
14:17:26:812 3104 kl1 (d6635d474d792e798233ef59ebd918b1) C:\WINDOWS\system32\DRIVERS\kl1.sys
14:17:26:812 3104 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\kl1.sys. Real md5: d6635d474d792e798233ef59ebd918b1, Fake md5: 7dd41b7ac1fbb1dbf20bb1f4e4fbe58c
14:17:26:812 3104 File "C:\WINDOWS\system32\DRIVERS\kl1.sys" infected by TDSS rootkit ... 14:17:42:140 3104 Backup copy found, using it..
14:17:42:156 3104 will be cured on next reboot
14:17:42:234 3104 KLIF (a11c971434468fa05815eec8228d63fd) C:\WINDOWS\system32\DRIVERS\klif.sys
14:17:42:343 3104 klmd23 (67e1faa88fb397b3d56909d7e04f4dd3) C:\WINDOWS\system32\drivers\klmd.sys
14:17:42:468 3104 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
14:17:42:500 3104 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys
14:17:42:609 3104 LHidFlt2 (3c357dfdbbf2b4b01aa4b9c8a26e4416) C:\WINDOWS\system32\DRIVERS\LHidFlt2.Sys
14:17:42:656 3104 LHidUsb (ffb851b1b2f6596b7d3182b977a85206) C:\WINDOWS\system32\Drivers\LHidUsb.Sys
14:17:42:687 3104 LMouFlt2 (aef09673376a4d93c09e8341854f1bf4) C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
14:17:42:734 3104 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
14:17:42:828 3104 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
14:17:42:890 3104 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
14:17:43:000 3104 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:17:43:062 3104 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:17:43:187 3104 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
14:17:43:250 3104 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
14:17:43:312 3104 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:17:43:359 3104 MRxSmb (68755f0ff16070178b54674fe5b847b0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:17:43:390 3104 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
14:17:43:468 3104 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:17:43:546 3104 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:17:43:640 3104 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
14:17:43:734 3104 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:17:43:765 3104 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
14:17:43:828 3104 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
14:17:43:875 3104 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:17:43:968 3104 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:17:44:015 3104 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:17:44:093 3104 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
14:17:44:125 3104 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
14:17:44:234 3104 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
14:17:44:296 3104 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
14:17:44:406 3104 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
14:17:44:500 3104 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
14:17:44:625 3104 nv (94c9962a2d51115be99dbed20801edae) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
14:17:44:750 3104 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:17:44:796 3104 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:17:44:843 3104 ossrv (103a9b117a7d9903111955cdafe65ac6) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys
14:17:44:937 3104 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
14:17:44:968 3104 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
14:17:45:015 3104 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
14:17:45:046 3104 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
14:17:45:078 3104 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
14:17:45:125 3104 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
14:17:45:234 3104 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
14:17:45:265 3104 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
14:17:45:328 3104 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:17:45:359 3104 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
14:17:45:437 3104 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:17:45:453 3104 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
14:17:45:500 3104 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
14:17:45:515 3104 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
14:17:45:562 3104 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
14:17:45:578 3104 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
14:17:45:609 3104 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
14:17:45:640 3104 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:17:45:656 3104 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:17:45:718 3104 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:17:45:718 3104 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
14:17:45:750 3104 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:17:45:781 3104 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:17:45:843 3104 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:17:45:953 3104 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
14:17:46:031 3104 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
14:17:46:093 3104 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:17:46:203 3104 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
14:17:46:265 3104 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
14:17:46:343 3104 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
14:17:46:453 3104 sigfilt (6bd3976b881888ac9a0ed3eb94e7fd38) C:\WINDOWS\system32\drivers\sigfilt.sys
14:17:46:531 3104 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
14:17:46:640 3104 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
14:17:46:703 3104 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
14:17:46:765 3104 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
14:17:46:890 3104 Srv (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys
14:17:46:937 3104 STHDA (b95480c92c4c9c311be47b8a1ad73770) C:\WINDOWS\system32\drivers\sthda.sys
14:17:46:984 3104 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
14:17:47:015 3104 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
14:17:47:031 3104 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
14:17:47:093 3104 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
14:17:47:125 3104 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
14:17:47:203 3104 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
14:17:47:375 3104 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
14:17:47:437 3104 Tcpip (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:17:47:515 3104 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
14:17:47:546 3104 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
14:17:47:562 3104 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
14:17:47:578 3104 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
14:17:47:625 3104 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
14:17:47:640 3104 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
14:17:47:656 3104 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
14:17:47:734 3104 USBAAPL (026f7f224f088ee11e383bca448fff81) C:\WINDOWS\system32\Drivers\usbaapl.sys
14:17:47:781 3104 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
14:17:47:828 3104 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:17:47:875 3104 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:17:47:875 3104 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:17:47:937 3104 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
14:17:48:000 3104 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:17:48:015 3104 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:17:48:078 3104 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
14:17:48:140 3104 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
14:17:48:171 3104 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
14:17:48:250 3104 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
14:17:48:390 3104 vsdatant (1045d05bbd5170565927d7653346c961) C:\WINDOWS\system32\vsdatant.sys
14:17:48:468 3104 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:17:48:500 3104 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
14:17:48:578 3104 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
14:17:48:593 3104 Reboot required for cure complete..
14:17:48:609 3104 Cure on reboot scheduled successfully
14:17:48:609 3104
14:17:48:609 3104 Completed
14:17:48:609 3104
14:17:48:609 3104 Results:
14:17:48:609 3104 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
14:17:48:609 3104 File objects infected / cured / cured on reboot: 1 / 0 / 1
14:17:48:609 3104
14:17:48:625 3104 KLMD(ARK) unloaded successfully


#13 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:04:22 AM

Posted 15 June 2010 - 02:55 PM

Hi,


Go to Start => Run and copy/paste the following line and click OK.

cmd /c mbr.exe -t >log.txt&start log.txt

A log file opens. Please post the content to your reply.





Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.





I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the icon on your desktop.
  • Check
  • Click the button.
  • Accept any security warnings from your browser.
  • Check
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push
  • Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the button.
  • Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt




  1. Please download OTL from one of the following mirrors:
  2. Save it to your desktop.
  3. Double click on the icon on your desktop.
  4. Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    mv61xx.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemdrive%\*.sys /90 /md5
  5. Push the Quick Scan button.
  6. Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#14 klogman

klogman
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:22 PM

Posted 15 June 2010 - 07:06 PM

MBAM Log
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4201

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

6/15/2010 4:48:43 PM
mbam-log-2010-06-15 (16-48-43).txt

Scan type: Quick scan
Objects scanned: 173423
Time elapsed: 10 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
ESET LOG
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinZBot1.zip Win32/Bagle.gen.zip worm

OTL logfile created on: 6/15/2010 7:30:41 PM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Kellogg\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 551.00 Mb Available Physical Memory | 54.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 293.16 Gb Total Space | 257.49 Gb Free Space | 87.84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KLOGZOID
Current User Name: Kellogg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/06/15 19:26:04 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kellogg\Desktop\OTL.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/10/23 08:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2005/06/17 07:55:58 | 000,086,140 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2004/01/08 09:50:00 | 000,037,888 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
PRC - [2002/04/04 16:03:00 | 000,188,416 | ---- | M] (HP) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
PRC - [2002/04/04 16:01:42 | 000,335,872 | ---- | M] (Hewlett-Packard) -- C:\WINDOWS\system32\hphmon04.exe


========== Modules (SafeList) ==========

MOD - [2010/06/15 19:26:04 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kellogg\Desktop\OTL.exe
MOD - [2008/04/14 05:42:02 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcp60.dll
MOD - [2008/04/14 05:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2004/01/08 09:50:00 | 000,024,064 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL
MOD - [2004/01/08 09:50:00 | 000,006,144 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (MskService)
SRV - File not found [Auto | Stopped] -- -- (MpfService)
SRV - File not found [On_Demand | Stopped] -- -- (mcupdmgr.exe)
SRV - File not found [Auto | Stopped] -- -- (McTskshd.exe)
SRV - File not found [Auto | Stopped] -- -- (McShield)
SRV - File not found [Auto | Stopped] -- -- (McDetect.exe)
SRV - [2009/10/17 02:41:10 | 002,384,240 | ---- | M] (Check Point Software Technologies LTD) [Auto | Stopped] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2006/10/23 08:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto | Running] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)
SRV - [2006/07/21 01:30:09 | 000,069,632 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe -- (Creative Labs Licensing Service)
SRV - [2005/12/12 16:52:32 | 000,180,224 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe -- (ELService)
SRV - [2005/06/17 07:55:58 | 000,086,140 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMon) Intel®
SRV - [2002/04/04 16:02:58 | 000,077,824 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hphipm11.exe -- (Pml Driver HPH11)


========== Driver Services (SafeList) ==========

DRV - [2010/06/14 14:21:03 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\kl1.sys -- (kl1)
DRV - [2009/10/17 02:39:42 | 000,486,280 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2009/10/12 19:15:30 | 000,317,072 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2009/02/15 01:48:23 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2008/04/14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/14 00:06:40 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/14 00:06:40 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 22:06:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2006/07/21 01:34:28 | 000,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2005/12/14 20:51:00 | 003,580,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2005/12/12 16:52:34 | 000,010,112 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ELhid.sys -- (ELhid)
DRV - [2005/12/12 16:52:34 | 000,007,040 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ELmon.sys -- (ELmon)
DRV - [2005/12/12 16:52:34 | 000,006,912 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ELkbd.sys -- (ELkbd)
DRV - [2005/12/12 16:52:34 | 000,006,400 | ---- | M] (Intel Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ELmou.sys -- (ELmou)
DRV - [2005/12/12 16:52:32 | 000,007,808 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ELacpi.sys -- (ELacpi)
DRV - [2005/09/12 03:30:00 | 000,089,264 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)
DRV - [2005/09/08 05:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005/09/08 05:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005/09/08 05:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005/09/08 05:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005/09/08 05:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005/09/08 05:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005/09/08 05:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005/08/25 19:05:24 | 000,176,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel®
DRV - [2005/08/25 12:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005/08/25 12:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2005/08/12 05:20:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)
DRV - [2005/06/17 12:33:40 | 000,872,064 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iastor)
DRV - [2005/06/06 21:40:48 | 000,180,736 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA) High Definition Audio Driver (WDM)
DRV - [2005/05/25 22:34:00 | 000,158,464 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTUSFSYN.SYS -- (CTUSFSYN)
DRV - [2005/03/25 16:11:00 | 001,350,272 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sigfilt.sys -- (sigfilt)
DRV - [2005/01/11 00:15:00 | 000,138,752 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTSFM2K.SYS -- (ctsfm2k)
DRV - [2005/01/11 00:15:00 | 000,106,496 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CTOSS2K.SYS -- (ossrv)
DRV - [2004/08/10 07:00:00 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2004/08/10 07:00:00 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2004/08/10 07:00:00 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2004/08/10 07:00:00 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2004/08/10 07:00:00 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2004/08/10 07:00:00 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2004/08/10 07:00:00 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2004/08/10 07:00:00 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2004/08/10 07:00:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2004/08/10 07:00:00 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2004/08/10 07:00:00 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2004/08/10 07:00:00 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2004/08/10 07:00:00 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2004/08/10 07:00:00 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2004/08/10 07:00:00 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2003/12/17 09:50:00 | 000,070,801 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFlt2.Sys -- (LMouFlt2)
DRV - [2003/12/17 09:50:00 | 000,037,887 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidUsb.sys -- (LHidUsb)
DRV - [2003/12/17 09:50:00 | 000,025,505 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFlt2.Sys -- (LHidFlt2)
DRV - [2003/01/10 16:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2002/04/04 16:02:58 | 000,050,800 | R--- | M] (HP) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hphid411.sys -- (Dot4 HPH11)
DRV - [2002/04/04 16:02:58 | 000,018,928 | R--- | M] (HP) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hphius11.sys -- (Dot4Usb HPH11)
DRV - [2002/04/04 16:02:58 | 000,016,112 | R--- | M] (HP) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hphipr11.sys -- (Dot4Print HPH11)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2010/06/10 17:31:58 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe (HP)
O4 - HKLM..\Run: [HPHmon04] C:\WINDOWS\system32\hphmon04.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPHUPD04] C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [MBMon] C:\WINDOWS\System32\CTMBHA.DLL ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [SetDefaultMIDI] C:\WINDOWS\MIDIDEF.EXE (Creative Technology Ltd)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: New Value #1 = NoClose"=dword:00000000
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shock...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2...78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {3234504D-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/a/0...5ce/mpg4dmo.CAB (Reg Error: Key error.)
O16 - DPF: {32564D57-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/wmv8dmo.cab (Reg Error: Key error.)
O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/C...C4D/mp43dmo.CAB (Reg Error: Key error.)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0...D0C/wmv9dmo.cab (Reg Error: Key error.)
O16 - DPF: {41564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A...01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-48.cab (EPUImageControl Class)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} Reg Error: Value error. (Java Plug-in 1.4.2_03)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/...tiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.4.2_03)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.74.166 68.87.68.166
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Kellogg\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kellogg\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 04:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{59d93270-7736-11df-8c0a-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{59d93270-7736-11df-8c0a-00038a000015}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{59d93270-7736-11df-8c0a-00038a000015}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2006/12/13 01:52:07 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/06/15 19:26:03 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Kellogg\Desktop\OTL.exe
[2010/06/15 17:21:00 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/06/15 07:03:12 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Kellogg\Recent
[2010/06/14 14:16:27 | 000,998,736 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\Kellogg\Desktop\TDSSKiller.exe
[2010/06/13 17:58:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\Application Data\U3
[2010/06/12 15:49:50 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/06/12 14:25:11 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/06/12 14:25:11 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/06/12 14:25:11 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/06/12 14:25:11 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/06/12 14:24:41 | 000,000,000 | ---D | C] -- C:\schrauber
[2010/06/12 14:15:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/06/10 18:52:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010/06/10 18:37:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
[2010/06/10 18:37:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas
[2010/06/10 18:37:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
[2010/06/10 18:37:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits
[2010/06/10 18:32:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2010/06/10 18:22:37 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[2010/06/10 16:58:45 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/06/10 16:44:14 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/06/08 13:59:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Identities
[2010/06/08 13:59:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Identities
[2010/06/07 21:06:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/06/05 20:25:11 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Kellogg\Desktop\mbam-setup-1.46.exe
[2010/06/05 18:37:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/05/29 01:11:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/05/28 09:30:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/05/28 09:30:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/05/27 16:05:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\My Documents\PBVRegistrationchecklist
[2010/05/20 06:47:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\My Documents\EHPHASavetheDate2010
[2010/05/19 13:23:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\My Documents\WORKDAYNOTICE
[2010/05/03 16:36:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\My Documents\IMG_2842
[2010/05/01 21:05:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\My Documents\Abby
[2010/04/14 13:00:04 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2010/04/14 11:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\Desktop\2009 Taxes K&D
[2010/04/13 15:22:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\My Documents\gsstra1
[2010/04/12 15:31:45 | 005,918,800 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Kellogg\Desktop\mbam-setup.exe
[2010/03/30 16:10:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kellogg\Downloads
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/06/15 19:33:00 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/15 19:26:04 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kellogg\Desktop\OTL.exe
[2010/06/15 10:33:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/15 01:00:00 | 000,000,354 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job
[2010/06/14 22:19:04 | 000,000,663 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/06/14 14:21:52 | 000,039,472 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/06/14 14:21:27 | 000,000,468 | ---- | M] () -- C:\WINDOWS\tasks\SDMsgUpdate (TE).job
[2010/06/14 14:21:25 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/06/14 14:21:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/06/14 14:21:03 | 000,128,016 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\kl1.sys
[2010/06/14 14:18:42 | 005,505,024 | ---- | M] () -- C:\Documents and Settings\Kellogg\ntuser.dat
[2010/06/14 14:18:42 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Kellogg\ntuser.ini
[2010/06/14 14:15:43 | 000,966,213 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\tdsskiller.zip
[2010/06/13 18:16:08 | 000,041,362 | ---- | M] () -- C:\Documents and Settings\Kellogg\Application Data\wklnhst.dat
[2010/06/13 18:16:07 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\Kellogg\My Documents\~$ice list for Big Letti.doc
[2010/06/12 15:22:14 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/06/12 14:15:15 | 003,706,656 | R--- | M] () -- C:\Documents and Settings\Kellogg\Desktop\schrauber.exe
[2010/06/10 19:28:02 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010/06/10 19:08:51 | 000,337,056 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/10 18:58:31 | 000,482,018 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/10 18:58:31 | 000,409,412 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/06/10 18:58:31 | 000,065,156 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/06/10 18:52:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/06/10 18:49:23 | 002,108,612 | -H-- | M] () -- C:\Documents and Settings\Kellogg\Local Settings\Application Data\IconCache.db
[2010/06/10 18:28:56 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/06/10 17:31:58 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/06/10 16:58:52 | 000,000,279 | RHS- | M] () -- C:\boot.ini
[2010/06/10 16:28:54 | 000,000,683 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\McAfee SecurityCenter.lnk
[2010/06/09 23:50:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/09 19:46:28 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/09 15:45:15 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\x1dp0m1x.exe
[2010/06/09 15:43:30 | 000,005,392 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Attach.zip
[2010/06/09 15:40:06 | 000,005,274 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Attach.rar
[2010/06/07 12:39:14 | 000,002,483 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Microsoft Word.lnk
[2010/06/07 09:16:27 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100607_091622.reg
[2010/06/06 21:25:20 | 000,001,216 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100606_212516.reg
[2010/06/06 17:17:15 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\dds.scr
[2010/06/06 15:04:16 | 000,004,348 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100606_150411.reg
[2010/06/05 20:26:11 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/05 20:25:23 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Kellogg\Desktop\mbam-setup-1.46.exe
[2010/06/05 17:23:03 | 000,400,876 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Fischer12
[2010/06/05 16:11:14 | 000,000,696 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/05/31 10:41:12 | 000,998,736 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\Kellogg\Desktop\TDSSKiller.exe
[2010/05/28 06:56:16 | 000,033,895 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\StatisticsReport.pdf
[2010/05/27 16:05:49 | 000,988,713 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\PBVRegistrationchecklist.zip
[2010/05/26 00:35:34 | 000,043,520 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Azar 14 day).doc
[2010/05/26 00:33:46 | 000,029,184 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Addendum for Azar Grievance.doc
[2010/05/25 19:19:45 | 000,035,840 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Grievance addendum for A Wright.doc
[2010/05/25 19:13:38 | 000,044,032 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Angie wright 14 day.doc
[2010/05/20 06:47:21 | 000,002,858 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\EHPHASavetheDate2010.zip
[2010/05/19 13:23:32 | 000,020,063 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\WORKDAYNOTICE.zip
[2010/05/17 03:33:50 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/13 16:37:25 | 000,406,317 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\IMG00094-20100512-0641.jpg
[2010/05/10 23:11:09 | 000,003,350 | -HS- | M] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2010/05/10 23:11:09 | 000,000,088 | RHS- | M] () -- C:\WINDOWS\System32\F2D6E2B635.sys
[2010/05/06 15:22:21 | 000,184,320 | ---- | M] () -- C:\Documents and Settings\Kellogg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/03 16:39:10 | 000,000,938 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\Shortcut to IMG_2855copy.lnk
[2010/05/03 16:36:23 | 000,427,889 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\IMG_2842.zip
[2010/05/01 21:05:40 | 000,480,192 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Abby.zip
[2010/05/01 01:00:00 | 000,000,356 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/28 18:17:14 | 001,311,693 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\4-22-10.pdf
[2010/04/27 19:48:14 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/04/25 13:14:33 | 000,351,339 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\8977911-Mr-Brightside-The-Killers.pdf
[2010/04/25 09:35:14 | 000,031,232 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Price list for Big Letti.doc
[2010/04/22 15:47:42 | 000,021,349 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\cles_Whatare_Deemed_Salaries,intheFERSAnnuitySupplement_.pdf
[2010/04/13 15:22:16 | 000,020,623 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\gsstra1.zip
[2010/04/12 15:31:50 | 005,918,800 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Kellogg\Desktop\mbam-setup.exe
[2010/04/12 15:18:36 | 000,363,520 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\rkill.com
[2010/04/10 16:44:25 | 001,791,220 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Fischer - Progress Photos1.pdf
[2010/04/10 16:44:25 | 001,791,220 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\4-11-10.pdf
[2010/04/09 19:27:11 | 000,031,990 | ---- | M] () -- C:\Documents and Settings\Kellogg\Desktop\SUITPLAY.zip
[2010/04/07 22:10:21 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Reasons to consolidate Rural Route 24.doc
[2010/04/04 01:02:47 | 000,006,418 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100404_000241.reg
[2010/04/03 20:38:20 | 000,982,948 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\4-2-10.pdf
[2010/04/03 00:45:01 | 000,003,698 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\image004.jpg
[2010/03/31 21:56:51 | 000,064,215 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\20100331
[2010/03/28 17:16:44 | 000,939,516 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\20100326 - Fischer - Progress Photos.pdf
[2010/03/28 16:53:36 | 005,103,518 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\IMG_0218.mov
[2010/03/22 07:36:15 | 001,413,717 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\3-19-10.pdf
[2010/03/19 01:10:32 | 000,025,600 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Failure to maintain even flow of mail Grievance 2010 mail count.doc
[2010/03/19 01:10:01 | 000,043,008 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Mail count 2010 hot case pull grievance.doc
[2010/03/19 00:37:29 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\Class action Grievance regarding failure to count all available mail.doc
[2010/03/19 00:35:23 | 000,043,520 | ---- | M] () -- C:\Documents and Settings\Kellogg\My Documents\MAil count 2010 flat grievence.doc
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/15 16:33:03 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Kellogg\mbr.log
[2010/06/15 16:33:03 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Kellogg\log.txt
[2010/06/14 14:15:38 | 000,966,213 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\tdsskiller.zip
[2010/06/13 18:16:07 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\Kellogg\My Documents\~$ice list for Big Letti.doc
[2010/06/12 14:25:11 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/06/12 14:25:11 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/06/12 14:25:11 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/06/12 14:25:11 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/06/12 14:25:11 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/06/12 14:15:12 | 003,706,656 | R--- | C] () -- C:\Documents and Settings\Kellogg\Desktop\schrauber.exe
[2010/06/10 18:29:47 | 000,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod
[2010/06/10 18:29:44 | 000,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2010/06/10 18:29:38 | 000,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img
[2010/06/10 16:58:52 | 000,000,209 | ---- | C] () -- C:\Boot.bak
[2010/06/10 16:58:46 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/06/10 16:28:54 | 000,000,683 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\McAfee SecurityCenter.lnk
[2010/06/09 15:45:13 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\x1dp0m1x.exe
[2010/06/09 15:43:30 | 000,005,392 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\Attach.zip
[2010/06/09 15:40:06 | 000,005,274 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\Attach.rar
[2010/06/07 09:16:25 | 000,000,644 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100607_091622.reg
[2010/06/06 21:25:18 | 000,001,216 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100606_212516.reg
[2010/06/06 17:17:14 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\dds.scr
[2010/06/06 15:04:13 | 000,004,348 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100606_150411.reg
[2010/06/05 17:23:01 | 000,400,876 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Fischer12
[2010/05/28 08:57:41 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/27 16:05:45 | 000,988,713 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\PBVRegistrationchecklist.zip
[2010/05/26 00:34:04 | 000,043,520 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\Azar 14 day).doc
[2010/05/26 00:28:34 | 000,029,184 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Addendum for Azar Grievance.doc
[2010/05/25 19:08:44 | 000,035,840 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\Grievance addendum for A Wright.doc
[2010/05/25 17:50:58 | 000,044,032 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\Angie wright 14 day.doc
[2010/05/21 13:46:45 | 005,505,024 | ---- | C] () -- C:\Documents and Settings\Kellogg\ntuser.dat
[2010/05/20 06:47:20 | 000,002,858 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\EHPHASavetheDate2010.zip
[2010/05/19 13:23:32 | 000,020,063 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\WORKDAYNOTICE.zip
[2010/05/17 03:33:50 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/05/13 16:37:23 | 000,406,317 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\IMG00094-20100512-0641.jpg
[2010/05/03 16:39:10 | 000,000,938 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\Shortcut to IMG_2855copy.lnk
[2010/05/03 16:36:21 | 000,427,889 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\IMG_2842.zip
[2010/05/01 21:05:38 | 000,480,192 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Abby.zip
[2010/04/28 18:17:09 | 001,311,693 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\4-22-10.pdf
[2010/04/28 17:53:57 | 001,791,220 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\4-11-10.pdf
[2010/04/25 13:14:32 | 000,351,339 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\8977911-Mr-Brightside-The-Killers.pdf
[2010/04/25 09:35:12 | 000,031,232 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Price list for Big Letti.doc
[2010/04/22 15:47:42 | 000,021,349 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\cles_Whatare_Deemed_Salaries,intheFERSAnnuitySupplement_.pdf
[2010/04/13 15:22:15 | 000,020,623 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\gsstra1.zip
[2010/04/12 15:18:35 | 000,363,520 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\rkill.com
[2010/04/11 14:01:51 | 001,791,220 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Fischer - Progress Photos1.pdf
[2010/04/09 19:27:11 | 000,031,990 | ---- | C] () -- C:\Documents and Settings\Kellogg\Desktop\SUITPLAY.zip
[2010/04/07 22:10:20 | 000,026,624 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Reasons to consolidate Rural Route 24.doc
[2010/04/04 21:25:39 | 000,982,948 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\4-2-10.pdf
[2010/04/04 01:02:43 | 000,006,418 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\cc_20100404_000241.reg
[2010/04/03 00:45:01 | 000,003,698 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\image004.jpg
[2010/03/31 21:56:50 | 000,064,215 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\20100331
[2010/03/28 18:30:58 | 000,939,516 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\20100326 - Fischer - Progress Photos.pdf
[2010/03/28 16:53:15 | 005,103,518 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\IMG_0218.mov
[2010/03/22 07:36:09 | 001,413,717 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\3-19-10.pdf
[2010/03/19 01:10:32 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Failure to maintain even flow of mail Grievance 2010 mail count.doc
[2010/03/19 01:10:01 | 000,043,008 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Mail count 2010 hot case pull grievance.doc
[2010/03/19 00:37:29 | 000,032,256 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\Class action Grievance regarding failure to count all available mail.doc
[2010/03/19 00:35:23 | 000,043,520 | ---- | C] () -- C:\Documents and Settings\Kellogg\My Documents\MAil count 2010 flat grievence.doc
[2009/05/23 10:46:23 | 000,000,024 | RH-- | C] () -- C:\WINDOWS\WINO2SOX.DLL
[2008/12/10 18:58:57 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2008/03/31 23:06:46 | 000,010,587 | ---- | C] () -- C:\WINDOWS\System32\fupefybawe.sys
[2008/03/12 03:01:41 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2007/08/02 15:11:03 | 000,000,099 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/07/18 12:11:22 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll
[2006/12/11 14:18:33 | 000,000,121 | ---- | C] () -- C:\WINDOWS\QBdgpI.ini
[2006/12/11 14:18:33 | 000,000,045 | ---- | C] () -- C:\WINDOWS\BQINm.ini
[2006/09/06 17:06:57 | 000,000,072 | ---- | C] () -- C:\WINDOWS\sbwin.ini
[2006/08/23 23:16:38 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2006/08/15 12:21:35 | 000,000,316 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2006/08/11 18:07:16 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2006/08/09 22:16:44 | 000,003,350 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006/08/09 22:16:44 | 000,000,088 | RHS- | C] () -- C:\WINDOWS\System32\F2D6E2B635.sys
[2006/07/21 01:48:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/07/21 01:41:35 | 000,000,696 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/07/21 01:38:35 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/07/21 01:30:35 | 000,005,811 | ---- | C] () -- C:\WINDOWS\System32\CTSBMB.INI
[2006/07/21 01:10:16 | 000,004,969 | ---- | C] () -- C:\WINDOWS\System32\Sigfilt.ini
[2006/07/21 01:10:16 | 000,000,029 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2006/07/21 01:10:06 | 001,345,520 | ---- | C] () -- C:\WINDOWS\System32\CTMBHA.DLL
[2006/07/21 01:09:48 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/07/21 01:09:18 | 000,000,387 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/11/10 08:38:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2005/08/16 04:37:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 00:11:42 | 000,185,856 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2002/04/04 16:04:08 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll

========== LOP Check ==========

[2008/08/10 17:23:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\abafitaf
[2005/08/16 20:54:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DIGStream
[2010/03/16 00:03:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kaspersky SDK
[2009/01/26 13:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Musicnotes
[2008/08/12 19:32:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCPitstop
[2007/07/25 19:12:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Teleca
[2007/01/12 23:11:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/01/14 17:35:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2007/06/15 21:40:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/03/30 22:30:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2008/10/26 08:33:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2007/07/14 17:41:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\7Wonders
[2009/08/11 17:46:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Bridge Baron 19
[2010/03/15 23:56:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\CheckPoint
[2009/02/17 20:39:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/06/28 16:24:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Costco Photo Viewer US
[2008/07/26 13:41:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Feedreader
[2009/08/11 17:39:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Foxit
[2009/02/20 19:33:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\GetRightToGo
[2009/01/06 15:39:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Inspiration Software
[2006/08/16 19:25:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Leadertech
[2010/03/16 00:02:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\MailFrontier
[2008/09/03 20:43:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\SmartDraw
[2007/12/02 17:57:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Sony Setup
[2007/07/25 19:14:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Teleca
[2008/02/23 19:17:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Template
[2007/07/25 07:29:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Uniblue
[2008/10/15 12:09:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\vghd
[2007/01/12 23:11:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Viewpoint
[2007/11/09 19:55:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\Watchtower
[2006/08/13 00:07:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\WildTangent
[2008/07/08 21:31:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kellogg\Application Data\WinPatrol
[2010/06/15 01:00:00 | 000,000,354 | ---- | M] () -- C:\WINDOWS\Tasks\McDefragTask.job
[2010/05/01 01:00:00 | 000,000,356 | ---- | M] () -- C:\WINDOWS\Tasks\McQcTask.job
[2010/06/14 14:21:27 | 000,000,468 | ---- | M] () -- C:\WINDOWS\Tasks\SDMsgUpdate (TE).job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2006/09/13 06:36:07 | 000,010,920 | ---- | M] () -- C:\aolconnfix.exe


< MD5 for: AGP440.SYS >
[2004/08/10 05:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
[2004/08/10 07:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\AGP440.SYS
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\agp440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\i386\AGP440.SYS
[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/10 05:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
[2004/08/10 07:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\i386\atapi.sys
[2004/08/10 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/10 05:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\i386\eventlog.dll
[2004/08/10 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2006/04/26 08:23:52 | 000,250,880 | ---- | M] (Intel Corporation) MD5=1C77A81756D4777CCB0425AE8107FE96 -- C:\WINDOWS\dell\iastor\iastor.sys
[2005/06/17 12:33:40 | 000,872,064 | ---- | M] (Intel Corporation) MD5=9A65E42664D1534B68512CAAD0EFE963 -- C:\drivers\storage\sata\onboard\iastor.sys
[2005/06/17 12:33:40 | 000,872,064 | ---- | M] (Intel Corporation) MD5=9A65E42664D1534B68512CAAD0EFE963 -- C:\i386\iaStor.sys
[2005/06/17 12:33:40 | 000,872,064 | ---- | M] (Intel Corporation) MD5=9A65E42664D1534B68512CAAD0EFE963 -- C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netlogon.dll
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/10 05:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\i386\netlogon.dll
[2004/08/10 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATABUS.SYS >
[2006/03/16 20:51:32 | 000,099,840 | ---- | M] (NVIDIA Corporation) MD5=B7FB72492B753930EC70A0F49D04F12F -- C:\WINDOWS\dell\nvraid\NvAtaBus.sys
[2006/03/16 20:51:32 | 000,099,840 | ---- | M] (NVIDIA Corporation) MD5=B7FB72492B753930EC70A0F49D04F12F -- C:\WINDOWS\system32\drivers\NvAtaBus.sys

< MD5 for: SCECLI.DLL >
[2004/08/10 05:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\i386\scecli.dll
[2004/08/10 07:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: SYMMPI.SYS >
[2005/11/17 14:58:16 | 000,092,672 | ---- | M] (LSI Logic) MD5=1FD5249D5103125D2DA63F68D7BE1D35 -- C:\WINDOWS\dell\symmpi\symmpi.sys
[2005/11/17 14:58:16 | 000,092,672 | ---- | M] (LSI Logic) MD5=1FD5249D5103125D2DA63F68D7BE1D35 -- C:\WINDOWS\system32\drivers\symmpi.sys

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/14 05:41:52 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
[2008/12/20 19:15:12 | 000,347,136 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2008/12/20 19:15:13 | 000,214,528 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[2007/08/13 18:54:10 | 000,191,488 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll
[10 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/12/12 20:37:49 | 000,524,288 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2006/12/11 14:14:03 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav
[2006/12/12 20:37:49 | 024,903,680 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2006/12/12 20:37:49 | 004,718,592 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemdrive%\*.sys /90 /md5 >
[2010/06/14 14:21:13 | 1610,612,736 | -HS- | M] () Unable to obtain MD5 -- C:\pagefile.sys
< End of report >

OTL Extras logfile created on: 6/15/2010 7:30:41 PM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Kellogg\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 551.00 Mb Available Physical Memory | 54.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): c:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 293.16 Gb Total Space | 257.49 Gb Free Space | 87.84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KLOGZOID
Current User Name: Kellogg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{06040048-3E21-46D6-9A91-D927BA08F41D}" = Microsoft Encarta Encyclopedia Standard 2006
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{0D396571-7BBD-44CE-ABB3-518BF86B72F7}" = HP Photo and Imaging 1.0 - HP Photosmart Printer Series
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{162B71B8-8464-4680-A086-601D555B331D}" = Apple Mobile Device Support
"{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}" = Microsoft Works Suite Add-in for Microsoft Word
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer
"{4667B940-BB01-428B-986E-A0CC46497BF7}" = ELIcon
"{46C73DE4-E96D-4F7C-8371-F28052183B12}" = Sonic Advanced Decoder
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{4CEA6811-DFAD-4892-828D-49941FE3B779}" = Intel® PROSet for Wired Connections
"{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}" = Sound Blaster Audigy ADVANCED MB
"{548EEA8E-8299-497F-8057-811D2D7097DC}" = Dell Support 3.1
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79.1
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image Standard 2006 Editor
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image Standard 2006 Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE}" = EarthLink setup files
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch® Jukebox
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A9B8148-DDD7-448F-BD6C-358386D32354}" = Corel Photo Album 6
"{8C22F265-DE76-44D1-8A79-A71D819137DA}" = Intel® Quick Resume Technology Drivers
"{8D2AE3F6-79DF-423C-91CB-389F6FB5837B}" = Andrea VoiceCenter
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{903CE8F7-6C7B-41E6-A1CF-3BF1176264EC}" = Intel® Viiv™
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager
"{90840409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{91120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A683A2C0-821C-486F-858C-FA634DB5E864}" = EducateU
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6884A07-0305-47AE-9969-8F26FADC17DE}" = Games, Music, & Photos Launcher
"{C26B06A9-27BB-45B0-9873-9C623EC2BA38}" = iTunes
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade
"{DF6A589A-7A1A-430C-9FF2-A0BDB42669DC}" = Search Assist
"{E42BD75A-FC23-4E3F-9F91-2658334C644F}" = Internet Service Offers Launcher
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"America Online us" = America Online (Choose which version to remove)
"AOL Connectivity Services" = AOL Connectivity Services
"AOLCoach" = AOL Coach Version 1.0(Build:20040229.1 en)
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"ESET Online Scanner" = ESET Online Scanner v3
"ESPNMotion" = ESPNMotion
"Google Desktop" = Google Desktop
"HijackThis" = HijackThis 1.99.1
"Home Publishing" = Microsoft Greetings
"Hoyle Board Games Demo" = Hoyle Board Games Demo
"Hoyle Card Games 3" = Hoyle Card Games 3
"hphuni04" = Photosmart Printer 130,230,7150,7350,7550 (Remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Intel® Quick Resume Technology" = Intel® Quick Resume Technology Drivers
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Uninstall Utility" = McAfee Uninstaller
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"PictureItPrem_v11" = Microsoft Digital Image Standard 2006
"PROR" = Microsoft Office Professional 2007 Trial
"PROSet" = Intel® PRO Network Connections Drivers
"Sierra Utilities" = Sierra Utilities
"Sound Blaster Audigy ADVANCED MB Product Registration" = Sound Blaster Audigy ADVANCED MB Product Registration
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"StreetPlugin" = Learn2 Player (Uninstall Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"Works2006Setup" = Microsoft Works Suite 2006 Setup Launcher
"Works99Setup" = Microsoft Works Setup Launcher
"ZoneAlarm Security Suite" = ZoneAlarm Security Suite

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"SmartDraw 2009" = SmartDraw 2009

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/13/2010 11:40:42 PM | Computer Name = KLOGZOID | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/14/2010 4:04:10 AM | Computer Name = KLOGZOID | Source = Google Update | ID = 20
Description =

Error - 6/14/2010 5:04:10 AM | Computer Name = KLOGZOID | Source = Google Update | ID = 20
Description =

Error - 6/14/2010 6:04:10 AM | Computer Name = KLOGZOID | Source = Google Update | ID = 20
Description =

Error - 6/14/2010 6:31:03 AM | Computer Name = KLOGZOID | Source = Google Update | ID = 20
Description =

Error - 6/14/2010 6:35:07 AM | Computer Name = KLOGZOID | Source = Google Update | ID = 20
Description =

Error - 6/14/2010 1:46:07 PM | Computer Name = KLOGZOID | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 6/14/2010 1:46:07 PM | Computer Name = KLOGZOID | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/14/2010 2:17:42 PM | Computer Name = KLOGZOID | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/15/2010 7:02:13 AM | Computer Name = KLOGZOID | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module jscript.dll, version 5.7.0.16599, fault address 0x0001b746.

[ IntelDH Events ]
Error - 6/12/2010 2:47:31 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/12/2010 3:38:04 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/12/2010 3:42:50 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/12/2010 3:57:33 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/12/2010 11:32:09 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/13/2010 9:31:55 AM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/13/2010 5:50:56 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/14/2010 6:31:16 AM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/14/2010 6:35:20 AM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

Error - 6/14/2010 1:44:25 PM | Computer Name = KLOGZOID | Source = IntelQRTD | ID = 7
Description = Could not attach to EL Acpi driver.

[ System Events ]
Error - 6/14/2010 1:44:24 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7000
Description = The McAfee SpamKiller Server service failed to start due to the following
error: %%2

Error - 6/14/2010 1:44:27 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7023
Description = The Intel® Quick Resume Technology Drivers service terminated with
the following error: %%203

Error - 6/14/2010 2:20:42 PM | Computer Name = KLOGZOID | Source = DCOM | ID = 10010
Description = The server {9B1F122C-2982-4E91-AA8B-E071D54F2A4D} did not register
with DCOM within the required timeout.

Error - 6/14/2010 2:21:33 PM | Computer Name = KLOGZOID | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring
the volume.

Error - 6/14/2010 2:22:35 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7000
Description = The McAfee WSC Integration service failed to start due to the following
error: %%2

Error - 6/14/2010 2:22:35 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7000
Description = The McAfee.com McShield service failed to start due to the following
error: %%3

Error - 6/14/2010 2:22:35 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7000
Description = The McAfee Task Scheduler service failed to start due to the following
error: %%2

Error - 6/14/2010 2:22:35 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7000
Description = The McAfee Personal Firewall Service service failed to start due to
the following error: %%3

Error - 6/14/2010 2:22:35 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7000
Description = The McAfee SpamKiller Server service failed to start due to the following
error: %%2

Error - 6/14/2010 2:22:35 PM | Computer Name = KLOGZOID | Source = Service Control Manager | ID = 7023
Description = The Intel® Quick Resume Technology Drivers service terminated with
the following error: %%203


< End of report >




#15 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:04:22 AM

Posted 16 June 2010 - 12:47 PM

Hi,


Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This changed from what we know in 2006 read this article:

http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Click on start > run > and then paste the following into the "open" field: appwiz.cpl and press OK. From within Add or Remove Programs uninstall the following if they exist: Viewpoint, Viewpoint Manager, Viewpoint Media Player.





Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    CODE
    :OTL
    O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
    [2008/08/10 17:23:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\abafitaf
  • Then click the Run Fix button at the top
  • Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  • Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
================================Follow up scan=================================
  • Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.


How is it running?
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users