Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help, windows won't load, keeps restarting over and over


  • Please log in to reply
6 replies to this topic

#1 Rage Manager

Rage Manager

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:02 PM

Posted 14 August 2010 - 08:01 AM

***UPDATE***
I was able to find an older hard drive and access the one that would not load windows.

However, this drive is also infected with a rootkit / malware (the reason i stopped using it)

It has some version of Virtumonde, and something else infecting it. Right now it will not let me download AVG or anything that might help...

I'm not sure but i'm thinking it might be easier to fix this drive instead of the one that wont run windows.

I tried to download the dds tool, but it stopped the download and said it was blocked because of my "Security Zone Policy"
***UPDATE***


Hello, this forum has helped me out before and I'd be eternally grateful if it could do so once again

my computer is shared between me and my girlfriend. I was browsing the internet and suddenly avg starts to go nuts and starts blocking things I go to my firewall and somehow it's disabled (this could be human error, not sure)

I do a full avg scan and find only two entries. So I come here and start to get setup to post all the required logs, but as the rootkit searching program was finishing up my computer froze and I'm stuck.

My computer will now load right up to windows and then will think for a second and then will restart, and then it will repeat over and over. It won't load into safe mode or won't load into anything

Is there anything I can do?

Edited by Rage Manager, 14 August 2010 - 09:39 AM.


BC AdBot (Login to Remove)

 


#2 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:04:02 PM

Posted 21 August 2010 - 01:31 PM

Welcome to the BleepingComputer Forums.

Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again.
  1. Double click on RSIT.exe to run RSIT.
  2. Click Continue at the disclaimer screen.
  3. Please post the contents of log.txt.
Thank you for your patience.

Please see Preparation Guide for use before posting about your potential Malware problem.

If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.

Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so.

While we are working on your HijackThis log, please:
  1. Reply to this thread; do not start another!
  2. Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so.
  3. Do not run any other tool until instructed to do so!
  4. Let me know if any of the links do not work or if any of the tools do not work.
  5. Tell me about problems or symptoms that occur during the fix.
  6. Do not run any other programs or open any other windows while doing a fix.
  7. Ask any questions that you have regarding the fix(es), the infection(s), the performance of your computer, etc.
Thanks.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#3 Rage Manager

Rage Manager
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:02 PM

Posted 23 August 2010 - 07:33 AM

Hi, thanks for responding I'll be posting the logs right after I get out of work later today.

#4 Rage Manager

Rage Manager
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:02 PM

Posted 23 August 2010 - 07:27 PM


Hi, I was able to run the file you linked me to and as you requested I've posted the log of the scan below.

First a very quick update to my computer's situation. As you can imagine I need a functioning computer so I reinstalled windows over the malware infected drives and it seems to have taken care of some of the issues. However, when i run "whatsrunning" and look at the ip's coming from my machine there are multiple entries listing 007guard.com and i know that something i don't want to see. So I'm hoping you can help me clear what is left on this drive.


______________________________________________________________________
Logfile of random's system information tool 1.08 (written by random/random)
Run by Brian at 2010-08-23 19:13:40
Microsoft Windows 7 Ultimate
System drive C: has 934 GB (98%) free of 954 GB
Total RAM: 3062 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:14:22 PM, on 8/23/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Brian\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Brian.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7934 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files (x86)\AVG\AVG9\avgssie.dll [2010-08-22 1619296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~2\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll [2010-06-30 2102600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll [2010-06-30 2102600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"=C:\PROGRA~2\AVG\AVG9\avgtray.exe [2010-08-22 2065760]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uninstall Adobe Download Manager"=C:\Windows\system32\rundll32.exe [2009-07-13 44544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Logitech . Product Registration.lnk - C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\SysWOW64\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-23 19:13:45 ----D---- C:\Program Files (x86)\trend micro
2010-08-23 19:13:40 ----D---- C:\rsit
2010-08-23 19:11:14 ----D---- C:\Users\Brian\AppData\Roaming\Macromedia
2010-08-23 19:11:14 ----D---- C:\Users\Brian\AppData\Roaming\Adobe
2010-08-23 19:11:06 ----D---- C:\Windows\SysWOW64\Macromed
2010-08-23 19:09:07 ----D---- C:\ProgramData\NOS
2010-08-23 19:09:07 ----D---- C:\Program Files (x86)\NOS
2010-08-23 18:57:27 ----D---- C:\ProgramData\COMODO
2010-08-23 18:48:13 ----D---- C:\Program Files (x86)\Microsoft Works
2010-08-23 18:47:34 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2010-08-23 18:47:34 ----D---- C:\Program Files (x86)\Common Files\DESIGNER
2010-08-23 18:47:06 ----D---- C:\Windows\PCHEALTH
2010-08-23 18:47:06 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-08-23 18:45:34 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2010-08-23 18:44:40 ----D---- C:\ProgramData\Microsoft Help
2010-08-23 18:44:40 ----D---- C:\Program Files (x86)\Microsoft Office
2010-08-23 18:44:20 ----RHD---- C:\MSOCache
2010-08-22 23:05:54 ----D---- C:\Windows\SysWOW64\Wat
2010-08-22 22:56:14 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\mscoree.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\dfshim.dll
2010-08-22 22:46:33 ----A---- C:\Windows\SysWOW64\mshtml.dll
2010-08-22 22:46:33 ----A---- C:\Windows\SysWOW64\ieframe.dll
2010-08-22 22:46:32 ----A---- C:\Windows\SysWOW64\urlmon.dll
2010-08-22 22:46:32 ----A---- C:\Windows\SysWOW64\mstime.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\wininet.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\ieui.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\iepeers.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2010-08-22 22:46:30 ----A---- C:\Windows\SysWOW64\msfeedssync.exe
2010-08-22 22:46:30 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2010-08-22 22:46:22 ----A---- C:\Windows\SysWOW64\sspicli.dll
2010-08-22 22:46:22 ----A---- C:\Windows\SysWOW64\secur32.dll
2010-08-22 22:46:15 ----A---- C:\Windows\SysWOW64\wmp.dll
2010-08-22 22:46:15 ----A---- C:\Windows\SysWOW64\CertEnroll.dll
2010-08-22 22:46:10 ----A---- C:\Windows\SysWOW64\wmploc.DLL
2010-08-22 22:46:08 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2010-08-22 22:46:07 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2010-08-22 22:46:05 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2010-08-22 22:46:02 ----A---- C:\Windows\SysWOW64\psisdecd.dll
2010-08-22 22:45:55 ----A---- C:\Windows\SysWOW64\explorer.exe
2010-08-22 22:45:55 ----A---- C:\Windows\explorer.exe
2010-08-22 22:45:54 ----A---- C:\Windows\SysWOW64\secproc_isv.dll
2010-08-22 22:45:54 ----A---- C:\Windows\SysWOW64\secproc.dll
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\secproc_ssp_isv.dll
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\secproc_ssp.dll
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate_ssp.exe
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate_isv.exe
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate.exe
2010-08-22 22:45:50 ----A---- C:\Windows\SysWOW64\ntdll.dll
2010-08-22 22:45:46 ----A---- C:\Windows\SysWOW64\shell32.dll
2010-08-22 22:45:46 ----A---- C:\Windows\SysWOW64\schannel.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\tsbyuv.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\quartz.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\msyuv.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\msvidc32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\msrle32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\mciavi32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\iyuv_32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\avifil32.dll
2010-08-22 22:45:43 ----A---- C:\Windows\SysWOW64\inetcomm.dll
2010-08-22 22:45:40 ----A---- C:\Windows\SysWOW64\t2embed.dll
2010-08-22 22:45:39 ----A---- C:\Windows\SysWOW64\vbscript.dll
2010-08-22 22:45:37 ----A---- C:\Windows\SysWOW64\asycfilt.dll
2010-08-22 22:45:36 ----A---- C:\Windows\SysWOW64\setup16.exe
2010-08-22 22:45:36 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2010-08-22 22:45:35 ----A---- C:\Windows\SysWOW64\wow32.dll
2010-08-22 22:45:35 ----A---- C:\Windows\SysWOW64\user.exe
2010-08-22 22:45:35 ----A---- C:\Windows\SysWOW64\instnm.exe
2010-08-22 22:45:32 ----A---- C:\Windows\SysWOW64\rtutils.dll
2010-08-22 22:45:27 ----A---- C:\Windows\SysWOW64\msxml3.dll
2010-08-22 22:45:26 ----A---- C:\Windows\SysWOW64\msasn1.dll
2010-08-22 22:45:26 ----A---- C:\Windows\SysWOW64\iccvid.dll
2010-08-22 22:45:24 ----A---- C:\Windows\SysWOW64\fontsub.dll
2010-08-22 22:45:24 ----A---- C:\Windows\SysWOW64\atmfd.dll
2010-08-22 22:45:22 ----A---- C:\Windows\SysWOW64\atmlib.dll
2010-08-22 22:45:20 ----A---- C:\Windows\SysWOW64\jscript.dll
2010-08-22 22:45:17 ----A---- C:\Windows\SysWOW64\tzres.dll
2010-08-22 19:21:27 ----D---- C:\Users\Brian\AppData\Roaming\Malwarebytes
2010-08-22 19:21:19 ----A---- C:\Windows\SysWOW64\drivers\mbamswissarmy.sys
2010-08-22 19:21:18 ----D---- C:\ProgramData\Malwarebytes
2010-08-22 19:21:18 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-08-22 19:18:25 ----D---- C:\ProgramData\Comodo Downloader
2010-08-22 19:10:57 ----D---- C:\Program Files (x86)\WhatsRunning
2010-08-22 19:07:40 ----D---- C:\ProgramData\Logitech
2010-08-22 19:07:32 ----D---- C:\Users\Brian\AppData\Roaming\Leadertech
2010-08-22 19:07:30 ----D---- C:\Program Files (x86)\Common Files\LogiShrd
2010-08-22 19:06:17 ----D---- C:\ProgramData\Logishrd
2010-08-22 19:05:13 ----D---- C:\Users\Brian\AppData\Roaming\Logitech
2010-08-22 19:05:13 ----D---- C:\Users\Brian\AppData\Roaming\Logishrd
2010-08-22 16:39:13 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-08-22 16:39:13 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2010-08-22 16:27:15 ----D---- C:\ProgramData\TEMP
2010-08-22 16:27:07 ----A---- C:\Windows\SysWOW64\MSSTDFMT.DLL
2010-08-22 16:21:40 ----D---- C:\ProgramData\AVG Security Toolbar
2010-08-22 16:19:16 ----D---- C:\Program Files (x86)\AVG
2010-08-22 16:19:00 ----D---- C:\ProgramData\avg9
2010-08-22 16:07:56 ----D---- C:\utilties&records
2010-08-22 16:02:18 ----D---- C:\Users\Brian\AppData\Roaming\Mozilla
2010-08-22 16:02:13 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-08-22 15:49:51 ----D---- C:\Program Files (x86)\ATI
2010-08-22 15:49:50 ----D---- C:\Program Files (x86)\Common Files\ATI Technologies
2010-08-22 15:49:06 ----SHD---- C:\Windows\Installer
2010-08-22 15:48:12 ----D---- C:\ATI
2010-08-22 15:38:05 ----A---- C:\Windows\SysWOW64\wintrust.dll
2010-08-22 15:38:04 ----A---- C:\Windows\SysWOW64\cabview.dll
2010-08-22 15:36:18 ----D---- C:\Users\Brian\AppData\Roaming\Identities
2010-08-22 15:36:07 ----SD---- C:\Users\Brian\AppData\Roaming\Microsoft
2010-08-22 15:36:07 ----D---- C:\Users\Brian\AppData\Roaming\Media Center Programs
2010-08-22 15:36:01 ----SHD---- C:\Recovery
2010-08-22 15:35:59 ----D---- C:\Windows\SoftwareDistribution
2010-08-22 10:19:14 ----A---- C:\Windows\ntbtlog.txt
2010-08-22 10:09:37 ----D---- C:\Windows\Panther
2010-08-22 09:11:07 ----D---- C:\Windows\Prefetch
2010-08-22 09:10:43 ----ASH---- C:\pagefile.sys
2010-08-22 09:10:42 ----SHD---- C:\System Volume Information
2010-08-22 09:10:42 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 months======

2010-08-23 19:13:56 ----D---- C:\Windows\Temp
2010-08-23 19:13:45 ----RD---- C:\Program Files (x86)
2010-08-23 19:11:06 ----D---- C:\Windows\SysWOW64
2010-08-23 19:09:07 ----HD---- C:\ProgramData
2010-08-23 19:02:52 ----D---- C:\Windows\System32
2010-08-23 19:02:52 ----D---- C:\Windows\inf
2010-08-23 18:52:58 ----RD---- C:\Program Files
2010-08-23 18:49:23 ----RSD---- C:\Windows\assembly
2010-08-23 18:49:12 ----D---- C:\Windows\winsxs
2010-08-23 18:48:08 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2010-08-23 18:47:52 ----D---- C:\Program Files (x86)\MSBuild
2010-08-23 18:47:34 ----D---- C:\Program Files (x86)\Common Files
2010-08-23 18:47:32 ----D---- C:\Windows\ShellNew
2010-08-23 18:47:09 ----RSD---- C:\Windows\Fonts
2010-08-23 18:47:06 ----SD---- C:\ProgramData\Microsoft
2010-08-23 18:47:06 ----D---- C:\Windows
2010-08-23 18:45:10 ----D---- C:\Program Files (x86)\Common Files\System
2010-08-23 18:45:10 ----A---- C:\Windows\win.ini
2010-08-23 18:21:22 ----D---- C:\Windows\Microsoft.NET
2010-08-22 23:05:53 ----D---- C:\Program Files (x86)\Windows Media Player
2010-08-22 23:05:51 ----D---- C:\Program Files (x86)\Windows Mail
2010-08-22 23:05:50 ----D---- C:\Windows\SysWOW64\migration
2010-08-22 23:05:50 ----D---- C:\Program Files (x86)\Internet Explorer
2010-08-22 23:05:49 ----D---- C:\Windows\AppPatch
2010-08-22 23:05:40 ----D---- C:\Windows\ehome
2010-08-22 22:49:34 ----D---- C:\Windows\SysWOW64\en-US
2010-08-22 22:48:38 ----D---- C:\Windows\debug
2010-08-22 19:21:19 ----D---- C:\Windows\SysWOW64\drivers
2010-08-22 17:06:58 ----D---- C:\Windows\Logs
2010-08-22 15:36:16 ----SHD---- C:\$Recycle.Bin
2010-08-22 15:36:07 ----RD---- C:\Users
2010-08-22 13:34:31 ----D---- C:\Windows\rescache
2010-08-22 09:11:04 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AvgRkx64;avgrkx64.sys; C:\Windows\System32\Drivers\avgrkx64.sys []
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 AvgLdx64;AVG AVI Loader Driver x64; C:\Windows\System32\Drivers\avgldx64.sys []
R1 AvgMfx64;AVG On-access Scanner Minifilter Driver x64; C:\Windows\System32\Drivers\avgmfx64.sys []
R1 AvgTdiA;AVG Network Redirector x64; C:\Windows\System32\Drivers\avgtdia.sys []
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys []
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys []
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys []
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys []
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys []
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe []
R2 avg9emc;AVG E-mail Scanner; C:\Program Files (x86)\AVG\AVG9\avgemc.exe [2010-08-22 921952]
R2 avg9wd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [2010-08-22 308136]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-06-01 2348600]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-13 20992]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-13 20992]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe [2010-06-30 431432]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2010-05-06 357456]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 nosGetPlusHelper;getPlus® Helper 3004; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []

-----------------EOF-----------------


#5 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:04:02 PM

Posted 26 August 2010 - 12:57 PM

Let's try this:
Step A

Often redirection is caused by a DNS and Hosts file hijack. Flush and restore both.

Clean Hosts File
    * Access folder C:\WINDOWS\SYSTEM32\DRIVERS\ETC in Explorer.
  1. Open file HOSTS in Notepad . Before making changes, do a Save As and save a backup of this file as HOSTS.BAK .
  2. Reopen the HOSTS file.
  3. Delete all entries in this file except for the following and any other entries you are sure have legitimate uses:

    127.0.0.1 localhost
  4. Save the file.
Note: If you use customized Hosts Files such as the mvps hosts file, you will need to download and install it again. Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE.

Step B

Flush DNS:
  1. Open up a command prompt Start > Run > "cmd.exe" > OK.
  2. Type in the command ipconfig /flushdns.
Step C

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2
  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  • When prompted to run the scan, click Yes.
  • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
Step D

Prior to using this program, please back up your data:

There are several free Backup Programs. Please decide for yourself which one meets your needs. Use at your own risk. You can check out other BackUp Programs at the sites below:Step E

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.4.1.2) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.
  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • If TDSSKiller does not run, try renaming it.
  • To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  • Click the Start Scan button.
  • Do not use the computer during the scan
  • If the scan completes with nothing found, click Close to exit.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  • A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.
Please post a new HijackThis log.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#6 Rage Manager

Rage Manager
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:03:02 PM

Posted 29 August 2010 - 06:44 PM

Hi thanks for getting back to me. I've finally got the time to follow the steps you outlined and pasted the results below. I think my main issue was that the first entry in the hosts file was 007guard.com from what spybot search and destroy had put into there. I saw online some people were having similar issues, but it never hurts to be too cautious after what happened to my main drive.

GoredFixe log:
GooredFix by jpshortstuff (03.07.10.1)
Log created at 18:31 on 29/08/2010 (Administrator)
Firefox version 3.6.8 (en-US)

========== GooredScan ==========

(none)

========== GooredLog ==========

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [23:02 22/08/2010]

C:\Users\Administrator\Application Data\Mozilla\Firefox\Profiles\bbzaueif.default\extensions\
(none)

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files (x86)\AVG\AVG9\Firefox" [23:20 22/08/2010]
"avg@igeared"="C:\Program Files (x86)\AVG\AVG9\Toolbar\Firefox\avg@igeared" [23:21 22/08/2010]

---------- Old Logs ----------
GooredFix[01.30.54_30-08-2010].txt

-=E.O.F=-



TDSS log:
2010/08/29 18:33:32.0080 TDSS rootkit removing tool 2.4.1.3 Aug 27 2010 08:53:42
2010/08/29 18:33:32.0080 ================================================================================
2010/08/29 18:33:32.0080 SystemInfo:
2010/08/29 18:33:32.0080
2010/08/29 18:33:32.0080 OS Version: 6.1.7600 ServicePack: 0.0
2010/08/29 18:33:32.0080 Product type: Workstation
2010/08/29 18:33:32.0080 ComputerName: BRIAN-PC
2010/08/29 18:33:32.0081 UserName: Administrator
2010/08/29 18:33:32.0081 Windows directory: C:\Windows
2010/08/29 18:33:32.0081 System windows directory: C:\Windows
2010/08/29 18:33:32.0081 Running under WOW64
2010/08/29 18:33:32.0081 Processor architecture: Intel x64
2010/08/29 18:33:32.0081 Number of processors: 8
2010/08/29 18:33:32.0081 Page size: 0x1000
2010/08/29 18:33:32.0081 Boot type: Normal boot
2010/08/29 18:33:32.0081 ================================================================================
2010/08/29 18:33:32.0081 Utility is running under WOW64, functionality is limited.
2010/08/29 18:33:32.0689 Initialize success
2010/08/29 18:33:37.0254 ================================================================================
2010/08/29 18:33:37.0254 Scan started
2010/08/29 18:33:37.0254 Mode: Manual;
2010/08/29 18:33:37.0254 ================================================================================
2010/08/29 18:33:37.0508 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
2010/08/29 18:33:37.0531 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
2010/08/29 18:33:37.0552 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2010/08/29 18:33:37.0584 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2010/08/29 18:33:37.0607 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2010/08/29 18:33:37.0626 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2010/08/29 18:33:37.0668 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2010/08/29 18:33:37.0832 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2010/08/29 18:33:37.0868 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2010/08/29 18:33:37.0919 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2010/08/29 18:33:37.0961 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2010/08/29 18:33:38.0099 amdkmdag (3d07f9c090c7a1d76d624972a5384471) C:\Windows\system32\DRIVERS\atikmdag.sys
2010/08/29 18:33:38.0250 amdkmdap (99ab7e4b24c80155dc4296f657faf3c7) C:\Windows\system32\DRIVERS\atikmpag.sys
2010/08/29 18:33:38.0267 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2010/08/29 18:33:38.0285 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys
2010/08/29 18:33:38.0302 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2010/08/29 18:33:38.0326 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys
2010/08/29 18:33:38.0354 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2010/08/29 18:33:38.0400 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2010/08/29 18:33:38.0417 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2010/08/29 18:33:38.0459 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/08/29 18:33:38.0477 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2010/08/29 18:33:38.0612 atikmdag (3d07f9c090c7a1d76d624972a5384471) C:\Windows\system32\DRIVERS\atikmdag.sys
2010/08/29 18:33:38.0717 AvgLdx64 (b447db072bf939db9e07bef2adf4ecbd) C:\Windows\system32\Drivers\avgldx64.sys
2010/08/29 18:33:38.0739 AvgMfx64 (405baabbb48f9176e220020b1a77c47b) C:\Windows\system32\Drivers\avgmfx64.sys
2010/08/29 18:33:38.0763 AvgRkx64 (5e7f0f9cbe0f7823371a4d51df29f7ff) C:\Windows\system32\Drivers\avgrkx64.sys
2010/08/29 18:33:38.0789 AvgTdiA (ce90aec358a809e7bce6bb0f1da84622) C:\Windows\system32\Drivers\avgtdia.sys
2010/08/29 18:33:38.0842 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2010/08/29 18:33:38.0871 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2010/08/29 18:33:38.0917 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2010/08/29 18:33:38.0994 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2010/08/29 18:33:39.0021 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys
2010/08/29 18:33:39.0041 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2010/08/29 18:33:39.0060 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2010/08/29 18:33:39.0088 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2010/08/29 18:33:39.0106 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2010/08/29 18:33:39.0123 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2010/08/29 18:33:39.0140 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2010/08/29 18:33:39.0158 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2010/08/29 18:33:39.0196 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/08/29 18:33:39.0222 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2010/08/29 18:33:39.0248 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2010/08/29 18:33:39.0286 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2010/08/29 18:33:39.0326 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2010/08/29 18:33:39.0400 cmdGuard (82a2bb05e25dc7c4f591ec7cc040f728) C:\Windows\system32\DRIVERS\cmdguard.sys
2010/08/29 18:33:39.0437 cmdHlp (332179e46d2aa3e79fe2fcbca272267f) C:\Windows\system32\DRIVERS\cmdhlp.sys
2010/08/29 18:33:39.0460 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2010/08/29 18:33:39.0488 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2010/08/29 18:33:39.0510 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2010/08/29 18:33:39.0535 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2010/08/29 18:33:39.0560 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2010/08/29 18:33:39.0620 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys
2010/08/29 18:33:39.0679 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2010/08/29 18:33:39.0712 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2010/08/29 18:33:39.0741 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2010/08/29 18:33:39.0809 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2010/08/29 18:33:39.0873 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys
2010/08/29 18:33:39.0952 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2010/08/29 18:33:40.0065 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2010/08/29 18:33:40.0096 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2010/08/29 18:33:40.0141 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2010/08/29 18:33:40.0172 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2010/08/29 18:33:40.0207 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2010/08/29 18:33:40.0252 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2010/08/29 18:33:40.0272 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2010/08/29 18:33:40.0291 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/08/29 18:33:40.0325 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2010/08/29 18:33:40.0368 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2010/08/29 18:33:40.0393 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2010/08/29 18:33:40.0417 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2010/08/29 18:33:40.0437 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2010/08/29 18:33:40.0470 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2010/08/29 18:33:40.0514 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2010/08/29 18:33:40.0545 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/08/29 18:33:40.0564 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2010/08/29 18:33:40.0583 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2010/08/29 18:33:40.0602 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2010/08/29 18:33:40.0646 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2010/08/29 18:33:40.0690 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2010/08/29 18:33:40.0720 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2010/08/29 18:33:40.0749 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2010/08/29 18:33:40.0772 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/08/29 18:33:40.0792 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
2010/08/29 18:33:40.0826 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2010/08/29 18:33:40.0888 inspect (08069a7784fc040f343f8767c4e359f9) C:\Windows\system32\DRIVERS\inspect.sys
2010/08/29 18:33:40.0912 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2010/08/29 18:33:40.0935 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2010/08/29 18:33:40.0975 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/08/29 18:33:41.0003 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2010/08/29 18:33:41.0025 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2010/08/29 18:33:41.0044 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2010/08/29 18:33:41.0062 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2010/08/29 18:33:41.0088 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/08/29 18:33:41.0107 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/08/29 18:33:41.0137 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/08/29 18:33:41.0170 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2010/08/29 18:33:41.0232 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2010/08/29 18:33:41.0264 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2010/08/29 18:33:41.0347 LHidFilt (0a7d6ed578d85f0c35353424ee3f5245) C:\Windows\system32\DRIVERS\LHidFilt.Sys
2010/08/29 18:33:41.0382 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2010/08/29 18:33:41.0427 LMouFilt (6542e2e6db58118fbb1b82a68ce3aff9) C:\Windows\system32\DRIVERS\LMouFilt.Sys
2010/08/29 18:33:41.0455 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2010/08/29 18:33:41.0475 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2010/08/29 18:33:41.0496 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2010/08/29 18:33:41.0515 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2010/08/29 18:33:41.0535 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2010/08/29 18:33:41.0573 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2010/08/29 18:33:41.0595 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2010/08/29 18:33:41.0639 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2010/08/29 18:33:41.0670 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2010/08/29 18:33:41.0693 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2010/08/29 18:33:41.0720 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2010/08/29 18:33:41.0753 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2010/08/29 18:33:41.0782 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2010/08/29 18:33:41.0809 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2010/08/29 18:33:41.0849 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2010/08/29 18:33:41.0899 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/08/29 18:33:41.0927 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/08/29 18:33:41.0979 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/08/29 18:33:42.0014 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
2010/08/29 18:33:42.0043 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2010/08/29 18:33:42.0098 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2010/08/29 18:33:42.0120 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2010/08/29 18:33:42.0143 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2010/08/29 18:33:42.0190 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2010/08/29 18:33:42.0207 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/08/29 18:33:42.0224 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2010/08/29 18:33:42.0256 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2010/08/29 18:33:42.0282 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/08/29 18:33:42.0303 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2010/08/29 18:33:42.0320 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2010/08/29 18:33:42.0347 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2010/08/29 18:33:42.0408 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2010/08/29 18:33:42.0441 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2010/08/29 18:33:42.0475 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2010/08/29 18:33:42.0509 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2010/08/29 18:33:42.0532 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2010/08/29 18:33:42.0562 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2010/08/29 18:33:42.0582 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2010/08/29 18:33:42.0598 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2010/08/29 18:33:42.0620 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2010/08/29 18:33:42.0678 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2010/08/29 18:33:42.0712 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2010/08/29 18:33:42.0748 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2010/08/29 18:33:42.0789 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys
2010/08/29 18:33:42.0851 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2010/08/29 18:33:42.0958 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
2010/08/29 18:33:43.0000 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
2010/08/29 18:33:43.0029 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2010/08/29 18:33:43.0063 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2010/08/29 18:33:43.0121 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2010/08/29 18:33:43.0146 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2010/08/29 18:33:43.0179 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2010/08/29 18:33:43.0199 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2010/08/29 18:33:43.0217 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2010/08/29 18:33:43.0238 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2010/08/29 18:33:43.0266 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2010/08/29 18:33:43.0394 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2010/08/29 18:33:43.0420 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2010/08/29 18:33:43.0469 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2010/08/29 18:33:43.0500 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2010/08/29 18:33:43.0528 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2010/08/29 18:33:43.0559 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2010/08/29 18:33:43.0576 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2010/08/29 18:33:43.0606 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2010/08/29 18:33:43.0632 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2010/08/29 18:33:43.0661 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2010/08/29 18:33:43.0678 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2010/08/29 18:33:43.0710 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2010/08/29 18:33:43.0730 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2010/08/29 18:33:43.0754 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/08/29 18:33:43.0783 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys
2010/08/29 18:33:43.0821 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2010/08/29 18:33:43.0843 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2010/08/29 18:33:43.0863 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2010/08/29 18:33:43.0882 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2010/08/29 18:33:43.0957 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2010/08/29 18:33:43.0995 RTL8167 (baefee35d27a5440d35092ce10267bec) C:\Windows\system32\DRIVERS\Rt64win7.sys
2010/08/29 18:33:44.0034 s3cap (88af6e02ab19df7fd07ecdf9c91e9af6) C:\Windows\system32\DRIVERS\vms3cap.sys
2010/08/29 18:33:44.0083 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2010/08/29 18:33:44.0132 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2010/08/29 18:33:44.0183 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2010/08/29 18:33:44.0230 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2010/08/29 18:33:44.0256 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2010/08/29 18:33:44.0283 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2010/08/29 18:33:44.0320 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
2010/08/29 18:33:44.0337 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2010/08/29 18:33:44.0355 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys
2010/08/29 18:33:44.0373 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2010/08/29 18:33:44.0431 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2010/08/29 18:33:44.0453 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2010/08/29 18:33:44.0470 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2010/08/29 18:33:44.0505 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2010/08/29 18:33:44.0599 srv (43067a65522eaec33d31a12d6fa8e3f4) C:\Windows\system32\DRIVERS\srv.sys
2010/08/29 18:33:44.0673 srv2 (03715cf9c30b563da35fc5f2b8f7b8e0) C:\Windows\system32\DRIVERS\srv2.sys
2010/08/29 18:33:44.0746 srvnet (fbd09635227a8026c0f7790f604343c6) C:\Windows\system32\DRIVERS\srvnet.sys
2010/08/29 18:33:44.0794 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2010/08/29 18:33:44.0838 storflt (ffd7a6f15b14234b5b0e5d49e7961895) C:\Windows\system32\DRIVERS\vmstorfl.sys
2010/08/29 18:33:44.0868 storvsc (8fccbefc5c440b3c23454656e551b09a) C:\Windows\system32\DRIVERS\storvsc.sys
2010/08/29 18:33:44.0893 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2010/08/29 18:33:45.0039 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2010/08/29 18:33:45.0109 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2010/08/29 18:33:45.0157 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2010/08/29 18:33:45.0190 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2010/08/29 18:33:45.0208 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2010/08/29 18:33:45.0233 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2010/08/29 18:33:45.0260 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2010/08/29 18:33:45.0328 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2010/08/29 18:33:45.0358 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2010/08/29 18:33:45.0378 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2010/08/29 18:33:45.0403 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
2010/08/29 18:33:45.0437 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2010/08/29 18:33:45.0463 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2010/08/29 18:33:45.0486 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2010/08/29 18:33:45.0526 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/08/29 18:33:45.0551 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2010/08/29 18:33:45.0568 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys
2010/08/29 18:33:45.0587 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys
2010/08/29 18:33:45.0605 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
2010/08/29 18:33:45.0627 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2010/08/29 18:33:45.0654 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/08/29 18:33:45.0677 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/08/29 18:33:45.0712 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2010/08/29 18:33:45.0739 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/08/29 18:33:45.0766 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2010/08/29 18:33:45.0799 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2010/08/29 18:33:45.0824 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2010/08/29 18:33:45.0866 vmbus (1501699d7eda984abc4155a7da5738d1) C:\Windows\system32\DRIVERS\vmbus.sys
2010/08/29 18:33:45.0886 VMBusHID (ae10c35761889e65a6f7176937c5592c) C:\Windows\system32\DRIVERS\VMBusHID.sys
2010/08/29 18:33:45.0914 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2010/08/29 18:33:45.0935 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2010/08/29 18:33:45.0956 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2010/08/29 18:33:45.0975 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2010/08/29 18:33:46.0003 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2010/08/29 18:33:46.0036 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2010/08/29 18:33:46.0071 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/29 18:33:46.0084 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/29 18:33:46.0162 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2010/08/29 18:33:46.0208 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2010/08/29 18:33:46.0294 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2010/08/29 18:33:46.0328 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2010/08/29 18:33:46.0411 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/08/29 18:33:46.0467 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2010/08/29 18:33:46.0520 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
2010/08/29 18:33:46.0538 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/08/29 18:33:46.0597 ================================================================================
2010/08/29 18:33:46.0597 Scan finished
2010/08/29 18:33:46.0597 ================================================================================
2010/08/29 18:33:53.0498 Deinitialize success




And finally the HijackThis log:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2010-08-29 18:43:09
Microsoft Windows 7 Ultimate
System drive C: has 931 GB (98%) free of 954 GB
Total RAM: 3062 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:43:32 PM, on 8/29/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Administrator\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~2\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2218506072-817491633-4073936350-1000\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (User 'Brian')
O4 - S-1-5-21-2218506072-817491633-4073936350-1000 Startup: Logitech . Product Registration.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (User 'Brian')
O4 - S-1-5-21-2218506072-817491633-4073936350-1000 User Startup: Logitech . Product Registration.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (User 'Brian')
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7782 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files (x86)\AVG\AVG9\avgssie.dll [2010-08-22 1619296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~2\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll [2010-06-30 2102600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files (x86)\AVG\AVG9\Toolbar\IEToolbar.dll [2010-06-30 2102600]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG9_TRAY"=C:\PROGRA~2\AVG\AVG9\avgtray.exe [2010-08-22 2065760]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\Windows\SysWOW64\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-29 18:33:32 ----A---- C:\TDSSKiller.2.4.1.3_29.08.2010_18.33.32_log.txt
2010-08-29 18:24:01 ----D---- C:\Users\Administrator\AppData\Roaming\Macromedia
2010-08-29 18:24:01 ----D---- C:\Users\Administrator\AppData\Roaming\Adobe
2010-08-29 18:23:38 ----D---- C:\Users\Administrator\AppData\Roaming\Mozilla
2010-08-29 18:23:30 ----D---- C:\Users\Administrator\AppData\Roaming\Logitech
2010-08-29 18:23:15 ----D---- C:\Users\Administrator\AppData\Roaming\Identities
2010-08-29 18:23:03 ----SD---- C:\Users\Administrator\AppData\Roaming\Microsoft
2010-08-29 18:23:03 ----D---- C:\Users\Administrator\AppData\Roaming\Media Center Programs
2010-08-24 15:02:44 ----HD---- C:\$AVG
2010-08-24 12:40:55 ----A---- C:\Windows\SysWOW64\oleaut32.dll
2010-08-23 19:13:45 ----D---- C:\Program Files (x86)\trend micro
2010-08-23 19:13:40 ----D---- C:\rsit
2010-08-23 19:11:06 ----D---- C:\Windows\SysWOW64\Macromed
2010-08-23 18:57:27 ----D---- C:\ProgramData\COMODO
2010-08-23 18:48:13 ----D---- C:\Program Files (x86)\Microsoft Works
2010-08-23 18:47:34 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2010-08-23 18:47:34 ----D---- C:\Program Files (x86)\Common Files\DESIGNER
2010-08-23 18:47:06 ----D---- C:\Windows\PCHEALTH
2010-08-23 18:47:06 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-08-23 18:45:34 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2010-08-23 18:44:40 ----D---- C:\ProgramData\Microsoft Help
2010-08-23 18:44:40 ----D---- C:\Program Files (x86)\Microsoft Office
2010-08-23 18:44:20 ----RHD---- C:\MSOCache
2010-08-22 23:05:54 ----D---- C:\Windows\SysWOW64\Wat
2010-08-22 22:56:14 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\mscoree.dll
2010-08-22 22:52:04 ----A---- C:\Windows\SysWOW64\dfshim.dll
2010-08-22 22:46:33 ----A---- C:\Windows\SysWOW64\mshtml.dll
2010-08-22 22:46:33 ----A---- C:\Windows\SysWOW64\ieframe.dll
2010-08-22 22:46:32 ----A---- C:\Windows\SysWOW64\urlmon.dll
2010-08-22 22:46:32 ----A---- C:\Windows\SysWOW64\mstime.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\wininet.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\ieui.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\iepeers.dll
2010-08-22 22:46:31 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2010-08-22 22:46:30 ----A---- C:\Windows\SysWOW64\msfeedssync.exe
2010-08-22 22:46:30 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2010-08-22 22:46:22 ----A---- C:\Windows\SysWOW64\sspicli.dll
2010-08-22 22:46:22 ----A---- C:\Windows\SysWOW64\secur32.dll
2010-08-22 22:46:15 ----A---- C:\Windows\SysWOW64\wmp.dll
2010-08-22 22:46:15 ----A---- C:\Windows\SysWOW64\CertEnroll.dll
2010-08-22 22:46:10 ----A---- C:\Windows\SysWOW64\wmploc.DLL
2010-08-22 22:46:08 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2010-08-22 22:46:07 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2010-08-22 22:46:05 ----A---- C:\Windows\SysWOW64\CPFilters.dll
2010-08-22 22:46:02 ----A---- C:\Windows\SysWOW64\psisdecd.dll
2010-08-22 22:45:55 ----A---- C:\Windows\SysWOW64\explorer.exe
2010-08-22 22:45:55 ----A---- C:\Windows\explorer.exe
2010-08-22 22:45:54 ----A---- C:\Windows\SysWOW64\secproc_isv.dll
2010-08-22 22:45:54 ----A---- C:\Windows\SysWOW64\secproc.dll
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\secproc_ssp_isv.dll
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\secproc_ssp.dll
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate_ssp.exe
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate_isv.exe
2010-08-22 22:45:53 ----A---- C:\Windows\SysWOW64\RMActivate.exe
2010-08-22 22:45:50 ----A---- C:\Windows\SysWOW64\ntdll.dll
2010-08-22 22:45:46 ----A---- C:\Windows\SysWOW64\shell32.dll
2010-08-22 22:45:46 ----A---- C:\Windows\SysWOW64\schannel.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\tsbyuv.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\quartz.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\msyuv.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\msvidc32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\msrle32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\mciavi32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\iyuv_32.dll
2010-08-22 22:45:44 ----A---- C:\Windows\SysWOW64\avifil32.dll
2010-08-22 22:45:43 ----A---- C:\Windows\SysWOW64\inetcomm.dll
2010-08-22 22:45:40 ----A---- C:\Windows\SysWOW64\t2embed.dll
2010-08-22 22:45:39 ----A---- C:\Windows\SysWOW64\vbscript.dll
2010-08-22 22:45:37 ----A---- C:\Windows\SysWOW64\asycfilt.dll
2010-08-22 22:45:36 ----A---- C:\Windows\SysWOW64\setup16.exe
2010-08-22 22:45:36 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2010-08-22 22:45:35 ----A---- C:\Windows\SysWOW64\wow32.dll
2010-08-22 22:45:35 ----A---- C:\Windows\SysWOW64\user.exe
2010-08-22 22:45:35 ----A---- C:\Windows\SysWOW64\instnm.exe
2010-08-22 22:45:32 ----A---- C:\Windows\SysWOW64\rtutils.dll
2010-08-22 22:45:27 ----A---- C:\Windows\SysWOW64\msxml3.dll
2010-08-22 22:45:26 ----A---- C:\Windows\SysWOW64\msasn1.dll
2010-08-22 22:45:26 ----A---- C:\Windows\SysWOW64\iccvid.dll
2010-08-22 22:45:24 ----A---- C:\Windows\SysWOW64\fontsub.dll
2010-08-22 22:45:24 ----A---- C:\Windows\SysWOW64\atmfd.dll
2010-08-22 22:45:22 ----A---- C:\Windows\SysWOW64\atmlib.dll
2010-08-22 22:45:20 ----A---- C:\Windows\SysWOW64\jscript.dll
2010-08-22 22:45:17 ----A---- C:\Windows\SysWOW64\tzres.dll
2010-08-22 19:21:19 ----A---- C:\Windows\SysWOW64\drivers\mbamswissarmy.sys
2010-08-22 19:21:18 ----D---- C:\ProgramData\Malwarebytes
2010-08-22 19:21:18 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-08-22 19:18:25 ----D---- C:\ProgramData\Comodo Downloader
2010-08-22 19:10:57 ----D---- C:\Program Files (x86)\WhatsRunning
2010-08-22 19:07:40 ----D---- C:\ProgramData\Logitech
2010-08-22 19:07:30 ----D---- C:\Program Files (x86)\Common Files\LogiShrd
2010-08-22 19:06:17 ----D---- C:\ProgramData\Logishrd
2010-08-22 16:39:13 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-08-22 16:39:13 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2010-08-22 16:27:15 ----D---- C:\ProgramData\TEMP
2010-08-22 16:27:07 ----A---- C:\Windows\SysWOW64\MSSTDFMT.DLL
2010-08-22 16:21:40 ----D---- C:\ProgramData\AVG Security Toolbar
2010-08-22 16:19:16 ----D---- C:\Program Files (x86)\AVG
2010-08-22 16:19:00 ----D---- C:\ProgramData\avg9
2010-08-22 16:07:56 ----D---- C:\utilties&records
2010-08-22 16:02:13 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-08-22 15:49:51 ----D---- C:\Program Files (x86)\ATI
2010-08-22 15:49:50 ----D---- C:\Program Files (x86)\Common Files\ATI Technologies
2010-08-22 15:49:06 ----SHD---- C:\Windows\Installer
2010-08-22 15:48:12 ----D---- C:\ATI
2010-08-22 15:38:05 ----A---- C:\Windows\SysWOW64\wintrust.dll
2010-08-22 15:38:04 ----A---- C:\Windows\SysWOW64\cabview.dll
2010-08-22 15:36:01 ----SHD---- C:\Recovery
2010-08-22 15:35:59 ----D---- C:\Windows\SoftwareDistribution
2010-08-22 10:19:14 ----A---- C:\Windows\ntbtlog.txt
2010-08-22 10:09:37 ----D---- C:\Windows\Panther
2010-08-22 09:11:07 ----D---- C:\Windows\Prefetch
2010-08-22 09:10:43 ----ASH---- C:\pagefile.sys
2010-08-22 09:10:42 ----SHD---- C:\System Volume Information
2010-08-22 09:10:42 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 months======

2010-08-29 18:43:26 ----D---- C:\Windows\Temp
2010-08-29 18:23:39 ----D---- C:\Windows
2010-08-29 18:23:12 ----SHD---- C:\$Recycle.Bin
2010-08-29 18:23:03 ----RD---- C:\Users
2010-08-29 18:21:49 ----D---- C:\Windows\System32
2010-08-29 18:21:49 ----D---- C:\Windows\inf
2010-08-29 18:20:58 ----SD---- C:\ProgramData\Microsoft
2010-08-25 03:18:21 ----D---- C:\Windows\winsxs
2010-08-25 03:16:44 ----D---- C:\Windows\SysWOW64
2010-08-25 03:00:57 ----D---- C:\Windows\AppPatch
2010-08-24 08:04:23 ----D---- C:\Windows\rescache
2010-08-24 07:38:33 ----D---- C:\Windows\Microsoft.NET
2010-08-24 07:38:26 ----RSD---- C:\Windows\assembly
2010-08-24 07:23:36 ----RD---- C:\Program Files (x86)
2010-08-24 07:23:36 ----HD---- C:\ProgramData
2010-08-23 18:52:58 ----RD---- C:\Program Files
2010-08-23 18:48:08 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2010-08-23 18:47:52 ----D---- C:\Program Files (x86)\MSBuild
2010-08-23 18:47:34 ----D---- C:\Program Files (x86)\Common Files
2010-08-23 18:47:32 ----D---- C:\Windows\ShellNew
2010-08-23 18:47:09 ----RSD---- C:\Windows\Fonts
2010-08-23 18:45:10 ----D---- C:\Program Files (x86)\Common Files\System
2010-08-23 18:45:10 ----A---- C:\Windows\win.ini
2010-08-22 23:05:53 ----D---- C:\Program Files (x86)\Windows Media Player
2010-08-22 23:05:51 ----D---- C:\Program Files (x86)\Windows Mail
2010-08-22 23:05:50 ----D---- C:\Windows\SysWOW64\migration
2010-08-22 23:05:50 ----D---- C:\Program Files (x86)\Internet Explorer
2010-08-22 23:05:40 ----D---- C:\Windows\ehome
2010-08-22 22:49:34 ----D---- C:\Windows\SysWOW64\en-US
2010-08-22 22:48:38 ----D---- C:\Windows\debug
2010-08-22 19:21:19 ----D---- C:\Windows\SysWOW64\drivers
2010-08-22 17:06:58 ----D---- C:\Windows\Logs
2010-08-22 09:11:04 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AvgRkx64;avgrkx64.sys; C:\Windows\System32\Drivers\avgrkx64.sys []
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 AvgLdx64;AVG AVI Loader Driver x64; C:\Windows\System32\Drivers\avgldx64.sys []
R1 AvgMfx64;AVG On-access Scanner Minifilter Driver x64; C:\Windows\System32\Drivers\avgmfx64.sys []
R1 AvgTdiA;AVG Network Redirector x64; C:\Windows\System32\Drivers\avgtdia.sys []
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys []
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys []
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys []
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys []
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys []
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys []
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys []
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys []
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys []
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys []
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe []
R2 avg9emc;AVG E-mail Scanner; C:\Program Files (x86)\AVG\AVG9\avgemc.exe [2010-08-22 921952]
R2 avg9wd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [2010-08-22 308136]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-06-01 2348600]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-13 20992]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-13 20992]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG9\Toolbar\ToolbarBroker.exe [2010-06-30 431432]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2010-05-06 357456]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []

-----------------EOF-----------------


Its looking like things are pretty clear, so i'm tentitvely optimistic, please let me know if you feel like any additional action is required.

Thanks!


#7 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:04:02 PM

Posted 30 August 2010 - 05:43 PM

Do you have Comodo Internet Security installed? If you do, you need to uninstall AVG9 since Comodo Internet Security includes a antivirus program.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users