Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus creates Hidden partition on Hard Drive


  • This topic is locked This topic is locked
26 replies to this topic

#16 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 13 September 2010 - 06:11 PM

Hello, aaronkuj.

I was going to ask you the same quesiton...how are things running on your end. Looking OK here, but symptoms are more important to konw than logs sometimes as things can be hidden.

Don't forget to post the Kapersky log.



Step 1

We need run an OTL Script
  1. Please download OTL from one of the following mirrors if you do not still have it.
  2. Save it to your desktop.
  3. Double click on the icon on your desktop.
  4. Paste the following code under the Custom Scans/Fixes box at the bottom. Do not include the word "Code".
    CODE
    :OTL
    SRV - File not found [Disabled | Stopped] -- C:\Program Files\Norton AntiVirus\navapsvc.exe -- (navapsvc)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O3 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/customize/...rch/search.html
    @Alternate Data Stream - 9237 bytes -> C:\WINDOWS\~GLH0002.TMP:kfrzpx
    @Alternate Data Stream - 7471 bytes -> C:\WINDOWS\smscfg.ini:gjsvmp
    @Alternate Data Stream - 7471 bytes -> C:\WINDOWS\mozver.dat:cldvzt
    @Alternate Data Stream - 7471 bytes -> C:\WINDOWS\_DEFAULT.PIF:phsyaz
    @Alternate Data Stream - 7471 bytes -> C:\WINDOWS\_DEFAULT.PIF:esmwdo
    @Alternate Data Stream - 7423 bytes -> C:\WINDOWS\_DEFAULT.PIF:zqzbbo
    @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C39E55C5
    @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
    @Alternate Data Stream - 11736 bytes -> C:\WINDOWS\WINNT.BMP:ufmtxj
    @Alternate Data Stream - 11736 bytes -> C:\WINDOWS\~GLH0002.TMP:seyunu
    @Alternate Data Stream - 11736 bytes -> C:\WINDOWS\_DEFAULT.PIF:wgztgw
    @Alternate Data Stream - 11736 bytes -> C:\WINDOWS\_DEFAULT.PIF:lstrje
    @Alternate Data Stream - 11736 bytes -> C:\WINDOWS\_DEFAULT.PIF:hpoohm
    @Alternate Data Stream - 11152 bytes -> C:\WINDOWS\TSC.ini:swsoge
    @Alternate Data Stream - 11152 bytes -> C:\WINDOWS\popcinfo.dat:cyszmi
    @Alternate Data Stream - 11152 bytes -> C:\WINDOWS\~GLH0002.TMP:mgzhdy
    @Alternate Data Stream - 11152 bytes -> C:\WINDOWS\~GLH0002.TMP:atdkqb
  5. Click the Run Fix button at the top.
  6. let the program run unhindered and reboot when it is done.
  7. You will get a log when it is done, please post that in your reply.
  8. Please then create a new OTL report....
  9. Click the "Scan All Users" checkbox.
  10. Push the button.
  11. A report will open, copy and paste it in a reply here.



Step 2

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


BC AdBot (Login to Remove)

 


#17 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 18 September 2010 - 06:08 AM

still there?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#18 aaronkuj

aaronkuj
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:12:40 AM

Posted 20 September 2010 - 01:06 PM

Yeah, I was looking for a week and didnt see that this topic moved to a second page....eesshh...will post.

#19 aaronkuj

aaronkuj
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:12:40 AM

Posted 20 September 2010 - 02:32 PM

OTL logfile created on: 9/20/2010 11:37:14 AM - Run 7
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Documents and Settings\Adminstrator\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 554.00 Mb Available Physical Memory | 55.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): E:\pagefile.sys 1522 1522 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 51.96 Gb Free Space | 69.78% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 298.09 Gb Total Space | 207.24 Gb Free Space | 69.52% Space Free | Partition Type: NTFS
Drive F: | 23.50 Mb Total Space | 19.52 Mb Free Space | 83.05% Space Free | Partition Type: NTFS
Drive G: | 7.81 Mb Total Space | 3.83 Mb Free Space | 49.06% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KUJPROD
Current User Name: Adminstrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/09/13 11:04:21 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Adminstrator\Desktop\OTL.exe
PRC - [2010/06/30 16:46:16 | 001,652,736 | R--- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe
PRC - [2010/06/09 05:34:17 | 000,116,104 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2010/06/09 05:33:48 | 000,378,248 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardian.exe
PRC - [2010/05/14 15:06:30 | 000,406,848 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
PRC - [2010/04/30 13:47:30 | 000,136,448 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
PRC - [2010/03/30 11:16:12 | 001,107,336 | ---- | M] (LogMeIn Inc.) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
PRC - [2009/12/07 00:19:00 | 001,590,216 | ---- | M] (UltraVNC) -- C:\Program Files\UltraVNC\winvnc.exe
PRC - [2009/09/10 15:21:52 | 000,322,048 | ---- | M] () -- C:\Program Files\XDS\BIN\winxftp.exe
PRC - [2008/08/11 13:41:00 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2008/08/11 13:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2008/07/03 12:21:54 | 001,404,928 | ---- | M] (International Datacasting Corporation) -- C:\Program Files\Datacast\XD_Client\XD_Agent.exe
PRC - [2008/07/03 12:21:54 | 000,024,576 | ---- | M] (International Datacasting Corporation) -- C:\Program Files\Datacast\XD_Client\XDSysAgent.exe
PRC - [2008/07/03 12:15:08 | 000,356,352 | ---- | M] (International Datacasting Corporation.) -- C:\Program Files\Datacast\XD_Client\Retriever.exe
PRC - [2008/07/03 12:13:32 | 000,405,504 | ---- | M] (International Datacasting Corporation.) -- C:\Program Files\Datacast\XD_Client\DataMan.exe
PRC - [2008/07/03 12:09:12 | 000,589,824 | ---- | M] ( ) -- C:\Program Files\Datacast\XD_Client\IPCap.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/17 14:57:12 | 000,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\RDS Online Backup Manager\jvm\bin\SchedulerOBM.exe
PRC - [2008/01/17 14:57:12 | 000,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\RDS Online Backup Manager\aua\jvm\bin\AuaObmJW.exe
PRC - [2008/01/17 14:56:16 | 000,270,336 | ---- | M] () -- C:\Program Files\RDS Online Backup Manager\bin\SystemTray.exe
PRC - [2008/01/17 14:56:16 | 000,061,440 | ---- | M] () -- C:\Program Files\RDS Online Backup Manager\aua\bin\AuaObm.exe
PRC - [2008/01/17 14:56:16 | 000,049,152 | ---- | M] () -- C:\Program Files\RDS Online Backup Manager\bin\Scheduler.exe
PRC - [2008/01/02 14:16:26 | 000,036,864 | ---- | M] (CMS Products™, Inc.) -- C:\Program Files\CMS Products\BounceBack Express\BBWatcherService.exe
PRC - [2004/10/14 15:42:54 | 001,404,928 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2004/08/03 15:09:12 | 000,917,504 | ---- | M] (Covert Systems, Inc.) -- C:\Program Files\MediaShooterPro\MediaShooterPro.exe
PRC - [2002/12/17 16:26:22 | 007,520,337 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlservr.exe
PRC - [2002/12/17 16:23:32 | 000,074,308 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe


========== Modules (SafeList) ==========

MOD - [2010/09/13 11:04:21 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Adminstrator\Desktop\OTL.exe
MOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/06/09 05:34:17 | 000,116,104 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2010/04/30 13:47:30 | 000,136,448 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe -- (NanoServiceMain)
SRV - [2010/03/30 11:16:12 | 001,107,336 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2009/12/07 00:19:00 | 001,590,216 | ---- | M] (UltraVNC) [Auto | Running] -- C:\Program Files\UltraVNC\WinVNC.exe -- (uvnc_service)
SRV - [2009/09/10 15:21:52 | 000,322,048 | ---- | M] () [Auto | Running] -- C:\Program Files\XDS\BIN\winxftp.exe -- (XDS Store and Forward)
SRV - [2008/08/11 13:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2008/07/03 12:21:54 | 000,024,576 | ---- | M] (International Datacasting Corporation) [Auto | Running] -- C:\Program Files\Datacast\XD_Client\XDSysAgent.exe -- (XDSysAgent)
SRV - [2008/01/17 14:56:16 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Program Files\RDS Online Backup Manager\aua\bin\AuaObm.exe -- (OBAutoUpdate) AutoUpdateAgent (RDS Online Backup Manager)
SRV - [2008/01/17 14:56:16 | 000,049,152 | ---- | M] () [Auto | Running] -- C:\Program Files\RDS Online Backup Manager\bin\Scheduler.exe -- (OBScheduler) Online Backup Scheduler (RDS Online Backup Manager)
SRV - [2008/01/02 14:16:26 | 000,036,864 | ---- | M] (CMS Products™, Inc.) [Auto | Running] -- C:\Program Files\CMS Products\BounceBack Express\BBWatcherService.exe -- (BBWatcherService)
SRV - [2003/04/01 22:08:30 | 000,069,632 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\IcdSptSv.exe -- (ICDSPTSV)
SRV - [2002/12/17 16:26:22 | 007,520,337 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlservr.exe -- (MSSQL$MPSC_DB)
SRV - [2002/12/17 16:23:30 | 000,311,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlagent.EXE -- (SQLAgent$MPSC_DB)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ADMINS~1\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/07/07 07:05:32 | 000,014,904 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\psi_mf.sys -- (PSI)
DRV - [2010/06/09 05:33:52 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2010/05/27 18:39:32 | 000,141,384 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PSINAflt.sys -- (PSINAflt)
DRV - [2010/05/12 10:58:12 | 000,110,920 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PSINProt.sys -- (PSINProt)
DRV - [2010/05/04 08:36:54 | 000,129,928 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PSINKNC.sys -- (PSINKNC)
DRV - [2010/04/30 13:46:52 | 000,111,624 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PSINProc.sys -- (PSINProc)
DRV - [2010/04/30 13:46:52 | 000,097,032 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PSINFile.sys -- (PSINFile)
DRV - [2010/02/06 17:01:41 | 000,010,688 | ---- | M] (UVNC BVBA) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mv2.sys -- (mv2)
DRV - [2009/09/23 10:41:58 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\hamachi.sys -- (hamachi)
DRV - [2009/06/30 09:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\pavboot.sys -- (pavboot)
DRV - [2008/08/11 13:41:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2008/08/11 13:41:00 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2008/04/13 11:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 11:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2007/04/27 07:40:00 | 000,090,688 | ---- | M] (SafeNet, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [2007/04/27 07:40:00 | 000,035,328 | ---- | M] (SafeNet, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\sntnlusb.sys -- (SNTNLUSB)
DRV - [2005/11/02 16:47:26 | 000,010,368 | R--- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys -- (pfc)
DRV - [2004/09/17 10:02:54 | 000,732,928 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\senfilt.sys -- (senfilt)
DRV - [2004/08/03 22:29:54 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys -- (nv)
DRV - [2004/08/03 22:29:49 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/03 22:29:47 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/03 22:29:45 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/03 22:29:43 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/03 22:29:42 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/03 22:29:41 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/03 22:29:37 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/03 22:29:37 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/03 22:29:37 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/03 22:29:36 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2003/10/01 17:44:00 | 000,031,744 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ICDSX.sys -- (ICDSX) Sony IC Recorder (SX)
DRV - [2003/08/06 00:04:00 | 000,100,373 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2003/08/06 00:04:00 | 000,098,068 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2003/08/06 00:04:00 | 000,083,284 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2003/08/06 00:04:00 | 000,034,837 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2003/08/06 00:04:00 | 000,025,685 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2003/08/06 00:04:00 | 000,014,229 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2003/08/06 00:04:00 | 000,006,357 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2003/08/06 00:04:00 | 000,004,117 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2003/08/06 00:04:00 | 000,002,233 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\dla\tfsndres.sys -- (tfsndres)
DRV - [2003/07/31 02:21:00 | 000,084,576 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2003/07/14 10:28:40 | 000,005,621 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys -- (sscdbhk5)
DRV - [2003/07/14 10:28:22 | 000,023,219 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys -- (ssrtln)
DRV - [2003/06/20 01:56:00 | 000,040,448 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys -- (drvnddm)
DRV - [2003/05/23 11:58:30 | 000,043,136 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2002/11/08 12:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2002/07/17 10:05:10 | 000,016,512 | ---- | M] (Adaptec) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\aspi32.sys -- (Aspi32)
DRV - [2001/08/17 13:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 13:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 13:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 13:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 13:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 12:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 12:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 12:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 12:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 12:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 12:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 12:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 12:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 12:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 12:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 11:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://inaboxonline.com/
IE - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: widgetruntime@surfsecret.com:1.0
FF - prefs.js..extensions.enabledItems: {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.3
FF - prefs.js..extensions.enabledItems: {5A170DD3-63CA-4c58-93B7-DE9FF536C2FF}:1.8.62
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=panda&type=panda1_0yatb&p="

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/04/23 12:45:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\widgetruntime@surfsecret.com: C:\Program Files\Panda Security\Panda ID Protect\Firefox [2010/08/19 11:23:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/17 06:20:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/17 06:20:36 | 000,000,000 | ---D | M]

[2008/08/27 12:17:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Extensions
[2010/08/19 11:22:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\2wxmmzn0.default\extensions
[2004/10/16 11:39:35 | 000,000,000 | ---D | M] (Firefox (default)) -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\2wxmmzn0.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/08/19 12:20:33 | 000,000,000 | ---D | M] (Panda Security Toolbar) -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\2wxmmzn0.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
[2004/11/28 16:29:51 | 000,000,000 | ---D | M] (Web Developer) -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\2wxmmzn0.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2004/11/28 16:29:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\2wxmmzn0.default\extensions\temp
[2010/09/20 05:41:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\wntrqxrq.Default User\extensions
[2010/07/26 11:38:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\wntrqxrq.Default User\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/26 11:38:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\wntrqxrq.Default User\extensions\{5A170DD3-63CA-4c58-93B7-DE9FF536C2FF}
[2010/08/19 12:20:41 | 000,000,000 | ---D | M] (Panda Security Toolbar) -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\wntrqxrq.Default User\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}
[2009/10/14 15:08:40 | 000,002,172 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\wntrqxrq.Default User\searchplugins\bing.xml
[2010/09/20 05:41:09 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/09/02 10:56:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/02 11:06:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2005/09/15 18:26:00 | 000,044,153 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\inspector.dll
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/03/09 16:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2010/08/14 06:14:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Panda Security Toolbar) - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll ()
O3 - HKLM\..\Toolbar: (Panda Security Toolbar) - {B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4} - C:\Program Files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll ()
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [OBSystemTray] C:\Program Files\RDS Online Backup Manager\bin\SystemTray.exe ()
O4 - HKLM..\Run: [PSUNMain] C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O4 - Startup: C:\Documents and Settings\Adminstrator\Start Menu\Programs\Startup\MediaShooterPro.lnk = C:\Program Files\MediaShooterPro\MediaShooterPro.exe (Covert Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\..Trusted Domains: ([]msn in My Computer)
O15 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\..Trusted Domains: emediaCenter.biz ([www] http in Trusted sites)
O15 - HKU\S-1-5-21-3109865031-142599481-1079352701-1007\..Trusted Domains: emediaCenter.biz ([www] https in Trusted sites)
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} https://secure.logmeinrescue.com/US/TechCon...scueControl.cab (LogMeIn Rescue Technician Console)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Adminstrator\My Documents\My Pictures\untitled.GIF
O29 - HKLM SecurityProviders - (zwebauth.dll) - C:\WINDOWS\System32\ZWebAuth.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 07:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/09/20 11:29:36 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/09/13 14:09:01 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Adminstrator\Desktop\TFC.exe
[2010/09/13 11:04:21 | 000,576,000 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Adminstrator\Desktop\OTL.exe
[2010/09/12 08:49:36 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/09/10 16:35:16 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/09/06 16:06:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adminstrator\Application Data\Sammsoft
[2010/09/06 14:54:05 | 000,544,768 | ---- | C] (Stardock Corporation) -- C:\WINDOWS\System32\wbocx.ocx
[2010/09/06 14:54:05 | 000,056,496 | ---- | C] (Stardock.Net, Inc) -- C:\WINDOWS\System32\wbhelp2.dll
[2010/09/06 14:54:04 | 000,258,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\unicows.dll
[2010/09/06 14:54:04 | 000,033,968 | ---- | C] (Neil Banfield) -- C:\WINDOWS\System32\anim.dll
[2010/09/06 14:54:04 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\W95INF32.DLL
[2010/09/06 14:54:04 | 000,002,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\W95INF16.DLL
[2010/09/06 14:54:01 | 000,000,000 | ---D | C] -- C:\Program Files\WinUtilities
[2010/09/02 12:05:14 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/09/02 12:05:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/09/02 12:05:13 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/09/02 10:57:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/09/02 10:56:12 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/09/02 10:23:42 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2010/09/01 15:34:37 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Adminstrator\Recent
[2010/09/01 12:39:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adminstrator\Application Data\Malwarebytes
[2010/09/01 12:38:24 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/01 12:38:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/01 12:38:19 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/01 12:38:18 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/31 13:40:45 | 001,210,704 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Adminstrator\Desktop\tdsskiller.exe
[2010/08/28 15:54:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adminstrator\Local Settings\Application Data\WeatherBug
[2010/08/28 15:53:49 | 000,000,000 | ---D | C] -- C:\Program Files\AWS
[2010/08/26 15:28:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adminstrator\Local Settings\Application Data\BounceBack Express
[2010/08/26 15:26:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adminstrator\Application Data\InstallShield Installation Information
[2010/08/26 15:26:00 | 000,000,000 | ---D | C] -- C:\Program Files\CMS Products
[2010/08/26 15:24:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Adminstrator\Desktop\Bounceback Express 8.0

========== Files - Modified Within 30 Days ==========

[2010/09/20 11:36:45 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3109865031-142599481-1079352701-1007.job
[2010/09/20 11:31:47 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/20 11:31:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2010/09/20 11:30:42 | 011,534,336 | ---- | M] () -- C:\Documents and Settings\Adminstrator\NTUSER.DAT
[2010/09/20 11:30:42 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Adminstrator\NTUSER.INI
[2010/09/20 11:02:10 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3109865031-142599481-1079352701-1007.job
[2010/09/20 05:33:37 | 000,002,491 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Word.lnk
[2010/09/20 05:29:37 | 002,482,703 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\seahawksmondayreport.mp3
[2010/09/16 04:57:38 | 000,981,852 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\seahawksthursdayreport.mp3
[2010/09/15 03:07:38 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/09/14 15:18:25 | 000,993,932 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\seahawksweeklygamepromo2.mp3
[2010/09/14 11:36:58 | 001,456,236 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\09-16-10.mp3
[2010/09/14 11:36:35 | 001,449,967 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\09-17-10.mp3
[2010/09/13 14:09:01 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Adminstrator\Desktop\TFC.exe
[2010/09/13 11:04:21 | 000,576,000 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Adminstrator\Desktop\OTL.exe
[2010/09/10 16:50:02 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/09/10 16:25:27 | 003,842,041 | R--- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\etavaresCF.exe
[2010/09/10 10:22:24 | 000,203,047 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\Happybirthday.mp3
[2010/09/09 11:41:22 | 000,020,928 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\tos-redalert.mp3
[2010/09/07 13:31:32 | 000,060,416 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/07 09:22:31 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\RKUnhookerLE.EXE
[2010/09/07 09:22:23 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\MBRCheck.exe
[2010/09/07 09:21:51 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/09/06 16:18:38 | 000,000,046 | ---- | M] () -- C:\WINDOWS\System32\_WKERNEL.FRE
[2010/09/06 15:43:19 | 000,535,700 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\AROscanlog.xml
[2010/09/06 14:54:22 | 000,000,643 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinUtilities.lnk
[2010/09/06 14:48:36 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/09/06 14:17:31 | 000,000,029 | ---- | M] () -- C:\UNWISE.INI
[2010/09/03 14:27:50 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\Defogger.exe
[2010/09/02 11:59:31 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/09/01 21:57:02 | 000,000,376 | ---- | M] () -- C:\WINDOWS\XFTP.INI
[2010/09/01 12:38:39 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/31 16:16:26 | 000,016,968 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/08/31 13:40:51 | 001,210,704 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Adminstrator\Desktop\tdsskiller.exe
[2010/08/30 15:04:54 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\New Microsoft Word Document.doc
[2010/08/28 15:53:54 | 000,001,765 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Application Data\Microsoft\Internet Explorer\Quick Launch\WeatherBug.lnk
[2010/08/28 15:53:54 | 000,001,747 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\WeatherBug.lnk
[2010/08/28 15:28:25 | 000,000,173 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/08/27 15:51:55 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\gmer.exe
[2010/08/27 15:32:33 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Adminstrator\defogger_reenable
[2010/08/27 15:25:48 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Desktop\dds.scr
[2010/08/27 08:53:34 | 000,220,700 | ---- | M] () -- C:\Documents and Settings\Adminstrator\Application Data\PandaIDProtectHelp.chm
[2010/08/26 09:59:36 | 000,000,606 | ---- | M] () -- C:\WINDOWS\System32\.crusader

========== Files Created - No Company Name ==========

[2010/09/15 05:22:37 | 002,482,703 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\seahawksmondayreport.mp3
[2010/09/15 03:01:36 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/09/14 15:18:25 | 000,993,932 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\seahawksweeklygamepromo2.mp3
[2010/09/14 11:36:09 | 001,456,236 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\09-16-10.mp3
[2010/09/14 11:35:55 | 001,449,967 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\09-17-10.mp3
[2010/09/10 10:22:22 | 000,203,047 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\Happybirthday.mp3
[2010/09/09 11:41:22 | 000,020,928 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\tos-redalert.mp3
[2010/09/09 07:03:57 | 000,981,852 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\seahawksthursdayreport.mp3
[2010/09/08 16:16:18 | 003,842,041 | R--- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\etavaresCF.exe
[2010/09/07 09:22:31 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\RKUnhookerLE.EXE
[2010/09/07 09:22:23 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\MBRCheck.exe
[2010/09/07 09:20:51 | 000,000,292 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-3109865031-142599481-1079352701-1007.job
[2010/09/07 09:20:50 | 000,000,300 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-3109865031-142599481-1079352701-1007.job
[2010/09/06 15:43:18 | 000,535,700 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\AROscanlog.xml
[2010/09/06 14:54:44 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\_WKERNEL.FRE
[2010/09/06 14:54:22 | 000,000,643 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinUtilities.lnk
[2010/09/06 14:54:02 | 000,000,439 | ---- | C] () -- C:\WINDOWS\System32\shfolder.inf
[2010/09/06 14:48:36 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/09/06 14:17:31 | 000,149,504 | ---- | C] () -- C:\UNWISE.EXE
[2010/09/06 14:17:31 | 000,000,029 | ---- | C] () -- C:\UNWISE.INI
[2010/09/03 14:27:50 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\Defogger.exe
[2010/09/02 11:59:31 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/09/01 12:38:39 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/30 14:04:08 | 000,019,968 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\New Microsoft Word Document.doc
[2010/08/30 13:27:51 | 000,000,195 | ---- | C] () -- C:\Documents and Settings\Adminstrator\mbr.log
[2010/08/28 15:53:54 | 000,001,765 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Application Data\Microsoft\Internet Explorer\Quick Launch\WeatherBug.lnk
[2010/08/28 15:53:53 | 000,001,747 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\WeatherBug.lnk
[2010/08/27 15:32:33 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Adminstrator\defogger_reenable
[2010/08/27 15:25:44 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Desktop\dds.scr
[2010/08/27 08:53:29 | 000,220,700 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Application Data\PandaIDProtectHelp.chm
[2010/08/26 15:26:15 | 000,035,520 | ---- | C] () -- C:\WINDOWS\System32\BBUninstall.exe
[2010/08/26 09:59:36 | 000,000,606 | ---- | C] () -- C:\WINDOWS\System32\.crusader
[2010/07/26 19:10:08 | 000,016,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/03/19 06:31:44 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Local Settings\Application Data\prvlcl.dat
[2010/02/06 10:18:46 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2010/01/25 11:58:06 | 000,462,848 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll
[2008/07/08 17:07:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MPSCDW.INI
[2008/07/08 16:00:04 | 000,266,240 | ---- | C] () -- C:\WINDOWS\System32\UNLHA32.DLL
[2008/07/08 16:00:03 | 001,601,536 | ---- | C] () -- C:\WINDOWS\System32\PdfDll32.dll
[2008/07/08 16:00:02 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\lttls13n.dll
[2008/07/08 16:00:02 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ltupl13n.dll
[2008/02/12 16:38:48 | 000,000,376 | ---- | C] () -- C:\WINDOWS\XFTP.INI
[2006/11/27 19:09:42 | 000,004,455 | ---- | C] () -- C:\WINDOWS\System32\winaspi32.dll
[2006/08/02 11:51:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\DVEdit.INI
[2006/08/02 11:29:18 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\IcdSptSvps.dll
[2006/08/02 11:29:17 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\dsp_trc.dll
[2006/07/12 13:15:26 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll
[2006/07/10 14:26:30 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\sh33w32.dll
[2005/09/11 23:09:47 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[2005/09/09 13:13:56 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/09/09 12:52:28 | 000,000,269 | ---- | C] () -- C:\WINDOWS\tmupdate.ini
[2005/08/01 06:00:29 | 000,039,823 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2005/07/21 14:26:29 | 000,001,087 | ---- | C] () -- C:\WINDOWS\CoolCD1.ini
[2005/07/11 14:04:24 | 000,000,823 | ---- | C] () -- C:\WINDOWS\TSC.ini
[2005/06/16 02:05:49 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/06/13 11:38:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\batcb.dll
[2005/05/07 13:54:37 | 000,000,173 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/04/27 09:10:39 | 000,000,029 | ---- | C] () -- C:\WINDOWS\AudACM.ini
[2004/07/30 07:36:02 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Application Data\PFP110JCM.{PB
[2004/05/27 15:44:41 | 000,060,416 | ---- | C] () -- C:\Documents and Settings\Adminstrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/06 09:59:37 | 000,071,749 | ---- | C] () -- C:\WINDOWS\HCExtOutput.dll
[2004/05/06 09:58:03 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2004/01/26 09:53:30 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2004/01/26 09:53:30 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2004/01/23 20:51:47 | 000,016,973 | ---- | C] () -- C:\WINDOWS\System32\ZWebAuth.dll
[2004/01/05 22:11:04 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\BsiUt232.dll
[2004/01/05 22:11:04 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\Extract32.dll
[2003/12/29 17:02:58 | 000,000,133 | ---- | C] () -- C:\WINDOWS\coolacm.ini
[2003/12/19 21:21:04 | 000,000,174 | ---- | C] () -- C:\WINDOWS\System32\mcini.ini
[2003/12/12 14:21:42 | 000,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003/12/12 14:04:40 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/12/12 13:52:04 | 000,000,549 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/08/13 21:54:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2003/05/31 00:40:09 | 000,056,320 | ---- | C] () -- C:\WINDOWS\System32\BsiGeode.dll
[2002/11/01 16:17:50 | 000,000,256 | ---- | C] () -- C:\WINDOWS\aucfg.ini
[2001/12/14 13:34:46 | 000,164,864 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[1999/07/23 10:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1998/08/16 07:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll
< End of report >



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4657

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/20/2010 12:19:03 PM
mbam-log-2010-09-20 (12-19-03).txt

Scan type: Quick scan
Objects scanned: 169364
Time elapsed: 14 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


#20 aaronkuj

aaronkuj
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:12:40 AM

Posted 20 September 2010 - 02:41 PM

System slow, lot of hard drive cache'ing' going on. I want to dump the OS but system too highly used and downtime, network paths, bookmarks, all those little programs used infrequently but needed have caused me to wait...plus I needed to learn from this infection first. This system has like 10 years of DLL's and registry lines that are not needed.


Whats This?!? >>> DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ADMINS~1\LOCALS~1\Temp\catchme.sys -- (catchme)

Edited by aaronkuj, 20 September 2010 - 02:44 PM.


#21 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 20 September 2010 - 05:43 PM

Hello, aaronkuj.
Let's double check your MBR.

What processes are using up your CPU? If nothing is high in task manager, we'll look at disk access in Process Explorer.

Did you complete the Kapersky scan from before?

That driver (catchme.sys) is related to a tool we used and is legit.

Please download MBRCheck by ad_13 and save it to your desktop.

Double-click to run. A window will pop up. If it says 'non-standard' or 'infected' MBR code detected, please type 3 for Exit for now and press Enter.

It will save a logfile on your desktop that starts with MBR, then has the date, etc. Please copy and paste the contents of that log in your reply.

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#22 aaronkuj

aaronkuj
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:12:40 AM

Posted 20 September 2010 - 06:59 PM

I check it every week...its good.
I will "attempt" Kapersky scan again tonight. the last time I had to quit after a few hours to work...it found a couple cookies and just the PEV.exe from Combofix but that was only 22% into it.



MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000007c

Kernel Drivers (total 130):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7D57000 \WINDOWS\system32\KDCOM.DLL
0xF7C67000 \WINDOWS\system32\BOOTVID.dll
0xF7808000 ACPI.sys
0xF7D59000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF77F7000 pci.sys
0xF7857000 isapnp.sys
0xF7E1F000 pciide.sys
0xF7AD7000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF7867000 MountMgr.sys
0xF77D8000 ftdisk.sys
0xF7ADF000 PartMgr.sys
0xF7AE7000 pavboot.sys
0xF7877000 VolSnap.sys
0xF77C0000 atapi.sys
0xF7887000 disk.sys
0xF7897000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF77A0000 fltmgr.sys
0xF778E000 sr.sys
0xF78A7000 PxHelp20.sys
0xF7779000 drvmcdb.sys
0xF7762000 KSecDD.sys
0xF76D5000 Ntfs.sys
0xF76A8000 NDIS.sys
0xF768E000 Mup.sys
0xF7A97000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF7461000 \SystemRoot\System32\DRIVERS\ialmnt5.sys
0xF744D000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF7BAF000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF7429000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF7BB7000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF7AA7000 \SystemRoot\System32\DRIVERS\bcm4sbxp.sys
0xF7AB7000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF7BC7000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF7BCF000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF7415000 \SystemRoot\System32\DRIVERS\parport.sys
0xF7AC7000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF7D13000 \SystemRoot\system32\drivers\pfc.sys
0xF7D71000 \SystemRoot\system32\drivers\sscdbhk5.sys
0xF78C7000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF78D7000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF73F2000 \SystemRoot\System32\DRIVERS\ks.sys
0xF78E7000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF73B2000 \SystemRoot\system32\drivers\smwdm.sys
0xF738E000 \SystemRoot\system32\drivers\portcls.sys
0xF78F7000 \SystemRoot\system32\drivers\drmk.sys
0xF72DB000 \SystemRoot\system32\drivers\senfilt.sys
0xF7F66000 \SystemRoot\system32\DRIVERS\lmimirr.sys
0xF7F67000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF7907000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF7D2B000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF72C4000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF7917000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF7927000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF7C0F000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF72B3000 \SystemRoot\System32\DRIVERS\psched.sys
0xF7937000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF7C1F000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF7C2F000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF7C3F000 \SystemRoot\system32\DRIVERS\hamachi.sys
0xF7947000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF7D77000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF7255000 \SystemRoot\System32\DRIVERS\update.sys
0xF7C57000 \SystemRoot\System32\DRIVERS\omci.sys
0xF7D3F000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF7957000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7977000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7D7D000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF7533000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7D83000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7E58000 \SystemRoot\System32\Drivers\Null.SYS
0xF7D87000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7B17000 \SystemRoot\system32\drivers\ssrtln.sys
0xF7B27000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7B2F000 \SystemRoot\System32\drivers\vga.sys
0xF7D8B000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7D8F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7B3F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7B4F000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7CDF000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xEF0DA000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xEF081000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xEF059000 \SystemRoot\System32\DRIVERS\netbt.sys
0xEF033000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF7987000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xEF011000 \SystemRoot\System32\drivers\afd.sys
0xF7997000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF7B5F000 \SystemRoot\system32\DRIVERS\SNTNLUSB.SYS
0xEEFE6000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xEEFC7000 \SystemRoot\system32\DRIVERS\psinknc.sys
0xEEEB7000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF79D7000 \SystemRoot\System32\Drivers\Fips.SYS
0xF79F7000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEEF97000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7B7F000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7EB9000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF03F000 \SystemRoot\System32\ialmdev5.DLL
0xBF06B000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xEED56000 \SystemRoot\system32\DRIVERS\PSINAflt.sys
0xEED3C000 \SystemRoot\system32\DRIVERS\PSINProt.sys
0xEED25000 \SystemRoot\system32\DRIVERS\PSINFile.sys
0xEED0B000 \SystemRoot\system32\DRIVERS\PSINProc.sys
0xF79A7000 \SystemRoot\system32\drivers\drvnddm.sys
0xF7F04000 \SystemRoot\system32\dla\tfsndres.sys
0xEECF6000 \SystemRoot\system32\dla\tfsnifs.sys
0xEEDDB000 \SystemRoot\system32\dla\tfsnopio.sys
0xF7DAD000 \SystemRoot\system32\dla\tfsnpool.sys
0xF7BFF000 \SystemRoot\system32\dla\tfsnboio.sys
0xF79B7000 \SystemRoot\system32\dla\tfsncofs.sys
0xF7F07000 \SystemRoot\system32\dla\tfsndrct.sys
0xEEC3E000 \SystemRoot\system32\dla\tfsnudf.sys
0xEEC25000 \SystemRoot\system32\dla\tfsnudfa.sys
0xEEA90000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF7DF1000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEEA53000 \SystemRoot\System32\Drivers\SENTINEL.SYS
0xF7B07000 \SystemRoot\System32\drivers\aspi32.sys
0xF7DF5000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
0xEE934000 \SystemRoot\System32\DRIVERS\srv.sys
0xEEAE5000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
0xEEA03000 \SystemRoot\system32\drivers\sysaudio.sys
0xEE561000 \SystemRoot\system32\drivers\wdmaud.sys
0xEE200000 \SystemRoot\System32\Drivers\HTTP.sys
0xED981000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
596 C:\WINDOWS\SYSTEM32\smss.exe
660 csrss.exe
684 C:\WINDOWS\SYSTEM32\winlogon.exe
728 C:\WINDOWS\SYSTEM32\services.exe
740 C:\WINDOWS\SYSTEM32\lsass.exe
952 C:\WINDOWS\SYSTEM32\svchost.exe
1020 svchost.exe
1240 C:\WINDOWS\SYSTEM32\svchost.exe
1288 svchost.exe
1392 svchost.exe
1456 C:\WINDOWS\SYSTEM32\spoolsv.exe
1964 svchost.exe
1996 C:\Program Files\CMS Products\BounceBack Express\BBWatcherService.exe
2016 C:\Program Files\Bonjour\mDNSResponder.exe
108 C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
180 C:\Program Files\Java\jre6\bin\jqs.exe
368 C:\Program Files\LogMeIn\x86\ramaint.exe
1124 C:\Program Files\LogMeIn\x86\LogMeIn.exe
1212 C:\Program Files\LogMeIn\x86\LMIGuardian.exe
1384 C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlservr.exe
1664 C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
1752 C:\Program Files\RDS Online Backup Manager\aua\bin\AuaObm.exe
1764 C:\Program Files\RDS Online Backup Manager\aua\jvm\bin\AuaObmJW.exe
1772 C:\Program Files\RDS Online Backup Manager\bin\Scheduler.exe
1796 C:\Program Files\RDS Online Backup Manager\jvm\bin\SchedulerOBM.exe
1816 C:\Program Files\UltraVNC\winvnc.exe
1916 C:\Program Files\XDS\BIN\winxftp.exe
156 C:\Program Files\Datacast\XD_Client\XDSysAgent.exe
432 C:\Program Files\UltraVNC\winvnc.exe
1268 C:\Program Files\Datacast\XD_Client\XD_Agent.exe
2592 alg.exe
2940 C:\Program Files\Datacast\XD_Client\Retriever.exe
3476 C:\Program Files\Datacast\XD_Client\IPCap.exe
3940 C:\Program Files\Datacast\XD_Client\DataMan.exe
3536 C:\WINDOWS\explorer.exe
3756 C:\Program Files\RDS Online Backup Manager\bin\SystemTray.exe
3864 C:\Program Files\Analog Devices\Core\smax4pnp.exe
3880 C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
4076 C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
640 C:\Program Files\AWS\WeatherBug\Weather.exe
2504 C:\Program Files\LogMeIn\x86\LMIGuardian.exe
2452 C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
2556 C:\Program Files\MediaShooterPro\MediaShooterPro.exe
2396 C:\Program Files\Windows Live\Mail\wlmail.exe
2624 C:\Program Files\Windows Live\Contacts\wlcomm.exe
1080 C:\Documents and Settings\Adminstrator\Desktop\MBRCheck.exe
3616 C:\Documents and Settings\Adminstrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
2436 C:\Documents and Settings\Adminstrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS)
\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000000`007e0000 (NTFS)
\\.\G: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD800BB-75FRA0, Rev: 77.07W77
PhysicalDrive1 Model Number: WDCWD3200AAJB-00J3A0, Rev: 01.03E01

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
298 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

#23 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 21 September 2010 - 06:10 PM

OK, you can try ESET if not. I can provide instructions if Kapersky takes too long again. Are there any specific files that are writing to disk and/or have very high CPU usage? I can provide instructions on how to check that if needed.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#24 aaronkuj

aaronkuj
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:12:40 AM

Posted 25 September 2010 - 01:37 PM

Kaspersky came up clean.

#25 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 25 September 2010 - 05:04 PM

OK, you appear clear of malware at this point. Before we clean up, did you want to trouble shoot the disk caching? Or do you just want to clean up our mess and ensure you can't accidentally get reinfected with the leftovers from our removal?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#26 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 29 September 2010 - 06:09 PM

still with me?


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#27 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:40 AM

Posted 05 October 2010 - 07:04 AM

Due to the lack of feedback, this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users