Google Redirect Virus

I appear to have a google redirect virus. I tried to find out why McAfees wasn't updating, and was redirected to somewhere else. I tried running GMER twice. The first time it locked up before I even hit scan. The second time, I re-ran defogger, GMER started up fine and ran a good 10+ minutes (the screensaver kicked in), and then the computer reset on its own. I think I have the rest of the necessary information, though. TDSSKiller told me I had Atapi and HardDrive1/MBR, but simply reset when I tried to run it. I appreciate any help you can provide.

UPDATE - contacted McAfees online chat. Tech changed a driver or host and got McAfees to update, but of course Google still redirects searches to JoeScam.com. Sorry if this constitutes the same as disabling something on my own. lemme know if I need to restart. Frankly, I expected them to push me to their hourly service.


DDS (Ver_10-03-17.01) - NTFSx86
Run by Jim at 13:13:56.61 on Sat 09/25/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3327.2619 [GMT -4:00]

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

============== Running Processes ===============

F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost -k DcomLaunch
F:\WINDOWS\system32\svchost -k rpcss
F:\WINDOWS\System32\svchost.exe -k netsvcs
F:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
F:\WINDOWS\system32\svchost.exe -k NetworkService
F:\WINDOWS\system32\svchost.exe -k LocalService
F:\WINDOWS\system32\spoolsv.exe
"F:\WINDOWS\system32\svchost.exe"
F:\WINDOWS\Explorer.EXE
F:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
F:\Program Files\HP\hpcoretech\hpcmpmgr.exe
F:\WINDOWS\RTHDCPL.EXE
F:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
F:\Program Files\lg_fwupdate\fwupdate.exe
F:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
F:\Program Files\Nero\Nero 7\InCD\InCD.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\McAfee.com\Agent\mcagent.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Linksys EasyLink AdvisorNEW\LinksysAgent.exe
F:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
F:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
F:\WINDOWS\system32\svchost.exe -k LocalService
F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\Program Files\Logitech\SetPoint\SetPoint.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\Program Files\Flip Video\FlipShare\FlipShareService.exe
F:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
F:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
F:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
F:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\Program Files\Kodak\Digital Display\OrbKodakLauncher\DllStartupService.exe
F:\Program Files\Common Files\LightScribe\LSSrvc.exe
F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
F:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
F:\Program Files\CyberLink\Shared Files\RichVideo.exe
F:\WINDOWS\system32\svchost.exe -k imgsvc
F:\Program Files\Viewpoint\Common\ViewpointService.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
F:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe
F:\WINDOWS\system32\wbem\unsecapp.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\WINDOWS\system32\HPZipm12.exe
F:\WINDOWS\System32\alg.exe
F:\Program Files\Java\jre6\bin\jucheck.exe
F:\WINDOWS\system32\msiexec.exe
F:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
F:\WINDOWS\system32\NOTEPAD.EXE
F:\Documents and Settings\Jim\Desktop\Defogger.exe
F:\Documents and Settings\Jim\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.pogo.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - f:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - f:\program files\common files\mcafee\systemcore\ScriptSn.20100915002538.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - f:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - f:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - f:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [ctfmon.exe] f:\windows\system32\ctfmon.exe
uRun: [Aim6]
uRun: [MSMSGS] "f:\program files\messenger\msmsgs.exe" /background
uRun: [LightScribe Control Panel] f:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [EasyLinkAdvisor] "c:\program files\linksys easylink advisornew\LinksysAgent.exe" /startup
uRun: [CTSyncU.exe] "f:\program files\creative\sync manager unicode\CTSyncU.exe"
mRun: [HP Software Update] "f:\program files\hp\hp software update\HPWuSchd2.exe"
mRun: [HP Component Manager] "f:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [RemoteControl] "f:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [LanguageShortcut] "f:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [LGODDFU] "f:\program files\lg_fwupdate\fwupdate.exe" blrun
mRun: [NeroFilterCheck] f:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [SecurDisc] f:\program files\nero\nero 7\incd\NBHGui.exe
mRun: [InCD] f:\program files\nero\nero 7\incd\InCD.exe
mRun: [ArcSoft Connection Service] f:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [SunJavaUpdateSched] "f:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "f:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "f:\program files\itunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "f:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "f:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [mcui_exe] "f:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [nwiz] f:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [NvCplDaemon] RUNDLL32.EXE f:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE f:\windows\system32\NvMcTray.dll,NvTaskbarInit
StartupFolder: f:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - f:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: f:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - f:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: f:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - f:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
StartupFolder: f:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - f:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: f:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - f:\program files\microsoft office\office\OSA9.EXE
IE: Add to Google Photos Screensa&ver - f:\windows\system32\GPhotos.scr/200
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - f:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - f:\program files\messenger\msmsgs.exe
DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - hxxp://pcpitstop.com/internet/pcpConnCheck.cab
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} - hxxp://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab
DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} - hxxp://a.download.toontown.com/sv1.0.38.38/ttinst.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 93.188.163.70,93.188.166.9
TCP: {9233E6CB-0B10-4F1A-8726-6C6DD05ED7AC} = 93.188.163.70,93.188.166.9
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - f:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: LBTWlgn - f:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - f:\windows\system32\WPDShServiceObj.dll
SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - f:\documents and settings\all users\application data\macromedia\swupdate\swupdate.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "f:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - f:\docume~1\jim\applic~1\mozilla\firefox\profiles\opcuv1ww.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
FF - plugin: f:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: f:\documents and settings\jim\application data\facebook\npfbplugin_1_0_3.dll
FF - plugin: f:\documents and settings\jim\application data\mozilla\firefox\profiles\opcuv1ww.default\extensions\{38ab6a6c-cc4c-4f9e-a3dd-3c5681ef18a1}\plugins\npsoe.dll
FF - plugin: f:\documents and settings\jim\application data\mozilla\firefox\profiles\opcuv1ww.default\extensions\yyginstantplay@yoyogames.com\plugins\NPYYGInstantPlay.dll
FF - plugin: f:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: f:\program files\google\google updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: f:\program files\google\picasa3\npPicasa3.dll
FF - plugin: f:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: f:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: f:\program files\virtools\3d life player\npvirtools.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - f:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.08 c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;f:\windows\system32\drivers\mfehidk.sys [2010-5-19 386712]
R1 mfetdi2k;McAfee Inc. mfetdi2k;f:\windows\system32\drivers\mfetdi2k.sys [2010-5-19 84072]
R2 KodakDigitalDisplayService;KodakDigitalDisplayService;f:\program files\kodak\digital display\orbkodaklauncher\DllStartupService.exe [2008-8-14 98304]
R2 McNaiAnn;McAfee VirusScan Announcer;"f:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-19 271480]
R2 McProxy;McAfee Proxy Service;"f:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-5-19 271480]
R2 McShield;McShield;f:\program files\common files\mcafee\systemcore\mcshield.exe [2010-5-19 171168]
R2 mfefire;McAfee Firewall Core Service;f:\program files\common files\mcafee\systemcore\mfefire.exe [2010-5-19 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;f:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-5-19 141792]
R2 SVKP;SVKP;f:\windows\system32\SVKP.sys [2008-12-14 2368]
R2 Viewpoint Manager Service;Viewpoint Manager Service;f:\program files\viewpoint\common\ViewpointService.exe [2008-9-17 24652]
R3 mfeavfk;McAfee Inc. mfeavfk;f:\windows\system32\drivers\mfeavfk.sys [2010-5-19 152992]
R3 mfebopk;McAfee Inc. mfebopk;f:\windows\system32\drivers\mfebopk.sys [2010-5-19 52104]
R3 mfefirek;McAfee Inc. mfefirek;f:\windows\system32\drivers\mfefirek.sys [2010-5-19 312904]
R3 mfendiskmp;mfendiskmp;f:\windows\system32\drivers\mfendisk.sys [2010-5-19 88544]
S2 gupdate;Google Update Service (gupdate);f:\program files\google\update\GoogleUpdate.exe [2010-1-6 135664]
S3 cfwids;McAfee Inc. cfwids;f:\windows\system32\drivers\cfwids.sys [2010-5-19 55840]
S3 kbeepm;kbeepm;\??\f:\docume~1\jim\locals~1\temp\kbeepm.sys --> f:\docume~1\jim\locals~1\temp\kbeepm.sys [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;f:\windows\system32\drivers\mfendisk.sys [2010-5-19 88544]
S3 mferkdet;McAfee Inc. mferkdet;f:\windows\system32\drivers\mferkdet.sys [2010-5-19 84264]

=============== Created Last 30 ================

2010-09-25 17:13:06 0 ----a-w- f:\documents and settings\jim\defogger_reenable
2010-09-25 17:09:51 0 d-----w- f:\program files\Trend Micro
2010-09-25 16:37:03 96512 ----a-w- f:\windows\system32\drivers\tsk82.tmp
2010-09-25 16:28:39 96512 ----a-w- f:\windows\system32\drivers\tsk46F.tmp
2010-09-22 05:47:52 664 ----a-w- f:\windows\system32\d3d9caps.dat
2010-09-18 22:09:00 0 d-----w- F:\spoolerlogs
2010-09-18 21:47:01 26112 ----a-w- f:\windows\system32\stu2.exe
2010-09-16 03:39:26 0 d-----w- f:\program files\DVDFab 8
2010-09-08 17:53:26 0 d-----w- f:\docume~1\alluse~1\applic~1\YoYoGames

==================== Find3M ====================

2010-09-18 21:46:58 31232 ----a-w- f:\windows\system32\userinit.exe
2010-08-24 18:57:38 95600 ----a-w- f:\windows\system32\drivers\mfeapfk.sys
2010-08-24 18:57:38 9344 ----a-w- f:\windows\system32\drivers\mfeclnk.sys
2010-08-24 18:57:38 88544 ----a-w- f:\windows\system32\drivers\mfendisk.sys
2010-08-24 18:57:38 84264 ----a-w- f:\windows\system32\drivers\mferkdet.sys
2010-08-24 18:57:38 84072 ----a-w- f:\windows\system32\drivers\mfetdi2k.sys
2010-08-24 18:57:38 55840 ----a-w- f:\windows\system32\drivers\cfwids.sys
2010-08-24 18:57:38 52104 ----a-w- f:\windows\system32\drivers\mfebopk.sys
2010-08-24 18:57:38 386712 ----a-w- f:\windows\system32\drivers\mfehidk.sys
2010-08-24 18:57:38 312904 ----a-w- f:\windows\system32\drivers\mfefirek.sys
2010-08-24 18:57:38 152992 ----a-w- f:\windows\system32\drivers\mfeavfk.sys
2010-08-17 13:17:06 58880 ----a-w- f:\windows\system32\spoolsv.exe
2010-08-11 21:34:47 232968 ----a-w- f:\windows\system32\nvdrsdb0.bin
2010-08-11 21:34:44 232968 ----a-w- f:\windows\system32\nvdrsdb1.bin
2010-07-22 15:49:15 590848 ----a-w- f:\windows\system32\rpcrt4.dll
2010-07-22 05:57:20 5120 ----a-w- f:\windows\system32\xpsp4res.dll
2010-07-09 22:38:00 6343040 ----a-w- f:\windows\system32\nv4_disp.dll
2010-07-09 22:38:00 61440 ----a-w- f:\windows\system32\OpenCL.dll
2010-07-09 22:38:00 604776 ----a-w- f:\windows\system32\nvudisp.exe
2010-07-09 22:38:00 4595712 ----a-w- f:\windows\system32\nvcuda.dll
2010-07-09 22:38:00 2914408 ----a-w- f:\windows\system32\nvcuvid.dll
2010-07-09 22:38:00 2506344 ----a-w- f:\windows\system32\nvcuvenc.dll
2010-07-09 22:38:00 236136 ----a-w- f:\windows\system32\nvcodins.dll
2010-07-09 22:38:00 236136 ----a-w- f:\windows\system32\nvcod.dll
2010-07-09 22:38:00 2195030 ----a-w- f:\windows\system32\nvdata.bin
2010-07-09 22:38:00 1388544 ----a-w- f:\windows\system32\nvapi.dll
2010-07-09 22:38:00 13549568 ----a-w- f:\windows\system32\nvoglnt.dll
2010-07-09 22:38:00 10260480 ----a-w- f:\windows\system32\nvcompiler.dll
2010-07-09 20:24:26 81920 ----a-w- f:\windows\system32\nvwddi.dll
2010-07-09 20:24:18 277608 ----a-w- f:\windows\system32\nvmccs.dll
2010-07-09 20:24:18 110696 ----a-w- f:\windows\system32\nvmctray.dll
2010-07-09 20:24:16 155752 ----a-w- f:\windows\system32\nvsvc32.exe
2010-07-09 20:24:16 145000 ----a-w- f:\windows\system32\nvcolor.exe
2010-07-09 20:24:16 13923432 ----a-w- f:\windows\system32\nvcpl.dll
2010-07-07 17:46:46 604776 ----a-w- f:\windows\system32\NVUNINST.EXE
2010-06-30 12:31:35 149504 ----a-w- f:\windows\system32\schannel.dll
2008-09-17 23:09:21 32768 --sha-w- f:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090820080915\index.dat
2008-09-17 23:09:21 32768 --sha-w- f:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091720080918\index.dat

============= FINISH: 13:14:59.15 ===============

Edited by Griswel, 25 September 2010 - 02:06 PM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
We need to create an OTL Report

1. Please download OTL from one of the following mirrors:
   • This is THE Mirror
2. Save it to your desktop.
3. Double click on the icon on your desktop.
4. Click the "Scan All Users" checkbox.
5. In the custom scan box paste the following:
   
   CODE
   msconfig
   safebootminimal
   activex
   drivers32
   netsvcs
   %SYSTEMDRIVE%\*.exe
   /md5start
   eventlog.dll
   scecli.dll
   netlogon.dll
   cngaudit.dll
   sceclt.dll
   ntelogon.dll
   logevent.dll
   iaStor.sys
   nvstor.sys
   atapi.sys
   IdeChnDr.sys
   viasraid.sys
   AGP440.sys
   vaxscsi.sys
   nvatabus.sys
   viamraid.sys
   nvata.sys
   nvgts.sys
   iastorv.sys
   ViPrt.sys
   eNetHook.dll
   ahcix86.sys
   KR10N.sys
   nvstor32.sys
   ahcix86s.sys
   nvrd32.sys
   symmpi.sys
   adp3132.sys
   mv61xx.sys
   nvraid.sys
   /md5stop
   %systemroot%\*. /mp /s
   %systemroot%\system32\*.dll /lockedfiles
   %systemroot%\Tasks\*.job /lockedfiles
   %systemroot%\system32\drivers\*.sys /lockedfiles
   %systemroot%\System32\config\*.sav
   %systemroot%\system32\drivers\*.sys /90
6. Push the button.
7. Two reports will open, copy and paste them in a reply here:
   • OTL.txt <-- Will be opened
   • Extra.txt<--Will be minimized

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

regards myrti

Stopped using computer Sunday after I got Desktop Security 2010 and constant "warning" popups rendering it very difficult to use. Downloaded on other computer and put needed files on CD for use here. Hope this works! Thanks for your help.

I used Notepad to paste the code into the box, and had it open when the OTL ran. OTL "could not find" the relevant files, so did not create them (I chose "yes"). So I am running it again... Again, it said it could not find the files, and when I said create to create them, I got two untitled, empty notepad files. EDIT - to be clear, I ran OTL again with Notepad closed. Same result - no files were created.

Any suggestions appreciated, this computer is nearly impossible to use.

Edited by Griswel, 30 September 2010 - 08:01 PM.

Hi,

can you please try to copy OTL over onto your Desktop and run the scan from there. It was probably trying to save the files to your CD which is impossible.

regards myrti

Working on it - 8 popups for every successful action, but it's possible. BTW Firefox won't even start now, but IE works.

OTL logfile created on: 10/1/2010 6:14:12 PM - Run 2
OTL by OldTimer - Version 3.2.14.1 Folder = F:\Documents and Settings\Jim\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4990 [binary data]

%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files
Drive C: | 233.76 Gb Total Space | 47.82 Gb Free Space | 20.46% Space Free | Partition Type: NTFS
Drive D: | 0.08 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
Drive F: | 298.08 Gb Total Space | 75.55 Gb Free Space | 25.34% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BLACKHANDLE
Current User Name: Jim
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/09/30 18:37:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\Documents and Settings\Jim\Desktop\OTL.exe
PRC - [2010/09/27 16:54:49 | 002,741,248 | ---- | M] () -- F:\Documents and Settings\Jim\Local Settings\Temp\m.25FA.tmp.exe
PRC - [2010/09/27 16:53:08 | 000,164,864 | ---- | M] () -- f:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\nb.lproj\QuickTimeResourcesQuickTimeResources7.6.4.exe
PRC - [2010/09/27 16:53:08 | 000,164,864 | ---- | M] () -- F:\Program Files\QuickTime\QuickTimePlayer.Resources\de.lproj\QuickTimeResourcesQuickTime7.6.41327.58.exe
PRC - [2010/09/27 16:53:08 | 000,164,864 | ---- | M] () -- f:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\QuickTimeResourcesQuickTime.exe
PRC - [2010/09/27 16:53:08 | 000,164,864 | ---- | M] () -- F:\Documents and Settings\Jim\Local Settings\Temp\kyEi.exe
PRC - [2010/09/27 12:56:36 | 001,608,704 | ---- | M] () -- F:\Documents and Settings\Jim\Application Data\Desktop Security\Desktop Security 2010.exe
PRC - [2010/09/27 12:56:04 | 000,283,136 | ---- | M] () -- F:\Documents and Settings\Jim\Application Data\Desktop Security\securitycenter.exe
PRC - [2010/08/24 14:57:38 | 000,188,136 | ---- | M] (McAfee, Inc.) -- F:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
PRC - [2010/08/24 14:57:38 | 000,171,168 | ---- | M] (McAfee, Inc.) -- F:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
PRC - [2010/08/24 14:57:38 | 000,141,792 | ---- | M] (McAfee, Inc.) -- F:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe
PRC - [2010/06/24 22:32:44 | 001,193,848 | ---- | M] (McAfee, Inc.) -- F:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2010/06/15 13:41:19 | 000,134,808 | ---- | M] (Google Inc.) -- F:\Program Files\Google\Update\1.2.183.29\GoogleCrashHandler.exe
PRC - [2010/05/14 12:59:44 | 000,455,944 | ---- | M] () -- F:\Program Files\Flip Video\FlipShare\FlipShareService.exe
PRC - [2010/04/21 11:20:06 | 001,155,256 | ---- | M] (McAfee, Inc.) -- f:\Program Files\McAfee\MSC\mcupdmgr.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) -- F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2009/10/11 05:17:45 | 000,386,872 | ---- | M] (Sun Microsystems, Inc.) -- F:\Program Files\Java\jre6\bin\jucheck.exe
PRC - [2009/07/20 12:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- F:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/10 12:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- F:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2008/10/30 15:16:42 | 000,282,624 | ---- | M] (Eastman Kodak Company) -- F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
PRC - [2008/10/21 16:30:35 | 000,548,864 | ---- | M] (BL) -- F:\Program Files\lg_fwupdate\fwupdate.exe
PRC - [2008/08/14 14:10:38 | 000,098,304 | R--- | M] (Orb Networks, Inc.) -- F:\Program Files\Kodak\Digital Display\OrbKodakLauncher\DllStartupService.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\explorer.exe
PRC - [2007/11/26 15:54:22 | 001,629,480 | ---- | M] (Nero AG) -- F:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
PRC - [2007/11/26 15:54:12 | 001,554,728 | ---- | M] (Nero AG) -- F:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
PRC - [2007/11/26 15:54:02 | 001,057,064 | ---- | M] (Nero AG) -- F:\Program Files\Nero\Nero 7\InCD\InCD.exe
PRC - [2007/03/15 19:16:42 | 000,454,784 | ---- | M] (Linksys, a Division of Cisco Systems, Inc.) -- C:\Program Files\Linksys EasyLink AdvisorNEW\LinksysAgent.exe
PRC - [2007/01/31 14:55:42 | 000,096,370 | ---- | M] (Canon Inc.) -- F:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- F:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/06/12 14:32:26 | 000,700,416 | ---- | M] () -- F:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
PRC - [2004/03/18 16:55:48 | 000,065,536 | ---- | M] (HP) -- F:\WINDOWS\system32\HPZipm12.exe


========== Modules (SafeList) ==========

MOD - [2010/09/30 18:37:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\Documents and Settings\Jim\Desktop\OTL.exe
MOD - [2009/07/20 12:29:06 | 000,045,584 | ---- | M] (Logitech, Inc.) -- F:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/07/20 12:25:22 | 000,064,016 | ---- | M] (Logitech, Inc.) -- F:\Program Files\Logitech\SetPoint\GameHook.dll
MOD - [2009/07/12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2008/04/13 20:12:00 | 001,384,479 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\system32\msvbvm60.dll
MOD - [2008/04/13 20:11:52 | 000,158,720 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\system32\dinput.dll
MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- F:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- F:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/08/24 14:57:38 | 000,188,136 | ---- | M] (McAfee, Inc.) [Auto | Running] -- F:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe -- (mfefire)
SRV - [2010/08/24 14:57:38 | 000,171,168 | ---- | M] () [Unknown | Running] -- F:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2010/08/24 14:57:38 | 000,141,792 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- F:\Program Files\Common Files\Mcafee\SystemCore\mfevtps.exe -- (mfevtp)
SRV - [2010/05/14 12:59:44 | 000,455,944 | ---- | M] () [Auto | Running] -- F:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2010/04/28 17:13:42 | 000,820,488 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- F:\WINDOWS\Temp\0245991285971058mcinst.exe -- (0245991285971058mcinstcleanup) McAfee Application Installer Cleanup (0245991285971058)
SRV - [2010/04/15 09:45:10 | 000,364,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- F:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2010/03/10 10:14:44 | 000,271,480 | ---- | M] (McAfee, Inc.) [Auto | Running] -- F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2009/07/20 12:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- F:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2008/08/14 14:10:38 | 000,098,304 | R--- | M] (Orb Networks, Inc.) [Auto | Running] -- F:\Program Files\Kodak\Digital Display\OrbKodakLauncher\DllStartupService.exe -- (KodakDigitalDisplayService)
SRV - [2007/11/26 15:54:12 | 001,554,728 | ---- | M] (Nero AG) [Auto | Running] -- F:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2007/01/31 14:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Running] -- F:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2007/01/04 17:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- F:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2004/03/18 16:55:48 | 000,065,536 | ---- | M] (HP) [On_Demand | Running] -- F:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- F:\DOCUME~1\Jim\LOCALS~1\Temp\kbeepm.sys -- (kbeepm)
DRV - File not found [Kernel | On_Demand | Stopped] -- F:\WINDOWS\System32\drivers\EagleNT.sys -- (EagleNT)
DRV - [2010/08/24 14:57:38 | 000,386,712 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- F:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2010/08/24 14:57:38 | 000,312,904 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2010/08/24 14:57:38 | 000,152,992 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2010/08/24 14:57:38 | 000,095,600 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2010/08/24 14:57:38 | 000,088,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)
DRV - [2010/08/24 14:57:38 | 000,088,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)
DRV - [2010/08/24 14:57:38 | 000,084,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2010/08/24 14:57:38 | 000,084,072 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)
DRV - [2010/08/24 14:57:38 | 000,055,840 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)
DRV - [2010/08/24 14:57:38 | 000,052,104 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2010/07/09 18:38:00 | 010,604,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2010/06/20 12:12:59 | 000,278,984 | ---- | M] () [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010/06/20 11:59:42 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/06/17 12:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 12:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/06/17 12:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2008/12/14 21:03:24 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto | Running] -- F:\WINDOWS\system32\SVKP.sys -- (SVKP)
DRV - [2008/04/13 14:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/01/29 23:28:36 | 004,725,760 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/12/05 09:45:30 | 000,104,064 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007/11/26 15:54:12 | 000,038,440 | ---- | M] (Nero AG) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm)
DRV - [2007/11/26 15:54:12 | 000,036,776 | ---- | M] (Nero AG) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass)
DRV - [2007/11/26 15:54:02 | 000,118,952 | ---- | M] (Nero AG) [File_System | Disabled | Running] -- F:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2007/04/11 15:33:06 | 000,079,376 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2007/04/11 15:32:38 | 000,063,248 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- F:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2007/03/22 13:57:14 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\elagopro.sys -- (elagopro)
DRV - [2007/03/22 13:57:14 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- F:\WINDOWS\system32\drivers\elaunidr.sys -- (elaunidr)
DRV - [2006/07/01 22:39:40 | 000,036,864 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- F:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/08/14 20:00:00 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- F:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



IE - HKU\S-1-5-21-789336058-261903793-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.pogo.com/
IE - HKU\S-1-5-21-789336058-261903793-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-789336058-261903793-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.drudgereport.com/"
FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: wowrealmwatcher@mozilla.org:0.4
FF - prefs.js..extensions.enabledItems: {38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}:1.0.3.118
FF - prefs.js..extensions.enabledItems: yyginstantplay@yoyogames.com:1.1.0.24
FF - prefs.js..network.proxy.no_proxies_on: "*.local"


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/16 21:36:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/16 21:36:19 | 000,000,000 | ---D | M]

[2008/09/16 21:15:11 | 000,000,000 | ---D | M] -- F:\Documents and Settings\Jim\Application Data\Mozilla\Extensions
[2010/09/30 19:20:18 | 000,000,000 | ---D | M] -- F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Profiles\opcuv1ww.default\extensions
[2010/09/17 20:07:44 | 000,000,000 | ---D | M] (Forecastfox Weather) -- F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Profiles\opcuv1ww.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/06/16 18:29:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Profiles\opcuv1ww.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/16 16:27:13 | 000,000,000 | ---D | M] () -- F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Profiles\opcuv1ww.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}
[2008/11/08 19:59:33 | 000,000,000 | ---D | M] -- F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Profiles\opcuv1ww.default\extensions\wowrealmwatcher@mozilla.org
[2010/09/08 13:53:16 | 000,000,000 | ---D | M] -- F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Profiles\opcuv1ww.default\extensions\yyginstantplay@yoyogames.com

O1 HOSTS File: ([2010/09/25 14:55:45 | 000,000,780 | ---- | M]) - F:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 64.71.248.152 download.mcafee.com
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - F:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20100915002538.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-789336058-261903793-682003330-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [ae0965a7157cdae0965a7157cd] F:\Documents and Settings\Jim\Local Settings\Temp\kyEi.exe ()
O4 - HKLM..\Run: [Alcmtr] F:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ArcSoft Connection Service] F:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [BrowserPlusBrowserPlusUninstaller] F:\Documents and Settings\Jim\Local Settings\Temp\kyEi.exe ()
O4 - HKLM..\Run: [InCD] F:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] F:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LanguageShortcut] F:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LGODDFU] F:\Program Files\lg_fwupdate\fwupdate.exe (BL)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] F:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [mcui_exe] F:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] F:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] F:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] F:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] F:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [QuickTimeQuickTimeResources] F:\Program Files\QuickTime\QuickTimePlayer.Resources\de.lproj\QuickTimeResourcesQuickTime7.6.41327.58.exe ()
O4 - HKLM..\Run: [SecurDisc] F:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (Nero AG)
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1004..\Run: [Aim6] File not found
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1004..\Run: [CTSyncU.exe] F:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1004..\Run: [Desktop Security] F:\Documents and Settings\Jim\Application Data\Desktop Security\Desktop Security 2010.exe ()
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1004..\Run: [EasyLinkAdvisor] C:\Program Files\Linksys EasyLink AdvisorNEW\LinksysAgent.exe (Linksys, a Division of Cisco Systems, Inc.)
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1004..\Run: [hgufrjuvdfwr] F:\Documents and Settings\Jim\Local Settings\Temp\m.25FA.tmp.exe ()
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1004..\Run: [SecurityCenter] F:\Documents and Settings\Jim\Application Data\Desktop Security\securitycenter.exe ()
O4 - HKU\S-1-5-21-789336058-261903793-682003330-1006..\Run: [EasyLinkAdvisor] C:\Program Files\Linksys EasyLink AdvisorNEW\LinksysAgent.exe (Linksys, a Division of Cisco Systems, Inc.)
O4 - HKLM..\RunServices: [BrowserPlusBrowserPlusUninstaller] F:\Documents and Settings\Jim\Local Settings\Temp\kyEi.exe ()
O4 - HKLM..\RunServices: [BrowserPlusUninstallerae0965a7157cd] F:\Documents and Settings\Jim\Local Settings\Temp\kyEi.exe ()
O4 - HKLM..\RunServices: [QuickTimeQuickTimeResources] F:\Program Files\QuickTime\QuickTimePlayer.Resources\de.lproj\QuickTimeResourcesQuickTime7.6.41327.58.exe ()
O4 - HKLM..\RunServices: [QuickTimeResourcesQuickTime] f:\Program Files\QuickTime\QuickTimePlayer.Resources\de.lproj\QuickTimeResourcesQuickTime7.6.41327.58.exe ()
O4 - HKLM..\RunServices: [QuickTimeResourcesQuickTime7.6.4] f:\Program Files\QuickTime\QTSystem\QuickTime3GPPAuthoring.Resources\pt_PT.lproj\QuickTimeResourcesQuickTimeResources.exe ()
O4 - HKLM..\RunServices: [QuickTimeResourcesQuickTime7.6.41327.58] f:\Program Files\QuickTime\QTSystem\QuickTimeMPEG.Resources\nl.lproj\QuickTimeResourcesQuickTime.exe ()
O4 - HKLM..\RunServices: [QuickTimeResourcesQuickTime7.6.51327.80] f:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\QuickTimeResourcesQuickTime.exe ()
O4 - HKLM..\RunServices: [QuickTimeResourcesQuickTimeResources] f:\Program Files\QuickTime\QTSystem\QuickTime3GPP.Resources\ru.lproj\QuickTimeResourcesQuickTimeResources.exe ()
O4 - HKLM..\RunServices: [QuickTimeResourcesQuickTimeResources7.6.4] f:\Program Files\QuickTime\QTSystem\QuickTimeStreamingAuthoring.Resources\nb.lproj\QuickTimeResourcesQuickTimeResources7.6.4.exe ()
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk = F:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Co.)
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = F:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = F:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-789336058-261903793-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O7 - HKU\S-1-5-21-789336058-261903793-682003330-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - F:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - F:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} http://pcpitstop.com/internet/pcpConnCheck.cab (iCC Class)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} http://download.microsoft.com/download/B/3...44/igdtoolx.cab (IGDTester Class)
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} http://a.download.toontown.com/sv1.0.38.38/ttinst.cab (Toontown Installer ActiveX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.163.70,93.188.166.9
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - F:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - F:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (F:\WINDOWS\system32\userinit.exe) - F:\WINDOWS\system32\userinit.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - f:\program files\common files\logitech\bluetooth\LBTWlgn.dll - f:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - F:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\swupdate.dll (Adobe Systems Inc.)
O24 - Desktop WallPaper: F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: F:\Documents and Settings\Jim\Application Data\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/29 17:46:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{96060832-b537-11de-b03d-001fc6d9337e}\Shell\AutoRun\command - "" = G:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{96060832-b537-11de-b03d-001fc6d9337e}\Shell\install\command - "" = G:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{96060832-b537-11de-b03d-001fc6d9337e}\Shell\usermanualEnglish\command - "" = G:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{96060832-b537-11de-b03d-001fc6d9337e}\Shell\usermanualFrench\command - "" = G:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{96060832-b537-11de-b03d-001fc6d9337e}\Shell\usermanualSpanish\command - "" = G:\rcaeasyrip_setup.exe -- File not found
O33 - MountPoints2\{b4c8598c-c467-11dd-9c16-001fc6d9337e}\Shell\AutoRun\command - "" = G:\Setup_FlipShare.exe -- File not found
O33 - MountPoints2\{b4c8598c-c467-11dd-9c16-001fc6d9337e}\Shell\Setup FlipShare\command - "" = G:\Setup_FlipShare.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


SafeBootMin: AppMgmt - F:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: mcmscsvc - F:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SafeBootMin: MCODS - F:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: WdfLoadGroup -
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "F:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - Microsoft NetShow Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection F:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection F:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - F:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - f:\WINDOWS\system32\Rundll32.exe f:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - F:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - F:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - F:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "F:\WINDOWS\system32\rundll32.exe" "F:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - F:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - F:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - F:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - F:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.3IV2 - F:\WINDOWS\System32\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
Drivers32: vidc.cvid - F:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - F:\WINDOWS\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv31 - F:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - F:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - F:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - F:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.VP60 - F:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - F:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.wmv3 - F:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - F:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - F:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/10/01 18:10:21 | 000,000,000 | ---D | C] -- F:\WINDOWS\LastGood
[2010/10/01 08:07:19 | 000,575,488 | ---- | C] (OldTimer Tools) -- F:\Documents and Settings\Jim\Desktop\OTL.exe
[2010/09/27 16:54:59 | 000,000,000 | ---D | C] -- F:\Documents and Settings\Jim\Application Data\Desktop Security
[2010/09/25 14:48:21 | 000,000,000 | ---D | C] -- F:\Documents and Settings\All Users\Application Data\Citrix
[2010/09/25 14:14:21 | 000,000,000 | ---D | C] -- F:\Program Files\Citrix
[2010/09/25 14:14:13 | 000,000,000 | ---D | C] -- F:\Documents and Settings\Jim\Local Settings\Application Data\Citrix
[2010/09/25 13:18:16 | 000,000,000 | ---D | C] -- F:\Program Files\GMER
[2010/09/25 13:09:51 | 000,000,000 | ---D | C] -- F:\Program Files\Trend Micro
[2010/09/24 12:52:46 | 000,000,000 | ---D | C] -- F:\Documents and Settings\All Users\Application Data\Macromedia
[2010/09/23 22:55:37 | 000,000,000 | ---D | C] -- F:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/09/23 22:55:35 | 000,000,000 | ---D | C] -- F:\Documents and Settings\NetworkService\Application Data\Sun
[2010/09/23 21:54:29 | 000,000,000 | ---D | C] -- F:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/09/23 21:54:26 | 000,000,000 | ---D | C] -- F:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/09/22 01:47:52 | 000,000,000 | ---D | C] -- F:\Documents and Settings\LocalService\Application Data\Sun
[2010/09/22 01:02:15 | 000,000,000 | ---D | C] -- F:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/09/22 01:02:11 | 000,000,000 | ---D | C] -- F:\Documents and Settings\LocalService\Application Data\Adobe
[2010/09/18 18:09:00 | 000,000,000 | ---D | C] -- F:\spoolerlogs
[2010/09/18 17:47:01 | 000,026,112 | ---- | C] (Microsoft Corporation) -- F:\WINDOWS\System32\stu2.exe
[2010/09/15 23:39:26 | 000,000,000 | ---D | C] -- F:\Program Files\DVDFab 8
[2010/09/10 23:47:39 | 000,000,000 | ---D | C] -- F:\Documents and Settings\Jim\Desktop\Pheta
[2010/09/08 13:53:26 | 000,000,000 | ---D | C] -- F:\Documents and Settings\Jim\My Documents\YoYoGames
[2010/09/08 13:53:26 | 000,000,000 | ---D | C] -- F:\Documents and Settings\All Users\Application Data\YoYoGames
[2010/09/06 21:02:14 | 000,000,000 | ---D | C] -- F:\Documents and Settings\Jim\My Documents\Mom School
[2008/11/04 13:54:12 | 000,047,360 | ---- | C] (VSO Software) -- F:\Documents and Settings\Jim\Application Data\pcouffin.sys
[9 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
[9 F:\Documents and Settings\Jim\My Documents\*.tmp files -> F:\Documents and Settings\Jim\My Documents\*.tmp -> ]
[5 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2 F:\WINDOWS\System32\drivers\*.tmp files -> F:\WINDOWS\System32\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/10/01 18:03:49 | 000,000,868 | ---- | M] () -- F:\WINDOWS\tasks\Google Software Updater.job
[2010/10/01 18:03:24 | 000,000,294 | ---- | M] () -- F:\WINDOWS\lgfwup.ini
[2010/10/01 18:03:20 | 000,000,882 | ---- | M] () -- F:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/01 18:03:15 | 000,000,006 | -H-- | M] () -- F:\WINDOWS\tasks\SA.DAT
[2010/10/01 18:03:12 | 000,002,048 | --S- | M] () -- F:\WINDOWS\bootstat.dat
[2010/10/01 08:08:36 | 005,767,168 | -H-- | M] () -- F:\Documents and Settings\Jim\NTUSER.DAT
[2010/09/30 19:46:00 | 000,000,886 | ---- | M] () -- F:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/30 19:09:16 | 000,013,646 | ---- | M] () -- F:\WINDOWS\System32\wpa.dbl
[2010/09/30 18:37:02 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\Documents and Settings\Jim\Desktop\OTL.exe
[2010/09/27 16:55:00 | 000,001,871 | ---- | M] () -- F:\Documents and Settings\Jim\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop Security.lnk
[2010/09/26 21:33:55 | 000,016,384 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\1lab.xls
[2010/09/26 20:52:43 | 000,002,473 | ---- | M] () -- F:\Documents and Settings\Jim\Desktop\Microsoft Word.lnk
[2010/09/26 15:43:42 | 000,015,360 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Julie Book 1.xls
[2010/09/26 13:47:02 | 000,030,208 | ---- | M] () -- F:\WINDOWS\System32\userinit.exe
[2010/09/26 13:24:04 | 000,002,471 | ---- | M] () -- F:\Documents and Settings\Jim\Desktop\Microsoft Excel.lnk
[2010/09/25 22:23:06 | 000,022,016 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Sunday School Folder Labels.doc
[2010/09/25 22:16:02 | 000,022,528 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Sunday School 3 and 5 names 2010.doc
[2010/09/25 22:04:07 | 000,022,016 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Sunday School Labels 1 2010.doc
[2010/09/25 18:47:24 | 000,058,880 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Sunday School intro letter.doc
[2010/09/25 14:14:11 | 000,103,784 | ---- | M] () -- F:\Documents and Settings\Jim\GoToAssistDownloadHelper.exe
[2010/09/25 13:13:06 | 000,000,000 | ---- | M] () -- F:\Documents and Settings\Jim\defogger_reenable
[2010/09/23 22:55:34 | 000,000,664 | ---- | M] () -- F:\WINDOWS\System32\d3d9caps.dat
[2010/09/22 03:48:54 | 000,001,915 | ---- | M] () -- F:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/09/21 23:51:24 | 000,019,456 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Voice Lessons 2010-2011.doc
[2010/09/19 08:54:03 | 000,027,648 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Questions for your Special Educator 1.doc
[2010/09/19 00:01:06 | 000,340,480 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Spaghetti_Supper_Invitation 2010.doc
[2010/09/18 23:57:01 | 000,027,648 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Questions for your Special Educator.doc
[2010/09/18 19:46:02 | 000,000,432 | ---- | M] () -- F:\WINDOWS\tasks\EasyShare Registration Task.job
[2010/09/18 17:46:58 | 000,000,069 | ---- | M] () -- F:\WINDOWS\NeroDigital.ini
[2010/09/18 07:47:21 | 025,698,719 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Civ_V_Manual_English_v1.0.pdf
[2010/09/16 07:56:47 | 000,037,376 | ---- | M] () -- F:\Documents and Settings\Jim\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/16 03:03:50 | 000,001,374 | ---- | M] () -- F:\WINDOWS\imsins.BAK
[2010/09/13 23:14:08 | 000,019,456 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Dance 2010-11.doc
[2010/09/11 23:18:00 | 000,881,152 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\2010 Marathon Water Table Info.doc
[2010/09/11 17:44:14 | 000,002,645 | ---- | M] () -- F:\Documents and Settings\All Users\Documents\Global.sw2
[2010/09/10 17:42:34 | 000,019,456 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Day 1.doc
[2010/09/10 17:42:29 | 000,897,024 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Economics.doc
[2010/09/08 19:45:44 | 000,000,709 | ---- | M] () -- F:\Documents and Settings\Jim\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/09/08 19:45:44 | 000,000,709 | ---- | M] () -- F:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/09/08 19:01:12 | 000,000,162 | -H-- | M] () -- F:\Documents and Settings\Jim\My Documents\~$lie Summer History.doc
[2010/09/08 02:36:01 | 000,027,136 | ---- | M] () -- F:\Documents and Settings\Jim\Desktop\2010 Cross Country Important Dates.doc
[2010/09/08 02:34:07 | 000,042,496 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\ARMS schedule 10-11 Eckert 8th Grade.doc
[2010/09/08 02:18:02 | 000,041,984 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\ARMS schedule 10-11 Eckert 7th Grade.doc
[2010/09/08 02:12:28 | 000,199,680 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Christmas Card Labels 2010.doc
[2010/09/08 02:12:13 | 000,200,704 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Christmas Card Labels 2009.doc
[2010/09/08 02:11:52 | 000,897,024 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Julie Summer History.doc
[2010/09/08 01:27:37 | 000,019,456 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\First Day of School 9.doc
[2010/09/07 23:42:01 | 000,022,528 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Recreation Report.doc
[2010/09/07 21:03:18 | 000,019,968 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Supply list.doc
[2010/09/07 15:06:06 | 000,020,992 | ---- | M] () -- F:\Documents and Settings\Jim\Desktop\Letter of Interest Kathy.doc
[2010/09/07 14:15:57 | 000,033,280 | ---- | M] () -- F:\Documents and Settings\Jim\Desktop\RESUME Kathy.doc
[2010/09/06 21:12:15 | 000,041,472 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\ARMS schedule 10-11 Eckert Students blank.doc
[2010/09/04 22:28:29 | 000,025,088 | ---- | M] () -- F:\Documents and Settings\Jim\My Documents\Julie History checklist.doc
[9 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
[9 F:\Documents and Settings\Jim\My Documents\*.tmp files -> F:\Documents and Settings\Jim\My Documents\*.tmp -> ]
[5 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2 F:\WINDOWS\System32\drivers\*.tmp files -> F:\WINDOWS\System32\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/27 16:55:00 | 000,001,871 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\Microsoft\Internet Explorer\Quick Launch\Desktop Security.lnk
[2010/09/26 21:33:55 | 000,016,384 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\1lab.xls
[2010/09/26 15:43:42 | 000,015,360 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Julie Book 1.xls
[2010/09/25 22:23:06 | 000,022,016 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Sunday School Folder Labels.doc
[2010/09/25 22:16:02 | 000,022,528 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Sunday School 3 and 5 names 2010.doc
[2010/09/25 22:04:07 | 000,022,016 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Sunday School Labels 1 2010.doc
[2010/09/25 14:14:10 | 000,103,784 | ---- | C] () -- F:\Documents and Settings\Jim\GoToAssistDownloadHelper.exe
[2010/09/25 13:13:06 | 000,000,000 | ---- | C] () -- F:\Documents and Settings\Jim\defogger_reenable
[2010/09/22 03:48:54 | 000,001,915 | ---- | C] () -- F:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/09/22 01:47:52 | 000,000,664 | ---- | C] () -- F:\WINDOWS\System32\d3d9caps.dat
[2010/09/21 23:51:24 | 000,019,456 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Voice Lessons 2010-2011.doc
[2010/09/19 08:54:03 | 000,027,648 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Questions for your Special Educator 1.doc
[2010/09/19 00:01:05 | 000,340,480 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Spaghetti_Supper_Invitation 2010.doc
[2010/09/18 07:47:00 | 025,698,719 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Civ_V_Manual_English_v1.0.pdf
[2010/09/13 23:11:54 | 000,019,456 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Dance 2010-11.doc
[2010/09/11 23:17:59 | 000,881,152 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\2010 Marathon Water Table Info.doc
[2010/09/10 17:42:34 | 000,019,456 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Day 1.doc
[2010/09/10 17:42:28 | 000,897,024 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Economics.doc
[2010/09/08 19:45:44 | 000,000,709 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/09/08 19:45:44 | 000,000,709 | ---- | C] () -- F:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/09/08 19:01:12 | 000,000,162 | -H-- | C] () -- F:\Documents and Settings\Jim\My Documents\~$lie Summer History.doc
[2010/09/08 02:36:00 | 000,027,136 | ---- | C] () -- F:\Documents and Settings\Jim\Desktop\2010 Cross Country Important Dates.doc
[2010/09/08 02:18:14 | 000,042,496 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\ARMS schedule 10-11 Eckert 8th Grade.doc
[2010/09/08 02:18:02 | 000,041,984 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\ARMS schedule 10-11 Eckert 7th Grade.doc
[2010/09/08 02:12:27 | 000,199,680 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Christmas Card Labels 2010.doc
[2010/09/08 01:21:18 | 000,019,456 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\First Day of School 9.doc
[2010/09/07 22:29:58 | 000,022,528 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Recreation Report.doc
[2010/09/07 21:03:18 | 000,019,968 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Supply list.doc
[2010/09/07 14:16:06 | 000,020,992 | ---- | C] () -- F:\Documents and Settings\Jim\Desktop\Letter of Interest Kathy.doc
[2010/09/07 14:15:56 | 000,033,280 | ---- | C] () -- F:\Documents and Settings\Jim\Desktop\RESUME Kathy.doc
[2010/09/06 21:12:14 | 000,041,472 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\ARMS schedule 10-11 Eckert Students blank.doc
[2010/09/04 22:26:35 | 000,025,088 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Julie History checklist.doc
[2010/09/04 21:04:27 | 000,027,648 | ---- | C] () -- F:\Documents and Settings\Jim\My Documents\Questions for your Special Educator.doc
[2010/07/12 21:33:37 | 000,000,023 | ---- | C] () -- F:\WINDOWS\BlendSettings.ini
[2010/06/20 11:59:43 | 000,278,984 | ---- | C] () -- F:\WINDOWS\System32\drivers\atksgt.sys
[2010/06/20 11:59:42 | 000,018,048 | ---- | C] () -- F:\WINDOWS\System32\drivers\lirsgt.sys
[2009/12/01 21:15:36 | 000,000,479 | ---- | C] () -- F:\WINDOWS\iScreensaver.ini
[2009/08/18 20:17:25 | 000,000,180 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\setup.log
[2009/08/18 20:17:22 | 000,000,760 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\setup_ldm.iss
[2009/05/23 21:15:06 | 000,043,520 | ---- | C] () -- F:\WINDOWS\System32\CmdLineExt03.dll
[2009/05/23 21:14:39 | 000,197,120 | ---- | C] () -- F:\WINDOWS\patchw32.dll
[2009/01/19 10:02:05 | 000,000,376 | ---- | C] () -- F:\WINDOWS\ODBC.INI
[2008/12/07 10:04:33 | 000,037,376 | ---- | C] () -- F:\Documents and Settings\Jim\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/07 10:04:05 | 000,000,069 | ---- | C] () -- F:\WINDOWS\NeroDigital.ini
[2008/11/04 13:54:19 | 000,000,034 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\pcouffin.log
[2008/11/04 13:54:12 | 000,087,608 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\inst.exe
[2008/11/04 13:54:12 | 000,007,887 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\pcouffin.cat
[2008/11/04 13:54:12 | 000,001,144 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\pcouffin.inf
[2008/10/26 21:56:23 | 000,001,028 | ---- | C] () -- F:\Documents and Settings\Jim\Application Data\WavCodec.wff
[2008/10/21 16:29:44 | 000,000,294 | ---- | C] () -- F:\WINDOWS\lgfwup.ini
[2008/09/18 19:18:45 | 000,000,010 | ---- | C] () -- F:\WINDOWS\WININIT.INI
[2008/09/16 20:59:26 | 000,000,126 | ---- | C] () -- F:\Documents and Settings\Jim\Local Settings\Application Data\fusioncache.dat
[2008/09/16 20:32:57 | 000,001,887 | ---- | C] () -- F:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/09/14 20:37:58 | 000,028,634 | ---- | C] () -- F:\WINDOWS\Ascd_log.ini
[2008/09/14 20:37:11 | 000,028,165 | ---- | C] () -- F:\WINDOWS\Ascd_tmp.ini
[2008/09/14 20:37:11 | 000,005,810 | R--- | C] () -- F:\WINDOWS\System32\drivers\ASACPI.sys
[2008/09/14 20:36:59 | 000,010,296 | ---- | C] () -- F:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/02/28 01:34:00 | 000,286,720 | ---- | C] () -- F:\WINDOWS\System32\nvnt4cpl.dll
[2008/02/19 02:33:34 | 000,446,352 | ---- | C] () -- F:\WINDOWS\System32\OpenQuicktimeLib.dll
[1999/01/22 14:46:58 | 000,065,536 | ---- | C] () -- F:\WINDOWS\System32\MSRTEDIT.DLL
[1998/01/12 04:00:00 | 000,040,448 | ---- | C] () -- F:\WINDOWS\System32\REGOBJ.DLL

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2007/11/07 08:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- F:\install.exe


< MD5 for: AGP440.SYS >
[2004/08/04 08:00:00 | 018,738,937 | ---- | M] () .cab file -- F:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/17 18:55:50 | 023,852,652 | ---- | M] () .cab file -- F:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/17 18:55:50 | 023,852,652 | ---- | M] () .cab file -- F:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- F:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- F:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 08:00:00 | 018,738,937 | ---- | M] () .cab file -- F:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/17 18:55:50 | 023,852,652 | ---- | M] () .cab file -- F:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/17 18:55:50 | 023,852,652 | ---- | M] () .cab file -- F:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- F:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- F:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 08:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- F:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2002/10/24 15:59:48 | 000,087,040 | ---- | M] () MD5=F1D915C3870E741D83B5142F3B358761 -- F:\RECYCLER\S-1-5-21-789336058-261903793-682003330-1004\Df126\plugin\!Critical\Large IDE-Fix\files\sp2\atapi.sys
[2002/10/24 15:59:48 | 000,087,040 | ---- | M] () MD5=F1D915C3870E741D83B5142F3B358761 -- F:\RECYCLER\S-1-5-21-789336058-261903793-682003330-1004\Df48\!Critical\Large IDE-Fix\files\sp2\atapi.sys
[2002/10/24 15:59:48 | 000,087,040 | ---- | M] () MD5=F1D915C3870E741D83B5142F3B358761 -- F:\RECYCLER\S-1-5-21-789336058-261903793-682003330-1004\Df79\!Critical\Large IDE-Fix\files\sp2\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- F:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- F:\WINDOWS\system32\eventlog.dll
[2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- F:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- F:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- F:\WINDOWS\system32\netlogon.dll
[2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- F:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 08:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- F:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- F:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- F:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- F:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- F:\WINDOWS\system32\dxtrans.dll
[5 F:\WINDOWS\system32\*.tmp files -> F:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2 F:\WINDOWS\system32\drivers\*.tmp files -> F:\WINDOWS\system32\drivers\*.tmp -> ]

< %systemroot%\System32\config\*.sav >
[2008/09/15 04:00:26 | 000,094,208 | ---- | M] () -- F:\WINDOWS\system32\config\default.sav
[2008/09/15 04:00:26 | 000,634,880 | ---- | M] () -- F:\WINDOWS\system32\config\software.sav
[2008/09/15 04:00:26 | 000,905,216 | ---- | M] () -- F:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2010/08/24 14:57:38 | 000,055,840 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\cfwids.sys
[2010/08/24 14:57:38 | 000,095,600 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfeapfk.sys
[2010/08/24 14:57:38 | 000,152,992 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfeavfk.sys
[2010/08/24 14:57:38 | 000,052,104 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfebopk.sys
[2010/08/24 14:57:38 | 000,009,344 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfeclnk.sys
[2010/08/24 14:57:38 | 000,312,904 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfefirek.sys
[2010/08/24 14:57:38 | 000,386,712 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfehidk.sys
[2010/08/24 14:57:38 | 000,088,544 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfendisk.sys
[2010/08/24 14:57:38 | 000,084,264 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mferkdet.sys
[2010/08/24 14:57:38 | 000,084,072 | ---- | M] (McAfee, Inc.) -- F:\WINDOWS\system32\drivers\mfetdi2k.sys
[2010/07/09 18:38:00 | 010,604,128 | ---- | M] (NVIDIA Corporation) -- F:\WINDOWS\system32\drivers\nv4_mini.sys
[2 F:\WINDOWS\system32\drivers\*.tmp files -> F:\WINDOWS\system32\drivers\*.tmp -> ]
< End of report >

There's no Extra.txtx anywhere on the desktop. Sorry.

EDIT - on other computer. There was no other .txt file open and minimized, and nothing on the desktop named Extra or anything like it. Not sure if I did anything wrong or the virus was getting worse. When I typed the original message above, each letter would slowly appear. Again, I appreciate your help with this.

Edited by Griswel, 01 October 2010 - 05:47 PM.

Hi,

OTL will only create extras.txt on the first run. So it is not an issue that it didn't appear.

Please run a scan with Rootkit Unhooker:

Please download Rootkit Unhooker and save it to your Desktop

• Double-click on RKUnhookerLE to run it
• Click the Report tab, then click Scan
• Check Drivers, Stealth, and uncheck the rest
• Click OK
• Wait until it's finished and then go to File > Save Report
• Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

And make a backup of your MBR:

• Please download mbr.exe and save it to C:\windows <- (Important!).
• Open NOTEPAD and copy/paste the text in the quotebox below into it:
  
  CODE
  @ECHO OFF
  CD "%~DP0"
  MBR -c 0 1 backup_mbr.zip
  DEL %0
  
  
• Save this as mbrlook.bat. Choose to "Save type as - All Files" and save it to your Desktop.
  It should look like this:
  
• Double click the mbrlook.bat to run it.
• A file named mbr.zip will be created on your desktop. Please attach that to your next reply.

Once we have the backup of the file, I'll give you the instructions to replace the MBR.

Do you have a Windows CD?

regards myrti

I do have the install disk. I assume F:/Windows is needed if my main disk is F.

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0xB4BF3000 F:\WINDOWS\system32\DRIVERS\nv4_mini.sys 10604544 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 258.96 )
0xBD012000 F:\WINDOWS\System32\nv4_disp.dll 6344704 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 258.96 )
0xACF48000 F:\WINDOWS\system32\drivers\RtkHDAud.sys 4894720 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0x804D7000 F:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 F:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xB7DEB000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xA3D16000 F:\WINDOWS\system32\DRIVERS\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)
0xAB4B6000 F:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB4A11000 F:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xB7EA2000 mfehidk.sys 380928 bytes (McAfee, Inc., McAfee Link Driver)
0xACE54000 F:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA2747000 F:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)
0xB4A6F000 F:\WINDOWS\system32\drivers\mfefirek.sys 307200 bytes (McAfee, Inc., McAfee Core Firewall Engine Driver)
0xBFFA0000 F:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA2A6B000 F:\WINDOWS\system32\DRIVERS\atksgt.sys 274432 bytes
0xA11E2000 F:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xB7F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA3748000 F:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB7DBE000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xA2007000 F:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xAB795000 F:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB4B56000 F:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xAC80A000 F:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xA2AAE000 F:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xB4AE2000 F:\WINDOWS\system32\drivers\mfeavfk.sys 147456 bytes (McAfee, Inc., Anti-Virus File System Filter Driver)
0xACF24000 F:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB4BA1000 F:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB4B7E000 F:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAC3E9000 F:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x806E4000 ACPI_HAL 134400 bytes
0x806E4000 F:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB7F11000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB7F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xACEC0000 F:\WINDOWS\system32\drivers\InCDFs.sys 114688 bytes (Nero AG, InCD File System Driver)
0xB7DA4000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB4BC5000 F:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 106496 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver )
0xB7F31000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xB7E8B000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB4B17000 F:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA1EB1000 F:\WINDOWS\system32\drivers\mfeapfk.sys 90112 bytes (McAfee, Inc., Access Protection Filter Driver)
0xA3AD9000 F:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB4B2E000 F:\WINDOWS\system32\DRIVERS\mfendisk.sys 81920 bytes (McAfee, Inc., McAfee NDIS Intermediate Driver)
0xB4B42000 F:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xB4BDF000 F:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xACEAD000 F:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xACD80000 F:\WINDOWS\system32\drivers\mfetdi2k.sys 77824 bytes (McAfee, Inc., Anti-Virus Mini-Firewall Driver)
0xB7E78000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBD000000 F:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xB7EFF000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xB7F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB4B06000 F:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xA3F3A000 F:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xB8318000 F:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xB5680000 F:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xAE8C9000 F:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xB56A0000 F:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xB81F8000 F:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xB8208000 F:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xB82F8000 F:\WINDOWS\system32\DRIVERS\AmdK8.sys 57344 bytes (Advanced Micro Devices, AMD Processor Driver)
0xB80E8000 F:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xA4EDC000 F:\WINDOWS\system32\DRIVERS\HPZid412.sys 53248 bytes (HP, IEEE-1284.4-1999 Driver (Windows 2000))
0xB5670000 F:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xB80C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xA3F4A000 F:\WINDOWS\system32\DRIVERS\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xB5620000 F:\WINDOWS\System32\Drivers\pcouffin.sys 49152 bytes (VSO Software, low level access layer for CD/DVD/BD devices)
0xB5650000 F:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xB8178000 F:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xB8308000 F:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xA222E000 F:\WINDOWS\system32\drivers\mfebopk.sys 45056 bytes (McAfee, Inc., Buffer Overflow Protection Driver)
0xB80B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xB5660000 F:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xB80A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xB8218000 F:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB5610000 F:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xB80D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xA4F0C000 F:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xB5690000 F:\WINDOWS\system32\drivers\InCDRm.sys 36864 bytes (Nero AG, Nero MRW Filter Driver)
0xB5640000 F:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xAE859000 F:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA1D00000 F:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xB80F8000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xB81B8000 F:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xB8390000 F:\WINDOWS\system32\drivers\InCDPass.sys 32768 bytes (Nero AG, Ahead RW Filter Driver)
0xA3E80000 F:\WINDOWS\system32\DRIVERS\LHidFilt.Sys 32768 bytes (Logitech, Inc., Logitech HID Filter Driver.)
0xA3E78000 F:\WINDOWS\system32\DRIVERS\LMouFilt.Sys 32768 bytes (Logitech, Inc., Logitech Mouse Filter Driver.)
0xAEA25000 F:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xA4C83000 F:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xB8378000 F:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xB8430000 F:\WINDOWS\system32\DRIVERS\elagopro.sys 28672 bytes (Gteko Ltd., Gteko's GoProto protocol driver)
0xB83A0000 F:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xAEA3D000 F:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xB8328000 F:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xA4C7B000 F:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xB8398000 F:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xA4C73000 F:\WINDOWS\system32\DRIVERS\HPZius12.sys 24576 bytes (HP, 1284.4<->Usb Datalink Driver (Windows 2000))
0xB83C8000 F:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xB83D0000 F:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xAEA35000 F:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xAEE6F000 F:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xAE9F5000 F:\WINDOWS\system32\DRIVERS\lirsgt.sys 20480 bytes
0xAEA2D000 F:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xB8330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xB83B8000 F:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xB83C0000 F:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xB83A8000 F:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xB8370000 F:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0xA3E70000 F:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xA5AFD000 F:\WINDOWS\system32\DRIVERS\HPZipr12.sys 16384 bytes (HP, IEEE-1284.4-1999 Print Class Driver)
0xA5B05000 F:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xB8594000 F:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA51D3000 F:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB8550000 F:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xA6B31000 F:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
0xB84B8000 F:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xACF00000 F:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xA6B35000 F:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xAEDD4000 F:\WINDOWS\System32\Drivers\InCDrec.SYS 12288 bytes (Nero AG, InCD File System Recognizer)
0xB8544000 F:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xB8558000 F:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xAEDD0000 F:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xB8606000 F:\WINDOWS\system32\DRIVERS\ASACPI.sys 8192 bytes (-, ATK0110 ACPI Utility)
0xB85AE000 F:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xAE4C8000 F:\WINDOWS\system32\DRIVERS\elaunidr.sys 8192 bytes (Gteko Ltd., GUniDriver)
0xB85AC000 F:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xB85A8000 F:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xB85B0000 F:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xA7529000 F:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xB85B2000 F:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xB860A000 F:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xB8610000 F:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xB85AA000 F:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xB879C000 F:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xA45DB000 F:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xAE59F000 F:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xB8670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xAE646000 F:\WINDOWS\system32\SVKP.sys 4096 bytes (AntiCracking, SVKP driver for NT)
!!!!!!!!!!!Hidden driver: 0x8AE78AEA ?_empty_? 1302 bytes
!!!!!!!!!!!Hidden driver: 0x8AE1A0F8 ?_empty_? 0 bytes
==============================================
>Stealth
==============================================
0xB7F31000 WARNING: suspicious driver modification [atapi.sys::0x8AE78AEA]
0x01C00000 Hidden Image-->EastmanKodakCompany.EasyShare.dll [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 270336 bytes
0x05440000 Hidden Image-->log4net.dll [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 282624 bytes
0x01C90000 Hidden Image-->Interop.CABLib.dll [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 36864 bytes
0x053A0000 Hidden Image-->KEDDS.EasyShareLibrary.dll [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 36864 bytes
0x05610000 Hidden Image-->msvcm80.dll [ EPROCESS 0x89A233E8 ] PID: 1828, 507904 bytes
0x05AE0000 Hidden Image-->msvcm80.dll [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 507904 bytes
0x090C0000 Hidden Image-->KEDDS.StoryShareLibrary.dll [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 61440 bytes
0x052D0000 Hidden Image-->ESCliWicMDRW.esx [ EPROCESS 0x89A233E8 ] PID: 1828, 761856 bytes
0x08940000 Hidden Image-->ESCliWicMDRW.esx [ EPROCESS 0x8ADB9DA0 ] PID: 3296, 761856 bytes
0xB7F31000 WARNING: Virus alike driver modification [atapi.sys], 98304 bytes

It looks like I was wrong about C: sorry if I messed up. There is no mbr.zip there is backupmbr.zip.

Hi,

Windows sometimes is great in its way. As long as you are dropping it in the windows folder, it will find it.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
• Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.
  
  "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt
  
  
• If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
• When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

regards myrti

Nothing's easy.

I downloaded the TDSSKiller.exe, extracted to the desktop, and pasted the command you gave into "Run", quotation marks and all. However, when I hit enter, it merely started the program. Now, at first, I got a popup box warning me that I was using an .exe file and did I want to be warned every time I ran it. I checked no, and tried again. Again, the TDSSKiller didn't run any command, it just popped up a normal "choose what you want to do" box (but without the "are you sure you want to run an actual program on your computer?" warning box, it went straight to TDSSKiller). So I tried it. I ran a scan with both boxes checked. I closed out the box and hit report, hoping to manually paste what it had in it (there seemed to be a report), but the computer restarted with a brief blue screen I could not read.

I tried it again, figuring by now the computer had restarted - and you never know - but again the command simply made the program start, not run and create a report. So I hit "scan" again. It gives a box with some info, it found two threats like I mentioned in the very first post, but it was not a real report, so I hit report and again the computer restarted.

I had downloaded TDSSKiller.exe earlier, but I made sure to do a fresh download. I extracted to the desktop. I copied and pasted the command and I'm sure I got the quotation marks. Sorry everything's complicated. I appreciate your patience.

EDIT - I realized when I decided to try again that McAfees is still partially running in the background. I cannot disable it either from the Secutiry menu, from McAfees itself (it's no longer an option, so far as I can see). So I decided to uninstall it, which I intend to do anyway. Well, when the add/remove box finally populated, I chose McAfees, and it popped up a blank list and said to choose what I wanted to remove. I also can't simply manually remove the files from the harddrive, either. If this is the reason TDSSKiller won;t work, any suggestions would be appreciated.

Edited by Griswel, 05 October 2010 - 06:41 PM.

Hi,

can you try to run TDSSKiller by double-clicking. If that won't work, please try running it from safe mode, that should at least disable McAfee.

regards myrti

Took a few tries, finally hit "skip" instead of just closing out the TDSSKiller box. Here's the report:

2010/10/06 19:12:01.0265 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/06 19:12:01.0265 ================================================================================
2010/10/06 19:12:01.0265 SystemInfo:
2010/10/06 19:12:01.0265
2010/10/06 19:12:01.0265 OS Version: 5.1.2600 ServicePack: 3.0
2010/10/06 19:12:01.0265 Product type: Workstation
2010/10/06 19:12:01.0265 ComputerName: BLACKHANDLE
2010/10/06 19:12:01.0265 UserName: Jim
2010/10/06 19:12:01.0265 Windows directory: F:\WINDOWS
2010/10/06 19:12:01.0265 System windows directory: F:\WINDOWS
2010/10/06 19:12:01.0265 Processor architecture: Intel x86
2010/10/06 19:12:01.0265 Number of processors: 2
2010/10/06 19:12:01.0265 Page size: 0x1000
2010/10/06 19:12:01.0265 Boot type: Safe boot
2010/10/06 19:12:01.0265 ================================================================================
2010/10/06 19:12:01.0781 Initialize success
2010/10/06 19:12:07.0671 ================================================================================
2010/10/06 19:12:07.0671 Scan started
2010/10/06 19:12:07.0671 Mode: Manual;
2010/10/06 19:12:07.0671 ================================================================================
2010/10/06 19:12:16.0843 ACPI (8fd99680a539792a30e97944fdaecf17) F:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/10/06 19:12:17.0406 ACPIEC (9859c0f6936e723e4892d7141b1327d5) F:\WINDOWS\system32\drivers\ACPIEC.sys
2010/10/06 19:12:18.0359 aec (8bed39e3c35d6a489438b8141717a557) F:\WINDOWS\system32\drivers\aec.sys
2010/10/06 19:12:19.0078 AFD (7e775010ef291da96ad17ca4b17137d7) F:\WINDOWS\System32\drivers\afd.sys
2010/10/06 19:12:21.0312 AmdK8 (efbb0956baed786e137351b5ca272aef) F:\WINDOWS\system32\DRIVERS\AmdK8.sys
2010/10/06 19:12:23.0468 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) F:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/10/06 19:12:23.0937 atapi (b450ab525d3793b48ca0881269b6cb87) F:\WINDOWS\system32\DRIVERS\atapi.sys
2010/10/06 19:12:23.0937 Suspicious file (Forged): F:\WINDOWS\system32\DRIVERS\atapi.sys. Real md5: b450ab525d3793b48ca0881269b6cb87, Fake md5: 9f3a2f5aa6875c72bf062c712cfa2674
2010/10/06 19:12:23.0953 atapi - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/10/06 19:12:25.0093 atksgt (3c4b9850a2631c2263507400d029057b) F:\WINDOWS\system32\DRIVERS\atksgt.sys
2010/10/06 19:12:25.0718 Atmarpc (9916c1225104ba14794209cfa8012159) F:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/10/06 19:12:26.0203 audstub (d9f724aa26c010a217c97606b160ed68) F:\WINDOWS\system32\DRIVERS\audstub.sys
2010/10/06 19:12:26.0656 Beep (da1f27d85e0d1525f6621372e7b685e9) F:\WINDOWS\system32\drivers\Beep.sys
2010/10/06 19:12:27.0109 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) F:\WINDOWS\system32\drivers\cbidf2k.sys
2010/10/06 19:12:28.0000 Cdaudio (c1b486a7658353d33a10cc15211a873b) F:\WINDOWS\system32\drivers\Cdaudio.sys
2010/10/06 19:12:28.0546 Cdfs (c885b02847f5d2fd45a24e219ed93b32) F:\WINDOWS\system32\drivers\Cdfs.sys
2010/10/06 19:12:29.0078 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) F:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/10/06 19:12:31.0656 Disk (044452051f3e02e7963599fc8f4f3e25) F:\WINDOWS\system32\DRIVERS\disk.sys
2010/10/06 19:12:32.0593 dmboot (d992fe1274bde0f84ad826acae022a41) F:\WINDOWS\system32\drivers\dmboot.sys
2010/10/06 19:12:33.0578 dmio (7c824cf7bbde77d95c08005717a95f6f) F:\WINDOWS\system32\drivers\dmio.sys
2010/10/06 19:12:34.0109 dmload (e9317282a63ca4d188c0df5e09c6ac5f) F:\WINDOWS\system32\drivers\dmload.sys
2010/10/06 19:12:34.0625 DMusic (8a208dfcf89792a484e76c40e5f50b45) F:\WINDOWS\system32\drivers\DMusic.sys
2010/10/06 19:12:35.0484 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) F:\WINDOWS\system32\drivers\drmkaud.sys
2010/10/06 19:12:36.0437 elagopro (7ec42ec12a4bac14bcca99fb06f2d125) F:\WINDOWS\system32\DRIVERS\elagopro.sys
2010/10/06 19:12:36.0921 elaunidr (dfeabb7cfffadea4a912ab95bdc3177a) F:\WINDOWS\system32\DRIVERS\elaunidr.sys
2010/10/06 19:12:37.0515 Fastfat (38d332a6d56af32635675f132548343e) F:\WINDOWS\system32\drivers\Fastfat.sys
2010/10/06 19:12:38.0031 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) F:\WINDOWS\system32\DRIVERS\fdc.sys
2010/10/06 19:12:38.0515 Fips (d45926117eb9fa946a6af572fbe1caa3) F:\WINDOWS\system32\drivers\Fips.sys
2010/10/06 19:12:39.0000 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) F:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/10/06 19:12:39.0531 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) F:\WINDOWS\system32\drivers\fltmgr.sys
2010/10/06 19:12:40.0062 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) F:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/10/06 19:12:40.0531 Ftdisk (6ac26732762483366c3969c9e4d2259d) F:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/10/06 19:12:41.0078 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) F:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/10/06 19:12:41.0531 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) F:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/10/06 19:12:42.0062 HDAudBus (573c7d0a32852b48f3058cfd8026f511) F:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/10/06 19:12:42.0546 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) F:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/10/06 19:12:43.0515 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) F:\WINDOWS\system32\DRIVERS\HPZid412.sys
2010/10/06 19:12:43.0968 HPZipr12 (89f41658929393487b6b7d13c8528ce3) F:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2010/10/06 19:12:44.0453 HPZius12 (2906949bd4e206f2bb0dd1896ce9f66f) F:\WINDOWS\system32\DRIVERS\HPZius12.sys
2010/10/06 19:12:45.0078 HTTP (f80a415ef82cd06ffaf0d971528ead38) F:\WINDOWS\system32\Drivers\HTTP.sys
2010/10/06 19:12:46.0531 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) F:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/10/06 19:12:47.0109 Imapi (083a052659f5310dd8b6a6cb05edcf8e) F:\WINDOWS\system32\DRIVERS\imapi.sys
2010/10/06 19:12:47.0671 InCDfs (b02a8a25192ee1c5e653628637ab6aaa) F:\WINDOWS\system32\drivers\InCDFs.sys
2010/10/06 19:12:48.0156 InCDPass (b49bd5b663e1af9bf3233b782b70d865) F:\WINDOWS\system32\drivers\InCDPass.sys
2010/10/06 19:12:48.0609 InCDrec (8fd364edbd97983575cee3e8909e62b4) F:\WINDOWS\system32\drivers\InCDrec.sys
2010/10/06 19:12:49.0046 incdrm (fc04e827133d54ab79ca254708f76cd0) F:\WINDOWS\system32\drivers\InCDRm.sys
2010/10/06 19:12:52.0718 IntcAzAudAddService (f7f3328544e1ac2e97caea9b39d9b9de) F:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/10/06 19:12:56.0421 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) F:\WINDOWS\system32\drivers\ip6fw.sys
2010/10/06 19:12:56.0890 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) F:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/10/06 19:12:57.0343 IpInIp (b87ab476dcf76e72010632b5550955f5) F:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/10/06 19:12:57.0890 IpNat (cc748ea12c6effde940ee98098bf96bb) F:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/10/06 19:12:58.0468 IPSec (23c74d75e36e7158768dd63d92789a91) F:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/10/06 19:12:59.0015 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) F:\WINDOWS\system32\DRIVERS\irenum.sys
2010/10/06 19:12:59.0484 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) F:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/10/06 19:13:00.0031 Kbdclass (463c1ec80cd17420a542b7f36a36f128) F:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/10/06 19:13:00.0578 kbdhid (9ef487a186dea361aa06913a75b3fa99) F:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/10/06 19:13:01.0578 kmixer (692bcf44383d056aed41b045a323d378) F:\WINDOWS\system32\drivers\kmixer.sys
2010/10/06 19:13:02.0265 KSecDD (b467646c54cc746128904e1654c750c1) F:\WINDOWS\system32\drivers\KSecDD.sys
2010/10/06 19:13:02.0765 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) F:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
2010/10/06 19:13:03.0281 L8042mou (bea61fda2103f6f51b14eb0872e8a050) F:\WINDOWS\system32\DRIVERS\L8042mou.Sys
2010/10/06 19:13:04.0265 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) F:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
2010/10/06 19:13:04.0765 lirsgt (975b6cf65f44e95883f3855bae8cecaf) F:\WINDOWS\system32\DRIVERS\lirsgt.sys
2010/10/06 19:13:05.0265 LMouFilt (ab33792a87285344f43b5ce23421bab0) F:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
2010/10/06 19:13:05.0750 LMouKE (cab504e38fced9a56d87d838e9ba13e9) F:\WINDOWS\system32\DRIVERS\LMouKE.Sys
2010/10/06 19:13:06.0281 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) F:\WINDOWS\system32\drivers\mnmdd.sys
2010/10/06 19:13:06.0796 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) F:\WINDOWS\system32\drivers\Modem.sys
2010/10/06 19:13:07.0265 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) F:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/10/06 19:13:07.0750 mouhid (b1c303e17fb9d46e87a98e4ba6769685) F:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/10/06 19:13:08.0187 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) F:\WINDOWS\system32\drivers\MountMgr.sys
2010/10/06 19:13:09.0250 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) F:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/10/06 19:13:10.0078 MRxSmb (f3aefb11abc521122b67095044169e98) F:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/10/06 19:13:10.0828 Msfs (c941ea2454ba8350021d774daf0f1027) F:\WINDOWS\system32\drivers\Msfs.sys
2010/10/06 19:13:11.0296 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) F:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/10/06 19:13:11.0734 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) F:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/10/06 19:13:12.0140 MSPQM (bad59648ba099da4a17680b39730cb3d) F:\WINDOWS\system32\drivers\MSPQM.sys
2010/10/06 19:13:12.0593 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) F:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/10/06 19:13:13.0062 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) F:\WINDOWS\system32\DRIVERS\ASACPI.sys
2010/10/06 19:13:13.0531 Mup (2f625d11385b1a94360bfc70aaefdee1) F:\WINDOWS\system32\drivers\Mup.sys
2010/10/06 19:13:14.0203 NDIS (1df7f42665c94b825322fae71721130d) F:\WINDOWS\system32\drivers\NDIS.sys
2010/10/06 19:13:14.0796 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) F:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/10/06 19:13:15.0250 Ndisuio (f927a4434c5028758a842943ef1a3849) F:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/10/06 19:13:15.0718 NdisWan (edc1531a49c80614b2cfda43ca8659ab) F:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/10/06 19:13:16.0203 NDProxy (6215023940cfd3702b46abc304e1d45a) F:\WINDOWS\system32\drivers\NDProxy.sys
2010/10/06 19:13:16.0671 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) F:\WINDOWS\system32\DRIVERS\netbios.sys
2010/10/06 19:13:17.0203 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) F:\WINDOWS\system32\DRIVERS\netbt.sys
2010/10/06 19:13:17.0796 Npfs (3182d64ae053d6fb034f44b6def8034a) F:\WINDOWS\system32\drivers\Npfs.sys
2010/10/06 19:13:18.0843 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) F:\WINDOWS\system32\drivers\Ntfs.sys
2010/10/06 19:13:19.0906 Null (73c1e1f395918bc2c6dd67af7591a3ad) F:\WINDOWS\system32\drivers\Null.sys
2010/10/06 19:13:27.0046 nv (ed9816dbaf6689542ea7d022631906a1) F:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2010/10/06 19:13:33.0953 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) F:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/10/06 19:13:34.0421 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) F:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/10/06 19:13:34.0937 Parport (5575faf8f97ce5e713d108c2a58d7c7c) F:\WINDOWS\system32\DRIVERS\parport.sys
2010/10/06 19:13:35.0437 PartMgr (beb3ba25197665d82ec7065b724171c6) F:\WINDOWS\system32\drivers\PartMgr.sys
2010/10/06 19:13:35.0875 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) F:\WINDOWS\system32\drivers\ParVdm.sys
2010/10/06 19:13:36.0328 PCI (a219903ccf74233761d92bef471a07b1) F:\WINDOWS\system32\DRIVERS\pci.sys
2010/10/06 19:13:37.0234 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) F:\WINDOWS\system32\DRIVERS\pciide.sys
2010/10/06 19:13:37.0750 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) F:\WINDOWS\system32\drivers\Pcmcia.sys
2010/10/06 19:13:38.0359 pcouffin (5b6c11de7e839c05248ced8825470fef) F:\WINDOWS\system32\Drivers\pcouffin.sys
2010/10/06 19:13:41.0390 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) F:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/10/06 19:13:41.0859 Processor (a32bebaf723557681bfc6bd93e98bd26) F:\WINDOWS\system32\DRIVERS\processr.sys
2010/10/06 19:13:42.0328 PSched (09298ec810b07e5d582cb3a3f9255424) F:\WINDOWS\system32\DRIVERS\psched.sys
2010/10/06 19:13:42.0781 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) F:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/10/06 19:13:43.0406 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) F:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/10/06 19:13:45.0937 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) F:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/10/06 19:13:46.0421 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) F:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/10/06 19:13:46.0890 RasPppoe (5bc962f2654137c9909c3d4603587dee) F:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/10/06 19:13:47.0375 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) F:\WINDOWS\system32\DRIVERS\raspti.sys
2010/10/06 19:13:47.0953 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) F:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/10/06 19:13:48.0468 RDPCDD (4912d5b403614ce99c28420f75353332) F:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/10/06 19:13:48.0984 RDPWD (6728e45b66f93c08f11de2e316fc70dd) F:\WINDOWS\system32\drivers\RDPWD.sys
2010/10/06 19:13:49.0625 redbook (f828dd7e1419b6653894a8f97a0094c5) F:\WINDOWS\system32\DRIVERS\redbook.sys
2010/10/06 19:13:50.0234 RTLE8023xp (7aa960ae3855aac44781d7dd04038aa1) F:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2010/10/06 19:13:50.0765 Secdrv (90a3935d05b494a5a39d37e71f09a677) F:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/10/06 19:13:51.0234 serenum (0f29512ccd6bead730039fb4bd2c85ce) F:\WINDOWS\system32\DRIVERS\serenum.sys
2010/10/06 19:13:51.0718 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) F:\WINDOWS\system32\DRIVERS\serial.sys
2010/10/06 19:13:52.0218 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) F:\WINDOWS\system32\drivers\Sfloppy.sys
2010/10/06 19:13:53.0500 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) F:\WINDOWS\system32\drivers\splitter.sys
2010/10/06 19:13:53.0968 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) F:\WINDOWS\system32\DRIVERS\sr.sys
2010/10/06 19:13:54.0671 Srv (da852e3e0bf1cea75d756f9866241e57) F:\WINDOWS\system32\DRIVERS\srv.sys
2010/10/06 19:13:55.0328 SVKP (f05028b163b92c302a74409d683ac9b0) F:\WINDOWS\system32\SVKP.sys
2010/10/06 19:13:55.0984 swenum (3941d127aef12e93addf6fe6ee027e0f) F:\WINDOWS\system32\DRIVERS\swenum.sys
2010/10/06 19:13:56.0437 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) F:\WINDOWS\system32\drivers\swmidi.sys
2010/10/06 19:13:58.0562 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) F:\WINDOWS\system32\drivers\sysaudio.sys
2010/10/06 19:13:59.0281 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) F:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/10/06 19:13:59.0953 TDPIPE (6471a66807f5e104e4885f5b67349397) F:\WINDOWS\system32\drivers\TDPIPE.sys
2010/10/06 19:14:00.0406 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) F:\WINDOWS\system32\drivers\TDTCP.sys
2010/10/06 19:14:00.0890 TermDD (88155247177638048422893737429d9e) F:\WINDOWS\system32\DRIVERS\termdd.sys
2010/10/06 19:14:01.0812 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) F:\WINDOWS\system32\drivers\Udfs.sys
2010/10/06 19:14:02.0906 Update (402ddc88356b1bac0ee3dd1580c76a31) F:\WINDOWS\system32\DRIVERS\update.sys
2010/10/06 19:14:03.0593 USBAAPL (1df89c499bf45d878b87ebd4421d462d) F:\WINDOWS\system32\Drivers\usbaapl.sys
2010/10/06 19:14:04.0125 usbaudio (e919708db44ed8543a7c017953148330) F:\WINDOWS\system32\drivers\usbaudio.sys
2010/10/06 19:14:04.0640 usbccgp (173f317ce0db8e21322e71b7e60a27e8) F:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/10/06 19:14:05.0156 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) F:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/10/06 19:14:05.0640 usbhub (1ab3cdde553b6e064d2e754efe20285c) F:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/10/06 19:14:06.0140 usbohci (0daecce65366ea32b162f85f07c6753b) F:\WINDOWS\system32\DRIVERS\usbohci.sys
2010/10/06 19:14:06.0593 usbprint (a717c8721046828520c9edf31288fc00) F:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/10/06 19:14:07.0031 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) F:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/10/06 19:14:07.0515 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) F:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/10/06 19:14:08.0000 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) F:\WINDOWS\System32\drivers\vga.sys
2010/10/06 19:14:08.0890 VolSnap (4c8fcb5cc53aab716d810740fe59d025) F:\WINDOWS\system32\drivers\VolSnap.sys
2010/10/06 19:14:09.0468 Wanarp (e20b95baedb550f32dd489265c1da1f6) F:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/10/06 19:14:10.0250 Wdf01000 (fd47474bd21794508af449d9d91af6e6) F:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2010/10/06 19:14:11.0156 wdmaud (6768acf64b18196494413695f0c3a00f) F:\WINDOWS\system32\drivers\wdmaud.sys
2010/10/06 19:14:11.0750 WpdUsb (cf4def1bf66f06964dc0d91844239104) F:\WINDOWS\system32\DRIVERS\wpdusb.sys
2010/10/06 19:14:12.0343 WudfPf (f15feafffbb3644ccc80c5da584e6311) F:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/10/06 19:14:12.0859 WudfRd (28b524262bce6de1f7ef9f510ba3985b) F:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/10/06 19:14:13.0218 \HardDisk1\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/10/06 19:14:13.0218 ================================================================================
2010/10/06 19:14:13.0218 Scan finished
2010/10/06 19:14:13.0218 ================================================================================
2010/10/06 19:14:13.0250 Detected object count: 2
2010/10/06 19:14:46.0609 Rootkit.Win32.TDSS.tdl3(atapi) - User select action: Skip
2010/10/06 19:14:46.0640 Rootkit.Win32.TDSS.tdl4(\HardDisk1\MBR) - User select action: Skip

Hi,

can you have TDSSKiller remove the infections it found or will it close on you?

regards myrti

When I run TDSSKiller, it finds two infections, I leave it set to "cure", and hit continue. I see a brief blue screen and the computer restarts. So I tried "quarantine" instead of cure, which does not reset the computer, but does not affect the viruses, even after a restart. So I restarted, and tried TDSSKiller under Safe Mode. When I ran it, it did not show a blue screen, and the button said "reboot", but it did reset without my hitting reboot, and the viruses are active still.

I did uninstall McAfees, so that won't be interfering in anything, but TDSSKiller is not removing the infections.

Edited by Griswel, 07 October 2010 - 05:22 PM.

Hi,

it looks as if the infectoin does not want to be removed.

• Insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.
  
  
• If your PC is not booting from the CD, you need to change the boot order:
  • Restart your PC
  • As soon as you get an image, press the Setup key. This is usually F2, or Del. On some machines the key can also be a different one. It should, however, be stated on the screen which key is the setup key.
  • Once you enter the computer's BIOS, use the arrow keys and tab key to move between elements. Press enter to select an item to change.
  • Navigate to the tab, where you can set the boot order. It should be called Boot or Boot order
  • The tab should now show your current boot order.
    If the CD-drive is not at the top, please navigate to the CD-Rom drive with the keys arrows. Then move it to the top of the list. The keys for switching boot position are usually + to move up and - to move down. However they can be different, but they should be stated in the help, so that you can find them easily.
  • Once the CD-drive is on top of the boot order, navigate to Exit and select Exit saving changes.
• Your PC should now boot from your XP-CD.
  Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
  
  
• When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  
  
• When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.
  
  
• A command prompt will open
• Type fixmbr into the prompt and hit enter
• Type exit to leave and reboot.

Once booted, please run TDSSKiller again.

regards myrti

Well, interesting but no cigar. I have two Windows installations, so when things didn't work first try, I ran fixmbr on the other one. I ran TDSSKiller, but again it reset the computer each time it ran. So I tried running it in safe mode, same thing. Then I tried only curing one of the errors, no change. At one point I got a true blue screen of death, usually it rolls past quickly and restarts. Still, other than that it's the same as always - TDSSKiller just restarts the computer.