Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News:    Windows 10 Cumulative Updates Released With Fix for Windows Media Player

Featured Deal: Get 99% off The The 2019 Ethical Hacker Master Class Bundle

Photo

Google search redirect - scour.com and other sites

Started by jbai , Dec 28 2010 06:55 PM

  • This topic is locked This topic is locked
23 replies to this topic

#1 jbai

jbai

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 28 December 2010 - 06:55 PM

Hi everyone,
I've noticed that this virus has been very common lately.

Firefox gets redirected to a random site every so often after clicking a google search result.

DDS log is below:
My monitor had no signal after leaving the computer on for a while during the GMER scan, so I had to restart the PC. I'll attach the scan once it completes properly.

DDS (Ver_10-12-12.02) - NTFSx86
Run by Administrator at 2:26:07.60 on 29/12/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2046.1174 [GMT 11:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Application Data\dwm.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Application Data\Microsoft\conhost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Brownie\BrstsWnd.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Brownie\brpjp04a.exe
C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SteamWatch\SteamWatchTray.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Sound Control\sc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\SteamWatch\SteamWatch.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Defogger.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie_rsearch.html
uDefault_Page_URL = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:56242
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie_rsearch.html
mWinlogon: SfcDisable=-99 (0xffffff9d)
uWinlogon: Shell=explorer.exe,c:\documents and settings\administrator.experien-e04fa4\application data\dwm.exe
uWindows: Load=c:\docume~1\admini~1.exp\locals~1\temp\csrss.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Synapse BHO Class: {33414365-e6c7-460d-880a-a163bd69e84d} - c:\windows\downloaded program files\FujiFld.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Taskbar Shuffle] c:\program files\taskbar shuffle\taskbarshuffle.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SteamWatchTray] c:\program files\steamwatch\SteamWatchTray.exe
uRun: [Google Update] "c:\documents and settings\administrator.experien-e04fa4\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [BrStsWnd] c:\program files\brownie\BrstsWnd.exe Autorun
mRun: [DLBTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLBTtime.dll,_RunDLLEntry@16
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [conhost] c:\documents and settings\administrator.experien-e04fa4\application data\microsoft\conhost.exe
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\soundc~1.lnk - c:\program files\sound control\sc.exe
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
uPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
uPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
mPolicies-explorer: StartMenuFavorites = 0 (0x0)
mPolicies-explorer: Start_ShowMyComputer = 1 (0x1)
mPolicies-explorer: Start_ShowMyDocs = 1 (0x1)
mPolicies-explorer: Start_ShowMyMusic = 0 (0x0)
mPolicies-explorer: Start_ShowRun = 1 (0x1)
mPolicies-explorer: Start_ShowSearch = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
dPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
dPolicies-explorer: NoActiveDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: bmnet.dll
Trusted Zone: mh.org.au\pacs
DPF: {1FBD11EF-1260-11D1-87A7-444553540001} - hxxps://pacs.mh.org.au/osd/synapseWorkstation.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261355283593
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261396862750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} - hxxps://pacs.mh.org.au/osd/x86/win95/FujiInst.cab
TCP: {3580A888-7FA3-4E3C-A944-3B77874D3CD0} = 203.0.178.191
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1.exp\applic~1\mozilla\firefox\profiles\p7aolyxo.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en-GB&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\support@lastpass.com\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Aero Fox XL: {5c8bfb7c-9a54-11dc-8314-0800200c9a66} - %profile%\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: LastPass: support@lastpass.com - %profile%\extensions\support@lastpass.com
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Virtus Search Opt-in: extension@virtusdesigns.com - %profile%\extensions\extension@virtusdesigns.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-18 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-11 67656]
R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2008-12-22 80392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-12-21 583640]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-29 275968]
R2 SteamWatch;SteamWatch;c:\program files\steamwatch\SteamWatch.exe [2010-7-20 18944]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\vodafone\vodafone mobile connect\bin\VMCService.exe [2008-7-4 14336]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca536b94075016;Google Update Service (gupdate1ca536b94075016);c:\program files\google\update\GoogleUpdate.exe [2009-10-23 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-4-13 1691480]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [2009-4-13 1294336]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\dragon age\bin_ship\daupdatersvc.service.exe [2009-12-16 25832]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2008-5-3 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-3 32512]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2009-3-7 272128]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2009-7-28 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2009-7-28 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2009-7-28 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2009-7-28 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2009-7-28 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2009-7-28 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2009-7-28 117672]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2009-4-13 1294336]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-5-3 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================


==================== Find3M ====================

2010-12-28 13:37:07 119296 ----a-w- c:\windows\system32\zlib.dll
2010-12-28 13:36:36 16608 ----a-w- c:\windows\gdrv.sys
2010-12-28 09:24:04 138752 ----a-w- c:\docume~1\admini~1.exp\applic~1\dwm.exe
2010-12-27 10:53:15 108032 --sha-r- c:\windows\system32\kbdhe319I.dll
2010-12-04 06:54:49 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-12-04 06:54:41 270904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-12-04 06:54:41 270904 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-29 06:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 06:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-21 12:45:26 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-11-21 12:45:26 2272 ----a-w- c:\windows\system32\w95inf16.dll
2006-05-03 10:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

============= FINISH: 2:26:50.21 ===============

BC AdBot (Login to Remove)

 

#2 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 29 December 2010 - 04:44 PM

Ok here's some fresh logs, and I've also noticed a new symptom.

I got a Windows Delayed Write Failed error after the leaving the computer on for the GMER scan.
After saving the ark.txt (thankfully), I tried opening another .doc file to paste the screenshot of the error, but the computer locked up upon opening the .doc file, and needed a hard reset.

Here's the logs:


DDS (Ver_10-12-12.02) - NTFSx86
Run by Administrator at 0:47:59.53 on Thu 30/12/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2046.1352 [GMT 11:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\SteamWatch\SteamWatch.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Brownie\BrstsWnd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Brownie\brpjp04a.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SteamWatch\SteamWatchTray.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Sound Control\sc.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Defogger.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie_rsearch.html
uDefault_Page_URL = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:56242
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie_rsearch.html
mWinlogon: SfcDisable=-99 (0xffffff9d)
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Synapse BHO Class: {33414365-e6c7-460d-880a-a163bd69e84d} - c:\windows\downloaded program files\FujiFld.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Taskbar Shuffle] c:\program files\taskbar shuffle\taskbarshuffle.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SteamWatchTray] c:\program files\steamwatch\SteamWatchTray.exe
uRun: [Google Update] "c:\documents and settings\administrator.experien-e04fa4\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [BrStsWnd] c:\program files\brownie\BrstsWnd.exe Autorun
mRun: [DLBTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLBTtime.dll,_RunDLLEntry@16
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\soundc~1.lnk - c:\program files\sound control\sc.exe
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
uPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
uPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
mPolicies-explorer: StartMenuFavorites = 0 (0x0)
mPolicies-explorer: Start_ShowMyComputer = 1 (0x1)
mPolicies-explorer: Start_ShowMyDocs = 1 (0x1)
mPolicies-explorer: Start_ShowMyMusic = 0 (0x0)
mPolicies-explorer: Start_ShowRun = 1 (0x1)
mPolicies-explorer: Start_ShowSearch = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
dPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
dPolicies-explorer: NoActiveDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: bmnet.dll
Trusted Zone: mh.org.au\pacs
DPF: {1FBD11EF-1260-11D1-87A7-444553540001} - hxxps://pacs.mh.org.au/osd/synapseWorkstation.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261355283593
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261396862750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} - hxxps://pacs.mh.org.au/osd/x86/win95/FujiInst.cab
TCP: {3580A888-7FA3-4E3C-A944-3B77874D3CD0} = 203.0.178.191
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1.exp\applic~1\mozilla\firefox\profiles\p7aolyxo.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en-GB&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\support@lastpass.com\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Aero Fox XL: {5c8bfb7c-9a54-11dc-8314-0800200c9a66} - %profile%\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: LastPass: support@lastpass.com - %profile%\extensions\support@lastpass.com
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Virtus Search Opt-in: extension@virtusdesigns.com - %profile%\extensions\extension@virtusdesigns.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-18 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-11 67656]
R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2008-12-22 80392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-12-21 583640]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-29 275968]
R2 SteamWatch;SteamWatch;c:\program files\steamwatch\SteamWatch.exe [2010-7-20 18944]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\vodafone\vodafone mobile connect\bin\VMCService.exe [2008-7-4 14336]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca536b94075016;Google Update Service (gupdate1ca536b94075016);c:\program files\google\update\GoogleUpdate.exe [2009-10-23 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-4-13 1691480]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [2009-4-13 1294336]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\dragon age\bin_ship\daupdatersvc.service.exe [2009-12-16 25832]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2008-5-3 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-3 32512]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2009-3-7 272128]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2009-7-28 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2009-7-28 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2009-7-28 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2009-7-28 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2009-7-28 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2009-7-28 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2009-7-28 117672]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2009-4-13 1294336]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-5-3 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================


==================== Find3M ====================

2010-12-29 13:46:15 16608 ----a-w- c:\windows\gdrv.sys
2010-12-28 13:37:07 119296 ----a-w- c:\windows\system32\zlib.dll
2010-12-27 10:53:15 108032 --sha-r- c:\windows\system32\kbdhe319I.dll
2010-12-04 06:54:49 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-12-04 06:54:41 270904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-12-04 06:54:41 270904 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-29 06:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 06:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-21 12:45:26 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-11-21 12:45:26 2272 ----a-w- c:\windows\system32\w95inf16.dll
2006-05-03 10:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

============= FINISH: 0:48:57.31 ===============

Attached Files


#3 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 29 December 2010 - 04:48 PM

I've seen gringo asking other thread posters to "Please Do not Attach logs or put in code boxes.", so here's the copy pasted attach.txt and ark.txt in case.




UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 24/12/2008 8:46:44 AM
System Uptime: 30/12/2010 12:45:29 AM (0 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | EP45-DS3L
Processor: Intel Pentium III Xeon processor | Socket 775 | 2666/266mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 596 GiB total, 96.84 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

7-Zip 4.65
AaAaAA!!! - A Reckless Disregard for Gravity
Acrobat.com
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Download Manager
Adobe Drive CS4
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 9.4.1
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Advanced System Optimizer
Alien Swarm
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ashampoo Burning Studio 9.10
ATI AVIVO Codecs
ATI Catalyst Install Manager
ATI Parental Control & Encoder
µTorrent
Audacity 1.2.6
Audiosurf
Avanquest update
Bandwidth Meter Pro 2.6 build 617
Battlefield 2™
Battlefield: Bad Company™ 2
Battlezone 1.4M
Battlezone 1.4M Expansion
BioShock
Bonjour
Borderlands
Braid
Brother HL-2140
C-Media USB 108 Sound
Call of Duty® - World at War™ 1.2 Patch
Call of Duty® - World at War™ 1.4 Patch
Call of Duty® 4 - Modern Warfare™
Call of Duty® 4 - Modern Warfare™ 1.6 Patch
Call of Duty® 4 - Modern Warfare™ 1.7 Patch
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center HydraVision Full
Catalyst Control Center InstallProxy
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help English
CCleaner
CDDRV_Installer
Chime
Company of Heroes
Company of Heroes: Opposing Fronts
Connect
ConvertHelper 2.1
Counter-Strike
Critical Update for Windows Media Player 11 (KB959772)
Darksiders
Day of Defeat
dBpoweramp DSP Effects
dBpoweramp Music Converter
Defense Grid: The Awakening
Defraggler
Dell Photo AIO Printer 922
Deus Ex: Game of the Year Edition
Deus Ex: Invisible War
Diskeeper 2008 Pro Premier
Dragon Age: Origins
EA Download Manager
EndNote X3
Energy Saver Advance B8.0711.1
ESET Online Scanner v3
Fallout New Vegas
FEAR
FIFA 10
Flight Control HD
Foxit PDF Suite
Freedom Force
Freedom Force vs. the 3rd Reich
Freelancer
GameArena The Arena
GameSpy Arcade
Garena
Google Chrome
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Guild Wars
Half-Life
Half-Life 2: Deathmatch
Half-Life 2: Episode Two
Half-Life 2: Lost Coast
Half-Life: Blue Shift
Halo 2 for Windows Vista
Homeworld2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB938759)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HouseCall 6.6
iPhone Explorer 2.005
iSilo
iTunes
Japanese Fonts Support For Adobe Reader 9
Java Auto Updater
Java™ 6 Update 22
K-Lite Codec Pack 4.4.5 (Full)
KhalInstallWrapper
Killing Floor
Killing Floor Mod: Defence Alliance 2
kuler
Left 4 Dead
Left 4 Dead 2
Left 4 Dead 2 Add-on Support
Little Fighter 2 version 2.0
Logitech Registration
Logitech SetPoint
Magic Set Editor 2 - 0.2.7 beta
Magic The Gathering
MagicTG
Malwarebytes' Anti-Malware
Mass Effect 2
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Game Studios Common Redistributables Pack 1
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Text To Speech Engine 5.1
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft XML Parser
Microsoft XNA Framework Redistributable 3.1
MINERVA: Metastasis
Mozilla Firefox (3.6.13)
Mp3tag v2.43
MSVCRT
MSXML 6.0 Parser (KB927977)
NETGEAR WG111v2 wireless USB 2.0 adapter
Nokia Connectivity Cable Driver
Nokia PC Connectivity Solution
Nokia PC Suite
NVIDIA PhysX
Oblivion mod manager 1.1.12
OGA Notifier 2.0.0048.0
OpenAL
Operation Flashpoint: Dragon Rising
Opposing Force
Osmos
PDF Settings CS4
Photoshop Camera Raw
Planescape - Torment
Poker Night at the Inventory
Portal
Project64 1.6
Proxifier version 2.8
PunkBuster Services
Python 2.6 comtypes-0.6.2
Python 2.6 psyco-1.6
Python 2.6 pywin32-214
Python 2.6.4
Quake II
Quake II: Ground Zero
Quake II: The Reckoning
QuickTime
Realtek AC'97 Audio
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Registry Mechanic 9.0
ResearchSoft Direct Export Helper
Rockstar Games Social Club
Security Update for 2007 Microsoft Office System (KB2277947)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB980376)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2251419)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Segoe UI
Shatter
Sid Meier's Civilization IV
Sid Meier's Civilization IV: Beyond the Sword
Sid Meier's Civilization IV: Colonization
Sid Meier's Civilization IV: Warlords
Sony Ericsson PC Suite 4.010.00
Sound Control v2.48 BETA
Source SDK Base 2006
Speccy
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
Star Wars® Knights of the Old Republic® II: The Sith Lords™
Star Wars®: Knights of the Old Republic ™
StarCraft II
StealthBot v2.6 Revision 3 (remove only)
Steam
SteamWatch
StepMania (remove only)
STREET FIGHTER IV
Suite Shared Configuration CS4
SUPER © Version 2009.bld.35 (Jan 5, 2009)
Super Meat Boy
SUPERAntiSpyware
Synapse
System Shock2
Taskbar Shuffle version 2.5
Team Fortress 2
The Chronicles of Riddick: Escape From Butcher Bay
The Elder Scrolls IV: Oblivion
The Void
Thief 2 - The Metal Age (Remove Only)
TuneUp Utilities 2009
Tweak UI
Ulead Video ToolBox Basic
Unity Web Player
Unofficial Oblivion Patch v3.2.0
Unofficial Shivering Isles Patch v1.4.0
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Windows (KB971513)
Update for Outlook 2007 Junk Email Filter (kb2279264)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
USB Vibration Joystick
User Profile Hive Cleanup Service
Ventrilo Client
Veoh Web Player
ViewSonic Windows XP Signed Files
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
Vodafone Mobile Connect
Warcraft III: All Products
Warhammer® 40,000™: Dawn of War® II
Warhammer® 40,000™: Dawn of War® II – Chaos Rising™
WC3Banlist
WebFldrs XP
Windows Driver Package - Nokia Modem (07/24/2006 6.81.0.23)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Upload Tool
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows PowerShell™ 1.0 MUI pack
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Support Tools
WinPcap 3.1
WinRAR archiver
WinZip 12.0
WMPKeys
World of Goo
wxPython 2.8.10.1 (ansi) for Python 2.6
X-COM: Apocalypse
X-COM: Enforcer
X-COM: Interceptor
X-COM: Terror from the Deep
X-COM: UFO Defense
Xfire (remove only)
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

29/12/2010 9:37:19 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls.mui. Reference error message: Insufficient system resources exist to complete the requested service. .
29/12/2010 9:37:19 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\appwiz.cpl. Reference error message: The operation completed successfully. .
29/12/2010 9:06:44 AM, error: Srv [2019] - The server was unable to allocate from the system nonpaged pool because the pool was empty.
29/12/2010 4:23:42 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: The requested name is valid and was found in the database, but it does not have the correct associated data being resolved for. (0x80072AFC)
28/12/2010 12:54:15 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec Lbd MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL sr Tcpip tcpipBM WS2IFSL
28/12/2010 12:54:15 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 12:54:15 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 12:54:15 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 12:54:15 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 12:54:15 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 12:54:15 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 12:54:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
28/12/2010 12:54:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
27/12/2010 9:39:49 PM, error: Service Control Manager [7034] - The PinnacleUpdate Service service terminated unexpectedly. It has done this 1 time(s).
25/12/2010 5:38:09 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
25/12/2010 5:35:12 PM, error: ati2mtag [108] - The driver ati2dvag for the display device \Device\Video0 got stuck in an infinite loop. This usually indicates a problem with the device itself or with the device driver programming the hardware incorrectly. Please check with your hardware device vendor for any driver updates.
25/12/2010 10:24:22 PM, error: SRService [104] - The System Restore initialization process failed.
25/12/2010 10:24:22 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd sr
25/12/2010 10:24:22 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
25/12/2010 10:24:22 PM, error: Service Control Manager [7000] - The System Restore Filter Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

==== End Of File ===========================





GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-30 08:32:03
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T1L0-16 WDC_WD6400AAKS-00A7B0 rev.01.03B01
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1.EXP\LOCALS~1\Temp\pgndraog.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAC786620]
SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0xA91D46D0]

---- Kernel code sections - GMER 1.0.15 ----

? rwjyp.sys The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB90DB000, 0x239517, 0xE8000020]
? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys The system cannot find the file specified. !
? C:\DOCUME~1\ADMINI~1.EXP\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Tcp tcpipBM.SYS (Bytemobile Kernel Network Provider/Bytemobile, Inc.)

---- Files - GMER 1.0.15 ----

File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMEImage.py 1808 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\base64MIME.py 5809 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\base64MIME.pyc 5353 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Charset.py 15533 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Encoders.py 2274 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Encoders.pyc 2262 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Errors.py 1605 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\FeedParser.py 20800 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Generator.py 13805 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Header.py 22082 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Iterators.py 2167 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Message.py 31570 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMEAudio.py 2754 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMEBase.py 794 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMEMessage.py 1290 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMEMultipart.py 1380 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMENonMultipart.py 746 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\MIMEText.py 1009 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Parser.py 3349 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\quopriMIME.py 10861 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Utils.py 9219 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\Utils.pyc 8842 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\_parseaddr.py 15209 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\_parseaddr.pyc 13088 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\__init__.py 1321 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\email\__init__.pyc 1311 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\aliases.pyc 8454 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\ascii.pyc 1178 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\base64_codec.pyc 2574 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\big5.pyc 1521 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\big5hkscs.pyc 1531 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\bz2_codec.pyc 2609 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\charmap.pyc 1878 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp037.pyc 4853 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1006.pyc 3322 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1026.pyc 4885 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1140.pyc 1446 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1250.pyc 3024 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1251.pyc 3694 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1252.pyc 2107 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1253.pyc 3498 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1254.pyc 2233 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1255.pyc 3306 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_1.pyc 1538 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_10.pyc 2411 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_11.pyc 3277 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_13.pyc 2583 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_14.pyc 2131 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_15.pyc 1692 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_16.pyc 2259 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_2.pyc 2625 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_3.pyc 2179 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_4.pyc 2485 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_5.pyc 3325 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_6.pyc 3095 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_7.pyc 3041 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_8.pyc 2653 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso8859_9.pyc 1652 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\johab.pyc 1523 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\koi8_r.pyc 3945 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\koi8_u.pyc 1701 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\latin_1.pyc 1186 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mac_cyrillic.pyc 3838 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mac_greek.pyc 3758 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mac_iceland.pyc 3466 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mac_latin2.pyc 3771 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mac_roman.pyc 3506 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mac_turkish.pyc 3510 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\mbcs.pyc 1262 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\palmos.pyc 1968 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\ptcp154.pyc 3787 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\punycode.pyc 6853 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\quopri_codec.pyc 2427 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\raw_unicode_escape.pyc 1041 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\rot_13.pyc 2504 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\shift_jis.pyc 1531 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\shift_jisx0213.pyc 1541 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\shift_jis_2004.pyc 1541 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\string_escape.pyc 945 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\tis_620.pyc 1588 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\undefined.pyc 1434 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\unicode_escape.pyc 1025 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\unicode_internal.pyc 1033 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\utf_16.pyc 2213 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\utf_16_be.pyc 1056 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\utf_16_le.pyc 1056 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\utf_7.pyc 930 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\utf_8.pyc 1040 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\uu_codec.pyc 3802 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\zlib_codec.pyc 2553 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\__init__.pyc 3847 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp932.pyc 1523 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp949.pyc 1523 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp950.pyc 1523 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\euc_jisx0213.pyc 1537 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\euc_jis_2004.pyc 1537 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\euc_jp.pyc 1525 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\euc_kr.pyc 1525 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\gb18030.pyc 1527 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\gb2312.pyc 1525 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\gbk.pyc 1519 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\hex_codec.pyc 2559 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\hp_roman8.pyc 2985 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\hz.pyc 1517 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\idna.pyc 4294 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_jp.pyc 1538 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_jp_1.pyc 1542 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_jp_2.pyc 1542 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_jp_2004.pyc 1548 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_jp_3.pyc 1542 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_jp_ext.pyc 1546 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\iso2022_kr.pyc 1538 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1256.pyc 3156 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp875.pyc 5237 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1257.pyc 3103 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp1258.pyc 2375 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp424.pyc 5002 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp437.pyc 3708 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp500.pyc 4853 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp737.pyc 3943 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp775.pyc 3748 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp850.pyc 3493 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp852.pyc 3763 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp855.pyc 3943 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp856.pyc 3627 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp857.pyc 3503 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp860.pyc 3698 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp861.pyc 3708 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp862.pyc 3843 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp863.pyc 3708 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp864.pyc 3849 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp865.pyc 3708 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp866.pyc 3953 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp869.pyc 3857 bytes
File C:\Program Files\Steam\steamapps\common\sid meier's civilization iv warlords\Assets\Python\System\encodings\cp874.pyc 3808 bytes
File C:\Python26\comtypes-wininst.log 36922 bytes
File C:\Python26\DLLs 0 bytes
File C:\Python26\DLLs\bz2.pyd 71168 bytes executable
File C:\Python26\DLLs\py.ico 19790 bytes
File C:\Python26\DLLs\pyc.ico 19790 bytes
File C:\Python26\DLLs\pyexpat.pyd 153088 bytes executable
File C:\Python26\DLLs\select.pyd 11776 bytes executable
File C:\Python26\DLLs\sqlite3.dll 572928 bytes executable
File C:\Python26\DLLs\tcl85.dll 867328 bytes
File C:\Python26\DLLs\tclpip85.dll 8192 bytes executable
File C:\Python26\DLLs\tk85.dll 1319936 bytes executable
File C:\Python26\DLLs\unicodedata.pyd 585728 bytes executable
File C:\Python26\DLLs\winsound.pyd 10752 bytes executable
File C:\Python26\DLLs\_bsddb.pyd 963584 bytes executable
File C:\Python26\DLLs\_ctypes.pyd 73728 bytes
File C:\Python26\DLLs\_ctypes_test.pyd 14848 bytes executable
File C:\Python26\DLLs\_elementtree.pyd 86016 bytes executable
File C:\Python26\DLLs\_hashlib.pyd 311808 bytes executable
File C:\Python26\DLLs\_msi.pyd 47104 bytes executable
File C:\Python26\DLLs\_multiprocessing.pyd 23552 bytes
File C:\Python26\DLLs\_socket.pyd 40448 bytes executable
File C:\Python26\DLLs\_sqlite3.pyd 53248 bytes executable
File C:\Python26\DLLs\_ssl.pyd 645120 bytes executable
File C:\Python26\DLLs\_testcapi.pyd 21504 bytes executable
File C:\Python26\DLLs\_tkinter.pyd 30208 bytes executable
File C:\Python26\Doc 0 bytes
File C:\Python26\Doc\python264.chm 0 bytes
File C:\Python26\include 0 bytes
File C:\Python26\Lib 0 bytes
File C:\Python26\libs 0 bytes
File C:\Python26\LICENSE.txt 0 bytes
File C:\Python26\NEWS.txt 0 bytes
File C:\Python26\psyco-wininst.log 0 bytes
File C:\Python26\python.exe 0 bytes
File C:\Python26\pythonw.exe 0 bytes
File C:\Python26\pywin32-wininst.log 0 bytes
File C:\Python26\README.txt 0 bytes
File C:\Python26\Removecomtypes.exe 0 bytes
File C:\Python26\Removepsyco.exe 0 bytes
File C:\Python26\Removepywin32.exe 0 bytes
File C:\Python26\Scripts 0 bytes
File C:\Python26\tcl 0 bytes
File C:\Python26\Tools 0 bytes
File C:\Python26\w9xpopen.exe 0 bytes

---- EOF - GMER 1.0.15 ----

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:03:19 PM

Posted 04 January 2011 - 12:19 AM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • Please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.


We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.


In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

  • Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger may ask you to reboot the machine, if it does - click OK
Do not re-enable these drivers until otherwise instructed.

Download DDS:

  • Please download DDS by sUBs from one of the links below and save it to your desktop:

    Posted Image
    Download DDS and save it to your desktop

    Link1
    Link2
    Link3

    Please disable any anti-malware program that will block scripts from running before running DDS.

    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
    • DDS.txt
    • Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply





Scan With RKUnHooker

  • Please Download Rootkit Unhooker Save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".


information and logs:

  • In your next post I need the following

  • .logs from DDS
  • log from RKUnHooker
  • let me know of any problems you may have had

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 04 January 2011 - 01:10 AM

Hi Gringo,

I wish to apologize in advance; due to the long period of time my thread wasn't receiving any response, I was still searching online for potential fixes.

During this time, I ran ESET online scanner after seeing it recommended in a thread dealing with a similar problem, and my google redirection appears to have stopped.

However, I am not certain if the cause of the problem has been eliminated.

I will comply with your directions, and hopefully you can determine if my system is clean or not.

Thanks for your help.

#6 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 04 January 2011 - 01:18 AM

Here are the logs.
No problems in obtaining them.


DDS (Ver_10-12-12.02) - NTFSx86
Run by Administrator at 17:13:16.92 on Tue 04/01/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2046.1224 [GMT 11:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Brownie\BrstsWnd.exe
C:\Program Files\Brownie\brpjp04a.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SteamWatch\SteamWatchTray.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Sound Control\sc.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\SteamWatch\SteamWatch.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Defogger.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie_rsearch.html
uDefault_Page_URL = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:56242
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie_rsearch.html
mWinlogon: SfcDisable=-99 (0xffffff9d)
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Synapse BHO Class: {33414365-e6c7-460d-880a-a163bd69e84d} - c:\windows\downloaded program files\FujiFld.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [Taskbar Shuffle] c:\program files\taskbar shuffle\taskbarshuffle.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SteamWatchTray] c:\program files\steamwatch\SteamWatchTray.exe
uRun: [Google Update] "c:\documents and settings\administrator.experien-e04fa4\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [BrStsWnd] c:\program files\brownie\BrstsWnd.exe Autorun
mRun: [DLBTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLBTtime.dll,_RunDLLEntry@16
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\soundc~1.lnk - c:\program files\sound control\sc.exe
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
uPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
uPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
mPolicies-explorer: StartMenuFavorites = 0 (0x0)
mPolicies-explorer: Start_ShowMyComputer = 1 (0x1)
mPolicies-explorer: Start_ShowMyDocs = 1 (0x1)
mPolicies-explorer: Start_ShowMyMusic = 0 (0x0)
mPolicies-explorer: Start_ShowRun = 1 (0x1)
mPolicies-explorer: Start_ShowSearch = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
dPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1)
dPolicies-explorer: NoActiveDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: bmnet.dll
Trusted Zone: mh.org.au\pacs
DPF: {1FBD11EF-1260-11D1-87A7-444553540001} - hxxps://pacs.mh.org.au/osd/synapseWorkstation.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261355283593
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261396862750
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} - hxxps://pacs.mh.org.au/osd/x86/win95/FujiInst.cab
TCP: {3580A888-7FA3-4E3C-A944-3B77874D3CD0} = 203.0.178.191
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1.exp\applic~1\mozilla\firefox\profiles\p7aolyxo.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en-GB&q=
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - component: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\support@lastpass.com\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\firefox\profiles\p7aolyxo.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\administrator.experien-e04fa4\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Aero Fox XL: {5c8bfb7c-9a54-11dc-8314-0800200c9a66} - %profile%\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: LastPass: support@lastpass.com - %profile%\extensions\support@lastpass.com
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Virtus Search Opt-in: extension@virtusdesigns.com - %profile%\extensions\extension@virtusdesigns.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-18 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-11 67656]
R2 GEST Service;GEST Service for program management.;c:\program files\gigabyte\energysaver\GSvr.exe [2008-12-22 80392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-12-21 583640]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-29 275968]
R2 SteamWatch;SteamWatch;c:\program files\steamwatch\SteamWatch.exe [2010-7-20 18944]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\vodafone\vodafone mobile connect\bin\VMCService.exe [2008-7-4 14336]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca536b94075016;Google Update Service (gupdate1ca536b94075016);c:\program files\google\update\GoogleUpdate.exe [2009-10-23 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-4-13 1691480]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [2009-4-13 1294336]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2008-5-3 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-3 32512]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2009-3-7 272128]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2009-7-28 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2009-7-28 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2009-7-28 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2009-7-28 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2009-7-28 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2009-7-28 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2009-7-28 117672]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2009-4-13 1294336]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-5-3 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================


==================== Find3M ====================

2011-01-01 01:06:35 16608 ----a-w- c:\windows\gdrv.sys
2010-12-28 13:37:07 119296 ----a-w- c:\windows\system32\zlib.dll
2010-12-27 10:53:15 108032 --sha-r- c:\windows\system32\kbdhe319I.dll
2010-12-04 06:54:49 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-12-04 06:54:41 270904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-12-04 06:54:41 270904 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-29 06:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 06:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-21 12:45:26 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-11-21 12:45:26 2272 ----a-w- c:\windows\system32\w95inf16.dll
2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 07:53:06 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 05:34:10 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 16:17:32 16330752 ----a-w- c:\windows\system32\atioglxx.dll
2010-10-26 16:10:48 57344 ----a-w- c:\windows\system32\aticalrt.dll
2010-10-26 16:10:38 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-10-26 16:09:30 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2010-10-26 16:03:00 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-10-26 15:51:32 3958784 ----a-w- c:\windows\system32\ati3duag.dll
2010-10-26 15:50:50 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-10-26 15:49:50 301056 ----a-w- c:\windows\system32\ati2dvag.dll
2010-10-26 15:48:14 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2010-10-26 15:36:10 2671744 ----a-w- c:\windows\system32\ativvaxx.dll
2010-10-26 15:30:48 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2010-10-26 15:30:34 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2010-10-26 15:30:26 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2010-10-26 15:30:18 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-10-26 15:30:06 159744 ----a-w- c:\windows\system32\ati2evxx.dll
2010-10-26 15:28:34 614400 ----a-w- c:\windows\system32\ati2evxx.exe
2010-10-26 15:27:04 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2010-10-26 15:26:18 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-10-26 15:22:32 651264 ----a-w- c:\windows\system32\atikvmag.dll
2010-10-26 15:20:32 64512 ----a-w- c:\windows\system32\atimpc32.dll
2010-10-26 15:20:32 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-10-26 15:20:32 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2010-10-26 15:20:14 17408 ----a-w- c:\windows\system32\atitvo32.dll
2010-10-26 15:14:34 704512 ----a-w- c:\windows\system32\ati2cqag.dll
2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-19 20:51:33 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-13 14:36:52 15451288 ----a-w- c:\windows\system32\xlive.dll
2010-10-13 14:36:50 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2006-05-03 10:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

============= FINISH: 17:14:18.95 ===============







UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 24/12/2008 8:46:44 AM
System Uptime: 1/01/2011 12:25:35 PM (77 hours ago)

Motherboard: Gigabyte Technology Co., Ltd. | | EP45-DS3L
Processor: Intel Pentium III Xeon processor | Socket 775 | 2666/266mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 596 GiB total, 127.74 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

7-Zip 4.65
AaAaAA!!! - A Reckless Disregard for Gravity
Acrobat.com
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color - Photoshop Specific CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe Color Video Profiles CS CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Download Manager
Adobe Drive CS4
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS4
Adobe Photoshop CS4 Support
Adobe Reader 9.4.1
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Shockwave Player 11.5
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Advanced System Optimizer
Alien Swarm
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ashampoo Burning Studio 9.10
ATI AVIVO Codecs
ATI Catalyst Install Manager
ATI Parental Control & Encoder
µTorrent
Audacity 1.2.6
Audiosurf
Avanquest update
Bandwidth Meter Pro 2.6 build 617
Battlefield 2™
Battlefield: Bad Company™ 2
Battlezone 1.4M
Battlezone 1.4M Expansion
BioShock
Bonjour
Borderlands
Braid
Brother HL-2140
C-Media USB 108 Sound
Call of Duty® - World at War™ 1.2 Patch
Call of Duty® - World at War™ 1.4 Patch
Call of Duty® 4 - Modern Warfare™
Call of Duty® 4 - Modern Warfare™ 1.6 Patch
Call of Duty® 4 - Modern Warfare™ 1.7 Patch
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center HydraVision Full
Catalyst Control Center InstallProxy
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help English
CCleaner
CDDRV_Installer
Chime
Company of Heroes
Company of Heroes: Opposing Fronts
Connect
ConvertHelper 2.1
Counter-Strike
Critical Update for Windows Media Player 11 (KB959772)
Darksiders
Day of Defeat
dBpoweramp DSP Effects
dBpoweramp Music Converter
Defense Grid: The Awakening
Defraggler
Dell Photo AIO Printer 922
Deus Ex: Game of the Year Edition
Deus Ex: Invisible War
Diskeeper 2008 Pro Premier
EA Download Manager
EndNote X3
Energy Saver Advance B8.0711.1
ESET Online Scanner v3
Fallout New Vegas
FEAR
Flight Control HD
Foxit PDF Suite
Freedom Force
Freedom Force vs. the 3rd Reich
Freelancer
GameArena The Arena
GameSpy Arcade
Garena
Google Chrome
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Grand Theft Auto IV
Grand Theft Auto: Episodes from Liberty City
Guild Wars
Half-Life
Half-Life 2: Deathmatch
Half-Life 2: Episode Two
Half-Life 2: Lost Coast
Half-Life: Blue Shift
Halo 2 for Windows Vista
Homeworld2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB938759)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HouseCall 6.6
iPhone Explorer 2.005
iSilo
iTunes
Japanese Fonts Support For Adobe Reader 9
Java Auto Updater
Java™ 6 Update 23
K-Lite Codec Pack 4.4.5 (Full)
KhalInstallWrapper
Killing Floor
Killing Floor Mod: Defence Alliance 2
kuler
Left 4 Dead
Left 4 Dead 2
Left 4 Dead 2 Add-on Support
Little Fighter 2 version 2.0
Logitech Registration
Logitech SetPoint
Magic Set Editor 2 - 0.2.7 beta
Magic The Gathering
MagicTG
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Game Studios Common Redistributables Pack 1
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.5
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Text To Speech Engine 5.1
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft XML Parser
Microsoft XNA Framework Redistributable 3.1
MINERVA: Metastasis
Mozilla Firefox (3.6.13)
Mp3tag v2.43
MSVCRT
MSXML 6.0 Parser (KB927977)
NETGEAR WG111v2 wireless USB 2.0 adapter
Nokia Connectivity Cable Driver
Nokia PC Connectivity Solution
Nokia PC Suite
NVIDIA PhysX
Oblivion mod manager 1.1.12
OGA Notifier 2.0.0048.0
OpenAL
Operation Flashpoint: Dragon Rising
Opposing Force
Osmos
PDF Settings CS4
Photoshop Camera Raw
Planescape - Torment
Poker Night at the Inventory
Portal
Project64 1.6
Proxifier version 2.8
PunkBuster Services
Python 2.6 comtypes-0.6.2
Python 2.6 psyco-1.6
Python 2.6 pywin32-214
Python 2.6.4
Quake II
Quake II: Ground Zero
Quake II: The Reckoning
QuickTime
Realtek AC'97 Audio
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Registry Mechanic 9.0
ResearchSoft Direct Export Helper
Rockstar Games Social Club
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB2288953)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Segoe UI
Shatter
Sid Meier's Civilization IV
Sid Meier's Civilization IV: Beyond the Sword
Sid Meier's Civilization IV: Colonization
Sid Meier's Civilization IV: Warlords
Sony Ericsson PC Suite 4.010.00
Sound Control v2.48 BETA
Source SDK Base 2006
Speccy
Spelling Dictionaries Support For Adobe Reader 9
Spybot - Search & Destroy
Star Wars® Knights of the Old Republic® II: The Sith Lords™
Star Wars®: Knights of the Old Republic ™
StarCraft II
StealthBot v2.6 Revision 3 (remove only)
Steam
SteamWatch
StepMania (remove only)
STREET FIGHTER IV
Suite Shared Configuration CS4
SUPER © Version 2009.bld.35 (Jan 5, 2009)
Super Meat Boy
SUPERAntiSpyware
Synapse
System Shock2
Taskbar Shuffle version 2.5
Team Fortress 2
The Chronicles of Riddick: Escape From Butcher Bay
The Elder Scrolls IV: Oblivion
The Void
Thief 2 - The Metal Age (Remove Only)
TuneUp Utilities 2009
Tweak UI
Ulead Video ToolBox Basic
Unity Web Player
Unofficial Oblivion Patch v3.2.0
Unofficial Shivering Isles Patch v1.4.0
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft Windows (KB971513)
Update for Outlook 2007 Junk Email Filter (KB2466076)
Update for Windows Internet Explorer 8 (KB2447568)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
USB Vibration Joystick
User Profile Hive Cleanup Service
Ventrilo Client
Veoh Web Player
ViewSonic Windows XP Signed Files
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.1
Vodafone Mobile Connect
Warcraft III: All Products
Warhammer® 40,000™: Dawn of War® II
Warhammer® 40,000™: Dawn of War® II – Chaos Rising™
WC3Banlist
WebFldrs XP
Windows Driver Package - Nokia Modem (07/24/2006 6.81.0.23)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Upload Tool
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player Firefox Plugin
Windows PowerShell™ 1.0 MUI pack
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Support Tools
WinPcap 3.1
WinRAR archiver
WinZip 12.0
WMPKeys
World of Goo
wxPython 2.8.10.1 (ansi) for Python 2.6
X-COM: Apocalypse
X-COM: Enforcer
X-COM: Interceptor
X-COM: Terror from the Deep
X-COM: UFO Defense
Xfire (remove only)
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

30/12/2010 8:37:20 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd sr
30/12/2010 8:37:20 AM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
30/12/2010 8:37:20 AM, error: Service Control Manager [7000] - The System Restore Filter Driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
30/12/2010 8:36:30 AM, error: SRService [104] - The System Restore initialization process failed.
30/12/2010 8:32:40 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error message: Insufficient system resources exist to complete the requested service. .
30/12/2010 8:32:40 AM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\Microsoft Office\Office12\msproof6.dll. Reference error message: The operation completed successfully. .
30/12/2010 8:32:39 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.MFCLOC. Reference error message: Insufficient system resources exist to complete the requested service. .
30/12/2010 8:32:39 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll. Reference error message: The operation completed successfully. .
30/12/2010 8:32:39 AM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\WINDOWS\WinSxS\Policies\x86_Policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.policy" on line 0.
30/12/2010 8:27:19 AM, error: Srv [2019] - The server was unable to allocate from the system nonpaged pool because the pool was empty.
30/12/2010 4:16:09 AM, error: Service Control Manager [7034] - The GEST Service for program management. service terminated unexpectedly. It has done this 1 time(s).
29/12/2010 9:37:19 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls.mui. Reference error message: Insufficient system resources exist to complete the requested service. .
29/12/2010 9:37:19 AM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\appwiz.cpl. Reference error message: The operation completed successfully. .
29/12/2010 4:23:43 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: The requested name is valid and was found in the database, but it does not have the correct associated data being resolved for. (0x80072AFC)
29/12/2010 11:07:57 AM, error: Service Control Manager [7034] - The PinnacleUpdate Service service terminated unexpectedly. It has done this 1 time(s).
28/12/2010 8:21:40 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
28/12/2010 4:06:19 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
28/12/2010 4:04:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec Lbd MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL sr Tcpip tcpipBM WS2IFSL
28/12/2010 4:04:41 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 4:04:41 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 4:04:41 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 4:04:41 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 4:04:41 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
28/12/2010 4:04:41 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

==== End Of File ===========================





RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0xAC354000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 6287360 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0xB8B44000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 5857280 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)
0xBF220000 C:\WINDOWS\System32\ati3duag.dll 3960832 bytes (ATI Technologies Inc. , ati3duag.dll)
0xBF9C5000 C:\WINDOWS\System32\ativvaxx.dll 2674688 bytes (Advanced Micro Devices, Inc. , Radeon Video Acceleration Universal Driver)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2150400 bytes
0x804D7000 RAW 2150400 bytes
0x804D7000 WMIxWDM 2150400 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF10C000 C:\WINDOWS\System32\atikvmag.dll 716800 bytes (ATI Technologies Inc., Virtual Command And Memory Manager)
0xBF060000 C:\WINDOWS\System32\ati2cqag.dll 704512 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)
0xB9E22000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xAC0A8000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)
0xAC14B000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xBF1BB000 C:\WINDOWS\System32\atiok3x2.dll 413696 bytes (Advanced Micro Devices, Inc., Ring 0 x2 component)
0xB89DD000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xAC278000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA8D2E000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 319488 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA8620000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xB8A3B000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xB9F79000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xB9DF5000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xA34A3000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xAC1BB000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xB8B08000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xAC22A000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xB9F23000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xAC252000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xA0A88000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xAC97B000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB8AE4000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB8A93000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xAC208000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xAC1E6000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x806E4000 ACPI_HAL 134400 bytes
0x806E4000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xB9EEB000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xB9F49000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xAC99F000 C:\WINDOWS\system32\drivers\AtiHdmi.sys 114688 bytes (ATI Research Inc., Ati High Definition Audio Function Driver)
0xB9DDB000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xB8ACA000 C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 106496 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver )
0xB9F0B000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xAC090000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xB9EC2000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB8A7C000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA8A49000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB8AB6000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xB8B30000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xAC2D1000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xB9EAF000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xA911E000 C:\WINDOWS\System32\Drivers\adfs.SYS 69632 bytes (Adobe Systems, Inc., Adobe Drive File System Driver)
0xB9F68000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB8A6B000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xBA268000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xBA148000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xBA128000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xBA1E8000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xBA158000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xA8C9E000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xBA1F8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBA0E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xBA168000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xBA278000 C:\WINDOWS\System32\Drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xBA188000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xBA248000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xBA138000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xBA178000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xBA1D8000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xBA1A8000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xBA0D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xBA288000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xB9474000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xBA198000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xBA228000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xA12DA000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xBA238000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xBA3E0000 C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys 32768 bytes (Logitech, Inc., Logitech HID Filter Driver.)
0xBA3E8000 C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys 32768 bytes (Logitech, Inc., Logitech Mouse Filter Driver.)
0xBA3B8000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xBA3D0000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xBA488000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xBA490000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xBA3A0000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xBA470000 C:\DOCUME~1\ADMINI~1.EXP\LOCALS~1\Temp\mbr.sys 28672 bytes
0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xBA498000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0xBA340000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA3D8000 C:\WINDOWS\System32\Drivers\LUsbFilt.Sys 24576 bytes (Logitech, Inc., Logitech USB Filter Driver.)
0xBA380000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xBA3C8000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xBA480000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xBA3A8000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xBA438000 C:\WINDOWS\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)
0xBA390000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xBA3B0000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xBA4A8000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xBA4B0000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xBA3C0000 C:\WINDOWS\System32\Drivers\tcpipBM.SYS 20480 bytes (Bytemobile, Inc., Bytemobile Kernel Network Provider)
0xBA4A0000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xBA400000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xAC957000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xBA54C000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xA94F7000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xB9DA7000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xAC344000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xB9DA3000 C:\WINDOWS\system32\DRIVERS\fsvga.sys 12288 bytes (Microsoft Corporation, Full Screen Video Driver)
0xA8C46000 C:\WINDOWS\gdrv.sys 12288 bytes (Windows ® 2000 DDK provider, GIGABYTE Tools)
0xAC967000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xAC963000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xB9D9F000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xBA598000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xA8E1E000 C:\WINDOWS\system32\Drivers\uphcleanhlp.sys 12288 bytes
0xB9DB3000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)
0xBA604000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xBA60A000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xBA602000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xBA64E000 C:\WINDOWS\System32\Drivers\hiber_WMILIB.SYS 8192 bytes
0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xBA606000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xBA646000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xBA608000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xBA5F8000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xBA5FE000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xBA5AA000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xBA720000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xBA7C0000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xBA74D000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
0x06530000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 102400 bytes
0x07540000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 102400 bytes
0x07CF0000 Hidden Image-->CLI.Component.Eeu.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 1060864 bytes
0x03960000 Hidden Image-->Interop.DWUpdateServiceLib.dll [ EPROCESS 0x89619DA0 ] PID: 792, 110592 bytes
0x00D90000 Hidden Image-->CLI.Foundation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 110592 bytes
0x053A0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 110592 bytes
0x00D50000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 118784 bytes
0x03860000 Hidden Image-->MOM.Implementation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 118784 bytes
0x07050000 Hidden Image-->CLI.Component.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 1232896 bytes
0x039B0000 Hidden Image-->VMC.ConnectionServicesInterface.dll [ EPROCESS 0x89619DA0 ] PID: 792, 135168 bytes
0x04AB0000 Hidden Image-->CLI.Caste.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 159744 bytes
0x038F0000 Hidden Image-->VMC.BaseServices.DataAccessor.dll [ EPROCESS 0x89619DA0 ] PID: 792, 167936 bytes
0x06A50000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 1748992 bytes
0x07BF0000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 192512 bytes
0x064A0000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 208896 bytes
0x06550000 Hidden Image-->CLI.Aspect.InfoCentre.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 217088 bytes
0x03880000 Hidden Image-->VMC.BaseServices.XmlSerializers.dll [ EPROCESS 0x89619DA0 ] PID: 792, 233472 bytes
0x03920000 Hidden Image-->VMC.BaseServices.Platform.dll [ EPROCESS 0x89619DA0 ] PID: 792, 233472 bytes
0x074F0000 Hidden Image-->CLI.Aspect.CrossDisplay.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 282624 bytes
0x00F20000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 28672 bytes
0x01140000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 28672 bytes
0x044E0000 Hidden Image-->AEM.Plugin.Hotkeys.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x00D80000 Hidden Image-->MOM.Foundation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x00DB0000 Hidden Image-->LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x03930000 Hidden Image-->CLI.Component.Runtime.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x044A0000 Hidden Image-->AEM.Server.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x044C0000 Hidden Image-->AEM.Plugin.DPPE.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04660000 Hidden Image-->DEM.Graphics.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04500000 Hidden Image-->AEM.Plugin.WinMessages.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04630000 Hidden Image-->DEM.Foundation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04A20000 Hidden Image-->CLI.Caste.HydraVision.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04B20000 Hidden Image-->AEM.Plugin.GD.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04B00000 Hidden Image-->DEM.Graphics.I0709.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04B90000 Hidden Image-->ResourceManagement.Foundation.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04CD0000 Hidden Image-->DEM.Graphics.I0804.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x04E00000 Hidden Image-->AEM.Actions.CCAA.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05090000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05080000 Hidden Image-->CLI.Caste.Graphics.Runtime.Shared.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x050B0000 Hidden Image-->CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05100000 Hidden Image-->DEM.Graphics.I0805.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x054F0000 Hidden Image-->CLI.Aspect.Welcome.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05240000 Hidden Image-->DEM.Graphics.I0912.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05290000 Hidden Image-->DEM.Graphics.I0706.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05300000 Hidden Image-->CLI.Aspect.VPURecover.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05480000 Hidden Image-->DEM.Graphics.I0906.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05610000 Hidden Image-->DEM.Graphics.I0712.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05670000 Hidden Image-->DEM.Graphics.I0812.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x056A0000 Hidden Image-->DEM.Graphics.I0703.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05720000 Hidden Image-->atixclib.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06200000 Hidden Image-->AEM.Plugin.EEU.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x05DE0000 Hidden Image-->APM.Foundation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x061D0000 Hidden Image-->AEM.Plugin.REG.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06030000 Hidden Image-->CLI.Component.Runtime.Extension.EEU.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x063B0000 Hidden Image-->CLI.Component.Wizard.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06330000 Hidden Image-->CLI.Component.Client.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x064E0000 Hidden Image-->CLI.Caste.Graphics.Wizard.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06420000 Hidden Image-->CLI.Component.Dashboard.Shared.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06460000 Hidden Image-->CLI.Caste.Graphics.Dashboard.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06500000 Hidden Image-->Branding.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x06590000 Hidden Image-->CLI.Caste.HydraVision.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x07380000 Hidden Image-->CLI.Caste.HydraVision.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 28672 bytes
0x07900000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 364544 bytes
0x00C70000 Hidden Image-->VMC.WindowsService.Messaging.dll [ EPROCESS 0x89619DA0 ] PID: 792, 36864 bytes
0x038C0000 Hidden Image-->VMC.BaseServices.OutlookConnector.dll [ EPROCESS 0x89619DA0 ] PID: 792, 36864 bytes
0x03850000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 36864 bytes
0x038B0000 Hidden Image-->CLI.Foundation.XManifest.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x038F0000 Hidden Image-->AxInterop.WBOCXLib.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x039A0000 Hidden Image-->NEWAEM.Foundation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x03C10000 Hidden Image-->Interop.WBOCXLib.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x04A10000 Hidden Image-->CLI.Caste.HydraVision.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x050C0000 Hidden Image-->CLI.Aspect.CustomFormats.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x05120000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x05280000 Hidden Image-->CLI.Aspect.VPURecover.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x05320000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x05310000 Hidden Image-->CLI.Aspect.Welcome.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x05460000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x06400000 Hidden Image-->CLI.Component.Dashboard.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x063D0000 Hidden Image-->CLI.Component.Wizard.Shared.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 36864 bytes
0x06CC0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 372736 bytes
0x04A50000 Hidden Image-->CLI.Caste.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 389120 bytes
0x078A0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 389120 bytes
0x07570000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 405504 bytes
0x06340000 Hidden Image-->CLI.Component.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 413696 bytes
0x06830000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 421888 bytes
0x07480000 Hidden Image-->CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 421888 bytes
0x00D80000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 45056 bytes
0x00DF0000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 45056 bytes
0x03820000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 45056 bytes
0x00D50000 Hidden Image-->CCC.Implementation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 45056 bytes
0x00D70000 Hidden Image-->LOG.Foundation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 45056 bytes
0x00DF0000 Hidden Image-->LOG.Foundation.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 45056 bytes
0x03940000 Hidden Image-->ATICCCom.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 45056 bytes
0x05260000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 45056 bytes
0x052D0000 Hidden Image-->CLI.Aspect.DeviceLCD.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 45056 bytes
0x04670000 Hidden Image-->ATIDEMGX.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 462848 bytes
0x03910000 Hidden Image-->CLI.Foundation.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x03990000 Hidden Image-->AEM.Server.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x044B0000 Hidden Image-->AEM.Plugin.Source.Kit.Server.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x04610000 Hidden Image-->DEM.Graphics.I0601.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x050D0000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x050A0000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x050E0000 Hidden Image-->CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x05230000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x054E0000 Hidden Image-->CLI.Aspect.TransCode.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x061F0000 Hidden Image-->CLI.Component.Client.Shared.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x063C0000 Hidden Image-->CLI.Caste.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 53248 bytes
0x06140000 Hidden Image-->CLI.Component.Systemtray.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 585728 bytes
0x07960000 Hidden Image-->CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 585728 bytes
0x038E0000 Hidden Image-->CLI.Component.Runtime.Shared.Private.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 61440 bytes
0x052F0000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 61440 bytes
0x052E0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 61440 bytes
0x053C0000 Hidden Image-->CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 61440 bytes
0x054C0000 Hidden Image-->CLI.Aspect.DeviceCRT.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 61440 bytes
0x07680000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 643072 bytes
0x07C40000 Hidden Image-->CLI.Aspect.OverDrive5.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 667648 bytes
0x05DC0000 Hidden Image-->APM.Server.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 69632 bytes
0x038C0000 Hidden Image-->CLI.Component.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 69632 bytes
0x03890000 Hidden Image-->CLI.Component.SkinFactory.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 69632 bytes
0x053F0000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 69632 bytes
0x054A0000 Hidden Image-->CLI.Aspect.OverDrive5.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 69632 bytes
0x07C20000 Hidden Image-->CLI.Aspect.VPURecover.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 69632 bytes
0x06E70000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Wizard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 700416 bytes
0x065B0000 Hidden Image-->ResourceManagement.Foundation.Implementation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 749568 bytes
0x077E0000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 757760 bytes
0x00C80000 Hidden Image-->VMC.WindowsService.Core.dll [ EPROCESS 0x89619DA0 ] PID: 792, 77824 bytes
0x00E00000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x895F2648 ] PID: 3988, 77824 bytes
0x00DC0000 Hidden Image-->LOG.Foundation.Implementation.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x05030000 Hidden Image-->CLI.Aspect.DeviceCV.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x052A0000 Hidden Image-->CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x05380000 Hidden Image-->CLI.Aspect.Radeon3D.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x05420000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x05440000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Shared.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x06480000 Hidden Image-->CLI.Aspect.Welcome.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 77824 bytes
0x03970000 Hidden Image-->ADL.Foundation.dll [ EPROCESS 0x8967ADA0 ] PID: 256, 86016 bytes
0x05050000 Hidden Image-->CLI.Aspect.DeviceTV.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 86016 bytes
0x05340000 Hidden Image-->CLI.Aspect.OverDrive5.Graphics.Runtime.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 86016 bytes
0x06440000 Hidden Image-->CLI.Caste.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 86016 bytes
0x07AE0000 Hidden Image-->CLI.Aspect.MMVideo.Graphics.Dashboard.DLL [ EPROCESS 0x8967ADA0 ] PID: 256, 864256 bytes

#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:03:19 PM

Posted 04 January 2011 - 01:47 AM

Hello

It looks OK but I will check it out anyway

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 04 January 2011 - 03:39 AM

Combofix was "Attempting to create System Restore point" before the scan, but my System Restore hasn't worked for a while.
"System restore is not able to protect your computer" occurs when I attempt to open it, but anyway it's a separate issue.
Here's the Combofix log, thanks for your help.


ComboFix 11-01-03.03 - Administrator 04/01/2011 19:14:02.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2046.1383 [GMT 11:00]
Running from: c:\documents and settings\Administrator.EXPERIEN-E04FA4\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.WINDOWS\Microsoft
C:\driver
c:\driver\S-1-4-89-654352344-54323413-6452342-4545\Desktop.ini
C:\install.exe
c:\program files\INSTALL.LOG
c:\windows\system32\Ijl11.dll
C:\zip.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-04 to 2011-01-04 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-01 01:06 . 2008-12-23 21:59 16608 ----a-w- c:\windows\gdrv.sys
2010-12-04 06:54 . 2009-01-11 03:07 138416 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-12-04 06:54 . 2009-01-11 03:07 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-12-04 06:54 . 2009-02-28 12:47 270904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-12-04 06:54 . 2009-01-11 03:07 270904 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-29 06:38 . 2010-11-29 06:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 06:38 . 2010-11-29 06:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-21 12:45 . 2010-11-21 12:45 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-11-21 12:45 . 2010-11-21 12:45 2272 ----a-w- c:\windows\system32\w95inf16.dll
2010-11-18 18:12 . 2008-12-23 21:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 07:53 . 2010-08-28 11:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 05:34 . 2009-03-14 00:39 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-06 00:26 . 2008-05-03 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2008-05-03 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2008-05-03 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2008-05-03 12:00 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-05-03 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2008-05-03 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 16:55 . 2008-10-21 02:02 5524480 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2010-10-26 16:17 . 2008-10-21 02:02 16330752 ----a-w- c:\windows\system32\atioglxx.dll
2010-10-26 16:10 . 2009-02-25 20:32 57344 ----a-w- c:\windows\system32\aticalrt.dll
2010-10-26 16:10 . 2009-02-25 20:32 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-10-26 16:09 . 2009-02-25 20:30 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2010-10-26 16:03 . 2008-12-24 10:45 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-10-26 15:51 . 2008-10-21 02:02 3958784 ----a-w- c:\windows\system32\ati3duag.dll
2010-10-26 15:50 . 2008-12-24 10:45 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-10-26 15:49 . 2008-10-21 02:02 301056 ----a-w- c:\windows\system32\ati2dvag.dll
2010-10-26 15:48 . 2008-10-21 02:02 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2010-10-26 15:36 . 2008-10-21 02:02 2671744 ----a-w- c:\windows\system32\ativvaxx.dll
2010-10-26 15:30 . 2008-10-21 02:02 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2010-10-26 15:30 . 2008-10-21 02:02 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2010-10-26 15:30 . 2008-10-21 02:02 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2010-10-26 15:30 . 2008-10-21 02:02 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-10-26 15:30 . 2008-10-21 02:02 159744 ----a-w- c:\windows\system32\ati2evxx.dll
2010-10-26 15:28 . 2008-10-21 02:02 614400 ----a-w- c:\windows\system32\ati2evxx.exe
2010-10-26 15:27 . 2008-10-21 02:02 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2010-10-26 15:26 . 2010-06-04 07:22 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-10-26 15:22 . 2008-10-21 02:02 651264 ----a-w- c:\windows\system32\atikvmag.dll
2010-10-26 15:20 . 2010-06-04 07:22 64512 ----a-w- c:\windows\system32\atimpc32.dll
2010-10-26 15:20 . 2008-10-21 02:02 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-10-26 15:20 . 2008-10-21 02:02 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2010-10-26 15:20 . 2008-10-21 02:02 17408 ----a-w- c:\windows\system32\atitvo32.dll
2010-10-26 15:19 . 2008-10-21 02:02 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-10-26 15:14 . 2008-10-21 02:02 704512 ----a-w- c:\windows\system32\ati2cqag.dll
2010-10-26 13:25 . 2008-05-03 12:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-13 14:36 . 2010-10-13 14:36 15451288 ----a-w- c:\windows\system32\xlive.dll
2010-10-13 14:36 . 2010-10-13 14:36 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Taskbar Shuffle"="c:\program files\Taskbar Shuffle\taskbarshuffle.exe" [2008-04-16 818176]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-03 39408]
"SteamWatchTray"="c:\program files\SteamWatch\SteamWatchTray.exe" [2008-04-10 15360]
"Google Update"="c:\documents and settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-08-27 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-04 102400]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-09-17 880640]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2007-02-21 73728]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-18 76304]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-13 611712]
"RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-07 128512]

c:\documents and settings\Justin\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-4-16 809488]
Sound Control.lnk - c:\program files\Sound Control\sc.exe [2010-4-4 726016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-18 14:30 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 12:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 15:58 217544 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BandwidthMeterPro]
2008-08-16 03:35 236032 ----a-w- c:\program files\BandwidthMeterPro\BWMeterPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Photo AIO Printer 922]
2005-04-21 21:45 290816 ----a-w- c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
2009-03-18 18:44 3325952 ----a-w- c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2008-12-18 13:42 76304 ----a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileConnect]
2008-07-04 12:52 2072576 ----a-w- c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
2006-06-15 01:36 229376 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
2006-06-27 05:21 1449984 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2009-10-14 04:43 3217368 ----a-w- c:\program files\Registry Mechanic\RegMech.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2009-03-20 12:47 306088 ----a-w- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2010-04-30 07:22 19523616 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2008-07-02 06:16 393216 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 05:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-16 23:07 1242448 ----a-w- c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-12-14 20:02 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"PCSuiteTrayApplication"=c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe"=
"c:\\Program Files\\CAPCOM\\STREETFIGHTERIV\\StreetFighterIV.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\day of defeat\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\half-life\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\freedom force\\fforce.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\freedom force vs. the 3rd reich\\ffvt3r.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\company of heroes\\help.htm"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom apocalypse\\dosbox.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\world of goo\\WorldOfGoo.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\bioshock\\Builds\\Release\\Bioshock.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\osmos\\osmos.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins main trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins gameplay trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins stone prisoner trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins blood dragon armor trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins wardens keep trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins sacred ashes_2 trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\shattered horizon escalation trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2 - tv spot 2\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom ufo defense\\dosbox.exe"=
"c:\\Documents and Settings\\Administrator.EXPERIEN-E04FA4\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\company of heroes\\RelicCOH.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\counter-strike\\hl.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 3 arena\\quake3.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\Winquake.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\qwcl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\Glquake.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\glqwcl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\deus ex invisible war\\System\\dx2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 2\\quake2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 2\\reckoning.bat"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 2\\ground_zero.bat"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom interceptor\\Interceptor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\oblivion\\OblivionLauncher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv\\Civilization4.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom enforcer\\System\\XCom.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv beyond the sword\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the void\\bin\\win32\\Game.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the void\\bin\\win32\\Config.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv warlords\\Warlords\\Civ4Warlords.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv warlords\\Warlords\\Civ4Warlords_PitBoss.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\civilization iv colonization\\Colonization.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\x-com terror from the deep\\runme.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\deus ex\\System\\DeusEx.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dawn of war 2\\DOW2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\poker night at the inventory\\CelebrityPoker.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\chime\\Chime.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\aaaaaaaaaaaaaaaaaaaaaaaaa!!!\\main.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\shatter\\ShatterSettingsEditor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\flight_control_hd\\flightControl_win32.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\defensegridtheawakening\\DefenseGrid.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\operation flashpoint dragon rising\\OFDR.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\darksiders\\DarksidersPC.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\operation flashpoint dragon rising\\Mission Editor\\MissionEditor.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\borderlands\\Binaries\\Borderlands.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\killingfloor\\System\\KillingFloor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\grand theft auto iv\\GTAIV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\counter-strike source\\hl2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [18/02/2010 5:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/05/2010 5:41 AM 67656]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [22/12/2008 3:59 PM 80392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [21/12/2009 10:50 AM 583640]
R2 SteamWatch;SteamWatch;c:\program files\SteamWatch\SteamWatch.exe [20/07/2010 4:11 PM 18944]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [4/07/2008 11:52 PM 14336]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 2:16 PM 130384]
S2 gupdate1ca536b94075016;Google Update Service (gupdate1ca536b94075016);c:\program files\Google\Update\GoogleUpdate.exe [23/10/2009 10:01 AM 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [13/04/2009 9:44 PM 1691480]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [13/04/2009 9:38 PM 1294336]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3/05/2008 11:00 PM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [3/08/2005 8:10 AM 32512]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [7/03/2009 3:04 PM 272128]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [28/07/2009 6:25 PM 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [28/07/2009 6:25 PM 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [28/07/2009 6:25 PM 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [28/07/2009 6:25 PM 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [28/07/2009 6:25 PM 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [28/07/2009 6:25 PM 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [28/07/2009 6:25 PM 117672]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [13/04/2009 9:38 PM 1294336]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [3/05/2008 11:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 2:16 PM 753504]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NORMANDY
*Deregistered* - Normandy
*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
WINRM REG_MULTI_SZ WINRM
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-10-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 01:50]

2011-01-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 23:01]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 23:01]

2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1275210071-651377827-1417001333-500Core.job
- c:\documents and settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-27 12:04]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1275210071-651377827-1417001333-500UA.job
- c:\documents and settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-27 12:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:56242
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: bmnet.dll
Trusted Zone: mh.org.au\pacs
TCP: {3580A888-7FA3-4E3C-A944-3B77874D3CD0} = 203.0.178.191
DPF: {1FBD11EF-1260-11D1-87A7-444553540001} - hxxps://pacs.mh.org.au/osd/synapseWorkstation.cab
DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} - hxxps://pacs.mh.org.au/osd/x86/win95/FujiInst.cab
FF - ProfilePath - c:\documents and settings\Administrator.EXPERIEN-E04FA4\Application Data\Mozilla\Firefox\Profiles\p7aolyxo.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en-GB&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Aero Fox XL: {5c8bfb7c-9a54-11dc-8314-0800200c9a66} - %profile%\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: LastPass: support@lastpass.com - %profile%\extensions\support@lastpass.com
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Virtus Search Opt-in: extension@virtusdesigns.com - %profile%\extensions\extension@virtusdesigns.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-klmdb.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-04 19:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1275210071-651377827-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a8,75,60,b5,8d,83,93,41,b9,f8,fa,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a8,75,60,b5,8d,83,93,41,b9,f8,fa,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a8,75,60,b5,8d,83,93,41,b9,f8,fa,\

[HKEY_USERS\S-1-5-21-1275210071-651377827-1417001333-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:11,06,fb,a0,2a,0d,0f,f3,35,68,2e,af,3a,bb,cc,77,fc,06,f1,5b,5f,93,bc,
55,cc,14,b3,95,11,41,f6,17,c8,e2,9b,48,92,c0,64,d5,6a,83,c4,1b,49,e2,eb,b0,\
"??"=hex:32,53,37,69,28,1b,21,20,e0,99,f2,07,5b,dc,50,bf

[HKEY_USERS\S-1-5-21-1275210071-651377827-1417001333-500\Software\SecuROM\License information*]
"datasecu"=hex:4e,18,75,71,af,cc,8e,b1,4d,90,94,8e,42,27,69,4b,1d,64,72,2a,6a,
4c,b8,3a,48,33,5d,74,36,e6,1e,af,af,a2,bd,0d,cf,b8,18,bd,7a,6d,a2,6e,9a,4e,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'lsass.exe'(1064)
c:\windows\system32\bmnet.dll
.
Completion time: 2011-01-04 19:26:57
ComboFix-quarantined-files.txt 2011-01-04 08:26

Pre-Run: 137,051,824,128 bytes free
Post-Run: 138,258,509,824 bytes free

- - End Of File - - 12D98C737D6D4309EB7FB0C3A43A71A3

#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:03:19 PM

Posted 04 January 2011 - 06:04 AM

Hello

Remind me later about system restore to see if I can find something

I see some other stuff that we need to go after, so I want you to run this custom script for me.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window: 

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:56242


Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 04 January 2011 - 08:48 AM

ComboFix asked to update when I dragged the script as instructed, and I clicked yes and let it do its thing.
Internet Explorer shortcut appears on desktop after the scan (happened the first ComboFix scan too) and Firefox lost it's default browser status, I'm guessing that's meant to happen after ComboFix?

Here's the log:

ComboFix 11-01-03.04 - Administrator 05/01/2011 0:33.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.2046.1415 [GMT 11:00]
Running from: c:\documents and settings\Administrator.EXPERIEN-E04FA4\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator.EXPERIEN-E04FA4\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2010-12-04 to 2011-01-04 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-01 01:06 . 2008-12-23 21:59 16608 ----a-w- c:\windows\gdrv.sys
2010-12-04 06:54 . 2009-01-11 03:07 138416 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-12-04 06:54 . 2009-01-11 03:07 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-12-04 06:54 . 2009-02-28 12:47 270904 ----a-w- c:\windows\system32\PnkBstrB.xtr
2010-12-04 06:54 . 2009-01-11 03:07 270904 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-29 06:38 . 2010-11-29 06:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 06:38 . 2010-11-29 06:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-21 12:45 . 2010-11-21 12:45 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-11-21 12:45 . 2010-11-21 12:45 2272 ----a-w- c:\windows\system32\w95inf16.dll
2010-11-18 18:12 . 2008-12-23 21:44 81920 ----a-w- c:\windows\system32\isign32.dll
2010-11-12 07:53 . 2010-08-28 11:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-12 05:34 . 2009-03-14 00:39 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-11-06 00:26 . 2008-05-03 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2008-05-03 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2008-05-03 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2008-05-03 12:00 385024 ----a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-05-03 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2008-05-03 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-10-26 16:55 . 2008-10-21 02:02 5524480 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2010-10-26 16:17 . 2008-10-21 02:02 16330752 ----a-w- c:\windows\system32\atioglxx.dll
2010-10-26 16:10 . 2009-02-25 20:32 57344 ----a-w- c:\windows\system32\aticalrt.dll
2010-10-26 16:10 . 2009-02-25 20:32 53248 ----a-w- c:\windows\system32\aticalcl.dll
2010-10-26 16:09 . 2009-02-25 20:30 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2010-10-26 16:03 . 2008-12-24 10:45 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2010-10-26 15:51 . 2008-10-21 02:02 3958784 ----a-w- c:\windows\system32\ati3duag.dll
2010-10-26 15:50 . 2008-12-24 10:45 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-10-26 15:49 . 2008-10-21 02:02 301056 ----a-w- c:\windows\system32\ati2dvag.dll
2010-10-26 15:48 . 2008-10-21 02:02 393216 ----a-w- c:\windows\system32\atiok3x2.dll
2010-10-26 15:36 . 2008-10-21 02:02 2671744 ----a-w- c:\windows\system32\ativvaxx.dll
2010-10-26 15:30 . 2008-10-21 02:02 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2010-10-26 15:30 . 2008-10-21 02:02 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2010-10-26 15:30 . 2008-10-21 02:02 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2010-10-26 15:30 . 2008-10-21 02:02 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-10-26 15:30 . 2008-10-21 02:02 159744 ----a-w- c:\windows\system32\ati2evxx.dll
2010-10-26 15:28 . 2008-10-21 02:02 614400 ----a-w- c:\windows\system32\ati2evxx.exe
2010-10-26 15:27 . 2008-10-21 02:02 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2010-10-26 15:26 . 2010-06-04 07:22 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-10-26 15:22 . 2008-10-21 02:02 651264 ----a-w- c:\windows\system32\atikvmag.dll
2010-10-26 15:20 . 2010-06-04 07:22 64512 ----a-w- c:\windows\system32\atimpc32.dll
2010-10-26 15:20 . 2008-10-21 02:02 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-10-26 15:20 . 2008-10-21 02:02 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2010-10-26 15:20 . 2008-10-21 02:02 17408 ----a-w- c:\windows\system32\atitvo32.dll
2010-10-26 15:19 . 2008-10-21 02:02 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-10-26 15:14 . 2008-10-21 02:02 704512 ----a-w- c:\windows\system32\ati2cqag.dll
2010-10-26 13:25 . 2008-05-03 12:00 1853312 ----a-w- c:\windows\system32\win32k.sys
2010-10-13 14:36 . 2010-10-13 14:36 15451288 ----a-w- c:\windows\system32\xlive.dll
2010-10-13 14:36 . 2010-10-13 14:36 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Taskbar Shuffle"="c:\program files\Taskbar Shuffle\taskbarshuffle.exe" [2008-04-16 818176]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-03 39408]
"SteamWatchTray"="c:\program files\SteamWatch\SteamWatchTray.exe" [2008-04-10 15360]
"Google Update"="c:\documents and settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-08-27 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-04 102400]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-09-17 880640]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2007-02-21 73728]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-18 76304]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-13 611712]
"RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-07 128512]

c:\documents and settings\Justin\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-4-16 809488]
Sound Control.lnk - c:\program files\Sound Control\sc.exe [2010-4-4 726016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-18 14:30 72208 ----a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete\0autocheck lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 12:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-02-22 15:58 217544 ----a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BandwidthMeterPro]
2008-08-16 03:35 236032 ----a-w- c:\program files\BandwidthMeterPro\BWMeterPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Photo AIO Printer 922]
2005-04-21 21:45 290816 ----a-w- c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
2009-03-18 18:44 3325952 ----a-w- c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2008-12-18 13:42 76304 ----a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileConnect]
2008-07-04 12:52 2072576 ----a-w- c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
2006-06-15 01:36 229376 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
2006-06-27 05:21 1449984 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2009-10-14 04:43 3217368 ----a-w- c:\program files\Registry Mechanic\RegMech.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC]
2009-03-20 12:47 306088 ----a-w- c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2010-04-30 07:22 19523616 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2008-07-02 06:16 393216 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 05:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-16 23:07 1242448 ----a-w- c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-12-14 20:02 2424560 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"PCSuiteTrayApplication"=c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe"=
"c:\\Program Files\\CAPCOM\\STREETFIGHTERIV\\StreetFighterIV.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\day of defeat\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\half-life\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\freedom force\\fforce.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\freedom force vs. the 3rd reich\\ffvt3r.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\company of heroes\\help.htm"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom apocalypse\\dosbox.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\world of goo\\WorldOfGoo.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\bioshock\\Builds\\Release\\Bioshock.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\osmos\\osmos.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins main trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins gameplay trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins stone prisoner trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins blood dragon armor trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins wardens keep trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dragon age origins sacred ashes_2 trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\shattered horizon escalation trailer\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2 - tv spot 2\\smp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom ufo defense\\dosbox.exe"=
"c:\\Documents and Settings\\Administrator.EXPERIEN-E04FA4\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\company of heroes\\RelicCOH.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\counter-strike\\hl.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 3 arena\\quake3.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\Winquake.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\qwcl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\Glquake.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake\\glqwcl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\deus ex invisible war\\System\\dx2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 2\\quake2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 2\\reckoning.bat"=
"c:\\Program Files\\Steam\\steamapps\\common\\quake 2\\ground_zero.bat"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom interceptor\\Interceptor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\oblivion\\OblivionLauncher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv\\Civilization4.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\xcom enforcer\\System\\XCom.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv beyond the sword\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the void\\bin\\win32\\Game.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the void\\bin\\win32\\Config.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv warlords\\Warlords\\Civ4Warlords.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\sid meier's civilization iv warlords\\Warlords\\Civ4Warlords_PitBoss.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\civilization iv colonization\\Colonization.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\x-com terror from the deep\\runme.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\deus ex\\System\\DeusEx.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\dawn of war 2\\DOW2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\poker night at the inventory\\CelebrityPoker.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\chime\\Chime.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\aaaaaaaaaaaaaaaaaaaaaaaaa!!!\\main.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\shatter\\ShatterSettingsEditor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\amd driver updater, xp, 32 bit\\Setup.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\flight_control_hd\\flightControl_win32.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\defensegridtheawakening\\DefenseGrid.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\operation flashpoint dragon rising\\OFDR.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\darksiders\\DarksidersPC.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\operation flashpoint dragon rising\\Mission Editor\\MissionEditor.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\borderlands\\Binaries\\Borderlands.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\killingfloor\\System\\KillingFloor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\grand theft auto iv\\GTAIV\\LaunchGTAIV.exe"=
"c:\\Program Files\\Steam\\steamapps\\feed_me_coke@hotmail.com\\counter-strike source\\hl2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [18/02/2010 5:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/05/2010 5:41 AM 67656]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [22/12/2008 3:59 PM 80392]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [21/12/2009 10:50 AM 583640]
R2 SteamWatch;SteamWatch;c:\program files\SteamWatch\SteamWatch.exe [20/07/2010 4:11 PM 18944]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [4/07/2008 11:52 PM 14336]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 2:16 PM 130384]
S2 gupdate1ca536b94075016;Google Update Service (gupdate1ca536b94075016);c:\program files\Google\Update\GoogleUpdate.exe [23/10/2009 10:01 AM 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [13/04/2009 9:44 PM 1691480]
S3 CM1083264;C-Media CM108 Like Sound UDAX Interface;c:\windows\system32\drivers\CM108.sys [13/04/2009 9:38 PM 1294336]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3/05/2008 11:00 PM 14336]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [3/08/2005 8:10 AM 32512]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [7/03/2009 3:04 PM 272128]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [28/07/2009 6:25 PM 90536]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [28/07/2009 6:25 PM 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [28/07/2009 6:25 PM 122152]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [28/07/2009 6:25 PM 115496]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [28/07/2009 6:25 PM 25768]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [28/07/2009 6:25 PM 111912]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [28/07/2009 6:25 PM 117672]
S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [13/04/2009 9:38 PM 1294336]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [3/05/2008 11:00 PM 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 2:16 PM 753504]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NORMANDY
*Deregistered* - Normandy
*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
WINRM REG_MULTI_SZ WINRM
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-10-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 01:50]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 23:01]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 23:01]

2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1275210071-651377827-1417001333-500Core.job
- c:\documents and settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-27 12:04]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1275210071-651377827-1417001333-500UA.job
- c:\documents and settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-27 12:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
LSP: %SystemRoot%\system32\PrxerDrv.dll
LSP: bmnet.dll
Trusted Zone: mh.org.au\pacs
TCP: {3580A888-7FA3-4E3C-A944-3B77874D3CD0} = 203.0.178.191
DPF: {1FBD11EF-1260-11D1-87A7-444553540001} - hxxps://pacs.mh.org.au/osd/synapseWorkstation.cab
DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} - hxxps://pacs.mh.org.au/osd/x86/win95/FujiInst.cab
FF - ProfilePath - c:\documents and settings\Administrator.EXPERIEN-E04FA4\Application Data\Mozilla\Firefox\Profiles\p7aolyxo.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en-GB&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Aero Fox XL: {5c8bfb7c-9a54-11dc-8314-0800200c9a66} - %profile%\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: LastPass: support@lastpass.com - %profile%\extensions\support@lastpass.com
FF - Ext: Adobe DLM (powered by getPlus®): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Virtus Search Opt-in: extension@virtusdesigns.com - %profile%\extensions\extension@virtusdesigns.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-05 00:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1275210071-651377827-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a8,75,60,b5,8d,83,93,41,b9,f8,fa,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a8,75,60,b5,8d,83,93,41,b9,f8,fa,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a8,75,60,b5,8d,83,93,41,b9,f8,fa,\

[HKEY_USERS\S-1-5-21-1275210071-651377827-1417001333-500\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:11,06,fb,a0,2a,0d,0f,f3,35,68,2e,af,3a,bb,cc,77,fc,06,f1,5b,5f,93,bc,
55,cc,14,b3,95,11,41,f6,17,c8,e2,9b,48,92,c0,64,d5,6a,83,c4,1b,49,e2,eb,b0,\
"??"=hex:32,53,37,69,28,1b,21,20,e0,99,f2,07,5b,dc,50,bf

[HKEY_USERS\S-1-5-21-1275210071-651377827-1417001333-500\Software\SecuROM\License information*]
"datasecu"=hex:4e,18,75,71,af,cc,8e,b1,4d,90,94,8e,42,27,69,4b,1d,64,72,2a,6a,
4c,b8,3a,48,33,5d,74,36,e6,1e,af,af,a2,bd,0d,cf,b8,18,bd,7a,6d,a2,6e,9a,4e,\
"rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'lsass.exe'(1064)
c:\windows\system32\bmnet.dll

- - - - - - - > 'explorer.exe'(3708)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\Downloaded Program Files\FujiFld.dll
c:\windows\DOWNLO~1\FujiFldR.dll
c:\windows\Downloaded Program Files\DBCmds.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Completion time: 2011-01-05 00:45:17
ComboFix-quarantined-files.txt 2011-01-04 13:45
ComboFix2.txt 2011-01-04 08:26

Pre-Run: 138,204,553,216 bytes free
Post-Run: 138,186,387,456 bytes free

- - End Of File - - 8E8356E80BE01349FB8C56E5F0D47F63

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:03:19 PM

Posted 04 January 2011 - 09:57 AM

Hello

:P2P Warning!:

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur
Once upon a time, P2P file sharing was fairly safe. That is no longer true. P2P programs form a direct conduit on to your computer, their security measures are easily circumvented and malware writers are increasingly exploiting them to spread their wares on to your computer. Further to that, if your P2P program is not configured correctly, your computer may be sharing more files than you realise. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to a file sharing network by a badly configured program.

Please read these short reports on the dangers of peer-2-peer programs and file sharing.

FBI Cyber Education Letter
File sharing infects 500,000 computers
USAToday
infoworld


These logs are looking alot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

1. click on start
2. then go to settings
3. after that you need control panel
4. look for the icon add/remove programs
click on the following programs

Adobe Reader 9.4.1

and click on remove

Update Adobe Reader

Recently there have been vunerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.

Note: When installing FoxitReader, be carefull not to install anything to do with AskBar.
[/list]
Clear your Java Cache

  • click on Start-> Control Panel (Classic View)-> Java (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.

TFC(Temp File Cleaner):

  • Please download TFC to your desktop,
  • Save any unsaved work. TFC will close all open application windows.
  • Double-click TFC.exe to run the program.
  • If prompted, click "Yes" to reboot.
Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

: Malwarebytes' Anti-Malware :

  • I would like you to rerun MBAM
  • Double-click mbam icon
  • go to the update tab at the top
  • click on check for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

  • Go Here to download HijackThis Installer
  • Save HijackThis Installer to your desktop.
  • Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT use the AnalyseThis button its findings are dangerous if misinterpreted.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

"information and logs"

  • In your next post I need the following

  • Log From MBAM
  • report from Hijackthis
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 04 January 2011 - 05:46 PM

Followed all instructions, MBAM lit up with FakeAlert


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5460

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/01/2011 9:44:23 AM
mbam-log-2011-01-05 (09-44-23).txt

Scan type: Quick scan
Objects scanned: 202926
Time elapsed: 2 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\B60JHDGR6V (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:46:04 AM, on 5/01/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\SteamWatch\SteamWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Brownie\BrstsWnd.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Brownie\brpjp04a.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SteamWatch\SteamWatchTray.exe
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Sound Control\sc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Synapse BHO - {33414365-E6C7-460d-880A-A163BD69E84D} - C:\WINDOWS\Downloaded Program Files\FujiFld.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [BrStsWnd] C:\Program Files\Brownie\BrstsWnd.exe Autorun
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Taskbar Shuffle] C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SteamWatchTray] C:\Program Files\SteamWatch\SteamWatchTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: Sound Control.lnk = C:\Program Files\Sound Control\sc.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\prxerdrv.dll
O16 - DPF: {1FBD11EF-1260-11D1-87A7-444553540001} (Synapse Medical Imaging Workstation) - https://pacs.mh.org.au/osd/synapseWorkstation.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261355283593
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261396862750
O16 - DPF: {F88E6FA9-579E-4AE9-8DDA-C48BB36B0A32} (SynapseInstallHelper Class) - https://pacs.mh.org.au/osd/x86/win95/FujiInst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3580A888-7FA3-4E3C-A944-3B77874D3CD0}: NameServer = 203.0.178.191
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bytemobile Web Configurator (bmwebcfg) - Bytemobile, Inc. - C:\WINDOWS\system32\bmwebcfg.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: dlbt_device - - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Google Update Service (gupdate1ca536b94075016) (gupdate1ca536b94075016) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: SteamWatch - CL - C:\Program Files\SteamWatch\SteamWatch.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Vodafone Mobile Connect Service (VMCService) - Vodafone - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

--
End of file - 13374 bytes

#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:03:19 PM

Posted 04 January 2011 - 07:05 PM

Greetings

These logs are looking very good, we are almost done!!! Just one more scan to go.

:Remove unneeded startup entries:

This part of the fix is purely optional
These are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster.

  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

    • O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
      O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
      O4 - HKLM\..\Run: [BrStsWnd] C:\Program Files\Brownie\BrstsWnd.exe Autorun
      O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
      O4 - HKCU\..\Run: [Taskbar Shuffle] C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
      O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
      O4 - HKCU\..\Run: [SteamWatchTray] C:\Program Files\SteamWatch\SteamWatchTray.exe
      O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
      O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
      O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

    NOTE**You can research each of those lines >here< and see if you want to keep them or not
    just copy the name between the brakets and paste into the search space
    O4 - HKLM\..\Run: [IntelliPoint]


Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page to run an online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • click on the ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
  • When asked, allow the activex control to install
    • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options
    Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 jbai

jbai
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
    •  
  • Local time:02:19 PM

Posted 05 January 2011 - 04:55 PM

Thanks for your help Gringo.
Here's the log.

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=bf415cd2515e7d4e841316dbfcd54bdf
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-12-29 07:43:00
# local_time=2010-12-29 06:43:00 (+1000, AUS Eastern Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=42843
# found=5
# cleaned=5
# scan_time=1014
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Application Data\dwm.exe a variant of Win32/Kryptik.JFX trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Application Data\Microsoft\conhost.exe a variant of Win32/Kryptik.JFG trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Games Related\Alcohol 120% v1.9.6.4719\Activator-BetaMaster-v3.0\keymaker.exe probably a variant of Win32/Agent.CWORLZS trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Games\Game Resources\KOTOR\Star.Wars.KotoR.2.UPDATE.v1.02b.CRACKED.REPACK-CARBON\Cracktro.exe probably a variant of Win32/Agent.EQKKOIL trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Local Settings\Temp\csrss.exe a variant of Win32/Kryptik.JFX trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=bf415cd2515e7d4e841316dbfcd54bdf
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-12-30 05:15:28
# local_time=2010-12-30 04:15:28 (+1000, AUS Eastern Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5891 16776533 100 96 0 23337567 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=10532
# found=0
# cleaned=0
# scan_time=341
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=bf415cd2515e7d4e841316dbfcd54bdf
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-01-05 10:28:14
# local_time=2011-01-05 09:28:14 (+1000, AUS Eastern Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 37354 37354 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=13693
# found=3
# cleaned=0
# scan_time=4831
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\SPSS 17.rar NSIS/TrojanDownloader.Agent.NBS.Gen trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Torrents\Hirens.BootCD.9.7.with.keyboardpatch-MaxT.dk.zip probably unknown NewHeur_PE virus (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Torrents\Microsoft XP PRO\Windows XP PRO Corp SP3 Unattended CD September 2008 + CD-Key\WINDOW~1.ISO Win32/CMDOW.143 application (unable to clean) 00000000000000000000000000000000 I
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=bf415cd2515e7d4e841316dbfcd54bdf
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-01-05 06:54:47
# local_time=2011-01-06 05:54:47 (+1000, AUS Eastern Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 55601 55601 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=459388
# found=6
# cleaned=0
# scan_time=16978
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\SPSS 17.rar NSIS/TrojanDownloader.Agent.NBS.Gen trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Torrents\Hirens.BootCD.9.7.with.keyboardpatch-MaxT.dk.zip probably unknown NewHeur_PE virus (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Torrents\Microsoft XP PRO\Windows XP PRO Corp SP3 Unattended CD September 2008 + CD-Key\WINDOW~1.ISO Win32/CMDOW.143 application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Other Games\Assassins.Creed.II-SKIDROW\sr-acii.iso a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Other Games\Silent.Hill.2.(Directors.Cut).PC.MULTI5.[SPATorrent.CoM]\SHDC_NoCD\SHDC_NoCD Crack.rar a variant of Win32/Tool.TPE.A application (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\LucasArts\SWKotOR2\Cracktro.exe probably a variant of Win32/Agent.EQKKOIL trojan (unable to clean) 00000000000000000000000000000000 I

#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:03:19 PM

Posted 05 January 2011 - 05:00 PM

Greetings

There are somethings in the online scan I want to remove so run this scrript for me.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window: 

File::
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\SPSS 17.rar
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Torrents\Hirens.BootCD.9.7.with.keyboardpatch-MaxT.dk.zip
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Documents and Software\Utilities\Installation Files\Torrents\Microsoft XP PRO\Windows XP PRO Corp SP3 Unattended CD September 2008 + CD-Key\WINDOW~1.ISO
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Other Games\Assassins.Creed.II-SKIDROW\sr-acii.iso
C:\Documents and Settings\Administrator.EXPERIEN-E04FA4\Desktop\Other Games\Silent.Hill.2.(Directors.Cut).PC.MULTI5.[SPATorrent.CoM]\SHDC_NoCD\SHDC_NoCD Crack.rar
C:\Program Files\LucasArts\SWKotOR2\Cracktro.exe


Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University
Back to Virus, Trojan, Spyware, and Malware Removal Help


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users


  1. BleepingComputer.com
  2. → Security
  3. → Virus, Trojan, Spyware, and Malware Removal Help
  4. Privacy Policy
  5. Rules ·