Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows XP Repair--Cannot Run TDSSKiller, getting Google redirects


  • This topic is locked This topic is locked
21 replies to this topic

#1 Brainster55

Brainster55

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 05 July 2011 - 05:25 AM

I tried following the instructions to remove Windows XP repair, but although Rkill appears to work (finishes and generates a log), after downloading TDSSKiller and renaming it to annoy.com, it would not run. I got an hourglass for a second or so, but then nothing. I am getting Google redirects although I noticed that if I copy link location and then paste and go, it behaves normally.

Thanks in advance for your help!

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Run by Jordan Reccion at 0:22:22 on 2011-07-05
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.796 [GMT -7:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: Norton Internet Worm Protection *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Ralink\Common\RaRegistry.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\MsPMSPSv.exe
svchost.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\explorer.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.cox.net/
mSearch Page =
uWinlogon: Shell=explorer.exe,
uWindows: load=c:\docume~1\jordan~1\locals~1\temp\csrss.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search &

destroy\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet

explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program

files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Advanced SystemCare 4] "c:\program files\iobit\advanced systemcare 4\ASCTray.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [{8FF0329C-25AF-1C29-F62A-82FF22E24F78}] "c:\documents and settings\jordan reccion\application data\qowuul\zyoza.exe"
mRun: [PRONoMgr.exe] c:\program files\intel\ncs\proset\PRONoMgr.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
dRunOnce: [SetDefaultMidi] MIDIDEF.EXE
uPolicies-explorer: NoInstrumentation = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC} - c:\program

files\java\jre6\bin\jp2iexp.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program

files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} -

c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search &

destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxp://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -

hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131815231375
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
TCP: DhcpNameServer = 192.168.0.10
TCP: Interfaces\{0DF70CB3-64AC-4E7B-B131-01752B7ACBE0} : DhcpNameServer = 192.168.0.10
TCP: Interfaces\{341C778A-3D5A-4004-893B-1F9F4736AC4B} : DhcpNameServer = 192.168.0.10
TCP: Interfaces\{EBED2247-4694-4EF3-909F-E289681849DA} : DhcpNameServer = 192.168.0.10
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet

explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\jordan reccion\application data\mozilla\firefox\profiles\wjvtt1x9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 51455
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\canon\mycamera download plugin\NPCIG.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-5-19 13496]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 165264]
R1 MpKsl42048684;MpKsl42048684;c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{bdff591c-febe-45ae-86b5-0f18c20f2f64}\MpKsl42048684.sys [2011-7-4 28752]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\iobit\advanced systemcare 4\ASCService.exe

[2011-4-29 353168]
R2 NAUpdate;@c:\program files\nero\update\nasvc.exe,-200;c:\program files\nero\update\NASvc.exe [2011-3-29 598312]
R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RaRegistry.exe [2010-12-30 185632]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [2010-12-30 19072]
S1 MpKsl060cb661;MpKsl060cb661;\??\c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{bcc0f6d4-6038-46c2-9828-2692584ce64e}\mpksl060cb661.sys --> c:\documents and settings\all

users\application data\microsoft\microsoft antimalware\definition

updates\{bcc0f6d4-6038-46c2-9828-2692584ce64e}\MpKsl060cb661.sys [?]
S1 MpKsl6b8e90d4;MpKsl6b8e90d4;\??\c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{34b20b82-897d-42df-865d-4a244a15cca5}\mpksl6b8e90d4.sys --> c:\documents and settings\all

users\application data\microsoft\microsoft antimalware\definition

updates\{34b20b82-897d-42df-865d-4a244a15cca5}\MpKsl6b8e90d4.sys [?]
S1 MpKsl968b9f36;MpKsl968b9f36;\??\c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{000fe377-1f3f-4a43-a7f5-3fff35e3da72}\mpksl968b9f36.sys --> c:\documents and settings\all

users\application data\microsoft\microsoft antimalware\definition

updates\{000fe377-1f3f-4a43-a7f5-3fff35e3da72}\MpKsl968b9f36.sys [?]
S1 MpKsld783a656;MpKsld783a656;\??\c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{cd575ea7-8178-4cda-b21b-f72c9df6254e}\mpksld783a656.sys --> c:\documents and settings\all

users\application data\microsoft\microsoft antimalware\definition

updates\{cd575ea7-8178-4cda-b21b-f72c9df6254e}\MpKsld783a656.sys [?]
S1 MpKslf3f2bdc8;MpKslf3f2bdc8;\??\c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{ffd75320-f0be-473f-acc0-0a26d7dcdcc4}\mpkslf3f2bdc8.sys --> c:\documents and settings\all

users\application data\microsoft\microsoft antimalware\definition

updates\{ffd75320-f0be-473f-acc0-0a26d7dcdcc4}\MpKslf3f2bdc8.sys [?]
S1 MpKslfa2c2fd0;MpKslfa2c2fd0;\??\c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{78f03a23-5d63-43ce-901b-d7d0d6a13df5}\mpkslfa2c2fd0.sys --> c:\documents and settings\all

users\application data\microsoft\microsoft antimalware\definition

updates\{78f03a23-5d63-43ce-901b-d7d0d6a13df5}\MpKslfa2c2fd0.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-14 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-14 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-12-28 39984]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\sophosmemsweep.sys --> c:\windows\system32\SophosMEMSWEEP.SYS [?]
S3 RapDrv;RapDrv;c:\windows\system32\drivers\RapDrv.sys [2004-8-30 98144]
S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2004-8-30 37436]
S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2004-8-30 25284]
S4 BlackICE;BlackICE;c:\program files\network ice\blackice\blackd.exe [2004-8-30 737280]
.
=============== Created Last 30 ================
.
2011-07-05 06:05:30 54016 ----a-w- c:\windows\system32\drivers\eueoqjwa.sys
2011-07-04 21:51:24 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{bdff591c-febe-45ae-86b5-0f18c20f2f64}\MpKsl42048684.sys
2011-07-03 20:48:59 -------- d--h--w- c:\documents and settings\jordan reccion\application data\Qowuul
2011-07-03 20:48:59 -------- d--h--w- c:\documents and settings\jordan reccion\application data\Avroyx
2011-07-03 09:45:08 -------- d-----w- c:\program files\ClubWPT
2011-07-03 03:02:03 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft

antimalware\definition updates\{bdff591c-febe-45ae-86b5-0f18c20f2f64}\mpengine.dll
2011-07-01 19:51:46 -------- d-----w- c:\program files\Infogrames Interactive
2011-06-30 22:44:14 -------- d--h--w- c:\documents and settings\jordan reccion\local settings\application

data\CPN
2011-06-30 22:43:55 -------- d-----w- c:\program files\Cake Poker 2.0
2011-06-22 09:37:40 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-22 09:37:40 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-17 23:40:07 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 23:40:07 -------- d-----w- c:\program files\OpenAL
2011-06-17 23:25:41 -------- d-----w- c:\program files\The Adventure Company
2011-06-15 23:15:17 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-15 22:57:38 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-06-13 20:32:19 -------- d-----w- C:\Life32
2011-06-13 20:20:13 -------- d--h--w- c:\documents and settings\jordan reccion\application

data\GetRightToGo
2011-06-11 19:19:22 -------- d--h--w- c:\documents and settings\jordan reccion\application data\RIFT
2011-06-11 19:19:10 -------- d-----w- c:\program files\RIFT Game
2011-06-08 18:20:17 -------- d--h--w- c:\documents and settings\jordan reccion\application data\uPlayer
2011-06-08 18:19:54 -------- d-----w- c:\program files\uPlayer
.
==================== Find3M ====================
.
2011-07-02 02:51:02 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-17 23:40:07 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-09 07:13:22 0 ----a-w- c:\windows\Ykaqanuperamiy.bin
2011-05-29 16:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 16:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-03 17:54:33 86528 ----a-w- c:\windows\bnetunin.exe
2011-05-03 17:54:33 61440 ----a-w- c:\windows\diabunin.exe
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2003-03-31 12:00:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12:07 50688 --sh--w- c:\windows\twain_32.dll
2008-04-14 00:12:01 57344 --sha-w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12:01 413696 --sha-w- c:\windows\system32\msvcp60.dll
2010-12-20 17:32:15 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12:02 84992 --sha-w- c:\windows\system32\olepro32.dll
2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe
.
============= FINISH: 0:29:50.56 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 09 July 2011 - 11:34 PM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • Please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

  • Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger may ask you to reboot the machine, if it does - click OK
Do not re-enable these drivers until otherwise instructed.

Download DDS:

  • Please download DDS by sUBs from one of the links below and save it to your desktop:

    Posted Image
    Download DDS and save it to your desktop

    Link1
    Link2
    Link3

    Please disable any anti-malware program that will block scripts from running before running DDS.

    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
    • DDS.txt
    • Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply

Scan With RKUnHooker

  • Please Download Rootkit Unhooker Save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"


"just click on Cancel, then Accept".

information and logs:

  • In your next post I need the following

  • .logs from DDS
  • log from RKUnHooker
  • let me know of any problems you may have had

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 10 July 2011 - 12:41 PM

Hi Gringo, thanks for your help. I did the following:

1. Ran Defogger and got the "Finished!" message. It did not ask me to reboot the machine.

2. Ran dds.scr and got the two text files which I will paste at the end of this post. I should mention that dds.scr took quite a bit longer than the three minutes that the command window suggested would be required; I would estimate 15-20 minutes were required.

3. Tried running RKUnHooker. The program did give me the parasite detected inside itself message. I clicked cancel. It responded "Program Integrity Damaged". I clicked OK. The program eventually loaded. I clicked on the report tab and chose "Scan". I unchecked all but "Drivers" and "Stealth Code". It ran for about a minute, then suddenly terminated with no message from Windows or the program itself. I tried closing down everything other than this Firefox Window and it still terminated about a minute in every time I ran it. I could see that it was working on the Stealth Code part of the scan when it terminated as it showed the Drivers tab briefly and then went to the Stealth Code tab, so I tried ticking just Drivers and was able to generate that part of the report and will put it at the end. I tried the same with just ticking Stealth Code, but every time the program terminated abruptly. It did seem to detect a lot of Stealth Code.

4. Here is dds.txt:

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Run by Jordan Reccion at 2:22:12 on 2011-07-10
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.449 [GMT -7:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: Norton Internet Worm Protection *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Ralink\Common\RaRegistry.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\MsPMSPSv.exe
svchost.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Cake Poker 2.0\CakeNotifier.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.cox.net/
mSearch Page =
uWinlogon: Shell=explorer.exe,
uWindows: load=c:\docume~1\jordan~1\locals~1\temp\csrss.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Advanced SystemCare 4] "c:\program files\iobit\advanced systemcare 4\ASCTray.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [{8FF0329C-25AF-1C29-F62A-82FF22E24F78}] "c:\documents and settings\jordan reccion\application data\qowuul\zyoza.exe"
uRun: [CPN Notifier] c:\program files\cake poker 2.0\PokerNotifier.exe
mRun: [PRONoMgr.exe] c:\program files\intel\ncs\proset\PRONoMgr.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
dRunOnce: [SetDefaultMidi] MIDIDEF.EXE
uPolicies-explorer: NoInstrumentation = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxp://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131815231375
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
TCP: DhcpNameServer = 192.168.0.10
TCP: Interfaces\{0DF70CB3-64AC-4E7B-B131-01752B7ACBE0} : DhcpNameServer = 192.168.0.10
TCP: Interfaces\{341C778A-3D5A-4004-893B-1F9F4736AC4B} : DhcpNameServer = 192.168.0.10
TCP: Interfaces\{EBED2247-4694-4EF3-909F-E289681849DA} : DhcpNameServer = 192.168.0.10
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\jordan reccion\application data\mozilla\firefox\profiles\wjvtt1x9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 51455
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\canon\mycamera download plugin\NPCIG.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-5-19 13496]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-18 165264]
R1 MpKsl3fec89bc;MpKsl3fec89bc;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ee145a6c-227b-47ef-b8e9-ce9dc88f322e}\MpKsl3fec89bc.sys [2011-7-9 28752]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\iobit\advanced systemcare 4\ASCService.exe [2011-4-29 353168]
R2 NAUpdate;@c:\program files\nero\update\nasvc.exe,-200;c:\program files\nero\update\NASvc.exe [2011-3-29 598312]
R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RaRegistry.exe [2010-12-30 185632]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [2010-12-30 19072]
S1 jjraxcyz;jjraxcyz;c:\windows\system32\drivers\jjraxcyz.sys [2011-7-5 41680]
S1 MpKsl060cb661;MpKsl060cb661;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bcc0f6d4-6038-46c2-9828-2692584ce64e}\mpksl060cb661.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{bcc0f6d4-6038-46c2-9828-2692584ce64e}\MpKsl060cb661.sys [?]
S1 MpKsl6b8e90d4;MpKsl6b8e90d4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{34b20b82-897d-42df-865d-4a244a15cca5}\mpksl6b8e90d4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{34b20b82-897d-42df-865d-4a244a15cca5}\MpKsl6b8e90d4.sys [?]
S1 MpKsl968b9f36;MpKsl968b9f36;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{000fe377-1f3f-4a43-a7f5-3fff35e3da72}\mpksl968b9f36.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{000fe377-1f3f-4a43-a7f5-3fff35e3da72}\MpKsl968b9f36.sys [?]
S1 MpKsld783a656;MpKsld783a656;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cd575ea7-8178-4cda-b21b-f72c9df6254e}\mpksld783a656.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cd575ea7-8178-4cda-b21b-f72c9df6254e}\MpKsld783a656.sys [?]
S1 MpKslf3f2bdc8;MpKslf3f2bdc8;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ffd75320-f0be-473f-acc0-0a26d7dcdcc4}\mpkslf3f2bdc8.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ffd75320-f0be-473f-acc0-0a26d7dcdcc4}\MpKslf3f2bdc8.sys [?]
S1 MpKslfa2c2fd0;MpKslfa2c2fd0;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{78f03a23-5d63-43ce-901b-d7d0d6a13df5}\mpkslfa2c2fd0.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{78f03a23-5d63-43ce-901b-d7d0d6a13df5}\MpKslfa2c2fd0.sys [?]
S1 muzjewcr;muzjewcr;c:\windows\system32\drivers\muzjewcr.sys [2011-7-5 41680]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-14 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-14 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-12-28 39984]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\sophosmemsweep.sys --> c:\windows\system32\SophosMEMSWEEP.SYS [?]
S3 RapDrv;RapDrv;c:\windows\system32\drivers\RapDrv.sys [2004-8-30 98144]
S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2004-8-30 37436]
S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2004-8-30 25284]
S4 BlackICE;BlackICE;c:\program files\network ice\blackice\blackd.exe [2004-8-30 737280]
.
=============== Created Last 30 ================
.
2011-07-09 21:58:56 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ee145a6c-227b-47ef-b8e9-ce9dc88f322e}\MpKsl3fec89bc.sys
2011-07-09 21:58:25 7074640 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ee145a6c-227b-47ef-b8e9-ce9dc88f322e}\mpengine.dll
2011-07-09 16:26:11 -------- d-----w- c:\documents and settings\jordan reccion\local settings\application data\DOSBox
2011-07-09 08:47:44 -------- d-----w- c:\program files\DOSBox-0.74
2011-07-09 01:38:12 -------- d-----w- C:\dagger
2011-07-06 03:05:16 41680 ----a-w- c:\windows\system32\drivers\jjraxcyz.sys
2011-07-06 02:46:05 41680 ----a-w- c:\windows\system32\drivers\muzjewcr.sys
2011-07-05 23:17:03 1409 ----a-w- c:\windows\QTFont.for
2011-07-05 06:05:30 54016 ----a-w- c:\windows\system32\drivers\eueoqjwa.sys
2011-07-03 20:48:59 -------- d--h--w- c:\documents and settings\jordan reccion\application data\Qowuul
2011-07-03 20:48:59 -------- d--h--w- c:\documents and settings\jordan reccion\application data\Avroyx
2011-07-03 09:45:08 -------- d-----w- c:\program files\ClubWPT
2011-07-01 19:51:46 -------- d-----w- c:\program files\Infogrames Interactive
2011-06-30 22:44:14 -------- d--h--w- c:\documents and settings\jordan reccion\local settings\application data\CPN
2011-06-30 22:43:55 -------- d-----w- c:\program files\Cake Poker 2.0
2011-06-22 09:37:40 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2011-06-22 09:37:40 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2011-06-17 23:40:07 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 23:40:07 -------- d-----w- c:\program files\OpenAL
2011-06-17 23:25:41 -------- d-----w- c:\program files\The Adventure Company
2011-06-15 23:15:17 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-15 22:57:38 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-06-13 20:32:19 -------- d-----w- C:\Life32
2011-06-13 20:20:13 -------- d--h--w- c:\documents and settings\jordan reccion\application data\GetRightToGo
2011-06-11 19:19:22 -------- d--h--w- c:\documents and settings\jordan reccion\application data\RIFT
2011-06-11 19:19:10 -------- d-----w- c:\program files\RIFT Game
.
==================== Find3M ====================
.
2011-07-02 02:51:02 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-17 23:40:07 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-09 07:13:22 0 ----a-w- c:\windows\Ykaqanuperamiy.bin
2011-05-29 16:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 16:11:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-03 17:54:33 86528 ----a-w- c:\windows\bnetunin.exe
2011-05-03 17:54:33 61440 ----a-w- c:\windows\diabunin.exe
2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2003-03-31 12:00:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12:07 50688 --sh--w- c:\windows\twain_32.dll
2008-04-14 00:12:01 57344 --sha-w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12:01 413696 --sha-w- c:\windows\system32\msvcp60.dll
2010-12-20 17:32:15 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12:02 84992 --sha-w- c:\windows\system32\olepro32.dll
2008-04-14 00:12:32 11776 --sh--w- c:\windows\system32\regsvr32.exe
.
============= FINISH: 2:30:42.12 ===============

5. Here is attach.txt from dds.scr:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 6/17/2004 7:30:37 PM
System Uptime: 7/4/2011 2:50:36 PM (132 hours ago)
.
Motherboard: Intel Corporation | | D875PBZ
Processor: Intel® Pentium® 4 CPU 3.00GHz | J2E1 | 2992/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 153 GiB total, 29.137 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable
K: is FIXED (NTFS) - 1397 GiB total, 1085.05 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1480: 4/10/2011 7:09:01 PM - Software Distribution Service 3.0
RP1481: 4/11/2011 7:08:17 PM - Software Distribution Service 3.0
RP1482: 4/12/2011 7:09:31 PM - Software Distribution Service 3.0
RP1483: 4/13/2011 10:37:07 PM - Software Distribution Service 3.0
RP1484: 4/14/2011 2:32:40 PM - Software Distribution Service 3.0
RP1485: 4/14/2011 10:36:50 PM - Software Distribution Service 3.0
RP1486: 4/15/2011 10:35:55 PM - Software Distribution Service 3.0
RP1487: 4/15/2011 11:06:02 PM - Software Distribution Service 3.0
RP1488: 4/16/2011 11:32:22 PM - System Checkpoint
RP1489: 4/17/2011 1:42:21 AM - Software Distribution Service 3.0
RP1490: 4/18/2011 6:26:49 AM - System Checkpoint
RP1491: 4/18/2011 6:35:54 AM - Software Distribution Service 3.0
RP1492: 4/19/2011 6:35:28 AM - Software Distribution Service 3.0
RP1493: 4/20/2011 7:46:51 AM - System Checkpoint
RP1494: 4/20/2011 9:56:59 AM - Software Distribution Service 3.0
RP1495: 4/21/2011 9:56:59 AM - Software Distribution Service 3.0
RP1496: 4/22/2011 9:55:24 AM - Software Distribution Service 3.0
RP1497: 4/23/2011 9:57:23 AM - Software Distribution Service 3.0
RP1498: 4/24/2011 2:14:32 AM - Software Distribution Service 3.0
RP1499: 4/24/2011 9:56:58 AM - Software Distribution Service 3.0
RP1500: 4/25/2011 9:56:56 AM - Software Distribution Service 3.0
RP1501: 4/26/2011 9:56:40 AM - Software Distribution Service 3.0
RP1502: 4/27/2011 9:43:49 AM - Software Distribution Service 3.0
RP1503: 4/27/2011 9:56:07 AM - Software Distribution Service 3.0
RP1504: 4/28/2011 9:56:48 AM - Software Distribution Service 3.0
RP1505: 4/29/2011 10:27:41 AM - Software Distribution Service 3.0
RP1506: 4/30/2011 10:21:54 AM - Software Distribution Service 3.0
RP1507: 5/1/2011 10:21:55 AM - Software Distribution Service 3.0
RP1508: 5/2/2011 10:36:31 AM - Software Distribution Service 3.0
RP1509: 5/3/2011 10:36:11 AM - Software Distribution Service 3.0
RP1510: 5/4/2011 10:36:01 AM - Software Distribution Service 3.0
RP1511: 5/4/2011 10:40:48 AM - Installed The Great Escape
RP1512: 5/5/2011 2:16:24 PM - System Checkpoint
RP1513: 5/6/2011 8:49:31 AM - Software Distribution Service 3.0
RP1514: 5/7/2011 8:49:08 AM - Software Distribution Service 3.0
RP1515: 5/8/2011 2:37:02 AM - Software Distribution Service 3.0
RP1516: 5/8/2011 5:22:31 PM - Software Distribution Service 3.0
RP1517: 5/9/2011 5:21:27 PM - Software Distribution Service 3.0
RP1518: 5/10/2011 5:22:16 PM - Software Distribution Service 3.0
RP1519: 5/10/2011 9:16:29 PM - Software Distribution Service 3.0
RP1520: 5/11/2011 5:22:27 PM - Software Distribution Service 3.0
RP1521: 5/12/2011 5:22:18 PM - Software Distribution Service 3.0
RP1522: 5/13/2011 5:26:06 PM - Software Distribution Service 3.0
RP1523: 5/14/2011 5:22:25 PM - Software Distribution Service 3.0
RP1524: 5/15/2011 2:22:25 AM - Software Distribution Service 3.0
RP1525: 5/15/2011 5:21:06 PM - Software Distribution Service 3.0
RP1526: 5/16/2011 5:22:29 PM - Software Distribution Service 3.0
RP1527: 5/17/2011 5:22:42 PM - Software Distribution Service 3.0
RP1528: 5/18/2011 5:22:29 PM - Software Distribution Service 3.0
RP1529: 5/19/2011 6:59:11 PM - System Checkpoint
RP1530: 5/20/2011 12:34:20 PM - Software Distribution Service 3.0
RP1531: 5/21/2011 12:29:42 PM - Software Distribution Service 3.0
RP1532: 5/22/2011 1:58:01 AM - Software Distribution Service 3.0
RP1533: 5/22/2011 12:31:01 PM - Software Distribution Service 3.0
RP1534: 5/23/2011 12:30:58 PM - Software Distribution Service 3.0
RP1535: 5/24/2011 12:31:15 PM - Software Distribution Service 3.0
RP1536: 5/25/2011 12:30:06 PM - Software Distribution Service 3.0
RP1537: 5/26/2011 1:14:03 PM - System Checkpoint
RP1538: 5/27/2011 1:29:41 AM - Software Distribution Service 3.0
RP1539: 5/28/2011 1:29:55 AM - Software Distribution Service 3.0
RP1540: 5/29/2011 1:30:10 AM - Software Distribution Service 3.0
RP1541: 5/30/2011 1:29:48 AM - Software Distribution Service 3.0
RP1542: 5/31/2011 1:29:55 AM - Software Distribution Service 3.0
RP1543: 6/1/2011 1:31:53 AM - Software Distribution Service 3.0
RP1544: 6/2/2011 3:18:08 AM - System Checkpoint
RP1545: 6/2/2011 8:47:29 AM - Software Distribution Service 3.0
RP1546: 6/3/2011 8:42:05 AM - Software Distribution Service 3.0
RP1547: 6/4/2011 8:41:30 AM - Software Distribution Service 3.0
RP1548: 6/5/2011 2:04:19 AM - Software Distribution Service 3.0
RP1549: 6/6/2011 8:41:35 AM - Software Distribution Service 3.0
RP1550: 6/7/2011 8:42:01 AM - Software Distribution Service 3.0
RP1551: 6/8/2011 8:41:19 AM - Software Distribution Service 3.0
RP1552: 6/9/2011 8:42:54 AM - Software Distribution Service 3.0
RP1553: 6/10/2011 8:59:23 AM - Software Distribution Service 3.0
RP1554: 6/11/2011 12:19:03 PM - Installed RIFT
RP1555: 6/12/2011 2:06:41 AM - Software Distribution Service 3.0
RP1556: 6/12/2011 6:39:01 PM - Software Distribution Service 3.0
RP1557: 6/13/2011 6:39:16 PM - Software Distribution Service 3.0
RP1558: 6/14/2011 6:39:51 PM - Software Distribution Service 3.0
RP1559: 6/15/2011 4:10:19 PM - Software Distribution Service 3.0
RP1560: 6/16/2011 5:46:33 PM - Software Distribution Service 3.0
RP1561: 6/17/2011 5:46:22 PM - Software Distribution Service 3.0
RP1562: 6/18/2011 5:42:04 PM - Software Distribution Service 3.0
RP1563: 6/19/2011 1:41:02 AM - Software Distribution Service 3.0
RP1564: 6/19/2011 5:42:56 PM - Software Distribution Service 3.0
RP1565: 6/20/2011 5:47:28 PM - Software Distribution Service 3.0
RP1566: 6/21/2011 5:45:08 PM - Software Distribution Service 3.0
RP1567: 6/22/2011 7:03:00 PM - System Checkpoint
RP1568: 6/23/2011 9:55:07 AM - Software Distribution Service 3.0
RP1569: 6/24/2011 9:55:09 AM - Software Distribution Service 3.0
RP1570: 6/25/2011 9:54:19 AM - Software Distribution Service 3.0
RP1571: 6/26/2011 1:47:24 AM - Software Distribution Service 3.0
RP1572: 6/26/2011 9:54:23 AM - Software Distribution Service 3.0
RP1573: 6/27/2011 9:54:36 AM - Software Distribution Service 3.0
RP1574: 6/28/2011 10:17:04 AM - System Checkpoint
RP1575: 6/28/2011 12:13:58 PM - Software Distribution Service 3.0
RP1576: 6/29/2011 12:14:14 PM - Software Distribution Service 3.0
RP1577: 6/30/2011 12:12:51 PM - Software Distribution Service 3.0
RP1578: 7/1/2011 12:14:51 PM - Software Distribution Service 3.0
RP1579: 7/1/2011 7:51:53 PM - Software Distribution Service 3.0
RP1580: 7/2/2011 8:01:59 PM - Software Distribution Service 3.0
RP1581: 7/3/2011 8:30:35 PM - System Checkpoint
RP1582: 7/4/2011 8:55:04 PM - System Checkpoint
RP1583: 7/5/2011 12:25:11 AM - Software Distribution Service 3.0
RP1584: 7/5/2011 2:57:57 PM - Software Distribution Service 3.0
RP1585: 7/6/2011 2:58:15 PM - Software Distribution Service 3.0
RP1586: 7/7/2011 2:58:14 PM - Software Distribution Service 3.0
RP1587: 7/8/2011 2:58:22 PM - Software Distribution Service 3.0
RP1588: 7/9/2011 2:58:20 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
µTorrent
32 Bit HP CIO Components Installer
AcademicOnline Interactive Mathematics
ACDSee 4.0.2 PowerPack Suite
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.3.0
Adobe® Photoshop® Album Starter Edition 3.2
Advanced SystemCare 4
Alarm Clock v1.0
ATI Control Panel
ATI Display Driver
Battle.net
Bonjour
Business Contact Manager for Outlook 2003
Cake Poker 2.0
Calling all Titans! (remove only)
Canon Camera WIA Driver
CANON iMAGE GATEWAY MyCamera Download Plugin
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon IXY 200a, PowerShot S200, IXUS v2 WIA Driver
Canon MOV Decoder
Canon MOV Encoder
Canon MovieEdit Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
CCleaner (remove only)
Civilization III
ClubWPT
Coby Media Manager
Compatibility Pack for the 2007 Office system
Creative Driver
Creative MediaSource
Critical Update for Windows Media Player 11 (KB959772)
CSI-Hard Evidence
D-Link AirPlus
DC++ 0.782
Diablo
DiMAGE Viewer
DivX Web Player
DocProc
Doyles Room
DVD
DVD Shrink 3.2
Fallout
Game Booster
Gateway Drivers and Applications Recovery
Gateway IE Customizations
Gateway Ink Monitor
Gateway Rhapsody
Gateway User's Guide
Google Earth
Google Update Helper
Hallmark Card Studio 2 Standard
Hallmark Card Studio 2003
Hallmark Card Studio 2004 Deluxe
Hallmark Card Studio 2005 Deluxe
Hallmark Card Studio 2006
Hero X
Heroes of Might and Magic V
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 1.99.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
InCD
Intel® PRO Network Adapters and Drivers
Intel® PROSet
IsoBuster 1.8
Java 2 Runtime Environment, SE v1.4.2
Java Auto Updater
Java™ 6 Update 23
King's Bounty. The Legend (Remove Only)
Macromedia Shockwave Player
Mahjong Towers Eternity (remove only)
Majesty
Malwarebytes' Anti-Malware version 1.51.0.1200
Mavis Beacon Teaches Typing 8.0.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office File Validation Add-In
Microsoft Office Live Meeting 2005
Microsoft Office Professional Edition 2003
Microsoft Office Small Business Edition 2003
Microsoft Security Client
Microsoft Security Essentials
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Minigolf Carnival
mIRC
Mozilla Firefox 5.0 (x86 en-US)
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
msxml4SP2
Nero 10 Movie ThemePack Basic
Nero BurnRights 10
Nero BurnRights 10 Help (CHM)
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero CoverDesigner 10
Nero CoverDesigner 10 Help (CHM)
Nero DiscSpeed 10
Nero DiscSpeed 10 Help (CHM)
Nero Express 10
Nero Express 10 Help (CHM)
Nero InfoTool 10
Nero InfoTool 10 Help (CHM)
Nero Kwik Media
Nero MediaHub 10 Help (CHM)
Nero Multimedia Suite 10 Essentials
Nero StartSmart 10
Nero StartSmart 10 Help (CHM)
Nero Suite
Nero Update
Next Life US 1.2.16
OCR Software by I.R.I.S. 12.0
Office 2003 Setup Files
OpenAL
Personal License Update Wizard for Windows Media Player
PhotoParade Player
PokerStars
PokerStove version 1.23
QuickPar 0.9
QuickSFV (Remove only)
QuickTime
Ralink RT7x Wireless LAN Card
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953155)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Sid Meier's Pirates!
Skype Toolbars
Skype™ 5.1
Smart Defrag 2
Smart Link 56K Modem
Sound Blaster Audigy 2
Spybot - Search & Destroy
Tales of Monkey Island
The Great Escape
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WebFldrs XP
Winamp
Winamp Detector Plug-in
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
WinZip 11.1
Wireless-G PCI Adapter
.
==== Event Viewer Messages From Past Week ========
.
7/5/2011 8:59:37 PM, error: Service Control Manager [7034] - The DNS Client service terminated unexpectedly. It has done this 1 time(s).
7/4/2011 9:59:36 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.107.929.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7000.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
7/4/2011 9:58:57 AM, error: Service Control Manager [7034] - The Print Spooler service terminated unexpectedly. It has done this 3 time(s).
7/4/2011 9:55:48 AM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/4/2011 9:52:39 AM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/4/2011 2:41:02 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MpFilter MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip
7/4/2011 2:41:02 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/4/2011 2:41:02 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/4/2011 2:41:02 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
7/4/2011 2:41:02 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
7/4/2011 2:40:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
7/4/2011 2:40:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/3/2011 6:22:24 PM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/WinTools&threatid=2147603732 Name: Trojan:Win32/WinTools ID: 2147603732 Severity: Severe Category: Trojan Path: containerfile:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/~240422.tmp;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/~289685.tmp;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/~313790.tmp;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/~508277.tmp;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/ Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Remove Action Status: No additional actions required Error Code: 0x8007065e Error description: Data of this type is not supported. Signature Version: AV: 1.107.929.0, AS: 1.107.929.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
7/3/2011 6:22:24 PM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=Adware:Win32/IBISToolbar&threatid=6754 Name: Adware:Win32/IBISToolbar ID: 6754 Severity: High Category: Adware Path: containerfile:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/IExploreSkins.exe;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/temp.cab->IExploreSkins.exe;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/temp.cab->toolbar.dll;file:_C:\Documents and Settings\gary recchion\Application Data\Business Logic\UWC\Backup\J38222.9434984375.WCU->C:/Documents and Settings/gary recchion/Local Settings/Temp/toolbar.dll Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Remove Action Status: No additional actions required Error Code: 0x8007065e Error description: Data of this type is not supported. Signature Version: AV: 1.107.929.0, AS: 1.107.929.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.7000.0, NIS: 0.0.0.0
7/3/2011 2:13:18 PM, error: Dhcp [1002] - The IP address lease 192.168.0.2 for the Network Card with network address 000D888867E0 has been denied by the DHCP server 192.168.0.10 (The DHCP Server sent a DHCPNACK message).
7/3/2011 1:59:04 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.107.929.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7000.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
.
==== End Of File ===========================

6. RKUnHookerLE Report on Drivers only:

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2265088 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2265088 bytes
0x804D7000 RAW 2265088 bytes
0x804D7000 WMIxWDM 2265088 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF075000 C:\WINDOWS\System32\ati3duag.dll 1183744 bytes (ATI Technologies Inc. , ati3duag.dll)
0xB98EE000 C:\WINDOWS\System32\DRIVERS\ati2mtag.sys 778240 bytes (ATI Technologies Inc., ATI Radeon Miniport Driver)
0xA7ED5000 C:\WINDOWS\system32\drivers\ha10kx2k.sys 770048 bytes (Creative Technology Ltd, Creative EMU10KX HAL (WDM))
0xBF196000 C:\WINDOWS\System32\ativvaxx.dll 593920 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)
0xF7B52000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xA6782000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB9829000 C:\WINDOWS\system32\drivers\ctaud2k.sys 454656 bytes (Creative Technology Ltd, Creative WDM Audio Device Driver)
0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 405504 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)
0xB4B12000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xA6867000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xA3D62000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBF227000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xA377A000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xA2DC3000 C:\WINDOWS\system32\DRIVERS\airplus.sys 258048 bytes (D-Link, D-Link AirPlus Wireless Network Adapter Driver)
0xF75A8000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xF7833000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB97B7000 C:\WINDOWS\system32\drivers\ctoss2k.sys 176128 bytes (Creative Technology Ltd., Creative OS Services Driver (WDM))
0xA2AC6000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xA67F2000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xA683F000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xA6908000 C:\WINDOWS\system32\DRIVERS\MpFilter.sys 159744 bytes (Microsoft Corporation, Microsoft antimalware file system filter driver)
0xA675C000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xA37BB000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xB9805000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xB9898000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xB97E2000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xA681D000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x80700000 ACPI_HAL 134400 bytes
0x80700000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xA7EB5000 C:\WINDOWS\system32\drivers\ctac32k.sys 131072 bytes (Creative Technology Ltd, Creative AC3 SW Decoder Device Driver (WDM))
0xF74A0000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xA7E3B000 C:\WINDOWS\system32\drivers\hap16v2k.sys 131072 bytes (Creative Technology Ltd, Creative EMU10KX-P16v HAL (WDM))
0xA7E5B000 C:\WINDOWS\system32\drivers\ctsfm2k.sys 126976 bytes (Creative Technology Ltd, SoundFont® Manager (WDM))
0xF74D8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xB98BC000 C:\WINDOWS\System32\DRIVERS\e1000325.sys 122880 bytes (Intel Corporation, Intel® PRO/1000 Adapter NDIS 5.1 deserialized driver)
0xA7E9A000 C:\WINDOWS\system32\drivers\emupia2k.sys 110592 bytes (Creative Technology Ltd, E-mu Plug-in Architecture Driver (WDM))
0xF796D000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xA314C000 C:\DOCUME~1\JORDAN~1\LOCALS~1\Temp\kwldqpow.sys 102400 bytes
0xF74C0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xF7860000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB4C62000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA40D8000 C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys 90112 bytes (Microsoft Corporation, NWLINK2 IPX Protocol Driver)
0xA68D3000 C:\WINDOWS\System32\Drivers\InCDfs.SYS 86016 bytes (Ahead Software, InCD File System Driver)
0xA3FC8000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xB4E3A000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xB98DA000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xA68C0000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF748E000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF7597000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB4C51000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xB63FF000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF746E000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xBA4A4000 C:\WINDOWS\System32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)
0xB63EF000 C:\WINDOWS\System32\DRIVERS\nwlnknb.sys 65536 bytes (Microsoft Corporation, NWLINK2 IPX Netbios Protocol Driver)
0xF7607000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0xF7527000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xB9A1C000 C:\WINDOWS\System32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)
0xBA454000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF7517000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xF76B7000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xB63CF000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF7617000 C:\WINDOWS\System32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0xA4241000 C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys 57344 bytes (Microsoft Corporation, NWLINK2 SPX Protocol Driver)
0xF7657000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF7547000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF747E000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF7637000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF745E000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF7677000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xB9A2C000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF74F7000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF7627000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF7507000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF75F7000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xB63DF000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF7667000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF743E000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF76A7000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xF7647000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF741E000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF744E000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xBA414000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF7577000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF77B7000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF777F000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xBA331000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xF77C7000 C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CDRom Class Filter Driver)
0xBA321000 C:\WINDOWS\System32\DRIVERS\InCDPass.sys 28672 bytes (Ahead Software, Ahead RW Filter Driver)
0xB6397000 C:\DOCUME~1\JORDAN~1\LOCALS~1\Temp\mbr.sys 28672 bytes
0xBA329000 C:\WINDOWS\System32\Drivers\MxlW2k.SYS 28672 bytes (MusicMatch, Inc., MusicMatch Access Layer KMD)
0xF7707000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF77BF000 C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xBA341000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xBA339000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xA695F000 C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EE145A6C-227B-47EF-B8E9-CE9DC88F322E}\MpKsl3fec89bc.sys 24576 bytes (Microsoft Corporation, KSLDriver)
0xF7777000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF77A7000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF7787000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xF77AF000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xB9327000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xB931F000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF7757000 C:\WINDOWS\System32\Drivers\Scutum50.sys 20480 bytes (Printing Communications Assoc., Inc. (PCAUSA), PCAUSA NDIS 5.0 SPR Protocol Driver)
0xB932F000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xA692F000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xA410E000 C:\WINDOWS\System32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0xBA7B0000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xBA7D8000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xA3CFA000 C:\WINDOWS\System32\PfModNT.sys 16384 bytes (Creative Technology Ltd., PCI/ISA Device Info. Service)
0xBA7C8000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF7897000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xA460F000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xBA7BC000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xA8470000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xB4EAF000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF79CB000 C:\WINDOWS\system32\drivers\ctprxy2k.sys 8192 bytes (Creative Technology Ltd, Creative Proxy Device Driver (WDM))
0xB4EB1000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xAC9F8000 C:\WINDOWS\System32\Drivers\InCDrec.SYS 8192 bytes (Ahead Software AG, InCD File System Recognizer)
0xF7987000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xB4EAD000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xAC9F6000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xAC9FA000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF798B000 SmartDefragDriver.sys 8192 bytes
0xF79FB000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7999000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7989000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xB793F000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7A8F000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xB8DC9000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7A4F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
!!!!!!!!!!!Hidden driver: 0x8A50B280 00000285 0 bytes

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 10 July 2011 - 12:50 PM

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 11 July 2011 - 02:49 PM

Gringo,

I successfully turned off all my protections and ran Combofix. It gave me an error message about Iexplore.exe, and gave me the Abort/Retry/Ignore choices. After trying Retry a few times, I chose Ignore. The program ran for awhile, then seemingly disappeared for about a minute (might want to warn people this could happen). Then it came up as a command window. I installed the Windows Recovery Console when prompted to by the program. It ran for quite some time (I'd estimate 45 minutes, then finally generated this report:

ComboFix 11-07-11.02 - Jordan Reccion 07/11/2011 11:37:21.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.1054 [GMT -7:00]
Running from: c:\documents and settings\Jordan Reccion\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\gary recchion\g2mdlhlpx.exe
c:\documents and settings\Jordan Reccion\Application Data\ACD Systems\ACDSee\ImageDB.ddf
c:\documents and settings\Jordan Reccion\Application Data\Adobe\plugs\mmc206.exe
c:\documents and settings\Jordan Reccion\Application Data\Adobe\plugs\mmc21.exe
c:\windows\system\CW3215.DLL
c:\windows\system32\O.BAT
.
.
((((((((((((((((((((((((( Files Created from 2011-06-11 to 2011-07-11 )))))))))))))))))))))))))))))))
.
.
2011-07-11 18:20 . 2011-07-11 18:20 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DD6D68AF-B5C2-4D1E-9A22-CAE550276A39}\MpKsl45aa352a.sys
2011-07-11 18:19 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DD6D68AF-B5C2-4D1E-9A22-CAE550276A39}\mpengine.dll
2011-07-09 16:26 . 2011-07-09 16:26 -------- d-----w- c:\documents and settings\Jordan Reccion\Local Settings\Application Data\DOSBox
2011-07-09 08:47 . 2011-07-09 20:15 -------- d-----w- c:\program files\DOSBox-0.74
2011-07-09 01:38 . 2011-07-09 05:25 -------- d-----w- C:\dagger
2011-07-05 23:17 . 2011-07-05 23:17 1409 ----a-w- c:\windows\QTFont.for
2011-07-03 20:48 . 2011-07-11 17:39 -------- d--h--w- c:\documents and settings\Jordan Reccion\Application Data\Avroyx
2011-07-03 20:48 . 2011-07-05 06:05 -------- d--h--w- c:\documents and settings\Jordan Reccion\Application Data\Qowuul
2011-07-03 09:45 . 2011-07-03 09:45 -------- d-----w- c:\program files\ClubWPT
2011-07-01 19:51 . 2011-07-01 19:51 -------- d-----w- c:\program files\Infogrames Interactive
2011-06-30 22:44 . 2011-06-30 22:44 -------- d--h--w- c:\documents and settings\Jordan Reccion\Local Settings\Application Data\CPN
2011-06-30 22:43 . 2011-07-09 01:46 -------- d-----w- c:\program files\Cake Poker 2.0
2011-06-22 09:37 . 2011-06-22 09:37 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 09:37 . 2011-06-22 09:37 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-17 23:40 . 2011-06-17 23:40 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 23:40 . 2011-06-17 23:40 -------- d-----w- c:\program files\OpenAL
2011-06-17 23:25 . 2011-06-17 23:25 -------- d-----w- c:\program files\The Adventure Company
2011-06-15 23:15 . 2011-06-16 00:36 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-15 22:57 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-06-13 20:32 . 2011-06-13 20:32 -------- d-----w- C:\Life32
2011-06-13 20:20 . 2011-06-13 20:31 -------- d--h--w- c:\documents and settings\Jordan Reccion\Application Data\GetRightToGo
2011-06-11 19:19 . 2011-06-15 02:45 -------- d--h--w- c:\documents and settings\Jordan Reccion\Application Data\RIFT
2011-06-11 19:19 . 2011-07-02 03:42 -------- d-----w- c:\program files\RIFT Game
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-02 02:51 . 2011-05-26 08:24 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-17 23:40 . 2004-06-25 05:41 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-07 15:55 . 2010-02-20 19:04 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-05-29 16:11 . 2010-12-29 00:03 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 16:11 . 2010-12-29 00:03 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-03 17:54 . 2011-05-03 17:54 86528 ----a-w- c:\windows\bnetunin.exe
2011-05-03 17:54 . 2011-05-03 17:54 61440 ----a-w- c:\windows\diabunin.exe
2011-05-02 15:31 . 2004-06-07 21:19 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2003-03-31 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2002-11-18 16:27 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11 . 2004-02-07 02:05 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2003-03-31 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2003-03-31 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2003-03-31 12:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2011-06-22 09:37 . 2011-03-24 19:47 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2003-03-31 12:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12 50688 --sh--w- c:\windows\twain_32.dll
2008-04-14 00:12 57344 --sha-w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12 413696 --sha-w- c:\windows\system32\msvcp60.dll
2010-12-20 17:32 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12 84992 --sha-w- c:\windows\system32\olepro32.dll
2008-04-14 00:12 11776 --sh--w- c:\windows\system32\regsvr32.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 4"="c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe" [2011-05-28 412560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SetDefaultMidi"="MIDIDEF.EXE" [2004-06-18 49152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
ImageFox.lnk - c:\windows\Installer\{0A117913-C6BE-4524-A1A2-47AE6F3604EF}\IMAGEFOX_STRTUP_SHRTCUT.exe [2011-1-6 45056]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^D-Link AirPlus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus.lnk
backup=c:\windows\pss\D-Link AirPlus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet d series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet d series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet d series) - 1.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet d series) - 2.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet d series) - 2.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet d series) - 2.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-09 18:09 63712 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-05-27 21:52 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2001-09-04 20:24 28672 ----a-w- c:\windows\system32\Ati2mdxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-08-13 04:10 335872 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDet]
2002-09-30 08:00 45056 ----a-w- c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
2004-06-18 03:29 28672 ----a-w- c:\windows\system32\cthelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gateway Ink Monitor]
2003-06-25 04:33 303180 ----a-w- c:\program files\Gateway Utilities\GWInkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2003-10-06 15:40 1224754 ------w- c:\program files\Ahead\InCD\InCD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2003-09-03 17:27 53248 ----a-w- c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2003-09-03 17:27 114688 ----a-w- c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2006-01-12 22:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 22:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgr.exe]
2003-03-11 23:24 86016 ----a-w- c:\program files\Intel\NCS\PROSet\PRONoMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-05-16 02:29 282624 ----a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet]
2002-12-04 01:06 45056 ----a-w- c:\program files\Creative\SB Drive Det\SBDrvDet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-03 22:44 15028104 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 08:00 90112 ------w- c:\windows\Updreg.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"SLService"=2 (0x2)
"SCardSvr"=3 (0x3)
"RSVP"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"iPodService"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"PrismXL"=2 (0x2)
"gusvc"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"NetSvc"=3 (0x3)
"InCDsrv"=2 (0x2)
"LexBceS"=2 (0x2)
"BlackICE"=2 (0x2)
"YahooAUService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Cake Poker 2.0\\PokerClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [5/19/2011 12:52 PM 13496]
R1 MpKsl45aa352a;MpKsl45aa352a;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DD6D68AF-B5C2-4D1E-9A22-CAE550276A39}\MpKsl45aa352a.sys [7/11/2011 11:20 AM 28752]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [4/29/2011 10:04 AM 353168]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [3/29/2011 3:33 PM 598312]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [12/30/2010 12:36 AM 19072]
S1 jjraxcyz;jjraxcyz;\??\c:\windows\system32\drivers\jjraxcyz.sys --> c:\windows\system32\drivers\jjraxcyz.sys [?]
S1 MpKsl060cb661;MpKsl060cb661;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BCC0F6D4-6038-46C2-9828-2692584CE64E}\MpKsl060cb661.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BCC0F6D4-6038-46C2-9828-2692584CE64E}\MpKsl060cb661.sys [?]
S1 MpKsl6b8e90d4;MpKsl6b8e90d4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{34B20B82-897D-42DF-865D-4A244A15CCA5}\MpKsl6b8e90d4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{34B20B82-897D-42DF-865D-4A244A15CCA5}\MpKsl6b8e90d4.sys [?]
S1 MpKsl968b9f36;MpKsl968b9f36;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{000FE377-1F3F-4A43-A7F5-3FFF35E3DA72}\MpKsl968b9f36.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{000FE377-1F3F-4A43-A7F5-3FFF35E3DA72}\MpKsl968b9f36.sys [?]
S1 MpKsld783a656;MpKsld783a656;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CD575EA7-8178-4CDA-B21B-F72C9DF6254E}\MpKsld783a656.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CD575EA7-8178-4CDA-B21B-F72C9DF6254E}\MpKsld783a656.sys [?]
S1 MpKslf3f2bdc8;MpKslf3f2bdc8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FFD75320-F0BE-473F-ACC0-0A26D7DCDCC4}\MpKslf3f2bdc8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FFD75320-F0BE-473F-ACC0-0A26D7DCDCC4}\MpKslf3f2bdc8.sys [?]
S1 MpKslfa2c2fd0;MpKslfa2c2fd0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{78F03A23-5D63-43CE-901B-D7D0D6A13DF5}\MpKslfa2c2fd0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{78F03A23-5D63-43CE-901B-D7D0D6A13DF5}\MpKslfa2c2fd0.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/14/2011 9:59 AM 136176]
S3 BlackBox;BlackBox SR2; [x]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/14/2011 9:59 AM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/28/2010 5:03 PM 39984]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\SophosMEMSWEEP.SYS --> c:\windows\system32\SophosMEMSWEEP.SYS [?]
S3 RapDrv;RapDrv;c:\windows\system32\drivers\RapDrv.sys [8/30/2004 7:45 PM 98144]
S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [8/30/2004 7:45 PM 37436]
S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [8/30/2004 7:45 PM 25284]
S4 BlackICE;BlackICE;c:\program files\Network ICE\BlackICE\blackd.exe [8/30/2004 7:45 PM 737280]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSL45AA352A
*NewlyCreated* - MPKSLFDC5CDE1
*Deregistered* - MpKslfdc5cde1
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-11 c:\windows\Tasks\ASC4_PerformanceMonitor.job
- c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe [2011-04-29 21:46]
.
2011-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-14 16:59]
.
2011-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-14 16:59]
.
2011-07-11 c:\windows\Tasks\SmartDefrag_Startup.job
- c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2011-04-04 00:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.cox.net/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.10
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jordan Reccion\Application Data\Mozilla\Firefox\Profiles\wjvtt1x9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 51455
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-CPN Notifier - c:\program files\Cake Poker 2.0\PokerNotifier.exe
HKU-Default-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
MSConfigStartUp-alchem - c:\windows\alchem.exe
MSConfigStartUp-BearShare - c:\program files\BearShare\BearShare.exe
MSConfigStartUp-Internet Optimizer - c:\program files\Internet Optimizer\optimize.exe
MSConfigStartUp-MyDailyHoroscope - c:\progra~1\MYDAIL~1\MYDAIL~1.EXE
MSConfigStartUp-NAV CfgWiz - c:\program files\Common Files\Symantec Shared\CfgWiz.exe
MSConfigStartUp-RoxWatchTray - c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
MSConfigStartUp-Share-to-Web Namespace Daemon - c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
MSConfigStartUp-SSC_UserPrompt - c:\program files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
MSConfigStartUp-stcloader - c:\windows\System32\stcloader.exe
MSConfigStartUp-TV Media - c:\program files\TV Media\Tvm.exe
MSConfigStartUp-updater - c:\program files\Common files\updater\wupdater.exe
MSConfigStartUp-VVSN - c:\program files\VVSN\VVSN.exe
MSConfigStartUp-Win Server Updt - c:\windows\wupdt.exe
MSConfigStartUp-WinTools - c:\program files\Common Files\WinTools\WToolsA.exe
MSConfigStartUp-Xcpy1 - c:\program files\Common Files\Java\Xcpy1.exe
MSConfigStartUp-zango - c:\program files\zango\zango.exe
MSConfigStartUp-znpyvoboyzyi - c:\windows\System32\ljlaif.exe
AddRemove-Creative Driver - c:\windows\system32\ctdrvins
AddRemove-HijackThis - d:\downloads\HiJackThis\HijackThis.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-11 12:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-07-11 12:29:33
ComboFix-quarantined-files.txt 2011-07-11 19:29
.
Pre-Run: 33,444,921,344 bytes free
Post-Run: 34,170,351,616 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 736E40627764A0D7FE0D1755940885A5

Several things I noticed:

1. My programs are now listed again under the Start/All Programs button. Also, none of my files and folders are hidden (while I had unhidden them and was able to access them before, they were kind of half-greyed out, if you know what I mean; visible and usable but not sharp-looking).
2. When I rebooted my machine (required to disable Spybot per the instructions page), I did not get any of the Windows XP Repair screens, and my machine was connected automatically to the network. Previous reboots had required me to manually do this through control panel/network connections. Note that this was before running combo fix.

Remaining problem:

1. Still getting Google redirects.

Thanks again for your help getting me to this point!

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 11 July 2011 - 06:36 PM

I want you to run this tool for me next.

tdsskiller:

Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 12 July 2011 - 01:26 PM

Gringo,

Same problem with TDSSkiller as before. It will not run; just gives me a momentary hourglass and then nothing. I tried renaming it to bla.com and the hourglass lasted for five seconds or so, but nothing else happened.

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 12 July 2011 - 01:27 PM

Hello

I would like you to run this tool for me - fixTDSS

download it to your desktop and start the program

Follow the prompts and Ok any security prompts

when it is complete it will say the infection was cleared or no infection was found - let me know what it says

after it is complete I want you to restart the computer and try to rerun TDSSKiller for me and send me the report

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 12 July 2011 - 08:20 PM

Gringo,

Ding ding ding! I think we have a winner! Fix TDSS ran, and when I rebooted the computer it found something wrong with MBR. Once that was repaired I was able to run TDSSKiller and it reported no infections. Log below. I also do not seem to be getting anymore search engine redirects; Google, Yahoo and Bing all work perfectly.

Thanks for all your help; if you have any suggestions as to how to prevent a recurrence of these problems, or further tasks for me to do, please let me know. You rock!

:thumbsup:

Brainster

2011/07/12 18:13:13.0984 3068 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/12 18:13:14.0531 3068 ================================================================================
2011/07/12 18:13:14.0531 3068 SystemInfo:
2011/07/12 18:13:14.0531 3068
2011/07/12 18:13:14.0531 3068 OS Version: 5.1.2600 ServicePack: 3.0
2011/07/12 18:13:14.0531 3068 Product type: Workstation
2011/07/12 18:13:14.0531 3068 ComputerName: GATEWAY
2011/07/12 18:13:14.0531 3068 UserName: Jordan Reccion
2011/07/12 18:13:14.0531 3068 Windows directory: C:\WINDOWS
2011/07/12 18:13:14.0531 3068 System windows directory: C:\WINDOWS
2011/07/12 18:13:14.0531 3068 Processor architecture: Intel x86
2011/07/12 18:13:14.0531 3068 Number of processors: 2
2011/07/12 18:13:14.0531 3068 Page size: 0x1000
2011/07/12 18:13:14.0531 3068 Boot type: Normal boot
2011/07/12 18:13:14.0531 3068 ================================================================================
2011/07/12 18:13:16.0671 3068 Initialize success
2011/07/12 18:13:26.0296 0616 ================================================================================
2011/07/12 18:13:26.0296 0616 Scan started
2011/07/12 18:13:26.0296 0616 Mode: Manual;
2011/07/12 18:13:26.0296 0616 ================================================================================
2011/07/12 18:13:26.0968 0616 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/12 18:13:27.0062 0616 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/07/12 18:13:27.0187 0616 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/07/12 18:13:27.0281 0616 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/07/12 18:13:27.0328 0616 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/07/12 18:13:27.0546 0616 AIRPLUS (8b9ccded592a52e9c27e862f11a29c4d) C:\WINDOWS\system32\DRIVERS\airplus.sys
2011/07/12 18:13:27.0687 0616 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/07/12 18:13:27.0906 0616 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/12 18:13:27.0984 0616 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/12 18:13:28.0140 0616 ati2mtag (06ada8d1ae1cf24c2b9f7a3e6ebc899d) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/07/12 18:13:28.0203 0616 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/12 18:13:28.0281 0616 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/12 18:13:28.0375 0616 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/07/12 18:13:28.0640 0616 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/12 18:13:28.0718 0616 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/12 18:13:28.0765 0616 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/12 18:13:28.0812 0616 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/12 18:13:29.0031 0616 COMMONFX.DLL (94bf63b33483789c053626ce09f96424) C:\WINDOWS\system32\COMMONFX.DLL
2011/07/12 18:13:29.0265 0616 CT20XUT.DLL (6191a973461852a09d643609e1d5f7c6) C:\WINDOWS\system32\CT20XUT.DLL
2011/07/12 18:13:29.0359 0616 ctac32k (be3b26df6c5cee52ac6574cf0af07acd) C:\WINDOWS\system32\drivers\ctac32k.sys
2011/07/12 18:13:29.0437 0616 ctaud2k (382251387a959f0d3cd20b98d263174d) C:\WINDOWS\system32\drivers\ctaud2k.sys
2011/07/12 18:13:29.0500 0616 CTAUDFX.DLL (8dda6080c48be400223ab6aa0580c25f) C:\WINDOWS\system32\CTAUDFX.DLL
2011/07/12 18:13:29.0562 0616 ctdvda2k (6780608bb5d391161aa70c6db8e004b8) C:\WINDOWS\system32\drivers\ctdvda2k.sys
2011/07/12 18:13:29.0640 0616 CTEAPSFX.DLL (6a57f82009563aee8826f117e1d3c72c) C:\WINDOWS\system32\CTEAPSFX.DLL
2011/07/12 18:13:29.0718 0616 CTEDSPFX.DLL (c8ac1ffaeadd655193d7b1811a572d8d) C:\WINDOWS\system32\CTEDSPFX.DLL
2011/07/12 18:13:29.0812 0616 CTEDSPIO.DLL (44495d9daf675257d00b25b041ee6667) C:\WINDOWS\system32\CTEDSPIO.DLL
2011/07/12 18:13:29.0906 0616 CTEDSPSY.DLL (8e90b1762cb42e2fc76dac9210c83c66) C:\WINDOWS\system32\CTEDSPSY.DLL
2011/07/12 18:13:30.0000 0616 CTERFXFX.DLL (d3fbd9983325435b06795f29cb57ed3d) C:\WINDOWS\system32\CTERFXFX.DLL
2011/07/12 18:13:30.0140 0616 CTEXFIFX.DLL (2c48e9d8ca703964463f27ae341115b7) C:\WINDOWS\system32\CTEXFIFX.DLL
2011/07/12 18:13:30.0281 0616 CTHWIUT.DLL (f7657c598e7c29c6683c1e4a8dd68884) C:\WINDOWS\system32\CTHWIUT.DLL
2011/07/12 18:13:30.0375 0616 ctljystk (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
2011/07/12 18:13:30.0453 0616 ctprxy2k (2837eaee69a322005722a9881f2371a5) C:\WINDOWS\system32\drivers\ctprxy2k.sys
2011/07/12 18:13:30.0546 0616 CTSBLFX.DLL (6e7fee4a22bd76b850d58fca13616bf5) C:\WINDOWS\system32\CTSBLFX.DLL
2011/07/12 18:13:30.0609 0616 ctsfm2k (fb5642c8bf5804dbed0cb7562fe3c4b5) C:\WINDOWS\system32\drivers\ctsfm2k.sys
2011/07/12 18:13:30.0781 0616 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/12 18:13:30.0859 0616 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/07/12 18:13:30.0968 0616 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/07/12 18:13:31.0046 0616 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/07/12 18:13:31.0125 0616 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/07/12 18:13:31.0218 0616 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/12 18:13:31.0296 0616 E1000 (2476936f4994e9084ccfe75ed4f6226a) C:\WINDOWS\system32\DRIVERS\e1000325.sys
2011/07/12 18:13:31.0421 0616 emu10k (01f83e1b5dce05f5cb7d99113ca9e890) C:\WINDOWS\system32\drivers\emu10k1m.sys
2011/07/12 18:13:31.0484 0616 emu10k1 (7ffa171cce6a8bfc774862a578ba39a2) C:\WINDOWS\system32\drivers\ctlfacem.sys
2011/07/12 18:13:31.0562 0616 emupia (7c45da777832884fab03bf6af27262d5) C:\WINDOWS\system32\drivers\emupia2k.sys
2011/07/12 18:13:31.0625 0616 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/12 18:13:31.0671 0616 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/07/12 18:13:31.0734 0616 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/07/12 18:13:31.0781 0616 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/07/12 18:13:31.0828 0616 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/07/12 18:13:31.0906 0616 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/12 18:13:31.0968 0616 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/12 18:13:32.0031 0616 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2011/07/12 18:13:32.0093 0616 GEARAspiWDM (32a73a8952580b284a47290adb62032a) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/07/12 18:13:32.0187 0616 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/12 18:13:32.0328 0616 ha10kx2k (d835a46eb92bddfdd77b411204db3803) C:\WINDOWS\system32\drivers\ha10kx2k.sys
2011/07/12 18:13:32.0406 0616 hap16v2k (d1cba647e9e3b8c13b189b278c240804) C:\WINDOWS\system32\drivers\hap16v2k.sys
2011/07/12 18:13:32.0484 0616 hap17v2k (a595b88ad16d8b5693ddf08113caf30e) C:\WINDOWS\system32\drivers\hap17v2k.sys
2011/07/12 18:13:32.0578 0616 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/12 18:13:32.0718 0616 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/07/12 18:13:32.0781 0616 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/07/12 18:13:32.0906 0616 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/07/12 18:13:33.0031 0616 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/12 18:13:33.0218 0616 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/07/12 18:13:33.0281 0616 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/12 18:13:33.0375 0616 InCDfs (17dcd618b04d1704907fde3d11df2652) C:\WINDOWS\system32\drivers\InCDfs.sys
2011/07/12 18:13:33.0453 0616 InCDPass (eebe59979751176f7c7acd8d46119c06) C:\WINDOWS\system32\DRIVERS\InCDPass.sys
2011/07/12 18:13:33.0531 0616 InCDrec (20ede9602eed9e22908d4446a0f948a3) C:\WINDOWS\system32\drivers\InCDrec.sys
2011/07/12 18:13:33.0734 0616 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/07/12 18:13:33.0781 0616 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/07/12 18:13:33.0859 0616 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/12 18:13:33.0953 0616 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/12 18:13:34.0015 0616 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/12 18:13:34.0062 0616 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/12 18:13:34.0125 0616 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/12 18:13:34.0187 0616 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/12 18:13:34.0281 0616 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/12 18:13:34.0343 0616 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/07/12 18:13:34.0406 0616 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/12 18:13:34.0562 0616 MBAMSwissArmy (b309912717c29fc67e1ba4730a82b6dd) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011/07/12 18:13:34.0687 0616 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/12 18:13:34.0750 0616 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/07/12 18:13:34.0796 0616 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/12 18:13:34.0875 0616 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/12 18:13:34.0953 0616 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/12 18:13:35.0046 0616 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys
2011/07/12 18:13:35.0218 0616 MpKsl6d542a9b (5f53edfead46fa7adb78eee9ecce8fdf) C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{305939A0-5EEF-4063-AC69-5ECDF395998A}\MpKsl6d542a9b.sys
2011/07/12 18:13:35.0390 0616 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/12 18:13:35.0484 0616 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/12 18:13:35.0546 0616 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/07/12 18:13:35.0609 0616 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/12 18:13:35.0656 0616 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/12 18:13:35.0703 0616 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/12 18:13:35.0781 0616 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/12 18:13:35.0875 0616 Mtlmnt5 (8bc576bf81628ad9b03621bd381eb3c8) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
2011/07/12 18:13:36.0031 0616 Mtlstrm (b5f8b93fa9556a371f20721c80b70cd3) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
2011/07/12 18:13:36.0234 0616 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/07/12 18:13:36.0312 0616 MxlW2k (31509f505fea9b37f9e59a10adcfe8f5) C:\WINDOWS\system32\drivers\MxlW2k.sys
2011/07/12 18:13:36.0453 0616 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/07/12 18:13:36.0500 0616 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/12 18:13:36.0562 0616 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/12 18:13:36.0593 0616 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/12 18:13:36.0687 0616 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/12 18:13:36.0734 0616 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/12 18:13:36.0796 0616 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/12 18:13:36.0906 0616 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/07/12 18:13:36.0968 0616 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/07/12 18:13:37.0062 0616 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/12 18:13:37.0218 0616 NtMtlFax (d4c9a61408da38652267648d51739fdb) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
2011/07/12 18:13:37.0390 0616 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/07/12 18:13:37.0484 0616 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/12 18:13:37.0578 0616 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/12 18:13:37.0640 0616 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
2011/07/12 18:13:37.0718 0616 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
2011/07/12 18:13:37.0812 0616 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
2011/07/12 18:13:37.0890 0616 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/07/12 18:13:38.0000 0616 ossrv (b03666648f0af986b964346cb45c06db) C:\WINDOWS\system32\drivers\ctoss2k.sys
2011/07/12 18:13:38.0078 0616 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/12 18:13:38.0109 0616 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/12 18:13:38.0203 0616 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/12 18:13:38.0250 0616 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/12 18:13:38.0359 0616 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/12 18:13:38.0437 0616 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/07/12 18:13:38.0843 0616 PfModNT (5c125deac835c9927f7ab3e8a270fde7) C:\WINDOWS\System32\PfModNT.sys
2011/07/12 18:13:39.0046 0616 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/12 18:13:39.0109 0616 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/07/12 18:13:39.0156 0616 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/12 18:13:39.0218 0616 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/12 18:13:39.0312 0616 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/07/12 18:13:39.0609 0616 RapDrv (4f3607ea67ac59fc09b2e1c24f312a92) C:\WINDOWS\System32\drivers\RapDrv.sys
2011/07/12 18:13:39.0750 0616 RapFile (ceff7a5c5ae01ca6c1f558cda97d22b3) C:\WINDOWS\System32\drivers\RapFile.sys
2011/07/12 18:13:39.0859 0616 RapNet (5031bb7825b6f8d3ae271fc59c21e427) C:\WINDOWS\System32\drivers\RapNet.sys
2011/07/12 18:13:39.0937 0616 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/12 18:13:40.0000 0616 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/12 18:13:40.0062 0616 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/12 18:13:40.0109 0616 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/12 18:13:40.0171 0616 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/12 18:13:40.0203 0616 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/12 18:13:40.0281 0616 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/12 18:13:40.0375 0616 RecAgent (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\System32\DRIVERS\RecAgent.sys
2011/07/12 18:13:40.0437 0616 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/12 18:13:40.0562 0616 RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
2011/07/12 18:13:40.0656 0616 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2011/07/12 18:13:40.0765 0616 RT73 (4ef3f74439aa644bcd8ddc0ed88a5d01) C:\WINDOWS\system32\DRIVERS\rt73.sys
2011/07/12 18:13:40.0859 0616 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/07/12 18:13:40.0968 0616 rtl8185 (de11516a1123a4fa32150f24aa749502) C:\WINDOWS\system32\DRIVERS\rtl8185.sys
2011/07/12 18:13:41.0109 0616 Scutum50 (f34c06d1c706a6d9433570b087a18b02) C:\WINDOWS\system32\Drivers\Scutum50.sys
2011/07/12 18:13:41.0203 0616 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/12 18:13:41.0296 0616 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/07/12 18:13:41.0359 0616 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/07/12 18:13:41.0421 0616 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/12 18:13:41.0500 0616 sfman (0b1a5e9cacb5cdd54a2815107bd7c772) C:\WINDOWS\system32\drivers\sfmanm.sys
2011/07/12 18:13:41.0640 0616 Slntamr (9d3805cbf16056359a52dfb37a71aa49) C:\WINDOWS\system32\DRIVERS\slntamr.sys
2011/07/12 18:13:41.0750 0616 SlNtHal (0f3536110d1027e8bb07e0adb9058039) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
2011/07/12 18:13:41.0906 0616 SlWdmSup (3b4a3b282f62fe5d75127d22b26909ed) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
2011/07/12 18:13:42.0031 0616 SmartDefragDriver (972dea0d8149d73c5b7a2c97b2e749e3) C:\WINDOWS\system32\Drivers\SmartDefragDriver.sys
2011/07/12 18:13:42.0156 0616 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/07/12 18:13:42.0234 0616 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/12 18:13:42.0328 0616 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/12 18:13:42.0406 0616 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/12 18:13:42.0453 0616 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/07/12 18:13:42.0671 0616 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/12 18:13:42.0781 0616 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/12 18:13:42.0859 0616 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/12 18:13:42.0937 0616 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/12 18:13:43.0000 0616 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/12 18:13:43.0140 0616 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/07/12 18:13:43.0265 0616 UPATC (dcf812e04e90d5e07cc09795d1dfe92a) C:\WINDOWS\system32\DRIVERS\upatc.sys
2011/07/12 18:13:43.0390 0616 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/07/12 18:13:43.0468 0616 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/12 18:13:43.0531 0616 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/12 18:13:43.0578 0616 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/12 18:13:43.0640 0616 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/07/12 18:13:43.0718 0616 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/07/12 18:13:43.0796 0616 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/12 18:13:43.0843 0616 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/07/12 18:13:43.0921 0616 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/07/12 18:13:44.0015 0616 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/12 18:13:44.0093 0616 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/12 18:13:44.0218 0616 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/12 18:13:44.0375 0616 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/07/12 18:13:44.0453 0616 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/07/12 18:13:44.0546 0616 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/07/12 18:13:44.0656 0616 Boot (0x1200) (cae85af372bcf4d43141c4cd524fd695) \Device\Harddisk0\DR0\Partition0
2011/07/12 18:13:44.0656 0616 ================================================================================
2011/07/12 18:13:44.0656 0616 Scan finished
2011/07/12 18:13:44.0656 0616 ================================================================================
2011/07/12 18:13:44.0671 0344 Detected object count: 0
2011/07/12 18:13:44.0671 0344 Actual detected object count: 0

Edited by Brainster55, 12 July 2011 - 08:22 PM.


#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 12 July 2011 - 10:09 PM

Greetings

Good That cleaned up some bad guys but I see some other stuff that we need to go after, so I want you to run this custom script for me.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

FireFox::
FF - ProfilePath - c:\documents and settings\Jordan Reccion\Application Data\Mozilla\Firefox\Profiles\wjvtt1x9.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 51455


Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 12 July 2011 - 11:42 PM

Didn't seem to have any problems and combofix ran much faster this time around. I do notice that under the start programs button that the folders shown there are mostly empty. Is there a way to get those back? I can locate most of what I need and put shortcuts on the desktop, but I wouldn't mind having the shortcuts under the start button as well.

Aside from that the computer seems to be running fine--no search engine redirects, no annoying popups, etc.

Brainster

ComboFix 11-07-12.09 - Jordan Reccion 07/12/2011 20:32:28.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.1017 [GMT -7:00]
Running from: c:\documents and settings\Jordan Reccion\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jordan Reccion\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\gary recchion\WINDOWS
c:\documents and settings\Jordan Reccion\Application Data\ACD Systems\ACDSee\ImageDB.ddf
c:\documents and settings\Jordan Reccion\Application Data\Adobe\plugs
c:\documents and settings\Jordan Reccion\Application Data\Adobe\plugs\mmc150383312.txt
c:\documents and settings\Jordan Reccion\Application Data\Adobe\shed
c:\documents and settings\Jordan Reccion\Application Data\Adobe\shed\thr1.chm
c:\documents and settings\Jordan Reccion\Application Data\FFSJ
c:\documents and settings\Jordan Reccion\Application Data\FFSJ\FFSJ.cfg
c:\documents and settings\Jordan Reccion\Start Menu\Programs\Windows XP Repair
c:\documents and settings\Jordan Reccion\Start Menu\Programs\Windows XP Repair\Uninstall Windows XP Repair.lnk
c:\documents and settings\Jordan Reccion\Start Menu\Programs\Windows XP Repair\Windows XP Repair.lnk
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 )))))))))))))))))))))))))))))))
.
.
2011-07-13 02:40 . 2011-07-13 02:40 -------- d-----w- c:\windows\LastGood
2011-07-13 01:09 . 2011-07-13 01:09 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{305939A0-5EEF-4063-AC69-5ECDF395998A}\MpKsl6d542a9b.sys
2011-07-12 17:55 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{305939A0-5EEF-4063-AC69-5ECDF395998A}\mpengine.dll
2011-07-09 16:26 . 2011-07-09 16:26 -------- d-----w- c:\documents and settings\Jordan Reccion\Local Settings\Application Data\DOSBox
2011-07-09 08:47 . 2011-07-09 20:15 -------- d-----w- c:\program files\DOSBox-0.74
2011-07-09 01:38 . 2011-07-09 05:25 -------- d-----w- C:\dagger
2011-07-03 20:48 . 2011-07-11 17:39 -------- d-----w- c:\documents and settings\Jordan Reccion\Application Data\Avroyx
2011-07-03 20:48 . 2011-07-05 06:05 -------- d-----w- c:\documents and settings\Jordan Reccion\Application Data\Qowuul
2011-07-03 09:45 . 2011-07-03 09:45 -------- d-----w- c:\program files\ClubWPT
2011-07-01 19:51 . 2011-07-01 19:51 -------- d-----w- c:\program files\Infogrames Interactive
2011-06-30 22:44 . 2011-06-30 22:44 -------- d-----w- c:\documents and settings\Jordan Reccion\Local Settings\Application Data\CPN
2011-06-30 22:43 . 2011-07-09 01:46 -------- d-----w- c:\program files\Cake Poker 2.0
2011-06-22 09:37 . 2011-06-22 09:37 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-22 09:37 . 2011-06-22 09:37 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-17 23:40 . 2011-06-17 23:40 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2011-06-17 23:40 . 2011-06-17 23:40 -------- d-----w- c:\program files\OpenAL
2011-06-17 23:25 . 2011-06-17 23:25 -------- d-----w- c:\program files\The Adventure Company
2011-06-15 23:15 . 2011-06-16 00:36 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-15 22:57 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2011-06-13 20:32 . 2011-06-13 20:32 -------- d-----w- C:\Life32
2011-06-13 20:20 . 2011-06-13 20:31 -------- d-----w- c:\documents and settings\Jordan Reccion\Application Data\GetRightToGo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-02 02:51 . 2011-05-26 08:24 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-17 23:40 . 2004-06-25 05:41 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2011-06-07 15:55 . 2010-02-20 19:04 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-06-02 14:02 . 2003-06-04 15:22 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-29 16:11 . 2010-12-29 00:03 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 16:11 . 2010-12-29 00:03 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-04 11:52 . 2011-01-26 19:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-04 09:25 . 2011-01-26 19:59 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-03 17:54 . 2011-05-03 17:54 86528 ----a-w- c:\windows\bnetunin.exe
2011-05-03 17:54 . 2011-05-03 17:54 61440 ----a-w- c:\windows\diabunin.exe
2011-05-02 15:31 . 2004-06-07 21:19 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2003-03-31 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2002-11-18 16:27 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2011-04-26 11:07 293376 ----a-w- c:\windows\system32\SET8D.tmp
2011-04-26 11:07 . 2003-03-31 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-25 16:11 . 2004-02-07 02:05 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2003-03-31 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2003-03-31 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2003-03-31 12:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2011-06-22 09:37 . 2011-03-24 19:47 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2003-03-31 12:00 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12 50688 --sh--w- c:\windows\twain_32.dll
2008-04-14 00:12 57344 --sha-w- c:\windows\system32\msvcirt.dll
2008-04-14 00:12 413696 --sha-w- c:\windows\system32\msvcp60.dll
2010-12-20 17:32 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 00:12 11776 --sh--w- c:\windows\system32\regsvr32.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-11_19.10.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-13 01:09 . 2011-07-13 01:09 16384 c:\windows\Temp\Perflib_Perfdata_714.dat
+ 2011-07-13 01:09 . 2011-07-13 01:09 16384 c:\windows\Temp\Perflib_Perfdata_6e8.dat
- 2009-12-14 07:08 . 2010-12-09 14:30 33280 c:\windows\system32\dllcache\csrsrv.dll
+ 2009-12-14 07:08 . 2011-04-26 11:07 33280 c:\windows\system32\dllcache\csrsrv.dll
+ 2004-06-25 07:16 . 2011-07-13 02:49 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2011-07-13 01:06 . 2011-05-04 11:52 157472 c:\windows\system32\javaws.exe
- 2011-01-26 19:59 . 2011-01-26 19:59 157472 c:\windows\system32\javaws.exe
+ 2011-07-13 01:06 . 2011-05-04 11:52 145184 c:\windows\system32\javaw.exe
- 2011-01-26 19:59 . 2011-01-26 19:59 145184 c:\windows\system32\javaw.exe
- 2011-01-26 19:59 . 2011-01-26 19:59 145184 c:\windows\system32\java.exe
+ 2011-07-13 01:06 . 2011-05-04 11:52 145184 c:\windows\system32\java.exe
+ 2010-06-18 17:45 . 2011-04-26 11:07 293376 c:\windows\system32\dllcache\winsrv.dll
- 2010-06-18 17:45 . 2010-06-18 17:45 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2011-07-13 01:07 . 2011-07-13 01:07 203776 c:\windows\Installer\6b7dca3.msi
- 2004-06-25 07:16 . 2011-06-15 23:25 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2004-06-25 07:16 . 2011-07-13 02:49 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2004-06-25 07:16 . 2011-06-15 23:25 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2004-06-25 07:16 . 2011-07-13 02:48 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2011-01-05 18:21 . 2011-06-15 23:24 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2011-01-05 18:21 . 2011-07-13 02:48 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-10-15 18:22 . 2011-06-02 14:02 1858944 c:\windows\system32\dllcache\win32k.sys
+ 2011-05-23 21:15 . 2011-05-23 21:15 3617792 c:\windows\Installer\5addca.msp
+ 2007-04-19 21:09 . 2007-04-19 21:09 1061720 c:\windows\Installer\$PatchCache$\Managed\9040AC1900063D11C8EF10054038389C\11.0.8173\OMFC.DLL
+ 2005-05-12 20:34 . 2011-07-13 02:49 49089992 c:\windows\system32\MRT.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 4"="c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe" [2011-05-28 412560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SetDefaultMidi"="MIDIDEF.EXE" [2004-06-18 49152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
ImageFox.lnk - c:\windows\Installer\{0A117913-C6BE-4524-A1A2-47AE6F3604EF}\IMAGEFOX_STRTUP_SHRTCUT.exe [2011-1-6 45056]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^D-Link AirPlus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\D-Link AirPlus.lnk
backup=c:\windows\pss\D-Link AirPlus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet d series) - 1.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet d series) - 1.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet d series) - 1.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HPAiODevice(hp officejet d series) - 2.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HPAiODevice(hp officejet d series) - 2.lnk
backup=c:\windows\pss\HPAiODevice(hp officejet d series) - 2.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ralink Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-09 18:09 63712 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-05-27 21:52 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2001-09-04 20:24 28672 ----a-w- c:\windows\system32\Ati2mdxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-08-13 04:10 335872 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDet]
2002-09-30 08:00 45056 ----a-w- c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDET.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
2004-06-18 03:29 28672 ----a-w- c:\windows\system32\cthelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gateway Ink Monitor]
2003-06-25 04:33 303180 ----a-w- c:\program files\Gateway Utilities\GWInkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2003-10-06 15:40 1224754 ------w- c:\program files\Ahead\InCD\InCD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2003-09-03 17:27 53248 ----a-w- c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2003-09-03 17:27 114688 ----a-w- c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2006-01-12 22:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 22:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgr.exe]
2003-03-11 23:24 86016 ----a-w- c:\program files\Intel\NCS\PROSet\PRONoMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-05-16 02:29 282624 ----a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet]
2002-12-04 01:06 45056 ----a-w- c:\program files\Creative\SB Drive Det\SBDrvDet.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-03 22:44 15028104 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 08:00 90112 ------w- c:\windows\Updreg.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"SLService"=2 (0x2)
"SCardSvr"=3 (0x3)
"RSVP"=3 (0x3)
"FastUserSwitchingCompatibility"=3 (0x3)
"iPodService"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"PrismXL"=2 (0x2)
"gusvc"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"RoxLiveShare9"=2 (0x2)
"NetSvc"=3 (0x3)
"InCDsrv"=2 (0x2)
"LexBceS"=2 (0x2)
"BlackICE"=2 (0x2)
"YahooAUService"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\StubInstaller.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\DC++\\DCPlusPlus.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Cake Poker 2.0\\PokerClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [5/19/2011 12:52 PM 13496]
R1 MpKsl6d542a9b;MpKsl6d542a9b;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{305939A0-5EEF-4063-AC69-5ECDF395998A}\MpKsl6d542a9b.sys [7/12/2011 6:09 PM 28752]
R2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [4/29/2011 10:04 AM 353168]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [3/29/2011 3:33 PM 598312]
R2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\drivers\Scutum50.sys [12/30/2010 12:36 AM 19072]
S1 jjraxcyz;jjraxcyz;\??\c:\windows\system32\drivers\jjraxcyz.sys --> c:\windows\system32\drivers\jjraxcyz.sys [?]
S1 MpKsl060cb661;MpKsl060cb661;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BCC0F6D4-6038-46C2-9828-2692584CE64E}\MpKsl060cb661.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{BCC0F6D4-6038-46C2-9828-2692584CE64E}\MpKsl060cb661.sys [?]
S1 MpKsl6b8e90d4;MpKsl6b8e90d4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{34B20B82-897D-42DF-865D-4A244A15CCA5}\MpKsl6b8e90d4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{34B20B82-897D-42DF-865D-4A244A15CCA5}\MpKsl6b8e90d4.sys [?]
S1 MpKsl968b9f36;MpKsl968b9f36;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{000FE377-1F3F-4A43-A7F5-3FFF35E3DA72}\MpKsl968b9f36.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{000FE377-1F3F-4A43-A7F5-3FFF35E3DA72}\MpKsl968b9f36.sys [?]
S1 MpKsld783a656;MpKsld783a656;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CD575EA7-8178-4CDA-B21B-F72C9DF6254E}\MpKsld783a656.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{CD575EA7-8178-4CDA-B21B-F72C9DF6254E}\MpKsld783a656.sys [?]
S1 MpKslf3f2bdc8;MpKslf3f2bdc8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FFD75320-F0BE-473F-ACC0-0A26D7DCDCC4}\MpKslf3f2bdc8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FFD75320-F0BE-473F-ACC0-0A26D7DCDCC4}\MpKslf3f2bdc8.sys [?]
S1 MpKslfa2c2fd0;MpKslfa2c2fd0;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{78F03A23-5D63-43CE-901B-D7D0D6A13DF5}\MpKslfa2c2fd0.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{78F03A23-5D63-43CE-901B-D7D0D6A13DF5}\MpKslfa2c2fd0.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/14/2011 9:59 AM 136176]
S3 BlackBox;BlackBox SR2; [x]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/14/2011 9:59 AM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/28/2010 5:03 PM 39984]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\SophosMEMSWEEP.SYS --> c:\windows\system32\SophosMEMSWEEP.SYS [?]
S3 RapDrv;RapDrv;c:\windows\system32\drivers\RapDrv.sys [8/30/2004 7:45 PM 98144]
S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [8/30/2004 7:45 PM 37436]
S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [8/30/2004 7:45 PM 25284]
S4 BlackICE;BlackICE;c:\program files\Network ICE\BlackICE\blackd.exe [8/30/2004 7:45 PM 737280]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 76583095
*NewlyCreated* - MPKSL6D542A9B
*Deregistered* - 76583095
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-13 c:\windows\Tasks\ASC4_PerformanceMonitor.job
- c:\program files\IObit\Advanced SystemCare 4\PMonitor.exe [2011-04-29 21:46]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-14 16:59]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-14 16:59]
.
2011-07-13 c:\windows\Tasks\SmartDefrag_Startup.job
- c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2011-04-04 00:29]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.cox.net/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.10
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jordan Reccion\Application Data\Mozilla\Firefox\Profiles\wjvtt1x9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-12 20:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-07-12 20:44:28
ComboFix-quarantined-files.txt 2011-07-13 03:44
ComboFix2.txt 2011-07-11 19:29
.
Pre-Run: 33,598,619,648 bytes free
Post-Run: 34,311,708,672 bytes free
.
- - End Of File - - 7409E0D243BAFC2A0091356D8B2D487C

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 13 July 2011 - 12:06 AM

Hello

Lets see if I can find them - http://download.bleepingcomputer.com/grinler/unhide.exe

You can restore the defaults for the Start Menu, Accessories and Administrative Tools as follows:
Posted Image
  • Then click on the Restore button.




I would ike to see a report that combofix makes.

extra combofix report

  • push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • please copy and past the following into the box
C:\Qoobox\ComboFix-quarantined-files.txt
  • click ok

copy and paste the report into this topic for me to review

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 13 July 2011 - 12:13 PM

Gringo:

Here's the quarantined list:
2011-07-13 03:32:26 . 2011-07-13 03:32:26 0 ----a-w- C:\Qoobox\Quarantine\catchme.txt
2011-07-11 23:30:06 . 2011-07-12 20:51:48 181,792 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Application Data\ACD Systems\ACDSee\ImageDB.ddf.vir
2011-07-11 19:24:52 . 2011-07-11 19:24:52 838 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-HijackThis.reg.dat
2011-07-11 19:24:51 . 2011-07-11 19:24:51 450 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Creative Driver.reg.dat
2011-07-11 19:21:02 . 2011-07-11 19:21:02 572 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-znpyvoboyzyi.reg.dat
2011-07-11 19:21:01 . 2011-07-11 19:21:01 568 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-zango.reg.dat
2011-07-11 19:21:00 . 2011-07-11 19:21:00 594 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Xcpy1.reg.dat
2011-07-11 19:20:59 . 2011-07-11 19:20:59 608 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-WinTools.reg.dat
2011-07-11 19:20:58 . 2011-07-11 19:20:58 554 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Win Server Updt.reg.dat
2011-07-11 19:20:57 . 2011-07-11 19:20:57 552 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-VVSN.reg.dat
2011-07-11 19:20:55 . 2011-07-11 19:20:55 608 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-updater.reg.dat
2011-07-11 19:20:54 . 2011-07-11 19:20:54 564 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-TV Media.reg.dat
2011-07-11 19:20:53 . 2011-07-11 19:20:53 578 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-stcloader.reg.dat
2011-07-11 19:20:52 . 2011-07-11 19:20:52 672 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SSC_UserPrompt.reg.dat
2011-07-11 19:20:50 . 2011-07-11 19:20:50 674 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Share-to-Web Namespace Daemon.reg.dat
2011-07-11 19:20:48 . 2011-07-11 19:20:48 688 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-RoxWatchTray.reg.dat
2011-07-11 19:20:42 . 2011-07-11 19:20:42 682 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-NAV CfgWiz.reg.dat
2011-07-11 19:20:41 . 2011-07-11 19:20:41 590 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-MyDailyHoroscope.reg.dat
2011-07-11 19:20:38 . 2011-07-11 19:20:38 632 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Internet Optimizer.reg.dat
2011-07-11 19:20:33 . 2011-07-11 19:20:33 614 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-BearShare.reg.dat
2011-07-11 19:20:30 . 2011-07-11 19:20:30 540 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-alchem.reg.dat
2011-07-11 19:20:26 . 2011-07-11 19:20:26 600 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-Ad-Watch.reg.dat
2011-07-11 19:17:17 . 2011-07-11 19:17:17 81 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKU-Default-Run-swg.reg.dat
2011-07-11 19:16:08 . 2011-07-11 19:16:08 79 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-CPN Notifier.reg.dat
2011-07-11 18:57:50 . 2011-07-13 03:39:23 16,459 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2011-07-11 18:51:56 . 2011-06-27 19:22:31 2,465 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\4\Nero StartSmart 10.lnk
2011-07-11 18:51:56 . 2011-07-01 19:56:58 1,908 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\4\Play Civilization III.lnk
2011-07-11 18:51:56 . 2011-07-03 09:45:10 1,478 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\4\ClubWPT.lnk
2011-07-11 18:51:56 . 2011-07-04 01:46:27 784 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\4\Malwarebytes' Anti-Malware.lnk
2011-07-11 18:51:56 . 2011-07-02 03:29:19 2,349 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Startup\ImageFox.lnk
2011-07-11 18:51:56 . 2011-06-29 17:41:19 2,509 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Word 2003.lnk
2011-07-11 18:51:56 . 2011-07-01 19:51:54 783 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Infogrames Interactive\Civilization III\Civ3Edit\Civ3Edit.lnk
2011-07-11 18:51:56 . 2011-07-04 01:46:27 796 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware Help.lnk
2011-07-11 18:51:56 . 2011-07-04 01:46:27 796 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware.lnk
2011-07-11 18:51:56 . 2011-07-04 01:46:27 820 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Malwarebytes' Anti-Malware\Uninstall Malwarebytes' Anti-Malware.lnk
2011-07-11 18:51:56 . 2011-07-01 19:51:53 988 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Infogrames Interactive\Civilization III\Install Guide.lnk
2011-07-11 18:51:56 . 2011-07-01 19:51:53 988 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Infogrames Interactive\Civilization III\Play Civilization III.lnk
2011-07-11 18:51:56 . 2011-07-01 19:51:53 1,210 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Infogrames Interactive\Civilization III\Uninstall Civilization III.lnk
2011-07-11 18:51:56 . 2011-07-01 19:51:53 767 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Infogrames Interactive\Civilization III\View Readme.txt.lnk
2011-07-11 18:51:56 . 2011-07-01 19:51:54 783 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\Programs\Infogrames Interactive\Civilization III\Civ3Edit\Civ3Edit Help.lnk
2011-07-11 18:51:56 . 2011-07-03 09:45:10 1,528 ----a-w- C:\Qoobox\Quarantine\C\DOCUME~1\JORDAN~1\LOCALS~1\Temp\smtmp\1\ClubWPT.lnk
2011-07-11 18:22:19 . 2011-07-13 03:31:16 153 ----a-w- C:\Qoobox\Quarantine\catchme.log
2011-07-04 16:50:20 . 2011-07-04 16:50:20 899 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Start Menu\Programs\Windows XP Repair\Uninstall Windows XP Repair.lnk.vir
2011-07-04 16:50:20 . 2011-07-04 16:50:20 827 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Start Menu\Programs\Windows XP Repair\Windows XP Repair.lnk.vir
2011-07-03 20:51:03 . 2011-07-03 20:51:05 162 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Application Data\Adobe\plugs\mmc21.exe.vir
2011-07-03 20:41:57 . 2011-07-03 20:42:11 172,032 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Application Data\Adobe\plugs\mmc150383312.txt.vir
2011-07-03 20:41:56 . 2011-07-03 20:41:56 162 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Application Data\Adobe\plugs\mmc206.exe.vir
2011-07-03 20:41:52 . 2011-07-03 20:41:56 48 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Application Data\Adobe\shed\thr1.chm.vir
2011-04-15 21:06:59 . 2011-04-15 21:06:59 573 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Jordan Reccion\Application Data\FFSJ\FFSJ.cfg.vir
2007-06-08 00:39:03 . 2009-06-23 01:03:05 60,744 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\gary recchion\g2mdlhlpx.exe.vir
2004-10-19 19:14:05 . 1995-04-21 13:51:00 176,128 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system\CW3215.DLL.vir
2004-09-06 03:37:05 . 2004-09-06 03:37:06 188 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\O.BAT.vir
2003-06-04 15:22:46 . 2011-03-03 13:21:11 1,857,920 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000005_.tmp.dll.vir
2003-03-31 12:00:00 . 2010-12-09 14:30:22 33,280 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\_000006_.tmp.dll.vir

#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:13 PM

Posted 13 July 2011 - 01:57 PM

Open Notepad.
Copy all text from the following code box and paste it into Notepad window:

@echo off
xcopy "C:\Qoobox\Quarantine\C\documents and settings\Jordan Reccion\Local Settings\Temp\smtmp\1\*" "C:\Documents and Settings\All Users\Start Menu\" /s
xcopy "C:\Qoobox\Quarantine\C\documents and settings\Jordan Reccion\Local Settings\Temp\smtmp\2\*" "C:\Documents and Settings\Jordan Reccion\Application Data\Microsoft\Internet Explorer\Quick Launch\" /s
xcopy "C:\Qoobox\Quarantine\C\documents and settings\Jordan Reccion\Local Settings\Temp\smtmp\3\*" "C:\Documents and Settings\Jordan Reccion\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\" /s
xcopy "C:\Qoobox\Quarantine\C\documents and settings\Jordan Reccion\Local Settings\Temp\smtmp\4\*" "C:\Documents and Settings\All Users\Desktop\" /s 
exit

Save the file as fix.bat.

Double click fix.bat to run it.
A pop-up window will open and you'll see number of files being copied.
The window will close, when all copying is done.



let me know how things are now



gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 Brainster55

Brainster55
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:09:13 PM

Posted 14 July 2011 - 12:15 PM

Gringo,

Done. The computer seems to be running fine now. I did get back my accessories, etc., under the Start Button, although not all of the other programs are found there. I believe that is my fault however, as before I started posting here I tried using Advanced System Care to get rid of the infection, and one of the options they offer is "Junk Files Clean" which may have deleted the temp files where Windows XP Repair hid my shortcuts. It's no big deal, as I can restore those shortcuts manually.

Any recommendations as to how to prevent later infections? Should I set up a restore point? Or are there further steps to be done to clean my machine? Thanks again for all the help you have offered so far; you and the rest of the folks here at Bleeping Computer are a godsend!

Brainster55




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users